"The Kenyan authorities returned the devices seized during the July 19, 2025 raid to Mwangi on September 4, 2025. Mwangi immediately observed that the Samsung phone had its password protection removed and could now be opened without a password. He states that he never provided the device’s password to the authorities.

Researchers at the Citizen Lab analyzed artefacts collected from Mwangi’s devices shortly after they were returned to Mwangi and performed an analysis for evidence of compromise.

Our analysis of the Samsung Android phone confiscated by the Kenyan police belonging to Mwangi shows signs that Cellebrite was used on the phone on or around July 20, 2025 and July 21, 2025. The device was in the custody of the Kenyan police during this timeframe.

We observed traces of an application named com.client.appA on the Android phone. The Citizen Lab associates this application name with high confidence with Cellebrite’s forensic extraction technology. Other sources have also linked this indicator with Cellebrite’s forensic extraction technology.

The use of Cellebrite could have enabled the full extraction of all materials from Mwangi’s device, including messages, private materials, personal files, financial information, passwords, and other sensitive information.

Our analysis on artefacts from this and other devices seized in this case is ongoing."

https://citizenlab.ca/research/cellebrite-used-on-kenyan-activist-and-politician-boniface-mwangi/

#Kenya #Cellebrite #HumanRights #Surveillance #ForensicExtraction #Activism

"We forensically analyzed four devices belonging to Jordanian activists and human rights defenders seized by Jordanian authorities during detentions, arrests, and interrogations (and later returned). We also obtained three court records originating from criminal proceedings against activists and journalists under the 2023 Cybercrime Law. Each record includes a technical report prepared by Jordan’s Criminal Investigations Department that contains a summary of the forensic extraction conducted on the seized devices. The cases analyzed in this report occurred between late 2023 and mid-2025 in the context of protests in support of Palestinians in Gaza.

In total, we present seven different cases which lead us to conclude with high confidence that the seized devices were subjected to mobile forensic extraction using Cellebrite’s products. Forensic records obtained in previous testing rounds suggest Jordanian authorities have been using Cellebrite since at least 2020.

We release these findings alongside reporting from the Organized Crime and Corruption Reporting Project (OCCRP) which includes interviews with a few of the victims.

On December 29, 2025, the Citizen Lab and OCCRP sent letters to Cellebrite with a summary of findings. Cellebrite’s PR company responded to both Citizen Lab’s and OCCRP’s letters. On January 15, 2026, the Citizen Lab sent the PR company a follow-up letter with additional questions. We received a second response from Cellebrite. We share both responses here."

https://citizenlab.ca/research/from-protest-to-peril-cellebrite-used-against-jordanian-civil-society/

#CyberSecurity #Cellebrite #HumanRights #Jordan #ForensicExtraction