Controversial phone extraction systems made by Israeli company Cellebrite have become a go-to technology for law enforcement across Europe. Statewatch has mapped more than 150 public contracts worth a total of €69 million since 2023, including purchases funded by the EU.1 During a months-long investigation, we found Cellebrite tools used across Europe to profile journalists, racialised people and activists, raising serious concerns about fundamental rights and freedoms.
This is the first article in a five-part investigative series on the use of Cellebrite’s phone extraction services in Europe. In this first part, we dig into the public money, including EU and UK funds, paying for data extraction, and Cellebrite’s track record as a key tool for authoritarian and oppressive regimes in quashing dissent.
Revealing Cellebrite’s grip on Europe
Cellebrite was founded in 1998 as a backup and phone-to-phone data-transfer service. The company soon became a leading actor in Israel’s industrial tech complex, where private research supports security and defence bodies, and vice versa.
Cellebrite’s systems – from its flagship phone extraction tools to most recent AI-enhanced data analysis platforms – are used by both internal security bodies and armies. The company has a total of 5,300 clients in law enforcement in about 100 countries, according to its 2025 filings.
The use and misuse of Cellebrite’s tools by so-called authoritarian regimes has been highlighted in several reports by media outlets and human rights groups over the past decade. For the first time, this investigative series traces the use of Cellebrite’s tools inside the EU and its member states, as well as Switzerland, Moldova, Serbia and the UK. During its research, Statewatch also identified EU funds to equip a non-EU government, Moldova, with Cellebrite systems – despite documented police abuses in the country.
These findings come against a backdrop of major EU security reforms – from the recently entered-into-force Pact on Migration and Asylum to huge expansions to Europol and Frontex – alongside an explosion of AI-driven technologies for surveillance and monitoring crime. These changes will likely usher in even more private-public contracts, and increase the need for tech offered by companies like Cellebrite.
Through data analysis of internal documents and interviews with key sources, Statewatch has traced how public money – including EU and UK funds – has been channelled to Cellebrite and its vendors over the past three years, with limited accountability and safeguards. Among our findings is a key lack of questioning about whether technology developed during Israel’s genocide in Palestine should become an essential tool for European policing.
Cellebrite and authoritarian regimes
In August 2023, Yossi Carmil stepped down after almost 20 years as Cellebrite’s CEO. The business graduate and former Israeli Ministry of Defence employee boasted that his company had “enabled justice across the world”. A few months later, deep into the initial phase of Israel’s genocide against the Palestinian population in Gaza, at least seven Jordanian civil society members, including activists and a journalist, had their phones seized. The authorities cited their involvement in protests against Israel’s military campaign and Jordan’s involvement, or their social media activity, as reasons for taking their devices.
Jordanian authorities used Cellebrite’s Universal Forensic Extraction Device (UFED) to extract data from some of their phones, as later documented by Citizen Lab, a research centre associated with the University of Toronto, and reported by the investigative consortium OCCRP.
Systems like UFED have become a key component of digital investigations for law enforcement seizing phones and computers. They exploit vulnerabilities in a device’s operating system to bypass security measures and extract stored data. In some cases, depending on the device’s configuration and security settings, an hour of access to a phone may be enough for agents to copy its entire contents to an external archive.
Unlike spyware such as Pegasus, which can access phones remotely, UFED must be physically connected to the device. But both software leave minimal traces, and finding evidence of their use requires a high level of technical expertise.
Screenshot from a 2024 UFED manual shows the software’s opening page.
Over the past decade, Cellebrite software has been associated with surveillance and abuse by several governments in countries described as “partly free” or “not free” by US-based organisation Freedom House. The categories are based on scores assigned for various political rights and civil liberties available in the countries. Aside from Jordan, the list includes Bangladesh, China, Kenya, Uganda, Myanmar, Bahrein, Russia, Belarus and Serbia. Israeli authorities (long described as enforcing an apartheid system) also use Cellebrite’s systems. The consequences have sometimes been dramatic. In Myanmar, Reuters journalists Wa Lone and Kyaw Soe Oo were arrested and later jailed in 2017 while investigating the brutal killing of Rohingya civilians by the country’s security forces. Evidence for their sentence was based on data extracted from their mobile phones using Cellebrite’s UFED.
In a handful of cases, Cellebrite declared it would end its contracts with specific governments. In Russia, Belarus, China and Hong Kong the announcement came in the aftermath of violent crackdowns on civil society and protesters in 2020 and 2021. In Hong Kong, media reports and court files suggested that pro-democracy activists had their phones searched with UFED. In Serbia, Cellebrite cut ties with some clients following a 2024 report by Amnesty International on the abuse of its technology by national security forces.
Yet the use of Cellebrite’s tech for repressive policies did not necessarily end with those announcements, and the company continued to grow. Cellebrite’s annual revenue almost doubled in five years, from $246.2m in 2021 to $475.7m in 2025.
Screenshot of 2024 UFED manual shows the categories of content that can be extracted from a device.
Over the past two decades, Cellebrite has positioned itself as an essential provider for law-enforcement agencies around the world. Its engineers and IT analysts have built what are widely regarded as premium systems for mobile phone extraction (MPE). This extraction hardware and software can download the full contents of a phone or laptop, often without passcodes and, in certain circumstances, when data is protected by encryption.
The company claims that its systems can also recover deleted messages from social media, cloud services and email accounts. It can also identify GPS locations, whether through Wi-Fi connections or traces left in online maps, another capability often sought by law enforcement.
The procurement trail
While the use of Cellebrite’s products by governments in the Global South has received scrutiny from NGOs and media outlets, little has been said about the company’s impact in Europe.
Over several months, Statewatch, together with UK-based researcher Yuna Chang and independent journalists Joana Soares and Federica Tessari, has traced Cellebrite’s activity across Europe. This research has uncovered a list of contracts for the use of Cellebrite’s technology by authorities across the EU, the UK and the European Free Trade Association (Iceland, Liechtenstein, Norway and Switzerland).
Cellebrite public contracts
Total values for governments in the European Union and UK. Moldova and Switzerland, while included in this research, are excluded from the visualisation due to missing financial data
For contracts active between 1 January 2023 and 1 July 2026, our project identified 114 Cellebrite contracts with law enforcement agencies and other public bodies in 17 EU countries, one contract in Norway, and 39 contracts across the UK, for a total of €69.4 million. The figures suggest the UK is by far the largest European buyer of Cellebrite’s technology. The London Metropolitan Police’s most expensive contract, worth £7.9 million (€9.2 million), is a three-year agreement signed with Cellebrite in 2023 for a “Digital Forensic Tool Enterprise Agreement for unlocking.”
Given the transparency limitations invoked by law enforcement agencies to avoid disclosing information on the technology they procure and use, and the rising annual revenues registered by Cellebrite’s European subsidiaries – it is likely that more funds have been allocated to Cellebrite across Europe, and by EU bodies.
On the receiving end of more than 150 deals are the three companies Cellebrite has established across Europe – in the UK, Germany and France – or local companies authorised to resell Cellebrite’s products. The three European subsidiaries are fully controlled by the Israeli-based parent company, whose headquarters are in the tech district of Petaj Tikva, outside Tel Aviv. The procurement documents we identified provide limited information about which Cellebrite products have been licensed. The most sought-after products are UFED and its recent upgrade, Inseyets, followed by Physical Analyzer, Digital Collector, Inspector and Premium, the company’s top products for accessing encrypted devices.
Cellebrite’s public contracts in EU member states and the UK
Taken together, these systems can be used to extract data from Apple and Android phones, other devices, computers, cloud services and mobile applications. That data (i.e. Google searches, messages sent to a certain contact or online files) can then be decoded, analysed and organised into reports, timelines and network maps.
Lack of transparency around use of Cellebrite tools
The EU’s diplomatic service, the European External Action Service (EEAS), repeatedly refused to disclose documents from the past four years. The requests ranged from correspondence and procurement records to meeting minutes relating to the service’s relationship with Cellebrite. In what appears to be a significant stretching of the exception to transparency contained in EU law, the EEAS refused to disclose even the titles or registration numbers of a “limited number of documents” it identified, concluding that “the mere identification of such documents and consequently their public disclosure would undermine the protection of the public interest as regards public security”.
The EEAS explained that “by confirming, directly or indirectly through listing the identified documents, whether or not the EEAS uses Cellebrite products or services”, the service would be exposing “adversarial actors” to sensitive information about its cyber-forensic capabilities.
This, argues the service, would have “the direct effect of enabling such hostile actors to counteract and undermine the relevant capabilities of the EEAS”, compromising its ability to operate in the field of digital forensics, which it describes as “an essential component of the security of the EEAS”.
Statewatch has submitted a complaint to the European Ombudsman, asking it to review the EEAS decision, and align it with transparency norms. The Ombudsman has launched an inquiry in October 2026, and the case is likely to be finalised in early-to-mid 2027. In remarks made in October, the European Ombudsman said there was a need to improve transparency and public access to documents across the EU.
A significant lack of transparency was also encountered in Germany, where spending associated with only seven of the 14 contracts was identified. The largest is a three-year, €4.2 million contract signed in April 2026 by the Police of Saxony-Anhalt for “hardware and software for digital investigations, with functions for access, extraction, decoding, examination and automation.”
Other German law enforcement agencies have declined to disclose the value of their contracts. The BKA, Germany’s Federal Criminal Police Office, told Statewatch that its “systems and tools must comply with all applicable legal regulations, including data protection requirements,” and that “no information will be provided regarding any internal requirements for police systems and tools.”
The State of Hessen, in west central Germany, declared it was “not permitted to provide any information about the value of the contract,” citing Section 5 of the German Public Procurement Ordinance (VgV). The provision, however, aims at protecting information supplied by companies, including business and trade secrets, rather than the value of public contracts.
A spokesperson for the police in Baden-Württemberg, in southwest Germany, invoked similar arguments when asked about their 2023, four-year framework agreement for Cellebrite software, including UFED Touch, Physical Analyzer, UFED Cloud, Digital Collector, Inspector and Premium Enterprise. “In addition to protecting the business and trade secrets of our contractual partners,” he wrote, “in this area the protection of public safety and public order regularly takes priority, requiring us not to disclose such information externally.”
In other cases, reconstructing contracts with Cellebrite required more extensive document requests to dozens of authorities, many of which were reluctant to provide information under transparency laws.
EU funds for surveillance
Statewatch reconstruction shows that some national contracts awarded to Cellebrite were paid for through EU funds, amounting to €4.25 million over the 3.5-year period we examined. The funds came from the Internal Security Fund in the cases of Italy and France, and from the EU Anti-Fraud Programme in Romania. In Romania, the National Police and the National Anticorruption Directorate (DNA), a specialised prosecutorial authority responsible for financial crimes, began licensing several of Cellebrite’s phone and computer extraction programmes in 2022.
Statewatch wrote to the European Commission to ask about the fundamental rights implications of acquiring Cellebrite’s technology through EU funding. In their response, a Commission spokesperson said member state authorities had applied for grants to acquire forensic technologies, including Cellebrite, to combat fraud. They added:
“it is the responsibility of the national authorities to ensure that any project activities – including the acquisition and deployment of specialised digital forensics tools like Cellebrite – comply with the EU and national legal framework, including ethical and fundamental rights standards. […] when it comes to any illegal use of tools including software such as Cellebrite, the Commission’s position is very clear: any attempt to illegally access data of citizens, including journalists and political opponents, is unacceptable.”
The Commission spokesperson further pointed to safeguards concerning the surveillance of journalists contained in the recently adopted European Media Freedom Act, and noted that certain forms of “digital intrusion” may constitute criminal offences under the EU Directive on attacks against information systems.
Yet despite the Commission’s emphasis on legal compliance and corporate responsibility, our research into the EU’s use of – or financial contribution towards – Cellebrite’s systems, ran into a wall of opacity. EU transparency promises and legal obligations only partially materialised in response to a long series of access-to-documents requests to key agencies and institutions.
One of Cellebrite’s early appearances in the EU funding landscape is a research project called EVIDENCE, which ran from 2014 to 2016 and aimed at harmonising the collection and sharing of digital evidence. Cellebrite and its long-time competitors Magnet Forensics and Oxygen Forensics took part in project meetings and research for EVIDENCE. Oxygen Forensics was charged by US prosecutors in September 2026, over allegations it had concealed its Russian ownership and software development.
Gifts for the Moldovan police
Connections between CEPOL, the little-known EU agency for Law Enforcement Training, and Cellebrite have also emerged over the years. In 2019, London-based NGO Privacy International revealed that CEPOL had presented Cellebrite’s systems during training activities for Morocco’s national police, the Direction Générale de la Sécurité Nationale. The same police agency has been widely accused of violence and abuse of power during public events and protests.
Statewatch can now reveal that, from 2024, CEPOL has gifted the Moldovan National Police a set of forensic and data-analysis systems to equip its brand-new Cybercrime Laboratory. A 75-page list, obtained through a freedom of information (FOI) request, shows items due to be procured as part of the “EU4 Security Moldova Project”. The list includes Cellebrite’s Collector and Inspector software, as well as systems for facial recognition, video analysis, decryption and voice identification, alongside more than 200 terabytes of storage. Alongside Cellebrite, the providers include Russia-linked Oxygen Forensics, Magnet Forensics, Italy’s Amped, Czech’s Phonexia and other companies.
While Collector and Inspector help tap into computers, the EU’s support complements another US-funded grant that provided the Moldovan police with Cellebrite’s phone extraction tools.
Further documents obtained through a FOI show that CEPOL launched a procurement call in July 2024 for a comprehensive contract to “provide the Moldovan Police General Inspectorate with the necessary infrastructure, tools, resources and expertise to establish an advanced cybercrime laboratory,” thereby enabling “thorough digital investigations”. The call had a total value of €1.37 million for purchasing a range of technology. FORS Computer Srl, a Moldovan reseller that lists Cellebrite among its partners, later obtained the contract.
A second EU contract was awarded to Belgium-based SoftwareOne to train Moldovan officers to use Cellebrite’s forensic tools to hack into Android and Apple mobile phones. CEPOL refused to disclose the value of the specific spending for training in Moldova. It appears, however, to form part of a larger 2023 framework agreement managed by the European Commission’s Directorate-General for Informatics (DIGIT), known as Software for Innovation, Diversity and Evolution (SIDE) III. SoftwareOne is one of the winners of the tender and essentially acts as an intermediary, allowing dozens of EU agencies and bodies to acquire software and IT systems with other companies.
CEPOL told Statewatch:
“All training provided under CEPOL international cooperation projects, including on advanced technologies or digital forensics tools such as Cellebrite, explicitly integrates modules on the protection of human rights and fundamental freedoms.”
The agency said the terms governing the use of the equipment require “responsible practices”, including compliance with human rights principles, the avoidance of bias and respect for data protection regulations. It added that “it is essential to prevent the misuse of facial recognition technology and the mass manipulation of data, safeguarding the privacy and rights of all individuals.”
The agency also referred to the European Commission’s annual enlargement reports, which assess candidate countries’ compliance with EU norms. Notably, the latest report on Moldova raised concerns in areas related to law enforcement and data protection. On the right of assembly in the country, the report states that “the duties of public authorities to provide safeguards against the application of surveillance measures before and during assemblies still need to be better defined.” The Commission also warned of risks to freedom of expression and opinion linked to efforts to combat foreign interference.
The Moldovan General Police Inspectorate told Statewatch by email that its use of phone analysis systems respects data protection and fundamental rights, and that “the collection, without necessity, of information concerning a person’s private and intimate life is not permitted.” It did not, however, confirm whether any internal guidelines or data-protection assessments exist in relation to the use of these tools.
Risks of overreach
Ion Cojocari, a legal researcher and former judge in Moldova, told Statewatch that “while legal safeguards are essential, their effectiveness depends on how they are applied.” When it comes to safeguards governing the use of potentially privacy-breaching technology, Cojocari suggests that further assessments be made:
“Before concluding that the safeguards are sufficient in practice, [Moldova and its partners should monitor] what exactly investigators can examine, how confidential material is protected, how long extracted data are kept and who oversees their reuse.”
A prominent Moldovan activist and journalist in the early 2000s, Oleg Brega, has repeatedly denounced police abuse in the country. Speaking from Romania, Brega recalled a police raid on his NGO, Hyde Park, in April 2009, which he described as “a thorn in the side of the then-communist government”.
During the raid, police “seized computers, a modem, CDs/DVDs, placards, and correspondence,” said Brega. While the items were later returned, “no one was punished for that abuse, […] and some of the police officers, prosecutors, and judges involved still hold office today,” he said.
Brega believes there is now “a risk that new technologies and tools acquired through grants could be used illegally against government critics and political opponents.” While organised crime and foreign interests are threatening his country, he thinks that “a proper balance must be struck between state interests and fundamental human rights, enshrined in legal norms and clear oversight procedures.”
Moldovan and European authorities reassured Statewatch about the existing safeguards in place while using Cellebrite’s tech. However, Amnesty International has warned that the software poses risks to privacy and fundamental rights even when used by by governments across the EU, in candidate countries such as Moldova, and in the UK.
Ruairi Nolan, Deputy Programme Director at Amnesty Tech, a specialist department in Amnesty International, told Statewatch:
“Despite its ubiquity, Cellebrite is not a harmless tool; it enables complete access to the digital lives of individuals. While it may function in a different way to highly invasive spyware, it can still result in very similar human rights harms.”
Nolan added that cases “from around the world” have evidenced just how invasive the tech is. “Even when Cellebrite is used as intended, governments have failed to account for just how invasive such technologies are, and therefore how tightly their use should be regulated.”
Credits
This article was produced with support from the Bertha Challenge Fellowship.
The following external contributors supported this research:
- Joana Soares: freelance journalist covering EU digital policy and the impact of technology on society and democracy.
- Federica Tessari: Brussels-based investigative journalist and reporter, specialising in security, migration and European governance.
- Yuna Chang: London-based South Korean activist and investigative researcher exposing corporate power’s accountability. 2026 Bertha Challenge fellow at the Movement Research Unit.
- A note on methodology: Statewatch has included contracts that have been active in the period from January 1, 2023 to July 1, 2026. Contract values correspond to the sum indicated in award notices and – when indicated in the notice – do not include VAT. Values in GBP have been converted into EUR using the average exchange rate of June 2026. Data was extracted and cross-checked using open sources (national and EU procurement platforms, open government websites) and J360, a business opportunity platform run by French comnpany OctopusMind.