A seized iPhone gave up everything. The MacBook beside it gave up nothing.

Two devices went into Russian custody on the same May morning in 2021. One was read end to end. The other gave its captors nothing. The locked iPhone 12 belonging to opposition organizer Andrey Pivovarov was extracted with a commercial forensic kit. The MacBook seized beside it held, because its disk was encrypted and no one had the password. That split is the part worth your attention, more than the headline that a sanctioned tool was used anyway.

The disclosure is fresh even though the event is not. Citizen Lab published its forensic attribution on June 25, 2026, documenting an extraction that ran nearly five years earlier. It lands now because it pins down two things that rarely sit side by side: traces left on the hardware itself and the seizing government's own paperwork naming the tools it used.

What Citizen Lab documented

Russian security services detained Pivovarov at a St. Petersburg airport on May 31, 2021, and an iPhone 12 and a MacBook went into custody with him. Just over two weeks later, on June 17, examiners pointed Cellebrite's UFED Physical Analyzer and UFED 4PC at the phone. Out came chat histories from WhatsApp, Telegram, and Viber, plus the search terms the operators ran: the names of people in his circle, his partner among them. That contact graph became raw material for who got targeted next.

Pinning a years-old job on one vendor took two records that happened to agree. The phone itself had kept a log of the trusted machine it was wired to that day, and the host's fingerprint matched equipment the researchers had earlier linked to Cellebrite. Then the prosecution entered its own evidence: a forensic report, number 1269-17, produced inside Russia's Interior Ministry, that lists the UFED products outright. The laptop went the other way. Its disk encryption did not budge, the password never turned up, and the extraction came back empty.

The timing is the part the headlines fixed on. Cellebrite had announced back in March 2021 that it was done selling into Russia and Belarus, yet the extraction ran about three months after that line was drawn. The company's answer to reporters: any use past the cutoff was never authorized, its equipment runs with no assistance or approval from the vendor, and kit this old would be useless against a current phone anyway. Grant every word of that and the lesson for defenders gets sharper, not softer.

Why the laptop won and the phone did not

Strip away the geopolitics and you are left with a clean controlled experiment. Same owner, same seizure, same operators, two opposite outcomes. The variable that decided it was the state of encryption at the moment each device was taken.

A modern phone or laptop is always encrypted on disk, but the keys that turn that storage back into readable data are only present once someone has signed in to the device since it booted. A machine that is powered off, or freshly rebooted and never signed in to, keeps those keys nowhere an attacker can reach; brute force against a long passphrase is the only road, and it usually dead-ends. A device merely locked after normal use is a softer target, because the keys are already resident in memory and a forensic tool's job shrinks to reaching them. The MacBook behaved like the first case. The phone, whatever its precise state when grabbed, behaved like something a tool could still get into.

That is the single most useful variable a defender actually controls, and it is deliberately boring. Full-disk encryption with a long passphrase, on a device that is genuinely powered down before it can be seized, is what turned the laptop into a brick for the operator. The flip side is how little physical access a phone needs to surrender the rest: that unpatchable iPhone bootrom flaw is the same problem approached from the hardware end, and no software update closes it.

"We stopped selling it" was never a control

Citizen Lab's blunt point is the one to carry into a risk review. A UFED unit goes on doing its job offline for years after the vendor walks away from it, so the real exposure was never the next sale on the order book. It was every unit already parked in a police or intelligence office, needing nothing from Cellebrite to keep running. A sales ban does not reach into the room and switch off the boxes already there.

Security teams repeat that mistake in quieter forms. A revoked vendor license, a "deprovisioned" integration, a partner relationship wound down on paper: none of those revoke a capability that has already been delegated and runs without a live connection. The Cellebrite case is the dramatic version of a connected app that still holds a valid token, or a credential that outlives the crew that stole it. When police seized the malware behind one mass-theft operation, the stolen passwords still worked. When Washington export-controlled an AI bug-finding system, the copies already in circulation did not evaporate. Decommissioning is a paperwork event. Revocation is a technical one, and only the second changes what an adversary can do tonight.

Harden the devices that can be taken from your staff

Start from the assumption this case proves: any device that leaves your physical control should be treated as extracted, not as safely locked. Plan for the data on it being read, then work backward to limit what that costs you.

• Power off before the risk, not after. For staff crossing hostile borders or facing detention, a fully shut-down device keeps its keys out of memory. A lock screen on a device that has been used and not rebooted does not.

• Use a passphrase, not a short PIN. Full-disk encryption only buys time if the secret behind it resists brute force. A six-digit code or a biometric-only sign-in leaves the device in the reachable state the iPhone was likely in.

• Turn on Lockdown Mode for high-risk users. Apple's hardened profile, and equivalent restrictions on other platforms, narrows what a wired forensic tool can talk to on a locked device.

• Audit pairing and USB trust. The same pairing records that convicted this extraction are a detection surface. Knowing whether a returned device was ever connected to an unknown host is a question you can answer.

• Compartmentalize the contact graph. The phone's value here was less the messages than the names. Limit what a single seized device can expose about everyone the owner knows.

The uncomfortable takeaway is that the controls that worked were unglamorous and already available in 2021. Encryption you already own, a shutdown you can do at a checkpoint, and a passphrase long enough to mean it. The activist's laptop survived a state forensic lab not because of anything exotic, but because the boring defaults were set correctly and the device was off. Set them correctly on the devices your people carry into places you cannot reach, and assume the rest will be read.