The Citizen Lab report alleges that Russian authorities used Cellebrite tools to extract data from the phone of activist Andrey Pivovarov while it was in state custody, enabling access to sensitive information used in his prosecution. It further claims that the extracted data was used to identify and target individuals within Pivovarov’s social network, expanding surveillance beyond the original device. Researchers argue that this pattern suggests corporate facilitation of downstream harm, where access to one activist’s phone led to broader political targeting of regime opponents. The report also places this case in a wider context of repeated findings that Cellebrite technology has been linked to human rights abuses in multiple countries despite policy restrictions and contract terminations. Overall, it alleges that Cellebrite failed to adequately prevent foreseeable misuse of its tools through effective downstream due diligence under the UN Guiding Principles on Business and Human Rights. It also states: "[W]hile Cellebrite’s licensing agreement states they possess the ability to remotely disable the technology, previous reporting suggests this functionality was absent or ineffective, at best. Cellebrite now states that they are “in the process” of moving all licenses to a subscription model, and that devices will “immediately stop working” when the license expires. This pattern suggests a selective approach to the corporate obligation on businesses to respect human rights, rather than genuine compliance with the United Nations Guiding Principles on Human Rights (UNGPs). Genuine compliance would result in careful due diligence in export transactions, including careful customer research, contractual and procedural safeguards, strong grievance mechanisms, and transparent public reporting on transactions."