When forensic tools become weapons to silence activists and journalists

The recent findings of the Citizen Lab bring an uncomfortable reality back to the fore: commercial forensic tools that promise to help resolve crimes can become weapons against civil society. An independent forensic analysis determined with high confidence that Cellebrite's technology was used to extract data from Boniface Mwangi's phone, Kenyan activist and public figure who has announced their intention to stand for the presidency in 2027. The Citizen Lab report is available here: Citizen Lab - report on Mwangi.

The technical details that reveal the study are disturbing for its practical simplicity: Mwangi's phone, a Samsung held by the police after his arrest in July 2025, presented evidence of a forensic extraction dated around 20 and 21 July. When the device was returned in September, it no longer required a password to unblock. This suggests not only timely access to messages and files, but the possibility of a comprehensive copy of the activist's personal and professional information from private communications to credentials and financial data.

The use of tools such as Cellebrite's is neither new nor isolated. In recent months, the Citizen Lab published another report documenting similar uses of the same technology by Jordanian authorities against human rights defenders and pro-Palestinian protesters; in these cases the phones were seized during arrests and subsequently returned after the exactions. The report is available here: Citizen Lab - report on Jordan, and OCCRP's journalistic research on the matter provides additional context: OCCRP - Jordan used Israeli tech.

In the face of these revelations, Cellebrite told the press that his tools should be used according to due process and with the appropriate consent to support legal investigations, according to statements reproduced by The Guardian. However, the accumulation of cases in which these technologies are associated with rights violations raises questions about the controls that manufacturers and states apply on their effective use and on transparency in the sale and deployment of such capabilities.

In parallel, the technological threat landscape is growing in sophistication with the proliferation of commercial spyware designed explicitly for sustained monitoring. Amnesty International documented the case of Angolan journalist Teixeira Cândido, whose iPhone was compromised by the Predator spyware after opening a malicious link received by WhatsApp in May 2024. Amnesty's research, which rebuilds intrusion and subsequent attempts at re-infection, can be read here: Amnesty International - Predator in Angola.

Forensic reports indicate that Predator is not just a targeted Trojan: it is a modular platform that allows to activate or disable capabilities based on the activity of the target and that incorporates mechanisms to make it difficult to analyse and detect. A technical analysis published by Reverse Society offers a profound breakdown of these characteristics and of the anti-analysis techniques used by Predator: Reverse Society - Predator Analysis. The sophistication of these tools, which even avoid operating in certain locations, makes them particularly dangerous when they fall into the hands of governments with a history of political persecution.

Jamf Threat Labs researchers have drawn attention to telemetry systems and error codes that Predator uses to convert deployment failures into actionable information, facilitating operators to perfect their attacks. This work, which explains how operators get visibility about failed attempts, is documented in Jamf's blog: Jamf - Predator and anti-analysis techniques. That is, these platforms learn from their mistakes and adjust their tactics to ensure future successful intrusions.

The fabric that connects commercial forensic tool manufacturers to state buyers raises regulatory and ethical dilemmas. On the one hand, security forces argue that these technologies are useful for investigating serious crimes; on the other, documented cases show a pattern of use against journalists, activists and political opponents. International organizations and media have been calling for greater transparency in the export and control of these technologies, as well as accountability mechanisms when documenting their abuse.

In addition to public debate and regulatory demands, there are practical and human consequences: the violation of the privacy of activists and journalists can mean not only the exposure of talks and support networks, but immediate physical and legal risks. When a phone is the subject of a complete extraction or advanced intrusion, the vulnerability of its contacts and collaborators also increases, multiplying the damage beyond the individual directly affected.

The combination of forensic tools and commercial spyware creates an ecosystem in which state actors with few scruples can access technical capabilities that, in responsible and regulated hands, would serve to pursue crime; in irresponsible hands, they serve to silence dissent. Research by the Citizen Lab and organizations such as Amnesty helps shed light on practices that would otherwise remain in the dark, and their reports provide evidence that should serve as a basis for public policies and legal processes.

Meanwhile, the technological community and digital rights defenders insist on the need for a multifaceted response: stricter controls on the sale of these tools, independent audits of cases of use by states, and legal frameworks to ensure transparency and repairs when abuse is made. Policy makers, business and civil society are facing the challenge of balancing legitimate security needs with the protection of fundamental freedoms.

The stories of Mwangi and Teixeira Cândido are concrete examples of a global trend that demands attention. For those who want to elaborate on the technical details and forensic evidence, I recommend to consult the original documents mentioned in this article directly: Citizen Lab, the analysis of Revise Society on Predator and the Amnesty International. Only with rigorous information and citizen surveillance will it be possible to limit abuses and protect those who exercise their right to free expression and to protest peacefully.