CELLEBRITE

OLYMPUS opened an institutional file and set it beside the locksmith’s. A firm has no Big Five and no Dark Triad, and the unit does not invent them; what a firm has is a product, a court-evidence footprint, and a client list. Cellebrite is catalogued here as the extractor — the company whose device is plugged into a seized phone and produces the report a prosecutor hands the court. The finding is the position: a private Israeli firm whose forensic tool is the industry standard for unlocking and copying phones, whose output is treated as objective evidence, and whose security posture a rival once described in terms that would disqualify any other forensic instrument. Not a hand on any single case. A box on a bench, and the question of whether the report it prints can be trusted. The “breach reach” of a forensics vendor is real, but the numbers in the front matter are reach, evidentiary embedment, and durability — not malice.

Institutional Archetype

THE EXTRACTOR — The archetype is the maker of the tool that turns a seized phone into a court exhibit and is never itself cross-examined. Cellebrite does not investigate anyone; it sells the Universal Forensic Extraction Device (UFED) to police, prosecutors, and intelligence services, who plug in a phone and receive a forensic report — messages, photos, call logs, location history, app data. The structural power is that the report reads as fact: a network diagram is an argument, but a UFED extraction is presented as a photograph of the phone’s contents, and defense attorneys rarely challenge it because the technology is framed as objective. Nobody cross-examines a camera. That is the hazard — not any single extraction, but authorship of the instrument inside which the evidence is manufactured and the presumption that the instrument is neutral.

Mandate & Origin

Cellebrite was founded in 1999 in Petah Tikva, Israel, originally in phone-to-phone data transfer for mobile carriers, before becoming the dominant vendor of mobile-device forensics. Its UFED line is the industry standard for law-enforcement phone extraction worldwide. Its stated mandate is to help authorities “lawfully acquire digital evidence in criminal investigations and civil proceedings” — a chain-of-custody vocabulary that frames the firm as the neutral instrument between a warrant and a courtroom. The mandate is the product’s selling point and its shield: a tool for lawful investigation, whatever the investigation turns out to be.

In its own words. The annual report filed with the SEC on 3 March 2026 says the company “was incorporated on April 13, 1999 under Israeli Law,” counts “approximately 7,000 customers,” of which “approximately 5,300 federal, state and local agencies as well as approximately 1,700 corporations and service providers,” and says of its main product line that it is used by examiners “to collect and review digital evidence from the broadest range of digital sources when conducting legally sanctioned investigations” (Cellebrite DI Ltd., Form 20-F for 2025). The mandate sentence is a chief executive’s, in the 18 March 2021 release that ended sales to Russia and Belarus: “Cellebrite empowers law enforcement agencies and enterprises to make our communities safer by providing solutions that help lawfully acquire digital evidence in criminal investigations and civil proceedings,” said Yossi Carmil, then chief executive, “As part of our standard business operations, we regularly review and update our compliance policies to ensure we operate according to accepted international rules and regulations” (Cellebrite press release, 18 March 2021).

Funding & Backers

Cellebrite’s ownership sits at the intersection of Japanese and Israeli capital. Sun Corporation of Japan held a 71 percent stake before Cellebrite went public; Tel Aviv-based Israel Growth Partners (IGP) held about 24 percent. In August 2021 Cellebrite listed on Nasdaq under the ticker CLBT via a SPAC merger with TWC Tech Holdings II Corporation, at a roughly $2.4 billion valuation — a deal marked by an 87 percent redemption rate, so that only about $70 million of an intended $480 million actually reached the company. The public listing is the load-bearing fact: unlike the privately held locksmith next door, the extractor is a Nasdaq company with SEC filings, quarterly disclosure, and a compliance posture it must be seen to keep — which is both a check and a marketing asset.

The money, in the company’s own filings. The 2025 annual report puts total revenue at $475.7 million against $401.2 million in 2024 (up 19 percent), annual recurring revenue at $481 million against $396 million, and says “In 2025, Cellebrite’s Public Sector Customers accounted for more than 90% of total revenue” and “Revenue from the U.S. federal government customers accounted for approximately 16% of our total revenue in 2025.” The ownership table lists SUN Corporation with 106,065,324 shares, 42.52 percent, and True Wind Capital Management with 13,861,007 shares, 5.56 percent; the filing’s governance section says the company “cannot rely on such exemption because SUN Corporation is a controlling shareholder of Cellebrite,” and records that SUN is also a reseller in the Japanese market, with $5.836 million of 2025 revenue from it. The board’s chairman, Adam Clammer, is a managing member of the True Wind entities, and the filing notes that an affiliate of TWC Tech Holdings II announced in April 2024 that it had acquired about 19 percent of SUN (Form 20-F for 2025). The pre-SPAC 71 percent has become 42.52 percent. The second quarter of 2026 moved the other way: ARR of $507.8 million, up 21 percent, and revenue of $131.1 million, up 16 percent, with a lowered full-year ARR and revenue outlook (Form 6-K, exhibit 99.1, 13 August 2026).

Institutional Voice & Intent

The voice is the chain-of-custody register — the neutral-instrument’s, not the investigator’s. Cellebrite speaks in “lawful acquisition,” “digital intelligence,” “ethics and integrity policies,” and “compliance with international rules”: a governance vocabulary that positions the firm as the audited middle of a lawful process and abuse as the customer’s deviation. The persuasion is in the appearance of due process — a tool sold with an ethics policy reads as governed, even when the governance is applied after the exposure.

Stated intent: Provide law enforcement and the courts a reliable, lawful means to extract and present digital evidence, sold under compliance policies and reviewed against international norms.

Observed intent: Be the default forensic instrument inside courtrooms and police services worldwide, selling broadly and pruning the client list — publicly and after the fact — when a specific abuse is documented and reported.

Gap: The stated and observed intents diverge on two axes the record documents. First, reliability: in April 2021 Signal’s Moxie Marlinspike obtained a UFED kit and reported software more than 100 security updates out of date, including FFmpeg libraries from 2012 (“There have been over a hundred security updates in that time, none of which have been applied,” Signal), and demonstrated that a crafted file placed on a phone before seizure could alter not just the current report but past and future reports from that device — the extractor’s output modifiable by the evidence it extracts. Second, control: Cellebrite’s market exits are real but selective, applied where a report and press attention arrive and withheld where the same investigators raise the same concerns elsewhere. Whether the firm’s compliance posture is a genuine brake or a reputational instrument is not fully establishable from the outside — but on the reliability question, the forensic-integrity finding stands on Signal’s demonstration, not on characterization.

In the filing the register changes. The risk-factor section, written for investors, states the Serbia episode and the policy in the same breath: “in late 2024, Amnesty International published a report alleging that certain law enforcement agencies in Serbia had misused our solutions to access the mobile phones of several journalists and activists and then implanted spyware on those devices. After a review of the allegations brought forth by the Amnesty International report, we investigated each claim in accordance with our ethics and integrity policies, and found it appropriate to stop the use of our products by the relevant customers.” It adds that “we no longer sell our products to customers in China, Hong Kong, Russia, Belarus and certain other countries,” that “adverse media coverage and petitions relating to Bangladesh, Hong Kong, Russia, Serbia and Uganda have in the past negatively impacted, and may in the future negatively impact, our reputation,” and that the Ethics and Integrity Committee “serves as an advisory body to the board” and “is composed of seven industry experts.” It also says “Our decisions not to do business within certain countries or with certain customers may alter our expectations surrounding our long-term financial benefits and results, which may harm our growth prospects” (Form 20-F for 2025). The company’s spokesperson Victor Cooper put the other half to TechCrunch in February 2026: “We do not respond to speculation and encourage any organization with specific, evidence-based concerns to share them with us directly so we can act on them,” and that “high confidence is not direct evidence” (TechCrunch, 19 February 2026). The filing calls the committee advisory and prices the exits as a cost; the spokesperson’s line sets the bar for the next one.

Interest: What each position the company takes would pay it, documented, with the best case its holders state. The positions are Cellebrite’s own, taken from its annual report and releases; the courts and agencies that sit beside it are named where the record places them.

• Lawful phone extraction is the standard of evidence. Position: Carmil’s “solutions that help lawfully acquire digital evidence in criminal investigations and civil proceedings” (press release, 18 March 2021), and the report’s growth strategy: “Capitalize on the prioritization of law enforcement funding. We generate the majority of our revenue from contracts with national, regional and local governments to support an array of law enforcement agencies. We believe that ongoing funding of these law enforcement agencies will remain a top priority” (Form 20-F for 2025). What it pays: annual recurring revenue of $481 million at the end of 2025 and $507.8 million at 30 June 2026, from customers of whom more than 90 percent of revenue is public sector. Best case, the company’s: “helping customers accelerate investigations, uncover trusted intelligence, deliver justice and protect communities,” in its chief executive’s words (Form 6-K, exhibit 99.1, 13 August 2026). Who else gains: the police and prosecutors whose caseloads the tool moves, and the court that admits its output (below).
• An extract is lay evidence, not expert evidence. Position: not Cellebrite’s argument; the Fifth Circuit’s holding in United States v. Williams (No. 22-10316, 13 October 2023), that “Operating a Cellebrite device and understanding its report require knowledge in the realm of a reasonably tech-savvy lay person” (opinion). What it pays: a rule that the extract comes in through the officer who ran the program, with no witness from the vendor and no showing of the software’s reliability, is the cheapest path for every customer to put the output before a jury. Best case, the court’s: “district courts would need a mechanic to qualify as an expert just to testify that a car with a flat tire ran a red light.” Who else gains: prosecutors. Who loses on the same rule: a defendant whose only route to the software’s reliability is cross-examination of an operator who, in this record, “explicitly disclaimed” expertise.
• Self-governance by an advisory committee instead of a statute. Position: the report’s “Ethics and Integrity Committee, which serves as an advisory body to the board,” with “policies and procedures intended to prevent sales to customers in countries that do not meet the standards we have set in our policies” (Form 20-F for 2025). What it pays: the right to decide, case by case and after a report, which customers to cut, with the cost disclosed to investors as a risk to growth. Best case, the company’s: the committee holds “ethics experts, legal experts, former members of the police force, former members of ministries of defense, technology experts, academic experts and community leaders.” Who else gains: the customers in markets it does not cut, who face no external standard beyond the company’s own and Israel’s export licence.
• Keep exporting under the old licence terms. Position: after the Israeli Minister of Defense’s order of 18 November 2025 repealed the encryption control regime, effective 18 March 2026, the company says it is “currently in discussions with representatives of DECA and the Ministry of Economy regarding the possibility of continuing our export activities consistent with our practices under our current license, however there is no certainty with respect to the results of such discussions” (Form 20-F for 2025). What it pays: the filing says the new regime “could have the effect of subjecting some of our exports to a licensing requirement” and that if it cannot keep its practices it “would likely need to adapt our licensing, marketing and export practices,” which “would increase our expenses and may cause delays in sales and the loss of customers.” Best case, the company’s: its current licence “should remain valid until September 2027.” Who else gains: the ministry that licenses it, which per the filing can prohibit exports to some countries and require its consent for others.

Interest is a documented fact about each position, not a claim about motive, and not a verdict that the argument is wrong. Each best case is stated at the strength its author states it.

Position in the Apparatus

Cellebrite is a node in the operations wing, adjacent to the commercial-intrusion vendor NSO Group and the data-fusion vendor Palantir Technologies, and downstream of the state-collection substrate (the NSA surveillance stack). It shares the Israeli signals-intelligence-to-commercial lineage documented across the corpus, and it sits at a distinct point in the chain: where the locksmith opens a phone remotely and covertly, the extractor opens a phone in custody and produces the courtroom record. In the series research the two appear together as vendor nodes selling into an overlapping customer cohort of state security services. The pipeline is lawful and the adjacency is recurrence, not a curated roster. The extractor’s product became the evidentiary substrate of criminal courts, and its market is every police service that seizes phones.

Actions & Leadership Choices

Founding purpose, judged on evidence. Cellebrite was founded in 1999 and became a commercial forensics vendor whose product is the industry-standard bridge between a seized phone and a court exhibit. Judged on its deeds, its purpose is to sell that bridge as broadly as the market allows, with the ethics policy as the governing instrument invoked after exposure. The deeds below are weighed against that model.

Consequential actions, especially where it cost something. The record is a sequence of exposures, market exits, and one forensic-integrity finding that never provoked a recall. April 2021: Signal’s Marlinspike published the vulnerability analysis; Cellebrite patched the specific flaws he named and left the structural problem — untrusted data from adversary-controlled devices parsed with inadequate security — in place. The UFED remains in use in criminal cases worldwide. 2023: a 1.7-terabyte dump of Cellebrite internal data (alongside 103GB from rival MSAB) was leaked via DDoSecrets, confirming the scope of the government client base. On the exit side, Cellebrite has repeatedly cut clients under pressure: Russia and Belarus in March 2021 (and, per later reporting, Bangladesh and Myanmar); China and Hong Kong under US export rules; and Serbia on February 25, 2025, after Amnesty International’s December 16, 2024 report “A Digital Prison” documented Serbian authorities using UFED exploits to bypass Android security and covertly install the NoviSpy spyware on journalists’ and activists’ phones during police interviews.

The costly counter-instance and the qualifier arrive together. Cellebrite’s exits are real — it forfeits revenue when it cuts a market — but they are selective: Citizen Lab documented in 2026 that Russian authorities used Cellebrite tools against activist Andrey Pivovarov’s iPhone despite the 2021 halt, and reporting found Chinese police kept buying after the stated exit, while Citizen Lab’s John Scott-Railton noted publicly that Cellebrite cut Serbia on the strength of Amnesty’s research and dismissed Citizen Lab’s regarding Jordan and Kenya. A halt announced is not a halt enforced.

Leadership choices. The leadership ledger is the pattern itself: a public company (led through these events by CEO Yossi Carmil, since succeeded by Thomas Hogan, announced 6 Nov 2024) that patches the named flaw rather than the class of flaw, that exits a market when a report and a headline coincide, and that invokes “high confidence is not direct evidence” to decline the exits it prefers not to make. The choice under cost — to prune selectively and publicly rather than either sell without limit or hold a single consistent standard — is the choice that defines it, and it is the opposite of the privately held NSO Group, which litigates rather than exits.

The chief executives, in their own words. The seat has changed hands twice in two years. On 6 November 2024 the company announced that Carmil, who joined in 2004 as its fifth employee and became chief executive a year later, would step down by 31 December 2024, with Thomas Hogan, then executive chairman, as interim chief executive; Hogan said “Cellebrite is indebted to Yossi Carmil. He is a rare CEO” (release via AAP, 6 November 2024). Hogan was appointed chief executive in August 2025, and on 13 August 2026 the company announced that Shiven Ramji, who joined as President, Products and Technology in May 2026 from Okta, “has succeeded Thomas E. Hogan as the Company’s CEO as part of a planned transition,” with Hogan leaving the board and agreeing to advise for six months. Hogan: “It has been a privilege to lead Cellebrite – a company that truly makes the world a safer place.” Chairman Adam Clammer: “With a product-first approach and a successful track record of building and growing businesses, Shiv is the right CEO for our next chapter.” Ramji, on the quarter in which the firm cut its outlook: “ARR came in below our expectations. We saw longer sales cycles and less expansion from Inseyets conversions than anticipated” (Form 6-K, exhibit 99.1, 13 August 2026; Form 6-K, 13 August 2026). None of the quoted statements mentions the exits, the Signal findings or the Citizen Lab reports. The 2025 annual report’s own sentence on its reputational risk, by contrast, names Serbia.

In court, where the box is a witness nobody calls. In United States v. Williams (5th Cir., No. 22-10316, 13 October 2023) the defendant objected to an investigator introducing a Cellebrite extract without qualifying as an expert. The court records that “On voir dire, the police investigator disavowed any particular knowledge of Cellebrite’s technology or of any malware that may have affected the data extraction,” held that “the investigator knew no more than anyone else who runs a program on his computer that he did not write,” and observed that “Notably, the cross-examination of the investigator did not probe the reliability of Cellebrite technology.” It also notes that “Every circuit that has addressed this question–whether evidence obtained with Cellebrite technology requires expert testimony for admission–has answered it in the negative” (United States v. Williams, 5th Cir.). That is the extractor’s position stated by a court: the output is admitted as ordinary evidence, the operator vouches for nothing, and the one examination that could reach the software’s integrity was not conducted.

The federal customer, on the award record. The federal award database shows Cellebrite Inc. as the recipient of a one-year Immigration and Customs Enforcement order, 70CMSD26FR0000130, signed 15 September 2026 for $12,794,860, performance 30 September 2026 to 29 September 2027, described as providing “Cellebrite products and services to support homeland security investigations with digital forensic capabilities, technical support, and related mission needs,” awarded under full and open competition; the same purchase-order series runs back through $11.1 million for 2025-26, $9.6 million for 2024-25, $6.2 million for 2023-24 (“CELLEBRITE UFED & PREMIUM LICENSE”) and $2.9 million for 2019-20 (USAspending, award CONT_AWD_70CMSD26FR0000130). The company’s own report puts the federal share of revenue at about 16 percent, says that “Because we are organized in Israel, we entered into an agreement with the U.S. Department of Defense with respect to FOCI mitigation arrangements” for its classified-contract business, and that CFIUS “has permitted the acquisition to close on the basis of a national security agreement negotiated with relevant government agencies” for the December 2025 Corellium purchase, pending formal clearance (Form 20-F for 2025).

CONDUCT verdict: CONFLICTED — a commercial forensics vendor whose product is embedded in criminal courts worldwide and was shown by Signal to be alterable by the evidence it extracts, partly mitigated by documented, revenue-forfeiting market exits (Russia, Belarus, Serbia), but undercut by the exits’ selectivity and by forensic evidence that the tools kept being used in cut markets. The reliability finding stands on demonstration; the enforcement record stands on its own gaps; motive the record does not settle.

Alliance Map

These run at the same time, and the overlap is the finding. In 2026 the firm is at once an Israeli company under a Defense Ministry export licence being rewritten, a company whose filing names a Tokyo-listed “controlling shareholder,” a US federal customer base under a Pentagon FOCI arrangement and a CFIUS agreement, the recipient of a $12.8 million ICE order, and the author of an annual report that names Serbia. Each tie is documented in the company’s own filing, a federal record or a court opinion; no coordination among them is asserted.

Reach Assessment

Institutional: UFED became the default forensic instrument of police services and courts across scores of countries — reach measured in the criminal cases whose evidence it produced, not in any single extraction. Memetic: “Cellebrite” became the generic name for phone-cracking, and the Signal disclosure made it the reference case for the argument that forensic tools presented as objective are software like any other, with the security posture of a media player. Civilizational: Cellebrite does not build the AI systems this file otherwise tracks. It built the instrument that decides what a seized phone says in court, sold it worldwide, and left the structural integrity problem in place while patching the named flaws. The breach reach of a forensics vendor is wide because the report travels as fact: a UFED extraction is entered into the record, cited, and relied upon long after anyone checks whether the box that printed it could be trusted.

Score basis. Atk 8 is reach: the annual report counts “approximately 7,000 customers,” about 5,300 of them agencies, with public-sector customers “more than 90% of total revenue,” and the Fifth Circuit held that “Operating a Cellebrite device and understanding its report require knowledge in the realm of a reasonably tech-savvy lay person” (Form 20-F for 2025; Williams). It is not a 9 because buying the tool is each agency’s procurement choice, no statute obliges anyone to act on its output, and the firm’s own licence bars or consent-gates exports to listed countries. Def 8 is funding insulation: customers number about 7,000, federal revenue is “approximately 16%,” and the books are public; the counterweights are that the money is more than 90 percent public-sector money from the agencies whose evidence the tool extracts, SUN Corporation is a “controlling shareholder” at 42.52 percent, and the export licence is a defense ministry’s to restrict (Form 20-F for 2025). It is not a 9 for those three reasons. Hp 8 is entrenchment: ARR of $507.8 million at 30 June 2026 with net retention of 117 percent, an ICE purchase order renewed every year from 2019 to the $12,794,860 order of 15 September 2026, and a court rule that lets the extract in through a lay operator (Form 6-K, exhibit 99.1; USAspending); it is not a 9 because the contracts are annual and the firm lowered its 2026 outlook on 13 August 2026. Peers on the same values: Ofcom at 8/8/8, hazard 80, reaches platforms by statute, where this firm’s reach is bought and its payers are its users, so its two extra hazard points rest on the evidentiary embedment the court record documents. On the neighbouring rungs, NSO Group at 9/6/7, hazard 86, reaches states by licence and is paid by them, with a court’s injunction against it; Cellebrite’s payers are more numerous and its filings public, which is the two-point difference in def, and its entrenchment is a point higher because its product has no injunction and a published appellate rule in its favor. Palantir at 9/9/9, hazard 90, holds ten-year agreements where this firm holds one-year orders, which is the whole gap. The values hold.

Companion file — the drama. The litigation posture, the press war, and the running public receipts are documented on troll.fan, the drama register of this same story: Cellebrite case file. This file keeps the mechanism; the drama lives there.

Sources: Cellebrite — Wikipedia; Cellebrite coming to Nasdaq via SPAC — CTech/Calcalist; Exploiting vulnerabilities in Cellebrite — Signal blog, Apr 2021; Hacked Cellebrite and MSAB software released — Schneier on Security; Cellebrite stops selling in Russian Federation and Belarus — Cellebrite press release; Serbia: “A Digital Prison” — Amnesty International Security Lab, Dec 16 2024; Cellebrite halts product use in Serbia following Amnesty report — Amnesty International, Feb 2025; Russia breaks into human rights activist’s phone with Cellebrite — Citizen Lab; Cellebrite cut off Serbia citing abuse of its phone unlocking tools. Why not others? — TechCrunch; Cellebrite DI Ltd., Form 20-F for 2025 — SEC EDGAR; Cellebrite Form 6-K exhibit 99.1, 13 August 2026 — SEC EDGAR; Cellebrite Form 6-K, 13 August 2026 — SEC EDGAR; Cellebrite CEO succession, 6 November 2024 — AAP; USAspending: ICE order 70CMSD26FR0000130; United States v. Williams, No. 22-10316 (5th Cir. 13 Oct 2023); Release: Cellebrite and MSAB — Distributed Denial of Secrets, 14 Jan 2023; Chinese Police Kept Buying Cellebrite Phone Crackers After Company Said It Ended Sales — The Intercept, 26 Aug 2021.