Natalia Krapiva 🕊️👩🏻‍💻

Bad news. US District Court denied WhatsApp's motion to hold NSO in contempt for continuing to hack WhatsApp users after a court order barred it from doing so. The evidence wasn't "clear and convincing" enough.

Judges in spyware cases should keep this in mind: forcing tech companies (or security researchers) to fully expose how we detect sophisticated spyware hands spyware firms like NSO, and everyone else in this market, a roadmap for evading detection.

Requiring platforms to burn their detection methods to hold spyware makers to account isn't accountability. It's impunity for the entire spyware industry.

And NSO isn't the only one reading these filings. Foreign intelligence services, exploit developers, and criminal hackers also study them closely.

Tech companies face the same dilemma as civil society investigators. The evidence you need to win in court is exactly what you can't reveal without helping the adversary. Apple dropped its own lawsuit against NSO because of this.

I wrote about this problem before. If showing "enough" evidence means walking the court through exactly how WhatsApp's threat intel team detects NSO, it will help NSO figure out how it got caught. www.justsecurity.org/118409/disco...

New report by @citizenlab.ca exposes an ad tech firm that helps spyware companies to profile+target millions of people around the world, incl. in the US and EU. Regulators and companies like Google & Microsoft need to take urgent action to stop these abuses @kevincollier.bsky.social @nbcnews.com

citizenlab.caExposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen LabThis is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Ca...

Citizen Lab's report: citizenlab.ca/research/how... NBC article: www.nbcnews.com/tech/securit...

🚨 BREAKING: U.S. DOJ arrested the CEO of Oxygen Forensics, Lee Reiber, for concealing the company's Russian ownership. Civil society, including First Department, @olgalautman.bsky.social, & myself, have been sounding alarms for years about this company! 1/ www.justice.gov/usao-cdca/pr...

10/ I am incredibly grateful to the Department of Commerce BIS, which leads the investigation, DOJ, and others in the US government for finally taking this major step towards accountability. But I also wonder how did this company pass federal vetting for a decade?

11/ And it doesn't just stop at the US border. Oxygen claims that it sells its tools in 150+ countries, including in Europe. This is a major threat to both human rights and national security. Every government using Oxygen must investigate, end these contracts, and impose sanctions!

8/ The cover-up started after Russia's 2022 full scale invasion of Ukraine: – installed a US CEO – renamed the Russian company (from Oxygen to MKO-Systems) – wiped the Russian owners from US filings – moved builds to US cloud (while the code stayed in Russia)

9/ But Russian civil society knew all long this was a complete ruse! Official Russian legal entities registry shows that the Russian company MKO Systems and Oxygen Software are the same company!

6/ First Department documented how Russian security services use Oxygen tech (Mobile Criminalist) to pull EVERYTHING out of seized phones — logins, passwords, private chats, social media posts, photos, and more. It's installed at border crossings & available to every security agency.

7/ Oxygen is the machinery behind human rights abuses in Russia. Anti-war posts, donations to Ukraine, criticism of Russian government are pulled from peoples' phones at a protest or border with Oxygen tools and turned into criminal charges & long prison terms.

4/ Oxygen sold its tech to the Pentagon, ICE, FBI, DEA, DHS & the State Dept, among others. And who else used this company's software? The FSB. Also Russia's Investigative Committee & Ministry of Internal Affairs. The same outfit was selling to US law enforcement AND Russian intelligence!

5/ Inside Russia, the SAME product is sold as "Мобильный криминалист" (Mobile Criminalist) — same code, different label. First Department (Первый Отдел) showed it's basically a localized copy of Oxygen's software. By 2025 it was the #1 phone-hacking tool on the Russian market.

2/ Oxygen's US CEO, Lee Reiber, was arrested Sunday in Idaho. The Moscow-based CTO, Oleg Davydov, was also picked up at Heathrow trying to board a flight to Turkey. He will be extradited to the US. Both are charged with conspiracy to commit wire fraud & face up to 20 years in prison.

3/ Prosecutors say Oxygen told the US government it had ZERO foreign ownership and that its software was developed in the US. In reality: owned and controlled by 5 Russian nationals through a Cyprus holding. Code written, reviewed, and managed in Russia!

Former MEP was hacked by the same gov behind the Pegasus attacks we exposed 2 years ago! @citizenlab.ca revealed that Stelios Kouloglou, former EU PEGA Committee member, was targeted by the same operator that hacked several Russian- & Belarusian-speaking journalists + activists living in EU 🧵1/

4/ 2+ years on: NO government has claimed responsibility. NO ONE has been held accountable. And now we learn about another victim — a then-sitting MEP investigating EU spyware scandals! This suggests that the full scale of the abuse is likely far bigger than we thought.

t.cohttps://www.accessnow.org/press-release/same-government-more-victims-access-now-calls-for-an-urgent-investigation-into-hacking-of-mep/

5/ @accessnow.org and 30+ civil society orgs & individuals, incl. @cdteu.org & EDRi, are calling on the EU to: 🔹 Launch an independent investigation 🔹 Provide effective remedies to victims 🔹 Fully implement the EU PEGA Committee recommendations Read our full PR and recommendations below:

2/ In 2023-2024, @accessnow.org and @citizenlab.ca published two investigations uncovering Pegasus attacks on Russian & Belarusian civil society figures living in the Baltics and Poland. Several victims were hacked from the same email account: rauharepo888[@]gmail.com

@mattburgess1.bsky.social

3/ The victims included @rferl.org.web.brid.gy & Nobel Prize-awarded media @novayagazeta.bsky.social journalists. We didn't name the perpetrator at the time. But we excluded Russia, Belarus, and Poland, among others.

Natalia Krapiva 🕊️👩🏻‍💻 reposted

Matt Burgess (WIRED)

3 July

NEW: A politician investigating Pegasus spyware… had their phone hacked with Pegasus multiple times. The compromises came days ahead of key meetings of the spyware inquiry Story with @lhn.bsky.social

wired.comEU Politicians Investigated Pegasus Spyware. Then It Ended Up on One of Their Phones“It is a direct attack on the rule of law,” says one European Parliament member of the new findings from Citizen Lab.

Natalia Krapiva 🕊️👩🏻‍💻 reposted

Eliot Higgins

@eliothiggins.bsky.social

3 July

Spyware used against MEP investigating Pegasus abuses, report finds www.theguardian.com/world/2026/j...

theguardian.comSpyware used against MEP investigating Pegasus abuses, report findsResearchers say Stelios Kouloglou’s device was compromised after he joined European parliamentary committee

Natalia Krapiva 🕊️👩🏻‍💻 reposted

Lorenzo Franceschi-Bicchierai

@lorenzofb.bsky.social

techcrunch.comCellebrite said it cut off Russia, but Russia used its tools anyway | TechCrunchSecurity researchers found evidence that Russian authorities hacked the iPhone of a political opponent using a phone-unlocking device made by Cellebrite, even after the company said it would stop sell...

NEW: Russia hacked into the phone of a Putin political opponent with Cellebrite — three months after the company said it cut ties with the Russian government. Cellebrite said that “any use of legacy Cellebrite hardware in Russia after March 2021 is entirely unauthorized.” Clearly it didn’t matter.

Natalia Krapiva 🕊️👩🏻‍💻 reposted

citizenlab.caRussia Breaks Into Human Rights Activist's Phone With Cellebrite - The Citizen LabWe analyzed Russian activist Andrey Pivovarov’s phone, finding that Russian authorities used forensic extraction tools made by Cellebrite to gain access to his device. A document prepared by Russian a...

NEW @citizenlab.ca report finds Russia 🇷🇺 used Cellebrite to break into activist's phone 👇 citizenlab.ca/research/rus...

BREAKING: @citizenlab.ca investigation reveals Russian security services used @cellebrite.bsky.social tools to hack the phone of a prominent former political prisoner Andrey Pivovarov. More on why this is concerning below 🧵1/ citizenlab.ca/research/rus...

accessnow.orgRussia used Cellebrite tech to hack prominent activistA Citizen Lab investigation confirms evidence Russian authorities used Cellebrite tool to hack prominent Russian activist Andrey Pivovarov after the Cellebrite claimed to have ceased sales to Russia.

8/ To demonstrate a genuine human rights commitment, Cellebrite must stop sales to known abusers, implement "killswitches" to stop the misuse, ensure their tech is watermarked and forensically traceable, & provide remedy to the victims. More in @accessnow.org post: www.accessnow.org/cellebrite-r...

9/ Read full @citizenlab.ca report & key security recommendations here: citizenlab.ca/research/rus... Civil society can also contact our Helpline at help@accessnow.org for digital security support.

6/ While we welcome Cellebrite’s exit from Russia, this evidence casts serious doubt on the company’s claims that withdrawal makes their technology "ineffective within a short period of time" as stated in their reply to our joint letter with the Citizen Lab.

7/ Furthermore, Cellebrite must explain why it repeatedly enters into contracts with countries notorious for human rights abuses, including Belarus, China, Saudi Arabia, Philippines, Ethiopia & more. Belarus was a dictatorship for 20+ years before Cellebrite's 2021 exit.

4/ @haaretzcom.bsky.social, Eitay Mack, @en.zona.media & First Department have documented multiple cases (backed by the Russian authorities' own documents) showing that UFEDs were still used against human rights defenders & anti-war protesters YEARS after the company's alleged exit.

5/ These are not just hypothetical harms. In 2023, Cellebrite tool helped convict anti-war activist Dmitry Ivanov to 8.5 years. Pivovarov served most of his 4-year sentence. FSB also targeted other Open Russia activists with phishing after searching their communications on Pivovarov’s phone.

2/ In March 2021, Cellebrite announced it had ceased operations in Russia after lawyer Eitay Mack & @haaretzcom.bsky.social revealed that the UFED tools were being used by Russian Investigative Committee to prosecute opposition figures, including Lyubov Sobol & Pussy Riot.

3/ While Cellebrite claimed it had ended the sales to Russia "immediately" and asserted that it could remotely disable devices to prevent future misuse, the evidence from independent media and lawyers tells a different story...

therecord.mediaRussia upgrades rules for its digital spy system to better track citizens onlineNew regulations published by Russia's Ministry of Digital Development at the end of May updated the technical standards governing SORM, formally known as the System for Operative Investigative Activit...

9 June

Spoke to @darynant.bsky.social about Russia's new SORM regulation. These new mass surveillance rules are aimed at ensuring that the Russian people do not dare to express their critical views online out of fear of being identified and prosecuted. therecord.media/russia-upgra...

8 June

Glad to see WhatsApp continuing to invest significant efforts & resources into countering the threat of spyware and holding companies like NSO Group accountable!

Access Now@accessnow.org

Spyware attacks threaten the privacy and safety of people around the world. Following a landmark ruling against NSO Group, WhatsApp is seeking to hold the company accountable for violating the court’s order and continuing attempts to target users.

wired.itOne Year On, Italy Is Still Waiting for Answers From Paragon Over Spyware ScandalIn 2025, Graphite spyware was discovered on the phones of Italian journalists and activists. Prosecutors have not yet received answers from Paragon, the Israeli spyware maker

5 June

Spoke to Wired Italia @rositarijtano.bsky.social about the lack of justice for the victims of Paragon’s spyware 1 year after WhatsApp notifications. www.wired.it/article/ital...

Natalia Krapiva 🕊️👩🏻‍💻 reposted

dnews.grCitizen Lab’s Ron Deibert: “Accountability may be delayed, but the truth will emerge” - DnewsGreece’s spyware scandal remains a live test case for Europe’s rule of law, according to Ron Deibert, founder and director of Citizen Lab, who warned in Athens that the global expansion of the commerc...

22 May

Greece 🇬🇷 has witnessed a flurry of corruption and espionage against journalists, but the journalists are relentless and principled and the truth will eventually come out through the courts and through public interest investigations. www.dnews.gr/eidhseis/new...

Natalia Krapiva 🕊️👩🏻‍💻 reposted

8 May

Replying to @rondeibert.bsky.social

Oh and here's the photo of the UN officials inspecting the poster after I refused to let Egyptian security take it away (2009). The poster is framed and hung on the wall of the inside of @citizenlab.ca to this day :)

Natalia Krapiva 🕊️👩🏻‍💻 reposted

2 May

Replying to @rondeibert.bsky.social

Another interesting coincidence: cofounder of @accessnow.org @brettsolomon.bsky.social was in attendance at that IGF, and that's where he and I first met. He described to me his vision for @accessnow.org which he was about to start.

Natalia Krapiva 🕊️👩🏻‍💻 reposted

2 May

Replying to @rondeibert.bsky.social

Interesting coincidence: I faced a similar type of pressure in 2009 in Egypt 🇪🇬 because of China 🇨🇳 at the UN's Internet Governance Forum (IGF) China forced UN officials to shut down our book launch because our book mentioned Tibet. Big standoff between security & me news.bbc.co.uk/2/hi/technol...

Natalia Krapiva 🕊️👩🏻‍💻 reposted