Jordanian Authorities Used Commercial Phone-Extraction Tools Against Gaza War Critics, Forensic Evidence Shows

Threat Summary

Category: State Surveillance Abuse | Mobile Device Exploitation | Digital Repression | Features: Commercial forensic spyware, forced device unlocking, exploit-based data extraction, legal suppression via cybercrime statutes, cross-platform compromise (iOS / Android) | Delivery Method: Cellebrite forensic extraction tools deployed during detention and interrogation | Threat Actor: State security and law enforcement authorities (Jordan)

---

Jordanian authorities used commercial phone-hacking technology to extract extensive personal data from the mobile devices of activists and human rights defenders critical of Israel’s military campaign in Gaza, according to a new forensic investigation.

The findings were published by Citizen Lab, which documented at least seven confirmed cases between late 2023 and mid-2025 in which seized phones were forensically accessed using tools produced by Cellebrite.

All documented extractions occurred while the individuals were detained or interrogated for political speech, raising serious concerns about the use of lawful interception tools as instruments of political repression.

---

Core Narrative

Citizen Lab’s investigation is based on direct forensic analysis of four confiscated devices—three iPhones and one Android handset—as well as Jordanian court records tied to three additional prosecutions. In each forensic case, researchers identified clear indicators of compromise consistent with Cellebrite-assisted extractions on both iOS and Android platforms.

According to the report, the targeted individuals were activists and civil society members whose speech criticized Israel’s actions in Gaza. The data extraction activity coincided with their detention by Jordanian authorities and was not incidental or remote; it occurred while the devices were in state custody.

Citizen Lab researchers stated they are aware of dozens of additional cases involving similar tactics, suggesting the seven documented incidents represent only a subset of a broader campaign. The institute also noted it believes Jordanian authorities have been deploying Cellebrite tools since at least 2020.

---

Technical Breakdown: What Cellebrite Can Extract

Cellebrite’s forensic platforms are capable of extracting an expansive range of data from mobile devices, including:

• Encrypted and unencrypted chat histories
• Photos, videos, and deleted media
• Location and movement history
• Saved passwords and authentication tokens
• Wi-Fi and network connection histories
• Call logs and contact databases
• Email archives and web browsing history
• Social media and third-party application data

The tools rely on a mix of brute-force passcode attacks and exploit-based methods that bypass device security mechanisms. Even when passcodes are provided, the software is frequently used to automate extraction, indexing, and visualization of entire device contents.

Citizen Lab confirmed it identified Cellebrite-related indicators of compromise on all four devices it directly analyzed.

---

Forced Unlocking and Custodial Abuse

In several cases, activists were compelled to unlock their phones using Face ID or passcodes while in custody. In one documented incident, an activist reported discovering their phone returned with the device passcode written on a piece of tape affixed to the back, despite the individual never providing the passcode to authorities.

Such practices raise significant legal and ethical concerns, particularly when biometric unlocking is performed under detention, where consent is inherently compromised.

---

Legal Infrastructure Enabling Surveillance

Citizen Lab linked the device extractions to prosecutions under Jordan’s cybercrime law, which was first enacted in 2015 and significantly expanded in 2023. The updated statute criminalizes online speech that “defames, slanders, or shows contempt for any individual,” language that critics say is broad enough to encompass political dissent.

Court records reviewed by Citizen Lab include technical forensic reports prepared by Jordan’s Criminal Investigations Department summarizing the data extracted from seized devices. These reports were used as evidentiary material in prosecutions of activists.

---

Vendor Role and Response

Cellebrite, headquartered in Israel, markets its tools globally to law enforcement agencies. The company has previously assisted high-profile investigations, including U.S. federal cases.

When contacted by Citizen Lab, Cellebrite did not dispute the findings in Jordan. A company spokesperson stated:

“As a matter of policy, we do not comment on specifics.”

The company added that it conducts customer vetting against internal human rights criteria and requires clients to certify lawful authority prior to use. Cellebrite also stated it takes allegations of misuse seriously.

Citizen Lab has urged Cellebrite to implement technical accountability measures, including watermarking extractions with unique customer identifiers to make abuse easier to detect and attribute.

---

Pattern of Global Misuse

Jordan is not an isolated case. Human rights organizations have previously documented Cellebrite tools being misused by state authorities in multiple countries.

In December 2024, Amnesty International reported that Serbian authorities used Cellebrite to unlock phones belonging to a journalist and an activist and subsequently plant spyware during detention.

Citizen Lab also cited prior evidence of Cellebrite-linked surveillance abuse in Russia, Nigeria, Botswana, Myanmar, and Italy. The company has also sold its technology to governments in Belarus, Bangladesh, China, Hong Kong, and Venezuela.

---

Infrastructure at Risk

• Activists and journalists
• Human rights defenders
• Mobile devices seized during detention
• Biometric authentication systems
• Legal systems used to legitimize digital surveillance

The risk does not stem from malware delivery or remote exploitation. It stems from state access combined with commercial-grade forensic tooling.

---

TRJ Verdict

This case illustrates how commercial surveillance tools blur the line between lawful investigation and political repression. Cellebrite did not need to compromise networks or deploy spyware remotely. The state already had physical access. The technology simply transformed custody into total digital exposure.

When cybercrime laws are written broadly and enforced selectively, forensic tools become accelerants — not safeguards. The device is no longer personal property; it becomes a prosecutorial archive.

This is not a vulnerability in iOS or Android alone.
It is a vulnerability in power, custody, and law.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---