In May 2025, Ahmed Salem walked into the local police station in Campobasso, southern Italy, to claim asylum. It would be his last moment of freedom for years.
The 24-year-old had left his native Al-Baddawi, a crowded Palestinian refugee camp in northern Lebanon in 2022. He then made the deadly sea crossing to Greece. According to letters, media reports and court documents seen by Statewatch, Salem then travelled to Germany and Belgium, in search of papers and work. His hopes of finally finding both in Italy were dashed soon after he entered the police headquarters.
According to investigative files seen by Statewatch, Salem was scrolling through his phone to find a photograph of an old document to show the officers, when one of them noticed some images. The police officer asked Salem to hand over the device. A few days later, national media reported the arrest of a young man in Campobasso over what authorities described as “jihadist propaganda.”
Salem was sent to prison in Rossano Calabro, one of four Italian high-security facilities designated for people accused or convicted of terrorism. Alongside a handful of Palestinian detainees, he found himself in a complex shared with hundreds of men accused or convicted of links to Italian organised crime groups, including affiliates of Calabria’s powerful ’Ndrangheta mafia-type clans.
The judgment came less than a year later: four years in prison for “incitement to commit a serious crime with the intention of terrorism” and “possession of material for the purpose of terrorism.” The second charge relied on a new offence implemented in April 2025 as part of a series of “security decrees” adopted by Giorgia Meloni’s government.
Data was extracted from Salem’s two phones using technology provided by Canada-based Magnet Forensics and Israel-based Cellebrite. The software was central to making the case against him.
A months-long investigation has found that Cellebrite software has been integral part of police investigations into several asylum seekers, a local journalist covering climate action in Germany, and two Northern Irish journalists who uncovered a 1994 Troubles massacre. Some of the phone seizures and data extractions have later been found to be illegal. The findings raise new concerns about the use of Cellebrite tech for invasive profiling and the protection of privacy rights and freedom of speech across Europe.
Right to defence compromised for targeted asylum seeker
The case against Ahmed Salem was built entirely around material found on one of his phones: videos shared on WhatsApp and Telegram, as well as a video selfie posted to his TikTok profile. The transcripts and descriptions of this material, obtained by Statewatch, do not explicitly portray him as a dangerous terrorist plotting to commit violence.
In a video transcript provided to Statewatch by Salem’s lawyer, Salem says in Arabic: “We have witnessed the most horrendous crimes of this occupation: genocide, homicide, torture, humiliation and rape. And not a single Arab, Muslim or human being raised his voice.”
Investigators concluded that “it is evident that, through this video, Salem exhorts the Muslim people — the people of the West Bank, of Palestine — to carry out acts of terrorism against Israel.” The judges likewise wrote that Salem’s videos “incited the Muslim people to react, expressing support for the Palestinian cause, with clear reference to the armed struggle.”
According to Flavio Rossi Albertini, Salem’s lawyer, the right to a defence was compromised during the proceedings. This is because the prosecution did not fully disclose the dates and precise portions of the files it relied on to incriminate his client. Italian law generally requires dates and material to be specified within a search warrant. However, vague wordings in the 2025 security provisions potentially allow for this requirement to be sidestepped.
Crucially, the videos the prosecutors presented do not contain instructions for committing acts of violence, said Rossi Albertini. Rather, they “show frames from sequences of fighting, serving an exclusively propagandistic purpose, to disseminate the message of Palestinian resilience in Gaza.” Some of the footage, he added, has already been reproduced by major European media outlets.
Cellebrite’s phone-extraction systems were central to the investigation into Salem
Italian prosecutors also relied on data extracted by Cellebrite tech in a case against Anan Yaeesh, another Palestinian man accused of terrorism. Alongside footage taken off Yaeesh’s phone, prosecutors used open-source material and the testimony of an Israeli diplomat in Europe. Yaeesh was sentenced to five years and six months in January 2026 for conspiracy with the purpose of terrorism. Two other defendants in the same case were acquitted.
According to Rossi Albertini, who also acts as Yaeesh’s lawyer, data extracted from his devices using Cellebrite technology in Italy were subsequently transferred to Israeli authorities. Israel reportedly requested the data via “mutual legal assistance”, a formal method of cooperation between countries when investigating crimes. Shortly after the request, in November 2023, Israeli forces shot dead four men in Tulkarem in the West Bank – three of them were people Yaeesh had been in contact with, and whose WhatsApp and Telegram messages had been retrieved by investigators.
Italian activists targeted after protesting deportation
In early 2025, before Ahmed Salem’s arrest on terrorism charges, the use of Cellebrite’s Universal Forensic Extraction Device (UFED) surfaced in another case, this time in northern Italy. It concerned three activists from a left-wing movement in Turin, the Assemblea No CPR, a group that campaigns against migrant detention centres, known in Italy as Centri Per il Rimpatrio (CPR).
In March 2024, the three rushed to Malpensa airport, near Milan, to prevent the deportation of a Moroccan activist who had taken part in pro-Palestine solidarity actions. The action was successful: the activists reached the tarmac, ran under the plane, and the pilot decided to let his handcuffed passenger disembark. The activists were stopped and briefly detained on suspicion of interrupting a public service. Their three smartphones were seized.
When prosecutors later asked them to disclose their passcodes, they refused. Eight months later, their phones were returned. “Two of them had their PIN codes written on a piece of paper on the back, and they were behaving strangely,” explained one of the activists, who asked not to be named. A subsequent analysis of the devices showed that they had been subjected to extraction using UFED Premium. Despite a lawyer’s request for an independent expert to be present during the data extraction procedure, it was conducted out of sight, without the three defendants being informed.
Court files viewed by Statewatch show that a judicial order authorised the extraction of WhatsApp chats and files, as well as videos, photos, call logs and Google searches. “From this material, you could understand that we are part of the fight against detention centres and that we were in contact with our comrade who had been detained,” the activist told Statewatch. “We couldn’t understand how much of this information was used for the specific case, and how much of it was used for broader profiling of our political activities and network.”
Legal proceedings are still ongoing, with the first hearing scheduled for January 2027.
Two activists from the same group also had their phones seized in July 2025. This time, they were accused of taking part in a nighttime action to deface the local headquarters of Fratelli d’Italia, the ruling party led by Giorgia Meloni. In this case too, an independent analysis by experts from Osservatorio Nessuno, an Italian nonprofit, revealed traces of Cellebrite’s activity on their devices.
German journalist’s phone ‘illegally’ tapped
In early September 2023, journalist Hendrik Torner took to the streets of Bamberg, in northern Bavaria. For months, local climate activists had shaken the usually quiet atmosphere of the UNESCO World Heritage-listed city centre. During the protests, they briefly occupied its medieval cathedral to protest state inaction over the climate crisis. Torner, who had recently graduated, was covering the mobilisations for a local trade union newspaper. As the day’s protests were winding down, he documented tensions between protesters and plainclothes police officers, recording audio on Signal, the secure messaging platform he used for most of his professional exchanges.
Officers subsequently seized his phone and initiated legal proceedings, alleging that he had violated the confidentiality of a private conversation, a criminal offence under German law. Torner relied on his phone as an essential work tool, said Gül Pınar, Torner’s lawyer – yet police did not return the device for more than 11 months. According to Pınar’s reconstruction and analysis by IT researchers at Reporters Sans Frontières, prosecutors used Cellebrite’s UFED tool to access messages on multiple platforms, from Signal to Instagram and Telegram. They also recorded newsletter subscriptions and memberships in chat groups and accessed personal photographs and communications with family members and journalistic sources.
A regional court found that the prolonged seizure of Torner’s phone had been unlawful, as no criminal offence was ultimately brought against him. In June 2025, Torner and his lawyers decided to take the case to Germany’s Federal Constitutional Court. They argued that the police had violated key constitutional protections, including freedom of the press, freedom of expression, freedom of action, the right to be heard in legal proceedings, and the right to confidential interpersonal communication. The case is still pending and may take years to resolve.
Torner told Statewatch: “Thanks to data stored on my phone and illegally analysed, the police created a full political profile of me, significantly violating my privacy.” After the experience, he says he no longer feels safe when covering political gatherings. “Because of the police, I wonder if a journalist in Germany can still trust that sensitive information will remain sensitive.”
In their submission to the Constitutional Court, Torner’s lawyers stated that his personal and professional data were likely still stored in a local police system. Statewatch contacted the Upper Franconia regional police force about this issue, as well as its data collection and retention practices. In their response, a spokesperson for the force said:
“Due to the technical requirements involved in securing evidence, digital forensics regularly requires storage media to be captured in their entirety as part of a complete acquisition, in order to ensure the integrity of the data without gaps… The protection of privacy and adherence to the principle of proportionality form the basis of all police activities, including the analysis of digital data storage media.”
Northern Irish journalists’ equipment ‘illegally’ seized
Torner is far from being the only European journalist whose devices were accessed using Cellebrite’s systems. In 2018, Northern Irish journalists and filmmakers Barry McCaffrey and Trevor Birney had their devices seized and their homes searched in connection with a documentary they had released the previous year about a 1994 Troubles massacre. A leaked document they had obtained for the documentary cast a shadow over the conduct of members of the Police Service of Northern Ireland. The police investigation was dropped less than a year later, after the High Court ruled that the warrants obtained were unlawful because they interfered with the protection of journalistic sources. Only in 2025 did an independent review confirm that police had used Cellebrite to examine material from McCaffrey’s seized equipment.
The review also found that a copy of data extracted from the journalists’ devices was still held on a Police Cyber Crime Centre system, despite a 2020 legal settlement for the case that required the agency to delete the material. It concluded that “the [phone] examination, including the software used, was unjustifiable, not because of the features of the software, but because of the illegality of the seizure of equipment belonging to journalists.”
The Police Service of Northern Ireland told Statewatch it “accepted all of the Review recommendations and work is ongoing to address those findings.” They added that “proactive steps were taken to quarantine and preserve the data and the material was subsequently deleted in line with the High Court Undertaking.” When it comes to current and past use of Cellebrite’s licenses, despite the review findings, the police said they “can neither confirm nor deny the use of such technology.”
Statewatch put the findings of this investigation to Cellebrite, who responded by saying that its technology “supports millions of lawful investigations annually, helping agencies investigate and prevent human trafficking, child exploitation, opioid and fentanyl distribution, financial crimes and scams targeting vulnerable populations, homicide, terrorism and other serious threats to public safety.”
“Given that context,” the company continued, “we are disappointed when media outlets and organisations choose to focus only on alleged misuse of our technology, often without facts and documentation that back up the claims. A balanced assessment of Cellebrite would account for the substantial public safety benefits our technology enables around the world.” They added:
“We take seriously all allegations of potential misuse and take immediate steps to investigate. If a violation is confirmed, we immediately terminate all licenses and support of our products with the relevant parties… The Ethics and Integrity Commitee provides Board-level oversight and guidance to the company regarding the ethical development, sale and use of Cellebrite’s technology… We regularly track and review countries against indices that score democratisation, human rights, rule of law and more.”
The company, however, did not respond to questions about its footprint in Europe, or address the cases documented in this investigation. It also didn’t refer to other instances of alleged misuse, its due diligence mechanisms, and the functioning of its Ethics & Integrity Committee. Cellebrite added in their reply that the committee “provides Board-level oversight and guidance to the Company regarding the ethical development, sale and use of Cellebrite’s technology.”
This article was produced with support from the Bertha Challenge Fellowship.
