After publicly calling for the release of the Kazakh rights movement Atazhurt, Bagdat Togysbayev was detained for five days by police. But what struck him as odd wasn't being behind bars, it was how his phone worked afterward.
The activist from the Tolebi district in the Turkistan Region, known for criticizing the government on social media, was forced to leave his phone -- a Xiaomi Redmi Note 10 smartphone -- with the authorities while in detention.
When he returned home, Togysbayev noticed something troubling. An automated call his phone makes when it is initiated went out to his younger sister.
"When I learned this, I immediately thought, 'they opened my phone.' Otherwise, my phone was locked and set to 'airplane' mode," he told RFE/RL's Kazakh Service, known locally as Radio Azattyq.
"A few days later, I returned home, I opened my phone and accessed the 2gis map. I found they had enabled the function that shows my location to others. They had set it up so that information would be automatically broadcast whenever I connected to the Internet," Togysbaev said.
Since then, he has taken precautions, often leaving his smartphone at home for days or weeks and turning it on only briefly. Kazakh authorities did not comment on the claims made by Togysbayev in response to a request from Azattyq, but his suspicions appear to be well founded.
An investigation by Radio Azattyq confirms that Kazakh authorities possess tools capable of bypassing passwords on smartphones and laptops.
Among them is UFED, an Israeli-made forensic system produced by Cellebrite, capable of retrieving messages, photos, browser histories, and even deleted data. UFED is used legally in many countries, but only by law enforcement and with judicial approval. It can only be used if authorities have physical access to the device.
Azattyq reviewed import-export data showing how UFED systems reached Kazakhstan.
The devices were purchased from Georgian Digital Forensics, which presents itself as a regional representative of Cellebrite. Two Kazakh companies, AskomMET and IRPLAB, imported UFED systems from Georgia three times in 2022–2023, according to Azattyq’s analysis of some ImportGenius records.
This pathway is further confirmed by a February 13, 2025, email seen by Azattyq, sent by Albert Avraham Katsir, a Cellebrite sales executive, to Giorgi Akhalaia, an official at Georgia’s Ministry of Internal Affairs.
In the email, Katsir writes: “From the entire Caucasus region, Georgia is the only country where we can sell our solutions. Unfortunately, for the first time, I express my concern that at any time this year Georgia could be blocked from selling our equipment.”
The email, publicly available on Georgia’s state procurement portal, does not specify the source of Katsir’s concerns.
Cellebrite presents itself as a provider of digital forensic tools strictly for lawful use.
According to the company, its Digital Intelligence solutions are designed for post-event investigations rather than preemptive surveillance, governed by strict licensing policies.
Cellebrite asserts that it vets customers based on human rights records and can disable access to its technology for violations, emphasizing that it positions itself as a partner to law enforcement within legal and ethical frameworks.
In March 2021, Cellebrite officially announced that it would stop selling its Digital Intelligence solutions and services to clients in the Russian Federation and Belarus, citing the need to operate according to internationally accepted rules and regulations.
However, even though the company claims it checks out its customers ahead of time, its technology can still be used in ways that raise legal and ethical concerns depending on local practices.
Concerns Over Forensic Phone Access
The Kazakh Justice Ministry Court Expertise Center confirmed to Azattyq that UFED and similar forensic software are used in practice alongside other systems such as MD-RED and MD-NEXT.
"It is regulated by the Criminal Procedure Code. Several articles address this. A person’s smartphone contains private information," parliament deputy Abzal Kuspan, who's also a lawyer, told Azattyq in an interview.
"If it needs to be opened, it should only be done with the authorization of the investigative court. Each step -- searching, seizing, opening -- requires separate protocols filled out by investigators, prosecutors, or other procedural persons."
Lawyer Bauyrzhan Azanov said that even with legal safeguards and oversight in digital investigations, there's little trust in the ability of authorities to stick to the rules.
"During covert investigations, we cannot know what data the investigator accesses or what purpose they have," he said. "Court oversight exists, but our confidence in it is limited. People’s constitutional, civil, and political rights exist on paper, but only the court can verify if they are respected."
Azattyq reporting also notes that in practice, many detainees provide authorities access to their phones under pressure, though law enforcement may later claim that access was voluntary.
“During the trial, if you ask the state prosecutor and investigators why they opened and searched the phone, they say the person gave the password themselves," Azanov said. "They say we did not force or pressure them. What can you do about that? That is the issue. Unlocking the phone or not unlocking it is the person’s own right."
Activists And Journalists Under Siege
Kazakhstan has also deployed other surveillance software against activists and journalists.
Amnesty International’s Security Lab confirmed that at least four Kazakh civil society activists had their mobile devices infected with NSO Group’s Pegasus spyware, targeting them from as early as June 2021. Marie Struthers, Amnesty International’s Director for Eastern Europe and Central Asia, said this case "adds to an already mounting pile of evidence that NSO’s spyware is the weapon of choice for governments seeking to silence social movements and crush dissent."
"States across the globe must immediately implement a moratorium on the export, sale, and use of surveillance equipment until a human rights-compliant regulatory framework is in place," she added.
Kazakh authorities’ investments in and use of advanced digital forensic and surveillance tools, including UFED systems and other commercially available software, come at a time when authorities have increased detentions and administrative actions against political activists and journalists in the lead-up to Kazakhstan’s constitutional referendum on March 15.
Several independent reporters were briefly detained at polling stations, journalists Saniya Toiken and Maqpal Muqanqyzy faced fines or other restrictions related to their coverage of the referendum.
Journalists Botagoz Omarova, Gulnara Bazhkenova are under house arrest for allegedly spreading false information. Anti-corruption activist Orazaly Yerzhanov was placed in pre-trial detention on March 5 on charges of "obstruction of electoral rights" after publicly calling for a boycott of the referendum.
