# Cellebrite DI Ltd. Form 20-F (FY2022) — encryption-control regime vs. Wassenaar, and the Hong Kong UFED petition > *Cellebrite's FY2022 SEC annual report, which sets out the historical baseline for the Cellebrite cell more fully than later filings: it explains the key legal distinction that cryptography subject to Israeli encryption-control law is carved out of (i.e., NOT regulated under) the ordinary Israeli dual-use export-control regime, and is instead governed by Israel's separate encryption-control regime; it identifies the candidate statutes (Defense Export Control Law 5767-2007; Import and Export Order (Dual Use) 5766-2006); and it discloses the August 2020 Tel Aviv District Court petition that sought to use the Defense Export Control Law to halt UFED exports to Hong Kong police. Directly relevant to the Arkansas investigation because it documents — from Cellebrite's own sworn filing — both how the regulatory regime is structured and how that regime has been litigated against the exact product (UFED) deployed by Arkansas agencies.* ## Source metadata - **Publisher:** Cellebrite DI Ltd. (Nasdaq: CLBT), Form 20-F FY2022, U.S. SEC EDGAR - **URL:** https://www.sec.gov/Archives/edgar/data/1854587/000162828023013355/cele-20221231.htm - **Archived:** 2026-06-07 via curl with declared User-Agent (SEC fair-access), HTML parsed to text - **Tier:** 2 (primary/official — audited corporate filing under U.S. securities law) ## Extract — verbatim (lightly cleaned) ### "Sanctions and Export Controls" (Regulations) "We are subject to Israeli regulations controlling the export of encryption technology. The Wassenaar Arrangement is a multilateral export control regime with 42 participating states. Although Israel is not a party to the Wassenaar Arrangement, it has adopted the Wassenaar Arrangement List of Dual Use Goods and Technologies and the goods and technologies listed therein are subject to Israeli export control laws and regulations. However, cryptography that is subject to Israeli encryption control laws is not regulated under the Israeli export control regime, even where its capabilities would otherwise place such cryptography within Part 2 of Chapter 5 of the Wassenaar Arrangement Dual Use List which relates to Information Security. Israeli law instead subjects such cryptography goods and technologies to its own encryption control regime, which includes export restrictions. Certain of our products are therefore currently subject to the Israeli encryption control regime and not to the Israeli export control laws vis-a-vis the Wassenaar Arrangement." "Our export license under the Israeli encryption control regime prohibit us from exporting our controlled products to customers in certain countries and require us to obtain the consent of the Ministry of Defense to export controlled products to customers in certain other countries. We understand that these restrictions are based, among other things, on both considerations of national security and the Israeli government's assessment of the human rights record of the country in question." ### Pending reform toward Wassenaar dual-use classification "In 2016, the Israeli Ministry of Defense published draft regulations proposing to cancel the existing encryption control regime and to bring Part 2 of Chapter 5 of the Wassenaar Arrangement into full force and effect in its place. In recent months, this effort was renewed and the regulator stated publicly its intention to advance this reform imminently. Section 5A(4)(b) of Part 2 of Chapter 5 of the Wassenaar Arrangement Dual Use List includes a new provision which (while not specifically stating) appears to apply to digital forensic technologies. If the reform will take place and the revised laws and regulations will come into effect, our solutions will become subject to the Wassenaar Arrangement dual use list as adopted by the State of Israel, and will likely be controlled under the Israeli Defense Export Control Law, 5767-2007 or the Import and Export Order (Export Control over Dual Use Goods, Services and Technology), 5766-2006, depending on the nature of the customer." "For example, under the Defense Export Control Law, an Israeli company may not conduct 'defense marketing activity' without a defense marketing license from the Israeli Ministry of Defense and, subject to certain marketing license exceptions, is subject to a licensing requirement from the Israeli Ministry of Defense for any export of controlled defense goods, services and/or know-how. The definition of defense marketing activity is broad and includes any marketing of 'defense equipment, services and/or know-how' outside of Israel or to a non-Israeli (including within Israel) regarding controlled dual-use equipment, services and/or know-how." ### The Hong Kong UFED Defense-Export-Control-Law petition "For example, in August 2020, a group of 61 petitioners, including a number of human rights activists, filed a petition before the District Court in Tel Aviv against various Israeli government entities and Cellebrite. The petition asked the District Court to exercise its power under the Defense Export Control Law to stop the exportation of our UFED solution to police forces in Hong Kong. Activists alleged that UFED was being used against pro-democracy protestors in Hong Kong and that this was resulting in human rights abuses. We have since adopted policies and procedures intended to prevent sales to customers in China and Hong Kong and have proactively stopped selling to Russia, Belarus and several other countries..." ### Note on partial coverage "Currently, some of our solutions are not subject to any export control laws." (Cellebrite's own statement that the regime reaches only some, not all, of its product line — useful caveat against over-claiming blanket coverage.)