Serbia used spyware to hack phones of journalists and activists, Amnesty says

Serbian police and intelligence services have used advanced spyware alongside other digital tools to hack the phones of activists and journalists and illegally surveil them, Amnesty International said in a report published on Monday.

Mobile forensic products made by Israeli firm Cellebrite are being used by authorities in Serbia to extract data from individuals' phones, while new Serbian spyware — dubbed "NoviSpy" by Amnesty — has been developed to covertly infect devices and capture information, according to the report.

The report, based on more than a dozen testimonies of activists and journalists who told Amnesty their phones were hacked in recent months during detention or questioning by police, said NoviSpy was used to unlock phones to capture covert screenshots and copy contact lists, which were then uploaded to a government-controlled server.

"Our investigation reveals how Serbian authorities have deployed surveillance technology and digital repression tactics as instruments of wider state control and repression directed against civil society," said Dinushika Dissanayake, Amnesty International’s deputy regional director for Europe.

In a statement responding to Amnesty's report on Monday, Serbia's intelligence agency BIA said that it "works exclusively in accordance with the laws of the Republic of Serbia".

"Therefore, we are not even able to comment on nonsensical allegations from their (Amnesty) text, just as we do not normally comment on similar content," BIA said. Serbia's police have not publicly commented on the report's findings.

Amnesty also said that Cellebrite's mobile forensic products — which are widely used by police and intelligence services globally to unlock devices and search them for evidence — can pose a risk to activists when "used outside of strict legal control and oversight".

Serbia received Cellebrite technology in 2019 as part of a wider package of aid designed to help the country meet the requirements for integration into the EU, Amnesty said.

One of the individuals named in the report — investigative journalist Slaviša Milanov — told Amnesty he was detained in February after a seemingly routine traffic stop.

After being released, Milanov noticed his phone had been tampered with and contacted Amnesty to ask for help. The NGO discovered that a Cellebrite product had been used to unlock the phone, and NoviSpy had been installed on his phone. Amnesty said forensic evidence indicates that the spyware was installed while Serbian police had the device.

"Two forms of highly invasive technologies were used in combination to target the device of an independent journalist, leaving almost his entire digital life open to the Serbian authorities," Amnesty's report said.

Cellebrite said in a statement that it was investigating the claims made in Amnesty's report.

"We take all allegations seriously of a customer’s potential misuse of our technology," the statement said. "We are prepared to take measures in line with our ethical values and contracts, including termination of Cellebrite’s relationship with any relevant agencies."

The Amnesty report comes as Serbian President Aleksandar Vučić is facing one of the biggest challenges to more than a decade of his increasingly autocratic rule, with widening anti-government protests led by university students and opposition activists that so far have been largely peaceful.

Vučić has accused Western intelligence services, NGOs and foreign media of conducting "hybrid warfare" against him and the country by illegally financing the protests, which started following the collapse of a concrete canopy at a railway station in the country’s north that killed 15 people on 1 November.

Serbia, which is formally seeking EU membership, has been building closer ties with Russia and China, including their spy agencies, in what officials said was a joint action against the so-called "coloured revolutions" — street protests against repressive regimes.