Serbia's secret service and police have been accused of illicitly spying on journalists and opposition activists through software installed on their mobile phones, according to Amnesty International's recent findings. The human rights watchdog detailed instances where spyware was utilized to gain unauthorized access to devices, allowing the capture of screenshots, contact lists, and personal data uploaded to government-controlled servers.
The report, which includes testimonies from victims claiming their phones were hacked during police interrogations, states, "Our investigation reveals how Serbian authorities have deployed surveillance technology and digital repression tactics as instruments of wider state control and repression directed against civil society," said Dinushika Dissanayake, Amnesty's Europe deputy director.
Serbian authorities, including the police and the Security Information Agency (BIA), have denied these accusations. The police called the report "absolutely incorrect" and argued, “The forensic tool is used in the same way by other police forces globally.” Meanwhile, the BIA stated, “Therefore, we are not even able to comment on nonsensical allegations from their text.”
The revelations come against the backdrop of increased civil unrest following the tragic collapse of a rail station canopy last month, which led to 15 fatalities. Many protestors attribute the disaster to systemic corruption and negligence among state officials. President Aleksandar Vucic has countered criticism by asserting, “hybrid warfare” from Western intelligence services, NGOs, and foreign media as responsible for the protests.
Analyses show the Serbian authorities employed advanced surveillance tools, including Cellebrite products and NoviSpy spyware. Cellebrite's technology can extract sensitive data from mobile devices without needing the devices’ passwords, posing significant risks to human rights defenders.
According to Amnesty, NoviSpy can capture sensitive personal data by remotely activating the microphone and camera of infected devices. Reports indicate its deployment during police interrogations, creating alarming concerns over privacy violations.
Both the allegations of illicit surveillance and subsequent denials have sparked outrage from numerous civil society organizations. The Belgrade Centre for Security Policy emphatically condemned the tactics used by authorities, proclaiming, “These practices represent a direct attack on fundamental freedoms, including the right to peaceful assembly, freedom of expression and the right of association.”
This outcry is compounded by international scrutiny, particularly from Norway, which previously funded the procurement of surveillance equipment. Norwegian Deputy Foreign Minister Maria Varteressian remarked, "The situation mentioned in this report is very worrying and, if proven true, unacceptable. We will meet with Serbian authorities and UNOPS later this month to get more information on the matter.”
Remarkably, Amnesty revealed instances where specific activists noticed suspicious activities on their phones post-police encounters, driving home the concerns about state-sponsored digital espionage.
While seeking to address these startling developments, Google preemptively notified potential targets of "government-backed attacks" as highlighted by the report. The tech giant also intervened by removing the NoviSpy spyware from affected Android devices.
Cellebrite, on its part, has initiated inquiries following the report's release and expressed willingness to sever ties with agencies involved if the allegations prove valid. David Gee, the firm’s Head of Marketing, stated, "If this accusation is proven true, it has the potential to violate our final user license agreement." He emphasized, “Installing surveillance software on devices was not part of what we did.”
With growing concerns over digital privacy, the report brings to light the need for stringent regulations governing the use of surveillance technologies imaginable human rights breaches. Amnesty International has urged global stakeholders to reassess the role of surveillance equipment like Cellebrite and prevent potential violations of individual rights.
