Serbia used spyware to hack phones of journalists

Less than a week after the publication of our joint appeal to the EU to take urgent EU-wide measures, such as stricter regulation of spyware exports and use, new spyware abuse scandal erupts in Serbia: Serbian intelligence services and police have used spyware and other digital tools to hack the phones of journalists and illegally surveil them, Amnesty International said in a report published on Monday.

According to this very documented report, mobile forensic products made by Israeli firm Cellebrite are being used by authorities in Serbia to extract data from journalists and activists’ phones, while new Serbian spyware “NoviSpy” has been developed to infect devices and capture information.

Amnesty International collected a dozen testimonies of activists and journalists, including investigative journalist Slaviša Milanov, whose phones have been hacked in recent months during questioning by Serbian police. NoviSpy was used to unlock their phones to capture covert screenshots and copy contact lists, which were then uploaded to a government-controlled server.

According to Amnesty International, Serbia received Cellebrite technology, which is widely used by police and intelligence services globally to unlock devices and search them for evidence, in 2019 as part of a package of aid designed to help the country meet the requirements for integration into the EU.

“This demonstrates the responsibility of the EU, which cannot continue to turn a blind eye to illicit state spying by its own Member States and candidate countries,” said EFJ General Secretary Ricardo Gutiérrez. It is time to take strong measures, starting with placing a ban on the use of commercial spyware by all governmental agencies and imposing sanctions on vendors”.

“Amnesty’s investigation reveals how Serbian authorities have deployed illicit surveillance technology as instruments of repression directed against journalists and civil society,” said EFJ President Maja Sever. “As established by the European Parliament in June 2023, the use of spyware by law enforcement should only be authorised in exceptional cases for a pre-defined purpose and a limited time. And data belonging to journalists should be shielded from surveillance, unless there is evidence of criminal activity. Investigations must be carried out to condemn the misuse of spyware. And laws must be passed to strictly limit their legitimate use”.