MUP and BIA illegally hacking phones of activists and journalists

Proven use of spyware and forensic tools contrary to law

The use of spyware represents a serious attack on human rights, freedom of expression and privacy of citizens. In Serbia its use is becoming a common practice. A new report by Amnesty International indicates widespread use of spyware against activists, journalists and members of civil society by the police and the Security Information Agency (BIA) in Serbia. The confirmed cases of Nikola Ristić from the group “SviĆe”, activist from the initiative “Marš sa Drine” Ivan Bjelić, journalist from Dimitrovgrad Slaviša Milanov, environmental activist Ivan Milosavljević Buki, and an activist from the organisation “Krokodil” were singled out.

Experts in digital forensics analysed the devices of Serbian citizens directly affected by the use of intrusive technologies and reliably determined that the police and BIA routinely used a new type of spyware that Amnesty International calls NoviSpy, along with the abuse of a highly sophisticated digital forensics tool from the Israeli company Cellebrite. The report states that the Ministry of Foreign Affairs of Norway donated this digital forensics tool to the Ministry of Interior of Serbia through the mediation of the United Nations Office for Project Services (UNOPS).

Members of civil society were infected with spyware during informational interviews when their devices were confiscated or out of their reach. After the police and BIA took the phone, they used Cellebrite to forcibly unlock the device and download data from it, and then install the NoviSpy spyware through direct access. According to Amnesty’s findings, NoviSpy can take screenshots and send them from the phone to the BIA server, but also obtain permissions to access the location, microphone and camera.

According to the Criminal Code, possession, distribution and use of spyware, as a type of computer virus, is a criminal offence. Also, any unauthorised access to protected devices and data is criminalised. Finally, although certain laws allow the application of special evidentiary actions and special measures of surveillance and data processing in exceptional cases, spyware with its intrusive and non-selective nature exceeds the limits of the legal principles of necessity, proportionality, protection of personal data and protection of privacy. Therefore, the indiscriminate nature of the use of spyware means that not only the data of the targeted person is processed, but also the data of all other persons on the device.

The increasingly widespread use of spyware is happening in parallel with the deterioration of democracy and rule of law in Serbia. In the past several years, citizens expressed their dissatisfaction in numerous protests against the government, which caused increased repression against activists, journalists, members of civil society and the opposition, and one of the most common tactics of intimidation were arrests and detentions due to unfounded accusations, e.g. for the violent overthrow of the constitutional order, after which the accused would be released.

There have been previous indications of spyware use in Serbia, with the most recent case occurring in late 2023, when an attempt to remotely infect the phones of civil society representatives raised suspicions that state authorities are using Pegasus and other spyware to target activists. The authors of the Amnesty report also recalled the revelations that indicated that there are servers in Serbia connected to the Predator spyware, which was originally developed in North Macedonia and is now a product of the Intellexa group. Predator was used to target journalists and politicians in Greece, the President of the European Parliament, the President of Taiwan and numerous activists around the world.

Amnesty International’s report provides strong evidence of the illegal use of sophisticated technologies to spy on journalists, activists and citizens. SHARE Foundation calls for the urgent declaration of spyware as an illegal technology that violates basic human rights and calls on government authorities to stop these practices without delay. It is necessary to urgently initiate the appropriate procedures for the implementation of internal control and determine criminal responsibility for a serious breach of official duty and a significant abuse of power.