Recent reports 1 have brought to light alarming allegations of surveillance of Serbian journalists by the Security Information Agency (BIA). This in-depth report delves into the issue, examining the evidence, the legal framework, and the implications for press freedom in Serbia, which has seen a worrying decline in its global press freedom ranking in recent years 2.
Reports from Human Rights Organizations and Press Freedom Groups
Several reputable organizations have raised concerns about the surveillance of Serbian journalists by the BIA. Amnesty International, in its December 2024 report „A Digital Prison: Surveillance and the Suppression of Civil Society in Serbia,“ revealed that Serbian authorities have been using spyware and mobile phone forensic tools to target journalists, activists, and others 1. The report highlights the use of Cellebrite’s UFED products to extract data from mobile devices and the deployment of NoviSpy, a previously unknown custom-made spyware designed for Android phones, to infect devices and capture confidential information 3.
The Media Freedom Rapid Response (MFRR), a consortium of press freedom organizations, also expressed serious concerns about these findings and called for a thorough investigation 4. They emphasized the need for Serbia to strengthen protections for journalists’ freedom of expression, privacy, and sources, as guaranteed under international human rights law 4.
Specific Cases of Surveillance
Amnesty International’s report documents specific cases of surveillance, including that of independent journalist Slaviša Milanov. In February 2024, Milanov was arrested under the pretext of a DUI test, and his Android phone was confiscated when he was initially detained. While the phone was turned off when he surrendered it to the police, NoviSpy was later installed on it without his knowledge or consent 1. Forensic evidence confirmed the use of Cellebrite’s UFED product to unlock his phone and enable the spyware infection 1. This case highlights the deceptive tactics employed by the authorities to gain access to journalists’ devices.
In another case, activists’ testimonies revealed that after meetings with the BIA, their phone contacts had been exported, and digital forensic experts discovered that NoviSpy had exported their contacts and sent private photos from their devices to a BIA-controlled server 5. This illustrates the intrusive nature of the spyware and its ability to collect sensitive personal information without the user’s knowledge.
Furthermore, an activist from Krokodil, an organization promoting dialogue in the Western Balkans, had their phone infected with NoviSpy during an interview with BIA officials in October 2024 1. Amnesty International’s forensic investigation recovered surveillance data captured by the spyware, including screenshots of emails, Signal and WhatsApp messages, and social media activity 6.
Exploits and Tools Used for Surveillance
The surveillance campaign against Serbian journalists and activists involved a combination of sophisticated tools and deceptive tactics. Here’s a closer look at the exploits and tools used:
Cellebrite UFED: This is a suite of mobile forensic tools used by law enforcement agencies worldwide to extract data from mobile devices. In the Serbian cases, Cellebrite’s UFED was reportedly used to bypass Android device security mechanisms and unlock phones, even without access to the passcode 3. This allowed the authorities to covertly install NoviSpy spyware during police interviews or while individuals were in detention 18.
NoviSpy: This is a custom-made Android spyware, previously unknown to security researchers, that was deployed by the Serbian police and the BIA 3. While less sophisticated than commercial spyware like Pegasus, NoviSpy still provides extensive surveillance capabilities 18. It can capture sensitive personal data, including screenshots, contact lists, and private photos, and can even activate a phone’s microphone or camera remotely 19.
Zero-Day Exploit: Amnesty International’s investigation uncovered evidence that a zero-day exploit in Android was used to facilitate the installation of NoviSpy 20. This type of exploit takes advantage of a previously unknown vulnerability in the operating system, making it particularly difficult to detect and defend against.
Deceptive Tactics: The Serbian authorities employed deceptive tactics to gain access to individuals’ devices and install the spyware. In some cases, phones were confiscated under false pretenses, such as during a DUI test, or while individuals were attending informational interviews with the police or BIA 1. This highlights the authorities’ deliberate efforts to conceal their surveillance activities.
Legal Framework for Surveillance in Serbia
Serbia’s legal framework for surveillance raises concerns about its adequacy in safeguarding journalists’ rights. Laws such as the Criminal Procedure Code, the Police Act, and the Electronic Communication Act authorize surveillance for law enforcement purposes, but the extent to which these laws protect journalists’ sources and communications remains unclear 7. This lack of clarity creates a legal gray area that can be exploited to justify surveillance of journalists.
Adding to these concerns, journalists in Serbia face various pressures, including institutional pressures, economic pressures, targeting, smear campaigns, verbal threats, and SLAPPs (Strategic Lawsuits Against Public Participation) 8. These pressures, combined with the potential for surveillance, create a hostile environment for journalists and can lead to self-censorship.
The 2023 EU Recommendation on the investigation of spyware use emphasizes that such surveillance should only be authorized in exceptional cases, for a predefined purpose, and for a limited time 9. It also stresses the need to protect journalists’ data unless there is evidence of criminal activity 9. However, it is unclear whether Serbia’s legal framework fully aligns with these recommendations, raising questions about the country’s commitment to protecting press freedom.
Safeguards for Journalists under Serbian Law
While Serbia has legal provisions aimed at protecting journalists, their effectiveness in preventing surveillance abuses is questionable. The Serbian Code of Journalists emphasizes the importance of resisting pressure and censorship, protecting sources, and ensuring accurate and unbiased reporting 10. However, these principles are not always upheld in practice, and journalists often face obstacles in exercising their profession freely.
Furthermore, the legal framework for protecting journalists from violence and harassment appears to be insufficient. Although the law prohibits threats and pressure against journalists, attacks and intimidation continue to occur 11. This suggests a gap between legal provisions and their enforcement, leaving journalists vulnerable to various forms of pressure and intimidation.
BIA’s Mandate and Powers
The BIA, Serbia’s Security Information Agency, is responsible for national security, counterintelligence, and counterterrorism 12. Its mandate may include surveillance activities to fulfill these responsibilities; however, it is crucial to ensure that these powers are not used to suppress freedom of expression or target journalists for their work 12.
The lack of transparency surrounding the BIA’s operations and the absence of robust oversight mechanisms raise concerns about the potential for abuse of power and violations of journalists’ rights 13. This lack of accountability allows for potential overreach and undermines the public’s trust in the agency.
Serbian Government’s Response and International Condemnation
The Serbian government’s response to the allegations of surveillance has been limited. While the BIA has dismissed the Amnesty International report as sensationalism, it has not provided a detailed rebuttal or addressed the specific concerns raised 14. This dismissive response further fuels concerns about the extent of surveillance and its impact on press freedom in Serbia.
However, civil society organizations and the international community have condemned the surveillance. The Belgrade Center for Security Policy strongly condemned the misuse of digital technologies for surveillance and demanded an immediate, transparent, and independent investigation into the allegations, as well as the prosecution of those responsible within the police and the Security Information Agency 15.
International organizations like Amnesty International have called on the Serbian authorities to cease the unlawful targeting of journalists and activists 6. The European Union, which Serbia aspires to join, has also expressed concerns about the situation 17. Norway’s Deputy Minister of Foreign Affairs expressed alarm over the report and stated that Norway will be meeting with Serbian authorities and UNOPS to gather more information 17. This international pressure is crucial in holding the Serbian authorities accountable and ensuring the protection of journalists’ rights.
It is particularly concerning that Serbia received phone-cracking devices from Cellebrite as part of EU assistance aimed at helping the country meet the requirements for integration into the European Union 5. This raises questions about Serbia’s commitment to EU values and the effectiveness of the EU’s assistance programs.
Synthesis and Conclusion
The surveillance of Serbian journalists by the BIA raises serious concerns about the state of press freedom and democratic values in the country. The use of spyware and mobile phone forensic tools to target journalists, activists, and others is a clear violation of their right to privacy and freedom of expression. This practice not only undermines individual rights but also has a chilling effect on investigative journalism and the public’s right to information. Journalists, fearing surveillance and reprisals, may self-censor, leading to a less informed public and a weaker democracy.
The lack of transparency surrounding the BIA’s operations, the inadequate legal safeguards for journalists, and the limited response from the Serbian government further exacerbate the problem. This lack of accountability allows for potential abuse of power and undermines public trust in state institutions.
International condemnation and pressure from organizations like Amnesty International and the European Union are crucial in holding the Serbian authorities accountable and ensuring the protection of journalists’ rights. The Serbian government must take immediate and decisive action to address these concerns, including:
- Conducting a thorough and independent investigation into the allegations of surveillance.
- Strengthening legal safeguards for journalists’ sources and communications.
- Ensuring transparency and accountability in the BIA’s operations.
- Ceasing the unlawful targeting of journalists and activists.
Failure to do so will have serious implications for press freedom, democracy, and civil society in Serbia. Unchecked surveillance can contribute to a climate of fear and intimidation, ultimately eroding democratic values and hindering the country’s progress towards EU integration.
The international community must continue to monitor the situation in Serbia and exert pressure on the government to uphold its human rights obligations. Protecting journalists and ensuring press freedom are essential for a functioning democracy and a just society.
Works cited
- Serbia: Authorities using spyware and Cellebrite forensic extraction tools to hack journalists and activists – Amnesty International, accessed December 19, 2024, https://www.amnesty.org/en/latest/news/2024/12/serbia-authorities-using-spyware-and-cellebrite-forensic-extraction-tools-to-hack-journalists-and-activists/
- Media Freedom – Balkanmedia – Konrad-Adenauer-Stiftung, accessed December 19, 2024, https://www.kas.de/en/web/balkanmedia/media-freedom9
- Amnesty Accuses Serbia of Tracking Activists with Spyware – Infosecurity Magazine, accessed December 19, 2024, https://www.infosecurity-magazine.com/news/amnesty-accuses-serbia-spyware/
- Urgent need for a swift and thorough investigation into intelligence …, accessed December 19, 2024, https://ipi.media/rgent-need-for-a-swift-and-thorough-investigation-into-intelligence-and-police-invasive-surveillance-of-journalists-and-sources/
- Serbia used Israeli firm’s tech to spy on journalists: Amnesty, accessed December 19, 2024, https://www.newarab.com/news/serbia-used-israeli-firms-tech-spy-journalists-amnesty
- Serbia: ‘A Digital Prison’ – Authorities using spyware to unlawfully hack journalists and activists – Amnesty International, accessed December 19, 2024, https://www.amnesty.org.uk/press-releases/serbia-digital-prison-authorities-using-spyware-unlawfully-hack-journalists-and
- Data Protection & Privacy 2024 – Serbia – Global Practice Guides, accessed December 19, 2024, https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2024/serbia/trends-and-developments
- Threats to the Safety of Journalists in Serbia: New Report – Freedom …, accessed December 19, 2024, https://www.coe.int/en/web/freedom-expression/-/threats-to-the-safety-of-journalists-in-serbia-new-report
- Serbia: Investigate surveillance of journalists and sources now …, accessed December 19, 2024, https://www.article19.org/resources/serbia-investigate-surveillance-of-journalists-and-sources-now/
- Serbian Journalists’ Code of Ethics – Press Council, accessed December 19, 2024, https://savetzastampu.rs/en/documents/kodeks-novinara-srbije/
- Serbia – United States Department of State, accessed December 19, 2024, https://www.state.gov/reports/2023-country-reports-on-human-rights-practices/serbia/
- BIA/BIE | U.S. Department of the Interior, accessed December 19, 2024, https://www.doi.gov/ocl/biabie
- Bureau of Indian Affairs – Wikipedia, accessed December 19, 2024, https://en.wikipedia.org/wiki/Bureau_of_Indian_Affairs
- Serbian police use mobile phone spyware to keep track of …, accessed December 19, 2024, https://apnews.com/d35744f1fb9282aed8618934748dc93b
- Serbia has been illegally spying on political opponents and …, accessed December 19, 2024, https://halifax.citynews.ca/2024/12/16/serbia-has-been-illegally-spying-on-political-opponents-and-journalists-amnesty-says-2/
- Serbian police use mobile phone spyware to keep track of …, accessed December 19, 2024, https://www.mrt.com/news/world/article/serbia-has-been-illegally-spying-on-political-19983312.php
- Serbia spied on journalists: report – Taipei Times, accessed December 19, 2024, https://www.taipeitimes.com/News/world/archives/2024/12/17/2003828648
- Amnesty International: Serbian authorities have deployed surveillance technology against journalists and activists – European Western Balkans, accessed December 19, 2024, https://europeanwesternbalkans.com/2024/12/16/amnesty-international-serbian-authorities-have-deployed-surveillance-technology-against-journalists-and-activists/
- Amnesty International exposes Serbian police’s use of spyware on journalists, activists, accessed December 19, 2024, https://cyberscoop.com/amnesty-international-exposes-serbian-polices-use-of-spyware-on-journalists-activists/
- “A Digital Prison”: Surveillance and the suppression of civil society in Serbia, accessed December 19, 2024, https://securitylab.amnesty.org/latest/2024/12/a-digital-prison-surveillance-and-the-suppression-of-civil-society-in-serbia/
English 
Serbian