Serbian Police Allegedly Deploy Spyware Against Journalists And Activists

Serbian police and intelligence agencies have been accused of using advanced spyware and mobile forensic tools to unlawfully surveil journalists, activists, and civil society members, according to a new report by Amnesty International.

The report, “A Digital Prison: Surveillance and the Suppression of Civil Society in Serbia,” reveals troubling evidence of state-backed surveillance tactics undermining free speech and human rights in the country.

Amnesty International’s findings expose how Serbian authorities employed forensic tools developed by Israeli company Cellebrite to unlock and extract data from activists’ and journalists’ mobile phones.

Furthermore, Serbian security agencies reportedly deployed NoviSpy, a previously unknown Android spyware, to infect devices covertly during police detentions or interrogations.

Cellebrite’s forensic tools, widely used by law enforcement worldwide, enable the extraction of data from locked devices, bypassing security protocols even on newer smartphones.

NoviSpy, though less sophisticated than commercial spyware like Pegasus, grants authorities extensive surveillance capabilities, including access to personal data and the ability to activate a device’s microphone or camera.

The report cites forensic evidence linking Serbian authorities to spyware infections during detentions. In one case, investigative journalist Slaviša Milanov’s Android phone was reportedly unlocked while in police custody under the pretext of a sobriety test.

Milanov recounted to 404 Media that in February, he and Petar Videnov, editor-in-chief of FAR, were driving to Pirot in southeastern Serbia when, around 10:50 a.m., traffic police stopped them and asked for their identity cards.

Milanov noted that the officers appeared to be on the phone with someone during the interaction. They then informed Milanov that he would need to “go with them for testing for psychoactive substances.”

At the police station, Milanov was asked to turn off his phone and hand over all personal belongings. According to Amnesty International, Milanov did not provide the phone’s passcode. He underwent alcohol and drug testing, both of which came back negative.

Over an hour after the initial stop, Milanov said he asked one of the officers, “What is happening, are we finished, since I have […] tasks to do in Pirot?” The officer replied that they were waiting for the “chief” and stepped out to make phone calls. Milanov recalled overhearing the officer say, “He is negative, and I can’t hold him anymore.”

Subsequently, two plainclothes officers questioned Milanov in a separate building about his journalism and FAR’s funding. Authorities eventually returned his belongings, and he was released.

Later, Milanov noticed unusual activity on his phone, such as mobile data and Wi-Fi being turned off, and certain apps consuming excessive battery power. He used Stay Free, a usage-tracking app, which revealed that multiple applications had been active while the phone was in police possession, he told 404 Media.

“I am concerned by the way police behave during the incident, especially the way how they took/extracted the data from my mobilephone without using legal procedures,” told Milanov to 404 Media.

“The fact that they extracted 1.6 GB data from my mobilephone, including personal, family and business information as well as information about our associates and people serving as a ‘source of information’ for journalist research, is unacceptable,” he added

Further cases include an activist from the NGO Krokodil, whose Samsung device was compromised during an interview with Serbia’s Security Information Agency (BIA). Amnesty’s analysis uncovered surveillance data, including screenshots of private communications, captured without consent.

Serbian civil society members report feeling traumatized, describing the surveillance as a form of digital imprisonment. “This is an incredibly effective way to completely discourage communication between people. Anything that you say could be used against you, which is paralyzing at both personal and professional levels,” said one activist.

Cellebrite responded to the findings, stating that their tools do not install spyware and are licensed only for lawful investigations. However, Amnesty’s research highlights how such tools can be misused without oversight, posing significant risks to human rights.

Amnesty International has called on Serbian authorities to cease the unlawful use of spyware, provide remedies to victims, and hold perpetrators accountable.