Behind the Screen: How Serbia Uses Spyware to Silence Critics

Unlawful Use of Spyware in Serbia

A recent investigation by Amnesty International has uncovered disturbing details about how Serbian authorities are using advanced surveillance technology to target activists, journalists, and members of civil society. The study, “A Digital Prison: Surveillance and the Suppression of Civil Society in Serbia,” reveals how Serbian authorities unlawfully deploy Cellebrite’s mobile forensic products and a proprietary Android spyware program called NoviSpy against individuals during detentions and police interviews.

Cellebrite, a company known for its mobile data extraction technology, creates tools such as the UFED suite, which can unlock smartphones and extract data even without the passcode. Serbian police and intelligence services, including the Security Information Agency (BIA), have been using these tools to bypass phone security and install NoviSpy, a spyware program designed to extract private information and monitor individuals.

NoviSpy allows authorities to remotely access sensitive data, activate a phone’s microphone or camera, and capture activities such as social media usage, emails, and messaging apps. The spyware is reportedly installed on devices during detentions or interviews, exploiting vulnerabilities in Android phones. This covert practice has raised serious concerns about human rights violations in Serbia.

How Spyware Targets Phones

Amnesty International’s investigation revealed the systematic use of Cellebrite’s technology to unlock smartphones and prepare them for NoviSpy installation. For example, authorities used Cellebrite’s UFED product to exploit vulnerabilities in Android devices, bypass security systems, and gain unauthorized access. One such vulnerability in Qualcomm chipsets affected millions of devices globally before developers patched it in October 2024.

In one instance, police detained a journalist and tampered with his phone while he was in custody. Forensic analysis revealed that authorities used Cellebrite’s tools to unlock the phone and installed NoviSpy during his detention. Similarly, an environmental activist had their phone infected with NoviSpy after a meeting with intelligence officials. These incidents highlight how authorities are targeting individuals advocating for freedom of speech and environmental causes.

Authorities use Cellebrite’s tools to facilitate spyware installation, targeting not only activists and journalists but also other individuals. Amnesty International uncovered cases where police or intelligence agencies invited individuals to their offices under false pretenses and secretly infected their phones. The data captured through NoviSpy includes personal conversations, emails, and even encrypted messaging apps like Signal and WhatsApp. This has created a climate of fear among activists, forcing many into self-censorship.

Impact on Civil Society in Serbia

The misuse of surveillance technology has had a devastating impact on Serbian civil society. Activists have reported feeling violated, anxious, and unsafe. The sense of being constantly watched has led many to avoid open communication, fearing that their words could be used against them. This digital repression has paralyzed personal and professional interactions, making it increasingly difficult for people to advocate for their causes.

Amnesty International’s report also sheds light on the role of technology companies like Cellebrite in enabling these abuses. While Cellebrite insists its products are intended for lawful use, the findings demonstrate how these tools can be misused when sold to governments lacking adequate oversight. Amnesty has called on Cellebrite and other companies to conduct stricter due diligence to prevent their technology from contributing to human rights violations.

The report underscores the alarming escalation of state repression in Serbia, where activists, journalists, and NGOs face smear campaigns, arrests, and judicial harassment. Authorities deploy tools like NoviSpy and Cellebrite’s UFED products to monitor and silence dissent, shrinking the space for free speech and civil society in the country.

By exposing these practices, Amnesty International hopes to shed light on the urgent need to protect activists and hold those responsible for surveillance abuses accountable.