The Media Freedom Rapid Response (MFRR) partners join the SafeJournalists Network (SJN), in expressing serious concern over the revelations in Amnesty International’s forensic analysis, exposing the invasive use of spyware and other digital tools by Serbian intelligence services and police to hack journalists’ phones as part of a covert surveillance campaign. These concerning revelations come amidst escalating threats against journalists in Serbia.
In the report “A Digital Prison”: Surveillance and the Suppression of Civil Society in Serbia” published on 16 December 2024, Amnesty International revealed that mobile forensic products made by the Israeli company Cellebrite were being used by the Serbian authorities to extract data from the phones of journalists and activists, while new Serbian spyware, “NoviSpy”, had been developed to infect devices and capture confidential information, including contact lists, which were then uploaded to a government-controlled server.
According to Amnesty International, Cellebrite technology, widely used by police and intelligence agencies worldwide to unlock devices and search for evidence, was given to Serbia in 2019 as part of an aid package to help the country meet EU integration requirements. Amnesty International asked for comments from the Serbian government ahead of the publication but has not received a response.
Among the dozens of testimonies, collected with BIRN’s contribution, from activists and journalists whose phones were hacked during detentions and interrogations by Serbian police is the case of Slaviša Milanov, a journalist for FAR portal. On 21 February 2024, Milanov was traveling to the city of Pirot when he was arrested and taken to a police station, on the pretext of conducting a breathalyser test. Upon entering the police station, Milanov was ordered to leave his phone and personal belongings at the police reception. After his drug test came back negative, plainclothes police officers sent him to a second police station, where he was questioned on suspicion of transporting wanted persons across the Bulgarian border, which Milanov denied. The journalist was then questioned over his work.
“After his release, Slaviša noticed that his phone, which he had left at the police station reception during his interrogation, appeared to have been tampered with, and his phone data was turned off. He requested Amnesty International’s Security Lab to conduct a forensic analysis of his phone (…). The analysis revealed that Cellebrite’s UFED product was used to secretly unlock Slaviša’s phone during his detention,” declared Amnesty, before adding that additional forensic evidence confirmed NoviSpy was also used by the Serbian authorities to infect Milanov’s phone.
We urge the Serbian authorities to conduct a thorough, impartial and independent investigation into the alleged use of spyware against journalists, which is prohibited as a criminal offense under the Serbian Criminal Code. The MFRR consortium also calls on the government to strengthen protections for journalists’ freedom of expression, privacy, and sources, as guaranteed under international human rights law. Transparency and oversight of the secret services are essential to prevent further violations of journalists’ rights.
Under the 2023 EU Recommendation on the investigation of the use of Pegasus and equivalent surveillance spyware, the use of spyware by law enforcement should only be authorised in exceptional cases, for a predefined purpose, and for a limited time. Journalists’ data should be protected from surveillance unless there is evidence of criminal activity.
In addition, the MFRR partners and SafeJournalists echo Amnesty’s call to EU key institutions to prioritise the development of an EU framework addressing threats to fundamental rights posed by spyware applicable also to the candidate countries. This must include rigorous accountability mechanisms for state surveillance practices in line with the European Media Freedom Act (EMFA) as well as an EU-wide ban on the production, export, sale, import, acquisition, transfer, servicing, and use of spyware, which disproportionately interferes with those rights.
No “digital prison” must be created and allowed to operate freely as a tool to repress and silence journalists and civil society representatives for their work of public interest.
Signed by
The Media Freedom Rapid Response
The European Federation of Journalists (EFJ)
European Centre for Press and Media Freedom (ECPMF)
Free Press Unlimited (FPU)
International Press Institute (IPI)
OBC Transeuropa (OBCT)
ARTICLE 19 Europe
SafeJournalists Network
Association of Journalists of Kosovo
Association of Journalists of Macedonia
Association BH Journalists
Croatian Journalists’ Association
Independent Journalists’ Association of Serbia
Trade Union of Media of Montenegro