Surveillance Technology and Civil Rights The Case of Serbia's Digital Repression

A recent report reveals that Serbian authorities have been employing advanced mobile forensics and spyware to illegally surveil journalists, environmental activists, and civil rights defenders. The surveillance tools in question include mobile forensics products from the Israeli firm Cellebrite and a previously unknown spyware system, NoviSpy. These technologies have raised concerns about the erosion of privacy and human rights, particularly when used by state actors outside of legal frameworks.

Cellebrite's forensic tools are used globally by law enforcement and intelligence agencies to unlock and extract data from mobile devices, including the latest Android and iPhone models. This technology allows authorities to bypass passcodes and access sensitive personal data. However, when used improperly, it presents significant risks to individuals, particularly activists and journalists. According to Dinushika Dissanayake from Amnesty International, the use of such tools for surveillance purposes "poses an enormous risk" when employed without strict legal oversight.

NoviSpy, a spyware system less advanced than highly invasive programs like Pegasus, still provides Serbian authorities with the ability to monitor targets' activities, including turning on a device’s microphone or camera remotely. The report documents several cases where Serbian police used Cellebrite tools to facilitate NoviSpy infections on the mobile phones of activists and journalists, often during police interrogations.

One such case involved Serbian investigative journalist Slaviša Milanov, who was briefly detained by police under the guise of a routine drink-driving test. After his release, Milanov discovered his phone had been tampered with and that data was missing. Analysis revealed that Cellebrite’s tools were used to unlock the device, and NoviSpy had been installed during the time the police held the phone.

In another instance, the phone of environmental activist Nikola Ristić was also unlocked using Cellebrite’s forensic tools and infected with NoviSpy. These incidents point to the systematic misuse of surveillance technology by Serbian authorities, with a high degree of confidence linking the spyware to Serbia’s Security Information Agency (BIA).

Amnesty’s Security Lab confirmed that NoviSpy was installed on devices while in police custody and was made possible by advanced forensic tools like Cellebrite’s UFED platform. The report underscores the dangers of such technologies when used outside the bounds of justified legal investigations.

Following the discovery of NoviSpy, Amnesty informed Android and Google, which removed the spyware from affected devices and issued alerts to potential targets. However, the impact of surveillance technologies like Pegasus and NoviSpy on activists remains deeply troubling. Some victims of these programs report being traumatized, with one anonymous source stating that such invasive surveillance leaves individuals paralyzed, uncertain about what they can say or do without facing consequences.

While NSO Group, the developer of Pegasus, did not confirm Serbia’s use of its spyware, it stated that it takes human rights concerns seriously and investigates credible allegations of misuse. Similarly, Cellebrite distanced itself from the spyware claims, asserting that its products are intended solely for lawful use in criminal investigations, requiring warrants or consent. However, Amnesty’s report highlights that digital forensic tools can be easily misused to facilitate unauthorized surveillance and mass data collection.

Amnesty International urges Cellebrite and other digital forensic companies to ensure their products are not misused in ways that contribute to human rights violations. The report calls for greater due diligence to prevent such technologies from being deployed to undermine civil liberties and threaten the privacy of individuals worldwide.

In conclusion, the use of advanced surveillance technology by state actors without oversight poses significant risks to human rights. As digital repression tactics continue to grow, it is essential for companies like Cellebrite to ensure their products are not enabling abuses, and for governments to uphold legal frameworks that protect the privacy of individuals from unlawful surveillance.