
Serbian officials installed spyware on the phones of dozens of journalists and activists, Amnesty International said in a report published on December 16, citing digital forensic evidence and testimony from activists who said they had been hacked in recent months.
In two cases, software provided by Israeli surveillance company Cellebrite DI Ltd was used to unlock the phones, the report said.
The Serbian spyware, dubbed "NoviSpy" by Amnesty, then secretly took photos of mobile devices, copied contacts and uploaded them to a government-controlled server, the report said.
"In several cases, activists and a journalist reported signs of suspicious activity on their mobile phones immediately after interviews with Serbian police and security authorities," Amnesty said.
Serbia's Interior Ministry, Foreign Ministry and intelligence agency, BIA, did not respond to requests for comment made on December 12.
Cellebrite's products are widely used by law enforcement, including the FBI, to unlock smartphones and search them for evidence. Cellebrite's chief marketing officer, David Gee, said the company was investigating Amnesty's allegations.
“If these allegations are true, they could constitute a violation of our end-user license agreement,” Gee told Reuters. If that turns out to be the case, Gee said, Cellebrite could suspend the use of its technology by Serbian authorities.
Placing surveillance software on devices is “absolutely not what we do,” Gee said. He added that Cellebrite had begun contacting Serbian officials, but declined to provide further details.
One of the activists mentioned by Amnesty in the report said he had noticed that the contacts on his phone had been exported immediately after a meeting with the BIA.
The activist told Reuters that he had shown the phone to digital forensics experts, who discovered that the NoviSpy spyware had exported his contacts and sent private photos from his device to a server controlled by the BIA.
According to Amnesty, Serbia had received phone-cracking equipment from Cellebrite as part of a wider aid package to help Serbia meet the requirements for integration into the European Union.
This package, funded by the Norwegian government and administered by the United Nations Office for Project Services (UNOPS), was offered to the Serbian Ministry of Interior from 2017 to 2021 to assist Serbia in the fight against organized crime, the report says.
The Norwegian government temporarily halted the shipment of Cellebrite equipment to Serbia in 2018, Amnesty said. The Norwegian embassy in Belgrade also raised concerns about the program, the report added, but UNOPS eventually delivered the equipment in June 2019.
“The allegations made in the report are alarming and, if true, unacceptable,” Norway’s Deputy Foreign Minister, Maria Varteressian, told Reuters. “We will meet with the Serbian authorities as well as UNOPS later this month to obtain further information on the matter.”
"We expect UNOPS to investigate the allegations," she added.
UNOPS said in a statement that it welcomed Amnesty's report and said that, since 2017, the agency had "further strengthened mechanisms to assess and mitigate potential adverse effects." The agency did not provide details on those measures.