{"id":"SRB-122","notes":"Coded Sep 24 2026. Date = first documented compromise (Milanov, February 2024); further cases through October 2024; report published 16 December 2024. Precursor of the 2026 wave (SRB-121), which found a new NoviSpy version. Campaign: SRB-CAMP-018. Escalation 5: forensically confirmed NoviSpy infections (Amnesty). (Spyware thresholds, Sep 25 2026.) UN Special Rapporteurs (15 Sep 2026) cite Pegasus, NoviSpy and Cellebrite UFED together as confirming 'a pattern of unlawful surveillance and intimidation' in Serbia (CR-SRB-003); pattern: SRB-123 (2023), SRB-122 (2024), SRB-124 (2025), SRB-121 (2025–26).","country":"Serbia","sources":[{"url":"https://www.ohchr.org/en/press-releases/2026/09/serbia-use-spyware-against-opposition-and-dissenting-voices-affects","citation":"https://www.ohchr.org/en/press-releases/2026/09/serbia-use-spyware-against-opposition-and-dissenting-voices-affects"},{"url":"https://www.amnesty.org/en/latest/news/2024/12/serbia-authorities-using-spyware-and-cellebrite-forensic-extraction-tools-to-hack-journalists-and-activists/","citation":"https://www.amnesty.org/en/latest/news/2024/12/serbia-authorities-using-spyware-and-cellebrite-forensic-extraction-tools-to-hack-journalists-and-activists/"},{"url":"https://securitylab.amnesty.org/latest/2024/12/a-digital-prison-surveillance-and-the-suppression-of-civil-society-in-serbia/","citation":"https://securitylab.amnesty.org/latest/2024/12/a-digital-prison-surveillance-and-the-suppression-of-civil-society-in-serbia/"},{"url":"https://www.amnesty.org/en/documents/eur70/8814/2024/en/","citation":"https://www.amnesty.org/en/documents/eur70/8814/2024/en/"},{"url":"https://www.amnesty.org/en/latest/news/2025/02/cellebrite-halts-product-use-in-serbia-following-amnesty-surveillance-report/","citation":"https://www.amnesty.org/en/latest/news/2025/02/cellebrite-halts-product-use-in-serbia-following-amnesty-surveillance-report/"},{"url":"https://techcrunch.com/2025/02/26/cellebrite-suspends-serbia-as-customer-after-claims-police-used-firms-tech-to-plant-spyware/","citation":"https://techcrunch.com/2025/02/26/cellebrite-suspends-serbia-as-customer-after-claims-police-used-firms-tech-to-plant-spyware/"},{"url":"https://sharefoundation.info/en/cellebrite-halts-use-of-its-forensic-tool-in-serbia/","citation":"https://sharefoundation.info/en/cellebrite-halts-use-of-its-forensic-tool-in-serbia/"}],"summary":"Amnesty International's report 'A Digital Prison' (16 December 2024) documented that Serbian police and the Security Information Agency (BIA) covertly infected the phones of journalists and activists with NoviSpy, a previously unknown Android spyware, while the phones were taken from their owners during police detention or BIA 'informational interviews'. Cellebrite UFED mobile forensic tools — including a zero-day exploit — were used to unlock the devices before NoviSpy was installed; NoviSpy captured data such as contact lists and sent it to a government-controlled server. Documented cases include journalist Slaviša Milanov, whose phone was compromised after his arrest in February 2024, and an activist of Krokodil infected during a BIA interview in October 2024.","tactics":[{"code":"TC-21","role":"primary","label":"Surveillance Infrastructure / Spyware Deployment","needs_review":false},{"code":"TC-20","role":"secondary","label":"Security Apparatus Enforcement","needs_review":false}],"version":5,"channels":["Covert device infection during police detention and BIA interviews (Cellebrite UFED unlock, NoviSpy install)"],"entities":[{"id":1147,"name":"Security Information Agency (BIA); Serbian police","role":"actor","entity_type":"Security Apparatus"},{"id":1148,"name":"Independent investigative journalist Slaviša Milanov; an activist of Krokodil; environmental activist Nikola Ristić; further activists (pseudonymised in the report)","role":"target","entity_type":"Individual — Journalist / Activist"}],"date_text":"02/2024","created_at":"2026-09-24T23:55:20.691224+00:00","escalation":5,"harm_track":"Track 3 — Operational Suppression","narratives":[],"report_ids":[],"signal_ids":[],"updated_at":"2026-09-25T14:48:22.479476+00:00","occurred_on":"2024-02-01","campaign_ids":["SRB-CAMP-018"],"enabler_type":"","response_ids":["CR-SRB-001"],"trigger_type":"TR-08: Proactive / Ambient","campaign_phase":"","civic_response":"Amnesty International Security Lab's forensic investigation ('A Digital Prison', 16 December 2024) called on Serbia to stop using invasive spyware and on vendors to conduct due diligence. | Outcome (see Civic Responses CR-SRB-001): Cellebrite suspended use of its products by the relevant Serbian customers (25 February 2025).","date_precision":"month","enabler_status":"","campaigns_served":[],"consequence_category":"Operational Suppression","institutional_consequence":"Data seizure/exposure; Chilling effect; International response"}