{"id":"SIG-SRB-097","country":"Serbia","excerpt":"BCSP policy paper (Milica Tosic, January 2026) documents systematic spyware use against journalists and civil society in Serbia. Key findings: Amnesty International Digital Prison report December 2024 documents NoviSpy (domestically developed BIA-linked spyware) installed during police/BIA informational interviews; Cellebrite forensic tools used to forcibly unlock devices. Early 2025: minimum two Pegasus spyware infection attempts against BIRN journalists confirmed (NSO Group licenses Pegasus exclusively to state security agencies). February 2025: Amnesty documents Pegasus attempt against student activist. November 2023: Apple warnings to two civil society members about state-sponsored attacks. Nine CSOs filed criminal complaints to High-Tech Crime Prosecutor against BIA/police officials. Cellebrite announced suspension of tool use in Serbia after Amnesty report. No institutional accountability documented.","date_text":"01/01/2026","actor_text":"BIA (Security Intelligence Agency); Serbian police (MUP)","source_url":"https://www.bezbednost.org/spijunski-softver-negacija-ljudskih-prava-pod-izgovorom-bezbednosti/","campaign_id":"SRB-CAMP-003","incident_id":null,"observation":{"target":"BIRN journalists; civil society activists; student activists; CRTA","case_id":"","country":"Serbia","signal_id":"SIG-SRB-097","harm_track":"Track 1 — Legal/Administrative","source_url":"https://www.bezbednost.org/spijunski-softver-negacija-ljudskih-prava-pod-izgovorom-bezbednosti/","campaign_id":"SRB-CAMP-003","source_type":"Civil Society Report","tactic_code":"TC-21","target_type":"Sector","enabler_type":"","trigger_type":"TR-08: Proactive / Ambient","actor_primary":"BIA (Security Intelligence Agency); Serbian police (MUP)","actor_function":"Authorizing Actor","campaign_phase":"Phase 5: Systemic Assault","enabler_status":"","event_date_raw":"01/01/2026","channel_primary":"Official/Regulatory","date_confidence":"approximate","campaigns_served":"","confidence_notes":"Primary source: BCSP Policy Paper 1/2026, author Milica Tosic, funded Norwegian MFA. Secondary: Amnesty International Digital Prison December 2024. NoviSpy = domestically developed BIA-linked spyware — name coined by Amnesty research team. Pegasus = NSO Group commercial spyware licensed exclusively to state actors. National security framing used to justify spyware deployment — exact pattern documented as AML/security framing weaponization in Playbook taxonomy. Nine signatory CSOs include SHARE Foundation. Cross-reference: SIG-SRB-084 (GOSI surveillance as editorial content) and CRTA armed police raid documented in EP address.","escalation_stage":"5","narrative_origin":"Domestic","narrative_density":"High","actor_type_primary":"State","source_text_excerpt":"BCSP policy paper (Milica Tosic, January 2026) documents systematic spyware use against journalists and civil society in Serbia. Key findings: Amnesty International Digital Prison report December 2024 documents NoviSpy (domestically developed BIA-linked spyware) installed during police/BIA informational interviews; Cellebrite forensic tools used to forcibly unlock devices. Early 2025: minimum two Pegasus spyware infection attempts against BIRN journalists confirmed (NSO Group licenses Pegasus exclusively to state security agencies). February 2025: Amnesty documents Pegasus attempt against student activist. November 2023: Apple warnings to two civil society members about state-sponsored attacks. Nine CSOs filed criminal complaints to High-Tech Crime Prosecutor against BIA/police officials. Cellebrite announced suspension of tool use in Serbia after Amnesty report. No institutional accountability documented.","consequence_category":"Legal/Administrative","secondary_source_url":"https://www.amnesty.org/en/latest/news/2024/12/serbia-authorities-using-spyware-and-cellebrite-forensic-extraction-tools-to-hack-journalists-and-activists/","event_date_normalized":"2026-01-01","primary_narrative_code":"NF-04","primary_narrative_label":"Security Threat / Destabilization","secondary_narrative_code":"","institutional_consequence":"Chilling effect on journalism and civil society; self-censorship; source protection destroyed","secondary_narrative_label":""},"response_id":null,"source_type":"Civil Society Report","target_text":"BIRN journalists; civil society activists; student activists; CRTA","date_confidence":"approximate","normalized_date":"2026-01-01","confidence_notes":"Primary source: BCSP Policy Paper 1/2026, author Milica Tosic, funded Norwegian MFA. Secondary: Amnesty International Digital Prison December 2024. NoviSpy = domestically developed BIA-linked spyware — name coined by Amnesty research team. Pegasus = NSO Group commercial spyware licensed exclusively to state actors. National security framing used to justify spyware deployment — exact pattern documented as AML/security framing weaponization in Playbook taxonomy. Nine signatory CSOs include SHARE Foundation. Cross-reference: SIG-SRB-084 (GOSI surveillance as editorial content) and CRTA armed police raid documented in EP address.","secondary_source_url":"https://www.amnesty.org/en/latest/news/2024/12/serbia-authorities-using-spyware-and-cellebrite-forensic-extraction-tools-to-hack-journalists-and-activists/"}