- summary
- Amnesty International's report 'A Digital Prison' (16 December 2024) documented that Serbian police and the Security Information Agency (BIA) covertly infected the phones of journalists and activists with NoviSpy, a previously unknown Android spyware, while the phones were taken from their owners during police detention or BIA 'informational interviews'. Cellebrite UFED mobile forensic tools — including a zero-day exploit — were used to unlock the devices before NoviSpy was installed; NoviSpy captured data such as contact lists and sent it to a government-controlled server. Documented cases include journalist Slaviša Milanov, whose phone was compromised after his arrest in February 2024, and an activist of Krokodil infected during a BIA interview in October 2024.
- country
- Serbia
- date text
- 02/2024
- entities
- Security Information Agency (BIA); Serbian police
- entity type
- Security Apparatus
- id
- 1147
- name
- Security Information Agency (BIA); Serbian police
- role
- actor
- Independent investigative journalist Slaviša Milanov; an activist of Krokodil; environmental activist Nikola Ristić; further activists (pseudonymised in the report)
- entity type
- Individual — Journalist / Activist
- id
- 1148
- name
- Independent investigative journalist Slaviša Milanov; an activist of Krokodil; environmental activist Nikola Ristić; further activists (pseudonymised in the report)
- role
- target
- Security Information Agency (BIA); Serbian police
- sources
- citation
- https://www.amnesty.org/en/latest/news/2024/12/serbia-authorities-using-spyware-and-cellebrite-forensic-extraction-tools-to-hack-journalists-and-activists/
- url
- https://www.amnesty.org/en/latest/news/2024/12/serbia-authorities-using-spyware-and-cellebrite-forensic-extraction-tools-to-hack-journalists-and-activists/
- tactics
- Surveillance Infrastructure / Spyware Deployment
- label
- Surveillance Infrastructure / Spyware Deployment
- code
- TC-21
- needs review
- false
- role
- primary
- Security Apparatus Enforcement
- label
- Security Apparatus Enforcement
- code
- TC-20
- needs review
- false
- role
- secondary
- Surveillance Infrastructure / Spyware Deployment
- campaign ids
- channels
- Covert device infection during police detention and BIA interviews (Cellebrite UFED unlock, NoviSpy install)
- civic response
- Amnesty International Security Lab's forensic investigation ('A Digital Prison', 16 December 2024) called on Serbia to stop using invasive spyware and on vendors to conduct due diligence. | Outcome (see Civic Responses CR-SRB-001): Cellebrite suspended use of its products by the relevant Serbian customers (25 February 2025).
- consequence category
- Operational Suppression
- created at
- 2026-09-24T23:55:20.691224+00:00
- date precision
- month
- escalation
- 5
- harm track
- Track 3 — Operational Suppression
- id
- SRB-122
- institutional consequence
- Data seizure/exposure; Chilling effect; International response
- notes
- Coded Sep 24 2026. Date = first documented compromise (Milanov, February 2024); further cases through October 2024; report published 16 December 2024. Precursor of the 2026 wave (SRB-121), which found a new NoviSpy version. Campaign: SRB-CAMP-018. Escalation 5: forensically confirmed NoviSpy infections (Amnesty). (Spyware thresholds, Sep 25 2026.) UN Special Rapporteurs (15 Sep 2026) cite Pegasus, NoviSpy and Cellebrite UFED together as confirming 'a pattern of unlawful surveillance and intimidation' in Serbia (CR-SRB-003); pattern: SRB-123 (2023), SRB-122 (2024), SRB-124 (2025), SRB-121 (2025–26).
- occurred on
- 2024-02-01
- response ids
- trigger type
- TR-08: Proactive / Ambient
- updated at
- 2026-09-25T14:48:22.479476+00:00
- version
- 5
The public research collection