- country
- Serbia
- date text
- 01/01/2026
- actor text
- BIA (Security Intelligence Agency); Serbian police (MUP)
- campaign id
- SRB-CAMP-003
- confidence notes
- Primary source: BCSP Policy Paper 1/2026, author Milica Tosic, funded Norwegian MFA. Secondary: Amnesty International Digital Prison December 2024. NoviSpy = domestically developed BIA-linked spyware — name coined by Amnesty research team. Pegasus = NSO Group commercial spyware licensed exclusively to state actors. National security framing used to justify spyware deployment — exact pattern documented as AML/security framing weaponization in Playbook taxonomy. Nine signatory CSOs include SHARE Foundation. Cross-reference: SIG-SRB-084 (GOSI surveillance as editorial content) and CRTA armed police raid documented in EP address.
- date confidence
- approximate
- excerpt
- BCSP policy paper (Milica Tosic, January 2026) documents systematic spyware use against journalists and civil society in Serbia. Key findings: Amnesty International Digital Prison report December 2024 documents NoviSpy (domestically developed BIA-linked spyware) installed during police/BIA informational interviews; Cellebrite forensic tools used to forcibly unlock devices. Early 2025: minimum two Pegasus spyware infection attempts against BIRN journalists confirmed (NSO Group licenses Pegasus exclusively to state security agencies). February 2025: Amnesty documents Pegasus attempt against student activist. November 2023: Apple warnings to two civil society members about state-sponsored attacks. Nine CSOs filed criminal complaints to High-Tech Crime Prosecutor against BIA/police officials. Cellebrite announced suspension of tool use in Serbia after Amnesty report. No institutional accountability documented.
- id
- SIG-SRB-097
- normalized date
- 2026-01-01
- observation
- country
- Serbia
- actor function
- Authorizing Actor
- actor primary
- BIA (Security Intelligence Agency); Serbian police (MUP)
- actor type primary
- State
- campaign id
- SRB-CAMP-003
- campaign phase
- Phase 5: Systemic Assault
- channel primary
- Official/Regulatory
- confidence notes
- Primary source: BCSP Policy Paper 1/2026, author Milica Tosic, funded Norwegian MFA. Secondary: Amnesty International Digital Prison December 2024. NoviSpy = domestically developed BIA-linked spyware — name coined by Amnesty research team. Pegasus = NSO Group commercial spyware licensed exclusively to state actors. National security framing used to justify spyware deployment — exact pattern documented as AML/security framing weaponization in Playbook taxonomy. Nine signatory CSOs include SHARE Foundation. Cross-reference: SIG-SRB-084 (GOSI surveillance as editorial content) and CRTA armed police raid documented in EP address.
- consequence category
- Legal/Administrative
- date confidence
- approximate
- escalation stage
- 5
- event date normalized
- 2026-01-01
- event date raw
- 01/01/2026
- harm track
- Track 1 — Legal/Administrative
- institutional consequence
- Chilling effect on journalism and civil society; self-censorship; source protection destroyed
- narrative density
- High
- narrative origin
- Domestic
- primary narrative code
- NF-04
- primary narrative label
- Security Threat / Destabilization
- secondary source url
- https://www.amnesty.org/en/latest/news/2024/12/serbia-authorities-using-spyware-and-cellebrite-forensic-extraction-tools-to-hack-journalists-and-activists/
- signal id
- SIG-SRB-097
- source text excerpt
- BCSP policy paper (Milica Tosic, January 2026) documents systematic spyware use against journalists and civil society in Serbia. Key findings: Amnesty International Digital Prison report December 2024 documents NoviSpy (domestically developed BIA-linked spyware) installed during police/BIA informational interviews; Cellebrite forensic tools used to forcibly unlock devices. Early 2025: minimum two Pegasus spyware infection attempts against BIRN journalists confirmed (NSO Group licenses Pegasus exclusively to state security agencies). February 2025: Amnesty documents Pegasus attempt against student activist. November 2023: Apple warnings to two civil society members about state-sponsored attacks. Nine CSOs filed criminal complaints to High-Tech Crime Prosecutor against BIA/police officials. Cellebrite announced suspension of tool use in Serbia after Amnesty report. No institutional accountability documented.
- source type
- Civil Society Report
- source url
- https://www.bezbednost.org/spijunski-softver-negacija-ljudskih-prava-pod-izgovorom-bezbednosti/
- tactic code
- TC-21
- target
- BIRN journalists; civil society activists; student activists; CRTA
- target type
- Sector
- trigger type
- TR-08: Proactive / Ambient
- secondary source url
- https://www.amnesty.org/en/latest/news/2024/12/serbia-authorities-using-spyware-and-cellebrite-forensic-extraction-tools-to-hack-journalists-and-activists/
- source type
- Civil Society Report
- source url
- https://www.bezbednost.org/spijunski-softver-negacija-ljudskih-prava-pod-izgovorom-bezbednosti/
- target text
- BIRN journalists; civil society activists; student activists; CRTA
The public research collection