Serbian police used Cellebrite to unlock, then plant spyware, on a journalist’s phone

Serbian police allegedly used Cellebrite to hack and plant spyware on phones, targeting journalists and activists.

: Serbian authorities allegedly used Cellebrite to unlock and plant spyware on phones belonging to a journalist and activist, detailed by Amnesty International. Amnesty's report suggests the spyware, NoviSpy, was used to systematically infect devices to extract data. With a IP link to Serbian intelligence, NoviSpy’s widespread use raises concerns over privacy for civil society members.

According to a report by Amnesty International, local authorities in Serbia used Cellebrite devices to unlock the phones of a journalist, Slaviša Milanov, and activist, Nikola Ristić. Instead of merely accessing personal data, these tools allegedly allowed the installation of spyware named NoviSpy, exposing the individuals to continuous surveillance.

The report highlights this as the first documented forensic use of Cellebrite tools for spyware installation, a practice commonly used by governments worldwide but newly detected in Serbia. Amnesty's analysis connected NoviSpy to Serbian intelligence, with evidence showing language strings in code and IP addresses linking back to the Serbian Security Information Agency.

Amnesty uncovered NoviSpy on several civil society members' devices, indicating its widespread deployment. Devices, typically Android, and a discovered Qualcomm exploit further reveal the depth of targeting in Serbia, raising questions about international practices in digital rights. Cellebrite denies its tools' capability for such misuse and promises further investigation.

SpywareAmnesty Internationaldigital rights