Did Serbia hack the phones of activists and journalists? Why? | Spy news

Amnesty International discovered reported that phones belonging to Serbian activists and journalists were hacked by Serbian intelligence and police using Israeli spyware and other mobile device forensics tools.

Amnesty said on Monday that the software “is being used to illegally target journalists, environmental activists and others in a campaign of covert surveillance”.

Many of those targeted have not been arrested or charged with any crimes, he added.

The Serbian Security Intelligence Agency, known as the BIA, has denied accusations of illegal use of spyware.

“The forensic tool is used in the same way by other police forces around the world,” he said. “Therefore, we cannot comment on the nonsense claims in their (Amnesty’s) text, just as we normally do not comment on similar content.”

So what happened in Serbia and what does it all mean?

How did the use of spyware appear?

Freelance journalist Slavisa Milanov was taken to a police station in February after what appeared to be a routine traffic stop, according to Amnesty’s 87-page report, Digital Prison: The Surveillance and Suppression of Civil Society in Serbia.

When he picked up his phone after the police interview, Milanov found that both the data and Wi-Fi settings had been turned off. Taking this as a possible indication of hacking, Milanov contacted Amnesty International’s Security Lab and requested an inspection of his mobile device.

The lab’s software team found digital traces of Cellebrite’s Universal Forensic Extraction Device (UFED) technology, which appears to have been used to unlock Milanoov’s Android device.

It also discovered spyware that Amnesty said was previously unknown to it, a program called NoviSpy installed on Milanoov’s phone.

Milanov said that he was never informed that the police intended to search his phone, and that the police did not provide any legal basis for this. He said that he did not know what information was removed from his phone.

Using such technology without proper authorization is “illegal,” Amnesty said.

Dinushika Dissanayake, Amnesty International’s deputy regional director for Europe, said: “Our investigation reveals how the Serbian authorities are using surveillance technology and digital repression tactics as tools of wider state surveillance and repression of civil society.”

What did Amnesty’s investigation find?

Amnesty International’s investigation made two important findings. First, it found “forensic evidence” showing that Cellebrite’s technology was used to access the journalist’s device.

Cellebrite, a digital intelligence company based in Israel, produces data mining technology used legally by law enforcement departments globally, particularly in the United States.

In response to the Amnesty report, Cellebrite issued a statement: “We are investigating the allegations made in this report and are prepared to take action consistent with our ethical values ​​and agreements, including terminating Cellebrite’s relationships with any relevant entities.”

Amnesty found a second type of spyware on the journalist’s phone. It is not clear who created NoviSpy or where it came from.

The technology appears to allow attackers to remotely access and extract confidential information from infected smartphones.

The report noted that NoviSpy, which can be used to obtain information from Android devices, can also allow unauthorized monitoring of the device’s microphone and camera, which poses significant privacy and security risks.

The Amnesty report states: “An analysis of multiple NoviSpy spyware application samples recovered from infected devices showed that all communicated with servers located in Serbia to obtain both commands and tracking data. Note that one of these spyware samples was configured to connect directly to the IP address range associated with Serbia’s BIA.”

It works similarly to commercial spyware like NoviSpy PegasusIt is a sophisticated spyware developed by the Israeli cyber intelligence company NSO. hacking scandal It was highlighted in 2020.

According to the report, the NoviSpy software infiltrates the devices and captures a series of screenshots showing sensitive information such as the contents of email accounts, Signal and WhatsApp conversations, as well as social media interactions.

In another incident reported by Amnesty International related to the NoviSpy software in October, Serbian authorities summoned an activist from the Belgrade-based NGO Krokodil, a non-partisan civil society organization focused on culture, literature and social activism, to the BIA office.

While the activist was in the interview room, the activist’s Android phone was left unattended outside. A forensic examination by Amnesty International’s Security Lab revealed that NoviSpy spyware was secretly installed on the device during this period.

Why are journalists and activists targeted?

Amnesty International and other human rights organizations say that spyware attacks are being used to limit the freedom of the news media and to control communications more broadly within countries.

“This is a very effective way to completely stop communication between people. Anything you say can be used against you, which is paralyzing on a personal and professional level,” said an activist targeting Pegasus spyware, referred to in the report as “Branco”. Amnesty said some names have been changed to protect people’s identities.

“Goran” (not his real name), an activist targeting Pegasus spyware, said: “We are all in a digital prison, a digital gulag. We have the illusion of freedom, but in reality we have no freedom. This has two effects: either you prefer self-censorship, which seriously affects your ability to do your job, or you prefer to speak regardless.

Spyware can also be used to intimidate journalists and activists or to dissuade them from releasing information about influential people, Amnesty said.

In February, Human Rights Watch (HRW) published findings Between 2019 and 2023, the Pegasus spyware was used to target at least 33 individuals in Jordan, including journalists, activists and politicians. HRW used a report by Access Now, a US-based nonprofit that focuses on online privacy, free speech and data protection.

This report, based on forensic research in collaboration with Citizen Lab, a Canadian academic research center, uncovered evidence of Pegasus spyware on mobile devices. Some devices were found to be infected multiple times.

However, the investigation could not specify which specific organizations or countries were responsible for the organization of these attacks.

“Surveillance technologies and cyberweapons such as NSO Group’s Pegasus spyware are being used to target, intimidate and dissuade human rights defenders and journalists, infiltrate their networks and collect information for use against other targets.”

“Targeted surveillance of individuals violates their rights to privacy, freedom of expression, association and peaceful assembly. It also creates a chilling effect that forces people to self-censor and stop their activism or journalistic work for fear of reprisal.”

Is it legal to use spyware?

It depends on the laws of each country.

Article 41 of the Constitution of Serbia guarantees the confidentiality of correspondence and other forms of communication of individuals to protect individual privacy. As in other countries, the extraction of data from devices is allowed under Serbia’s Code of Criminal Procedure, but subject to restrictions – such as by court order.

An Amnesty International report stated: “Serbia’s Code of Criminal Procedure does not use the term ‘digital evidence’, but it considers computer data as a document (‘isprava’) that can be used as evidence in criminal proceedings.

“Surveillance of communications, including digital data, can be achieved through common evidentiary measures such as the inspection and search of mobile devices or other equipment that store digital records. These measures are usually not secret and are carried out with the knowledge and participation of the suspect.”

The BIA and the police also have the right to secretly monitor communications to gather evidence for criminal investigations, but this type of surveillance is also governed by the Code of Criminal Procedure.

Experts say it can be difficult to definitively prove whether data was extracted illegally due to the complexity of laws in different countries.

There is international precedent for how spyware can be used. Article 17 of the International Covenant on Civil and Political Rights states:

• No one shall be subjected to arbitrary or unlawful interference with his private life, family life, home or correspondence, and unlawful attacks on his honor and reputation.
• Everyone has the right to be protected by law from such interference or attacks.

As of June, 174 countries, including Serbia, had ratified the pact, making it one of the most widely accepted human rights treaties.

Who else has become the target of spyware in recent years?

• In October 2023Amnesty International’s Security Lab has discovered that two prominent journalists were targeted via iPhones by the Pegasus spyware. The victims were Siddharth Varadarajan, founding editor of The Wire, and Anand Manganale, South Asia editor of the Organized Crime and Corruption Reporting Project. It is not known who is responsible.
• in 2022HRW reported that Lama Fakih, a senior staff member and director of HRW’s Beirut office, was the subject of multiple cyber attacks in 2021 using the Pegasus spyware. Pegasus allegedly hacked Fakih’s phone five times between April and August of that year. Fakih, who oversees HRW’s crisis response in countries such as Afghanistan, Ethiopia, Israel, Myanmar, the Occupied Palestinian Territory, Syria and the United States, has been targeted by an unknown party for unknown reasons.
• in 2020A joint investigation by the University of Toronto’s Citizen Lab and Georgian independent researcher Nikolay Kvantaliani revealed that journalists and activists from Russia, Belarus, Latvia and Israel, as well as several individuals living in exile in Europe, were using the Pegasus spyware. These attacks began as early as 2020 and intensified after Russia’s large-scale intervention in Ukraine in 2022. Citizen Lab also identified a number of attacks against journalists and activists. El Salvador. It is not known who is responsible for the spyware attacks.
• in 2018, Jamal KhashoggiA well-known Saudi journalist, a columnist for The Washington Post and an outspoken critic of the Saudi Arabian government, was murdered and dismembered at the Saudi Arabian consulate in Istanbul. A subsequent investigation revealed that Pegasus spyware was deployed to monitor several people close to Khashoggi.