The Balkan Research Network of Serbia (BIRN) published a study which confirmed the long-standing speculation that Security Information Agency (BIA) tracks and eavesdrops on activists by installing malicious software on them spyware into phones. Confirmation that the phones of fifteen activists were infected, that is, that attempted attacks were registered, was given by the forensics of the international organization Amnesty International, which deals with human rights.
HOW BIA WORKS
When they detain one of the activists, her operatives try in different ways to persuade him to unlock their phone and thus cut short the job. By asking to see some recordings or photos on the phone, they gain access to the unlocked device, which they then take out of the interrogation room under various pretexts. During the hours-long, mostly pointless conversation with the activist, the forensics of the Serbian service processes the phone and installs spyware. BIRN research shows that BIA itself developed the NoviSpy spy software, which stores data precisely on the servers of this service. The program is installed on the targeted device and from that moment has access to call lists, contacts and messages, tracking the location of the phone, taking screenshots, as well as the device's microphone and camera.
In case the operatives do not convince the activist to unlock their phone, the BIA has a slightly more complicated alternative. Given that the phone is definitely left in the front room during the interrogation, BIRN writes, forensics is done on it with the help of the Israeli technology Cellebrite, a device that unlocks phones and extracts data from them. However, it can take several hours, so the first option is certainly simpler and faster. However, Cellebrite allows extracting deleted messages, hidden data, location history through base stations to which the phone was connected, bluetooth connections, Wi-Fi networks and the like.
Amnesty International's forensics showed that the NoviSpy program was installed on four devices, while traces of unsuccessful attempts were recorded on a dozen.
Is it permissible for the BIA to eavesdrop in this way? No, it's not. The BIA does not have the legal authority to confiscate and monitor phones on its own initiative, without an express order from the court and the prosecution.
Can you see spyware on your phone?
Some activists whose phone data was extracted through Cellebrite technology noticed, after their phones were returned, that certain data had been extracted from the device. However, they were probably not aware to what extent.
On the other hand, some activists have seen strange activities on their devices, such as overheating of the phone, sudden shutdown or high internet consumption. However, like most spyware, NoviSpy works in the background of the phone and is not easy to detect, apart from the inexplicable behavior of the phone.
ALL THEIR SPYING
A few days ago, BIRN also wrote that in the past decade, Serbia imported more than 20 IMSI catchers, devices that imitate base stations and enable the collection of data from all mobile phones in a certain area. In Serbia, the use of this technology is not regulated. The devices were also procured by the BIA and the Ministry of the Interior.
With the help of the IMSI catcher, the Ministry of Interior and the BIA can intercept communications from telephone devices on interesting events, such as protests, rallies or blockades, regardless of the telecommunications service provider (when they should have a court order).
Unlike the most advanced spy software, such as Pegasus and Predator, NoviSpy requires access to the device, that is, it cannot be installed "remotely", but must have access to the phone. As a reminder, the mobile phone of former Novi Sad police chief Slobodan Malešić was monitored in a similar way, who started noticing strange activities on the phone after one of his visits to the Security and Information Agency.
We should also not forget that during the past year two representatives of civil society in Serbia were the targets of Pegasus software attacks. This notorious Israeli-made spyware came into the public spotlight a few years ago when several international organizations specializing in digital rights found that it had been used around the world to spy on activists, journalists and political opponents.
The latest research by BIRN and the digital forensic results of Amnesty International have attracted the attention of the Western media as well. However, most of the companies (except Israeli ones) that sell this equipment to the Serbian services come from Western countries. Some of them have previously been under the radar for selling sophisticated surveillance technology to states that tend to abuse it. Until now, they have cleverly justified themselves by saying that they will investigate things in detail. We've seen how that goes.