Serbian Authorities Allegedly Used AI-Powered Cellebrite Tools to Unlock Journalist’s Phone and Install Spyware

Serbian authorities allegedly used Cellebrite’s AI-powered forensic tools to unlock journalists’ and activists’ phones without consent. They reportedly then installed NoviSpy, a newly discovered spyware. That then purportedly allowed covert data extraction, remote microphone and camera activation, and surveillance. Amnesty International uncovered forensic evidence linking Serbia’s Security Information Agency (BIA) to these attacks. Cellebrite halted sales to Serbia after the report.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.1 Disinformation, surveillance, and influence at scale

The BIA used Cellebrite and NoviSpy to conduct a coordinated, state-level covert surveillance campaign targeting journalists and activists to suppress political dissent.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The tools were used to bypass device encryption and extract highly sensitive personal data, including private messages, photos, and contacts.
• 2.2 AI system security vulnerabilities and attacks: The campaign relied on exploiting zero-day vulnerabilities in Android USB kernel drivers and Qualcomm chipsets to bypass security mechanisms.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by the intentional decision of Serbian authorities to use forensic tools and spyware to target civil society members after the technology was deployed.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The system is used in law enforcement and intelligence applications, which have significant implications for fundamental rights and are subject to strict regulatory requirements.

AI system and alleged parties

• AI system: Cellebrite UFED, NoviSpy (Cellebrite)
• AI purpose: Smart Surveillance; Identification
• Behaviour type: Tool
• Alleged developer: Serbian Security Information Agency (BIA), Cellebrite
• Alleged deployer: Serbian Security Information Agency (BIA), Serbian police, Government of Serbia
• Alleged harmed parties: Slaviša Milanov, Nikola Ristić, Krokodil, Journalists in Serbia, Human rights defenders in Serbia, Environmental activists in Serbia, Dissidents in Serbia, Civil society organizations in Serbia

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Minor, indirect Negligible
• Civil rights: direct Minor, indirect Negligible
• Democracy: direct Minor, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Minor
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Differential treatment

Reported: The report explicitly describes differential treatment of individuals and groups caused directly by the incident.

Directly caused: State authorities selectively targeted independent journalists, environmental activists, and civil society members for intrusive surveillance based on their political views and activism.

Inferred additional harm: It is likely that other critics of the government and opposition figures were subjected to similar discriminatory targeting and surveillance.

Civil rights

Reported: The report explicitly describes violations of human and civil rights caused directly by the incident.

Directly caused: The covert hacking and installation of spyware violated the targeted individuals' rights to privacy, freedom of expression, association, and peaceful assembly.

Inferred additional harm: The widespread use of these tools without strict legal oversight likely resulted in broader, undocumented violations of civil liberties across Serbian civil society.

Democracy

Reported: The report explicitly describes the erosion of democratic norms caused directly by the incident.

Directly caused: The state's use of intelligence services and advanced technology to covertly monitor and suppress peaceful dissent directly undermines democratic oversight and the rule of law.

Inferred additional harm: The unchecked deployment of such surveillance tools contributes to a broader state capture and the closing of civic space in Serbia.

Privacy

Reported: The report explicitly describes privacy violations caused directly by the incident.

Directly caused: The BIA bypassed device encryption to extract highly sensitive personal data, including private messages, photos, emails, and contacts without consent or warrants.

Inferred additional harm: The extraction of contact lists likely compromised the privacy of hundreds of secondary contacts and sources who communicated with the targeted individuals.

Psychological

Reported: The report explicitly describes psychological and mental-health harm to people caused directly by the incident.

Directly caused: Targeted activists reported experiencing severe anxiety, panic, trauma, and a shattered sense of personal security upon discovering they were surveilled.

Indirectly caused: The pervasive surveillance environment led to widespread self-censorship and a chilling effect, paralyzing communication at both personal and professional levels.

Inferred additional harm: It is highly likely that other unmentioned targets of the 'dozens, if not hundreds' of compromised devices experienced similar psychological distress and isolation.

People affected

• Occurrences reported: 1
• People reportedly harmed: 13
• People reportedly exposed: 13

Potential causes

Management

• Inadequate Corporate Oversight: Cellebrite failed to monitor product use by repressive regimes.
• Ignoring Misuse Warnings: Sales continued to Georgia despite known human rights risks.

Technology

• USB Driver Zero-Day Exploits: Exploited vulnerabilities in USB drivers to bypass Android security.
• Bypassing Device Encryption: Cellebrite UFED unlocked devices without requiring user passcodes.
• NoviSpy Android Spyware: Custom spyware allowed remote activation of camera and microphone.

Data Inputs

• Device Forensic Log Data: Analysis of device logs revealed Cellebrite exploit traces on phones.

Human Factors

• Deceptive Police Tactics: Authorities deceived targets to surrender phones under false pretexts.
• Lack of Owner Consent: Devices were searched without the owners' knowledge or legal consent.

Process and Methods

• Combining Forensics and Spyware: Cellebrite was used to unlock phones to facilitate spyware installation.
• Inadequate Due Diligence: UNOPS and Norway failed to assess human rights risks of donating tools.
• Lack of End-User Verification: Cellebrite did not verify if clients used tools for lawful purposes.

Regulatory Environment

• Weak Digital Surveillance Laws: Serbia's legal framework lacks safeguards against advanced surveillance.
• Lack of Judicial Oversight: Surveillance tools were deployed without strict legal controls.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from Amnesty International provide highly detailed technical forensic evidence, specific CVE identifiers, and direct testimonies from affected individuals, leaving very little ambiguity about the events.
• Ambiguities identified: The exact total number of targeted individuals is not fully quantified, described generally as 'dozens, if not hundreds'.
• Alternative interpretations: None, as the forensic evidence directly links the BIA and the use of Cellebrite tools to the spyware installations.

Serbian state authorities used Cellebrite forensic tools to exploit hardware zero-day vulnerabilities, bypassing device security to install custom NoviSpy spyware on journalists and activists. This coordinated domestic surveillance campaign represents a substantial threat to societal stability, human rights, and intelligence security within Serbia, highlighting the evolving risks of state-sponsored digital repression.

• Overall national security impact: Substantial
• Scope: Single nation
• Primary target: Serbia
• Alleged perpetrator: Serbian Security Information Agency

Threat characteristics

• Imminence: Long-term. This represents an ongoing, systemic domestic surveillance capability and strategic concern rather than an active, fast-moving crisis.
• Autonomy: Human-controlled. The forensic tools and spyware were directly operated and deployed by human intelligence officers to target specific individuals.
• Novelty: Evolved capability. While state surveillance via spyware is well-established, the combined physical exploitation of hardware zero-days to deploy custom spyware represents an evolved delivery method.

Impact by dimension

• Physical security: Negligible. No kinetic attacks, physical harm, or threats to critical infrastructure were reported in connection with this incident.
• Information security: Substantial. The state intelligence agency bypassed device encryption to conduct covert surveillance on journalists and activists, compromising sensitive communications, sources, and personal data.
• Sovereignty: Minor. Operations were conducted by domestic state authorities against their own citizens, representing an abuse of government power rather than an external threat to state sovereignty.
• Economic security: Minor. The exploit targeted zero-day vulnerabilities in Qualcomm chipsets and Android drivers, leading to Cellebrite suspending sales to Serbia, but caused minimal direct macroeconomic impact.
• Societal stability: Substantial. Systematic state targeting of civil society, journalists, and activists led to widespread trauma, self-censorship, and severe erosion of fundamental human rights and democratic norms.