# NoviSpy: spyware on activists' phones Category: Elections, media and institutions Period: from Jul 2023 Outcome: Under investigation (as of 20 Oct 2026) In December 2024, Amnesty International reported that the police and the BIA had unlocked journalists' and activists' phones with tools made by Cellebrite during informal interviews and detentions, and had secretly installed NoviSpy spyware on them. The BIA and the Interior Ministry deny this. Later investigations found NoviSpy on the phones of farmers and students as well, Pegasus attacks on students and the opposition, and Pegasus on the phone of rector Vladan Đokić. A criminal complaint against unknown persons was filed in December 2024, but according to the SHARE Foundation, the cases are still at the information-gathering stage and no one has been identified or charged. ## NoviSpy and Cellebrite tools In December 2024, Amnesty International, in an investigation with BIRN, reported that the police and the BIA had unlocked journalists' and activists' phones with tools made by the Israeli company Cellebrite during informal interviews and detentions, and had secretly installed home-grown spyware called NoviSpy on them. The first case uncovered was that of Slaviša Milanov, a journalist from Dimitrovgrad. Amnesty attributes the spyware to the BIA with high confidence. ## Denials and new licences BIA called the allegations “trivial sensationalism”, and the Interior Ministry called them “absolutely untrue”. In February 2025, Cellebrite stopped “relevant customers” in Serbia from using its products, but the Interior Ministry had bought new licences by April 2025. ## New attacks and Pegasus Later research by BIRN and the SHARE Foundation also found NoviSpy on the phones of four farmers and environmental activists. In 2026 it found a new version of the software on the phones of members of the student movement, alongside Pegasus attacks on students and the opposition. Attempts with Pegasus were also recorded in 2023 and 2025. In October 2026, Citizen Lab and SHARE confirmed Pegasus on the phone of Vladan Đokić, rector of the University of Belgrade. In November 2026 the university said that the rector's chief of staff had also been under secret surveillance for almost a year on the orders of the Security Information Agency (BIA). ## Recording equipment at the Faculty of Law The University of Belgrade Faculty of Law said that on 30 October 2026, equipment believed to be for audio and video recording was found in its largest lecture hall. Police seized it for forensic examination, and rector Đokić is demanding that it be established who installed it and on whose orders. ## Complaint going nowhere In December 2024, a criminal complaint against unidentified persons from the BIA and the police was filed with the Prosecutor's Office for High-Tech Crime. According to the SHARE Foundation, as of October 2026 the cases were still at the information-gathering stage. No one has been identified or charged. After the weekly Radar published reports on covert surveillance, the Belgrade Centre for Human Rights, SHARE, Partners Serbia and NUNS called on 6 November 2026 for criminal proceedings against the BIA's director and senior officials, an inquiry into the accountability of judges of the Higher Court in Belgrade, and the dismissal of the Ombudsman and the Commissioner. ## Complaints by former BIA officers On 3 November 2026, two former members of the BIA, among them Milan Zvezdanović, filed a criminal complaint against its director, Vladimir Orlić, and the leadership of the Tenth Regional Centre, which covers Vranje and Leskovac. According to the complaint, unfounded proposals for the secret surveillance of several dozen students, professors and activists were allegedly drawn up between November 2024 and July 2026. According to Zvezdanović, the BIA called the complainants' conduct malicious. On 9 November, Zvezdanović also reported Orlić to the Prosecutor's Office for Organised Crime on suspicion of disclosing official secrets. He is asking for an investigation into whether confidential BIA material was allegedly passed to Informer TV and the Centre for Social Stability to discredit critics of the government. He also wants the secret surveillance recordings compared with their broadcasts. ## Nadzor opozicionih političara Predsednik Demokratske stranke Srđan Milivojević izjavio je 6. novembra 2026. da je došao u posed svog dosijea iz BIA, po kome su, prema njegovim rečima, prisluškivani on i prostorije stranke u Beogradu i Kruševcu. Dokument nije pokazao, jer je, kako kaže, strogo poverljiv. Traži da se BIA i Vojnobezbednosna agencija raspuste. Zeleno-levi front saopštio je 9. novembra da je njegov kopredsednik, poslanik Radomir Lazović, bio pod tajnim nadzorom BIA, da su agenti ulazili u njegov stan da postave uređaje za prisluškivanje i da je na njegovom telefonu ranije pronađen Pegasus. Lazović traži da se BIA rasformira, a direktor Vladimir Orlić uhapsi. ## Participants - [Security Information Agency](https://odgovornost.rs/en/organizacije/bia): According to Amnesty International, it secretly installed NoviSpy on the phones of activists and journalists during informational interviews (responsible) - [Ministry of Internal Affairs of the Republic of Serbia](https://odgovornost.rs/en/organizacije/mup-srbije): According to Amnesty International, the phones of journalists and activists detained by the police were unlocked with a Cellebrite tool and infected with NoviSpy (responsible) - [Internal Control Sector of the Interior Ministry (MUP)](https://odgovornost.rs/en/organizacije/sektor-unutrasnje-kontrole): After a review, it told NUNS in April 2024 that Milanov's rights and freedoms had not been violated (investigation and courts) - [Cellebrite DI Ltd](https://odgovornost.rs/en/organizacije/cellebrite): After looking into the claims in the report, it suspended the use of its products by "relevant customers" in Serbia in February 2025 (commented on the case) - [NSO Group](https://odgovornost.rs/en/organizacije/nso-group): Jelena Kontić's criminal complaint accuses those responsible at the company of installing Pegasus on her phone (responsible) - [Informatika AD](https://odgovornost.rs/en/organizacije/informatika-ad): According to leaked documents, it sent BIA offers for forensic licences, but it disputes the authenticity of those documents (commented on the case) - [Aleksandar Vučić](https://odgovornost.rs/en/osobe/aleksandar-vucic): President of the Republic; dismissed the spying allegations in 2026 (commented on the case) - [Boris Majlat](https://odgovornost.rs/en/osobe/boris-majlat): He confirmed receiving the complaint and announced requests to the police; proceedings had not been opened earlier because, as he put it, "none of the injured parties came forward" (investigation and courts) - [Higher Public Prosecutor's Office in Belgrade, Special Department for High-Tech Crime](https://odgovornost.rs/en/organizacije/vjt-beograd-vtk): It received complaints against unidentified persons from BIA and the police; in October 2026 the investigation was still at the information-gathering stage (investigation and courts) - [Commissioner for Information of Public Importance and Personal Data Protection](https://odgovornost.rs/en/organizacije/poverenik): It opened proceedings after the report, and in September 2026 said that no violation of the law had been established (oversight and the public) - [Protector of Citizens (Ombudsman)](https://odgovornost.rs/en/organizacije/zastitnik-gradjana): It opened proceedings after the report, which were still ongoing in February 2025 (oversight and the public) - [Amnesty International](https://odgovornost.rs/en/organizacije/amnesty-international): On 16 December 2024 it published the report "A Digital Prison" on the NoviSpy spyware and the Cellebrite tool (oversight and the public) - [BIRN](https://odgovornost.rs/en/organizacije/birn): It investigated cases with Amnesty, and two of its journalists received messages with a Pegasus link in 2025 (oversight and the public) - [SHARE Foundation](https://odgovornost.rs/en/organizacije/share-fondacija): It publishes forensic findings on attacks and is among those who filed the 2024 criminal complaint (oversight and the public) - [Independent Journalists' Association of Serbia (NUNS)](https://odgovornost.rs/en/organizacije/nuns): Filed a complaint after Milanov was detained and was among those who filed the December 2024 complaint (oversight and the public) - [Vladan Đokić](https://odgovornost.rs/en/osobe/vladan-djokic): Rector of the University of Belgrade; according to Citizen Lab, his phone was infected with Pegasus in 2026, and he is calling for an investigation (harmed) - [Rade Bajić](https://odgovornost.rs/en/osobe/rade-bajic): Prosecutorial associate on the General Staff building case; received a warning of a spyware attack and says he was targeted because of that case (harmed) - [Public Prosecutor's Office for Organised Crime](https://odgovornost.rs/en/organizacije/jtok): After the attack on its associate, it replied that it has no jurisdiction over illegal wiretapping and that the high-tech crime department does (investigation and courts) - [University of Belgrade Faculty of Law](https://odgovornost.rs/en/organizacije/pravni-fakultet-beograd): Said recording equipment had been found in its lecture hall and asked the authorities to establish the facts (oversight and the public) - [University of Belgrade](https://odgovornost.rs/en/organizacije/univerzitet-u-beogradu): Said the rector's chief of staff had been under covert surveillance for almost a year on the BIA's orders and asked the prosecutor's office to establish the circumstances (oversight and the public) - [Vladimir Orlić](https://odgovornost.rs/en/osobe/vladimir-orlic): According to a complaint by former BIA officers, unfounded proposals for the covert surveillance of students were allegedly drawn up on his orders or with his knowledge (responsible) - [Milan Zvezdanović](https://odgovornost.rs/en/osobe/milan-zvezdanovic): Reported the BIA director over allegedly unfounded requests for the secret surveillance of students and over the alleged leaking of official secrets to Informer (oversight and the public) - [Srđan Milivojević](https://odgovornost.rs/en/osobe/srdjan-milivojevic): Claims his BIA file shows that he and the DS premises were wiretapped, and is calling for the agency to be disbanded (harmed) - [Democratic Party](https://odgovornost.rs/en/organizacije/demokratska-stranka): According to the party's president, the BIA wiretapped its offices in Belgrade and Kruševac (harmed) - [Belgrade Centre for Human Rights](https://odgovornost.rs/en/organizacije/beogradski-centar-za-ljudska-prava): Together with three other organisations, he called for criminal proceedings against the BIA leadership and for an inquiry into the responsibility of judges over secret surveillance (oversight and the public) - [Partners Serbia](https://odgovornost.rs/en/organizacije/partneri-srbija): Together with three other organisations, she called for criminal proceedings against the BIA leadership and for an inquiry into the responsibility of judges over secret surveillance (oversight and the public) - [Radomir Lazović](https://odgovornost.rs/en/osobe/radomir-lazovic): Prema saopštenju ZLF-a, bio je pod tajnim nadzorom BIA, a agenti su ulazili u njegov stan da postave prislušne uređaje (harmed) ## Victims and others harmed - [Slaviša Milanov](https://odgovornost.rs/en/osobe/slavisa-milanov) - [Ivan Bjelić](https://odgovornost.rs/en/osobe/ivan-bjelic) - [Ivan Milosavljević](https://odgovornost.rs/en/osobe/ivan-milosavljevic) - [Nenad Kovačević](https://odgovornost.rs/en/osobe/nenad-kovacevic) - [Ljubomir Stefanović](https://odgovornost.rs/en/osobe/ljubomir-stefanovic) - [Slobodan Vidojević](https://odgovornost.rs/en/osobe/slobodan-vidojevic) - [Vladimir Višić](https://odgovornost.rs/en/osobe/vladimir-visic) - [Zlatko Kokanović](https://odgovornost.rs/en/osobe/zlatko-kokanovic) - [Jovan Topalović](https://odgovornost.rs/en/osobe/jovan-topalovic) - [Jelena Veljković](https://odgovornost.rs/en/osobe/jelena-veljkovic) - [Igor Božić](https://odgovornost.rs/en/osobe/igor-bozic) - [Jelena Kontić](https://odgovornost.rs/en/osobe/jelena-kontic) ## Sources - [Amnesty International: "A Digital Prison": surveillance and the repression of civil society in Serbia (summary)](): 16 Dec 2024 - [Radio Slobodna Evropa: Amnesty: Serbian authorities use technology to hack journalists and activists](): 16 Dec 2024 - [BIRN / Balkan Insight: Proven: BIA hacks activists' phones](): 16 Dec 2024 - [Insajder: Amnesty International: Serbian authorities use spyware to repress civil society; Interior Ministry and BIA deny it](): 16 Dec 2024 - [Radio Slobodna Evropa: What is known about NoviSpy, the spyware reportedly used in Serbia?](): 16 Dec 2024 - [Radio Slobodna Evropa: Civil society organisations file criminal complaint over 'spying' on journalists and activists in Serbia](): 24 Dec 2024 - [N1: NUNS called on prosecutors to identify those responsible for misusing digital forensic tools](): 17 Dec 2024 - [Vreme: NGOs: Criminal complaint against unidentified persons in the BIA and police over spyware](): 25 Dec 2024 - [Radio Slobodna Evropa: Cellebrite halts use of its forensic tools in Serbia after Amnesty report](): 26 Feb 2025 - [NUNS (Nezavisno udruženje novinara Srbije): Amnesty International: Cellebrite suspends use of its products in Serbia after Amnesty surveillance report](): 26 Feb 2025 - [Radio Slobodna Evropa: Tool for unlocking phones and extracting their contents still in the hands of Serbian police](): 30 Oct 2025 - [BIRN / Balkan Insight: Farmers under surveillance too: BIA planted spyware on farmers' phones](): 4 Dec 2025 - [Radio Slobodna Evropa: Serbian intelligence agency began buying controversial surveillance software 10 years ago](): 29 Jul 2025 - [N1: BIRN journalist: There may be more detained students who had spyware installed on their phones](): 3 Mar 2025 - [BIRN / Balkan Insight: Two BIRN journalists targeted with Pegasus spyware](): 27 Mar 2025 - [Vreme: State spying on activists](): 18 Dec 2024 - [Radio Slobodna Evropa: 'I am a victim of Pegasus': Serbian authorities accused of illegal spying](): 4 Sep 2026 - [N1: Pulled off the road over his vehicle inspection, then spyware put on his phone: how the BIA tracked farmers](): 5 Dec 2025 - [SHARE Fondacija: SHARE Foundation: students and opposition politicians targeted by spyware](): 2 Sep 2026 - [N1: Spyware on the phones of students and MPs: Vučić says "nonsense", BIA points to the interests of foreign intelligence services, and the Green-Left Front calls for an investigation](): 3 Sep 2026 - [Vreme: Criminal complaint filed over spying on a student's phone](): 6 Oct 2026 - [021.rs: Criminal complaint against BIA over spying on a student](): 6 Oct 2026 - [Cenzolovka: SHARE Foundation: Spyware use is spreading, and critics of the government are the targets](): 20 Oct 2026 - [Vreme: Spying on students: When Big Brother rides Pegasus](): 9 Sep 2026 - [SHARE Fondacija: New spyware cases: Rector Đokić and the Prosecutor's Office targeted](): 19 Oct 2026 - [Radio Slobodna Evropa: Belgrade University rector says spyware was found on his phone](): 19 Oct 2026 - [Citizen Lab: Targeting Democracy: Pegasus and Mercenary Spyware Attacks on Serbian Pro-Democracy Figures](): 19 Oct 2026 - [Vreme: Spyware on the phones of Rector Đokić and prosecutor Bajić](): 19 Oct 2026 - [N1: Spying with impunity: Pegasus found on the phones of a rector and a prosecution associate, institutions stay silent](): 20 Oct 2026 - [021.rs: Silence after report of spyware on the phones of Rector Đokić and prosecution associate Bajić](): 20 Oct 2026 - [N1: Faculty of Law: Equipment presumed to be for recording found inside fire-safety light in lecture hall](): 31 Oct 2026 - [Insajder: Rector Đokić demands to know who placed the disputed devices at the Faculty of Law and on whose orders](): 31 Oct 2026 - [Vreme: Who is secretly bugging and recording Law Faculty students](): 31 Oct 2026 - [Radar: (Video) Listening device and camera found in Faculty of Law lecture hall](): 30 Oct 2026 - [Danas: BIA also wiretapped the chief of staff of rector Vladan Đokić](): 5 Nov 2026 - [N1: Former BIA members file criminal complaint against Orlić over unlawful surveillance of students and citizens](): 3 Nov 2026 - [Insajder: Former BIA member Milan Zvezdanović: The state is not the same as the government, the constitutional order is protected by respecting the law (VIDEO)](): 5 Nov 2026 - [N1: Milivojević: BIA wiretapped me and DS premises](): 6 Nov 2026 - [NUNS (Nezavisno udruženje novinara Srbije): Call for an urgent investigation and for those at BIA and the Higher Court in Belgrade to be held accountable for abuse of authority and covert surveillance of critics of the Serbian Progressive Party government](): 6 Nov 2026 - [N1: Former BIA inspector files criminal complaint against Orlić: prosecutors should examine whether "strictly confidential" BIA material was passed to Informer and the Centre for Social Stability](): 9 Nov 2026 - [Nova.rs: Former BIA inspector files criminal complaint against Vladimir Orlić: he asks prosecutors to compare recordings of secretly monitored conversations with Informer's broadcasts](): 9 Nov 2026 - [Vreme: ZLF: BIA bugged MP Radomir Lazović's flat and mobile phone](): 9 Nov 2026 --- Source: Odgovornost, https://odgovornost.rs/en/afere/spijunski-softver-novispy As of: 9 Nov 2026 Licence: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/deed.en)