Anti-Spyware Coalition Sends Letter to European Union to Prosecute Illegal Hacking of Journalists and Activists in Serbia

On December 19, EPIC joined 50 civil society organizations urging major European Union (“EU”) institutions to take action to stop the Serbian Authorities’ illegal use of spyware to target journalists, activists, and members of civil society.

This letter follows an Amnesty International report exposing the use of Novispy and Cellebrite by Serbian police and its Security Information Agency. Cellebrite is a digital forensics tool that allows clients to bypass lock screens, passwords, and encryption to access target device data, often clearing the way for the infection of other spyware. According to the report, Novispy is a newly discovered Android-based spyware that allows clients to collect screenshots of all actions taken by the target device, track the target device’s location, record from the camera and microphone, and collect sensitive files and photos.

The letter calls for the Serbian government to adhere to its own legal framework and immediately cease the illegal use of spyware, which disproportionately interferes with fundamental rights, and for which there are no adequate safeguards to prevent and redress harms to human rights.

The letter also calls on the European Union institutions to urge Serbia to:

• Stop the illegal spyware use and protect fundamental rights.
• Demand an independent investigation into these violations and ensure accountability.
• Provide remedies for victims and halt the crackdown on civil society.

EPIC regularly advocates for greater oversight of surveillance systems and closely tracks government procurement, use, and export of spyware to ensure that fundamental human rights are protected. Recently, EPIC joined a letter sent to the DHS regarding its $2 million contract with well-known spyware developer Paragon Solutions and another letter to the new EU Polish Presidency urging them to prioritize anti-spyware policy. EPIC filed a friend of the court brief in the Ninth Circuit arguing that foreign spyware is not exempt from prosecution under the CFAA in the United States. EPIC is also a part of an international coalition to address the unchecked spread of spyware in the European Union and beyond.