Over the past decade, Serbia has imported more than 20 IMSI catchers, capable of indiscriminately harvesting communications from all mobile phones within a certain area. Experts say their use is not regulated in law, reported BIRN.

IMSI (International Mobile Subscriber Identity-Catcher) catchers impersonate cellphone towers, identify and geolocate users and indiscriminately harvest communications from all mobile phones within a range of several hundred metres.

According to the findings of a BIRN investigation, Serbia has imported more than 20 of them over the past decade, but, experts say, in that time it has failed to update legislation that would regulate their use.

Over the past year alone, according to data obtained from their foreign ministries, Switzerland and Finland have issued 16 licences for the export of IMSI catchers to Serbia, BIRN said, adding that a single device purchased by Serbia’s Ministry of Interior from a Swiss company cost nearly two million Swiss francs, or just over two million euros.

Public records show that the suppliers sold similar technology to a number of countries with questionable human rights records, such as Namibia, Morocco, the United Arab Emirates and Colombia.

Often portable and small enough to fit into a backpack, IMSI catchers are invisible to their targets, making it almost impossible to protect against their most intrusive functions.

Normally, police surveillance of mobile communications requires a court order and the mobile operator as intermediary. But Jelena Pejic Nikic, a researcher at the Belgrade Centre for Security Policy, said IMSI catchers in Serbia risk being used outside of normal procedures.

“There is no public regulation governing the application of this specific technology,” Pejic Nikic told BIRN. “There are more general legal provisions under which it might, but even then it enters a grey area, primarily due to potentially disproportionate surveillance and a lack of oversight.”

“The police,” she added, “must not use this technology preventively, such as identifying participants in anti-government demonstrations”.

IMSI catchers are used for intelligence gathering, in criminal investigations and search operations. But they also offer indiscriminate surveillance of large groups of people in specific areas, a practice that civil society organisations and digital rights advocates have long warned about, BIRN said.

“These devices have no limitations; they can be deployed in any location or situation, continuously monitoring large numbers of users simultaneously,” said an IT expert, speaking on condition of anonymity.

Stressing that wiretapping without a court order is a criminal offence, Pejic Nikic questioned how the operator of an IMSI catcher could isolate only those devices contained in such an order.

“If it is technically possible, the question arises about oversight – ensuring against excessive or abusive use,” Pejic Nikic told BIRN.

IMSU catchers used during 2014 protests in Ukraine

BIRN recalls that, in January 2014, when protests in Kyiv’s central square over the then pro-Russian president’s refusal to sign an integration deal with the European Union were at their peak, according to media reports, at midnight demonstrators received the same text message to their phones: “Dear subscriber,” it read, “you are registered as a participant in mass unrest”.

The message was delivered using an IMSI catcher.

Read the full story here.