Citizen Lab on surveillance targeting students: Serbia beginning to look like a buffet of mercenary spyware

N1: What have you been able to verify about the latest spyware targeting of students and activists here in Serbia?

“Well, what we’ve found is several things. First of all, we have a series of Apple notifications that have landed. This is very concerning because it indicates that there’s clearly a large-scale mercenary spyware operation going on. We’ve also conducted forensic analyses, including an analysis that allows us to say with high confidence that there’s been a Pegasus infection. All of these pieces point to one story, which is: there’s probably something larger going on.”

N1: When you’re mentioning Pegasus, what exactly was found on the device where Pegasus was detected? Was there a successful infection of the phone?

“There was a successful infection. Citizen Lab is 25 years old, and we are a world leader in conducting forensic analyses for this kind of what we call mercenary spyware. In this case, we analyzed artifacts from the device and concluded with high confidence that there had been an infection. Now, this kind of infection has a lot of capabilities. Functionally, it turns the phone into a spy in your own pocket.”

N1: We also heard that Apple warned their users that they had been targeted by spyware. What does such a notification actually tell us? And I mean, it's an Apple phone. What happens with Android phones?

“Well, first of all, I want to say: if you have received such a notification, you should treat your phone as if it has been compromised with this sophisticated spyware. We don’t think Apple sends these notifications by accident. If you've gotten one, you should take it seriously, and you should consult experts like the SHARE Foundation. What these notifications indicate is that Apple, in its investigations of sophisticated mercenary hacking groups like NSO Group and others, will sometimes find traces that infections have happened and then takes as its responsibility to notify the user. And so these are, we could say, the beginnings of a much deeper need for investigation. They’re the first step. They show pretty clearly that something has happened, and then we have to go from there. Now, there are several places that we can go. Obviously, groups like ours, the SHARE Foundation, our collaborator, Amnesty Tech, and others, can do forensic investigations. But I have to tell you that with mercenary spyware like Pegasus, the real evidence lies with the government operator. We know, from what NSO Group has said publicly, that their installations keep logs of every infection that has been ordered and conducted, and the exfiltration from that infection. So the canonical place where evidence would live would be with the government responsible for these operations.”

N1: You also mentioned Amnesty. Amnesty previously attributed Novi Spy to Serbia’s Security Intelligence Agency (BIA) with a high degree of confidence and documented other spyware cases in Serbia. So do the latest findings suggest, let’s say, isolated incidents or a broader pattern of state surveillance of journalists, activists, students - anyone the government considers to be against it?

“I have to tell you that as a researcher working on mercenary spyware and surveillance, to me Serbia is beginning to look like a buffet of mercenary spyware. And I have to tell you something else, which is: when we find cases, notifications here, notifications there, it’s like finding ants in your kitchen.

“In my professional experience, there are almost certainly many more cases waiting to be uncovered. Now, you mentioned Android phones earlier. Apple, obviously, does not operate Google, and they certainly don’t build Android phones.

“What this means, though, typically with mercenary spyware, is that the government customer will have the ability to hack Androids and iPhones. Now, we know from Amnesty’s great work that there has been other kinds of spyware on Android phones in Serbia.

“But we have this open question: what other infections are out there? It’s almost certainly the case that there’s a lot more that we haven’t found yet. It’s an extremely concerning situation.

“It’s a little bit like in epidemiology, when you start finding early cases of an infection and no clear explanation for how these people caught the infection. This means there’s a lot more out there.”

“Serbian citizens have had devices infected with government-grade spyware”

N1: Given that Pegasus, for instance, is sold generally to government intelligence and law enforcement agencies, what should Serbian authorities explain to the public? Because all we could hear from the authorities is that it’s a lie.

“Well, look, when you find Pegasus on a telephone, it's like finding the excrement, if you'll excuse my expression, of an elephant. There's an elephant somewhere. So who is the elephant in this room? Now, there are kind of two potential theories here. But what is clear is that Serbian citizens have had devices infected with government-grade spyware. So the question is: who did this infection? And I think it's critically important for the authorities to, at minimum, explain this. Otherwise, Serbian citizens can also ask this question: did someone else do it? Is there another government responsible? Now, I think what we have to look at here is the pattern of this targeting. Where are these infections landing? And I think the next step in this analysis is going to be also understanding the political situation in which these infections are happening.”

“Your whole life laid flat on the table by some government operator”

N1: And if Pegasus successfully infects the phone - we already talked about that - what can the operator actually access? Could the phone effectively become a surveillance device capable of reading communications, tracking movements, remotely activating its microphone and camera?

“That's right. So when a device is infected by Pegasus, Pegasus is what we call a zero-click infection. That means that there’s no website to visit, not even Pornhub, no link to click on, nothing that the user who becomes the victim can see.

“One minute the phone is theirs and it is private, and the next minute it is under someone else’s control. And once Pegasus is on a phone, it can do everything that you can do.

“It can view your pictures, look at your private messages, look at your encrypted messages, listen to your phone calls. But it can even do some things you can’t.

“For example, it can silently enable the microphone or the camera, turning it into what we would call an audio bug in a room, monitoring meetings or conversations. You go for a walk, you have a private conversation, you talk to your parents. All of these things are susceptible to monitoring.

“And it’s critical to understand that with this kind of surveillance, it’s not just your work life. It’s not just your public life. It’s not just what you say in the office. It is your whole life, laid flat on the table by some government operator. It’s an extremely invasive technology. And I think in many jurisdictions it would be considered illegally invasive.”

N1: And of course, with the elections coming up, how serious is the risk to democratic processes if state institutions are able to use highly intrusive spyware against students, activists, opposition politicians, journalists, without effective independent oversight? Especially since none of the previous cases have been solved.

“That’s exactly right. Now, this is not the first global case where Pegasus has shown up before elections.

“In Poland, for example, the member of parliament responsible for electoral strategy for the opposition in 2019 was hacked with Pegasus while he was planning that strategy. It’s not the only case.

“Ultimately, when infections happen with Pegasus prior to elections, this is a direct interference in the democratic process. For an election to work, people need to talk and strategize.

“They need the perception of privacy. Because as we all know, when you’re in a room and there’s a stranger listening to you, you will talk differently than when you do when you’re just with your friends. It’s an unbearable amount of government surveillance, and it needs to be clearly investigated.”