Forensic evidence indicates that Serbian pro-democracy figures were subjected to systematic digital surveillance in the months leading up to the local elections of March 2026. This revelation, brought to light through a comprehensive investigation by The Citizen Lab, paints a grim picture of the state of privacy and political freedom in the country. The report, titled “Targeting Democracy,” provides a forensic roadmap of how high-grade mercenary spyware was deployed against activists, academics, and legal professionals. This surveillance campaign was not merely an act of passive monitoring but a calculated effort to undermine those who challenged the government’s grip on power. As the political climate grew increasingly polarized, the use of technology like Pegasus, developed by the NSO Group, became a central pillar of the state’s repressive apparatus. By identifying at least 16 confirmed cases of infection, researchers have demonstrated that the scope of this digital intrusion was far wider than previously anticipated, affecting the very core of Serbian civil society.
Political Unrest: The Rise of Digital Weaponry
The roots of this current surveillance crisis can be traced back to the widespread anti-corruption protests that gripped the nation in late 2024. These student-led movements sparked a period of intense political volatility, prompting the administration to adopt more aggressive tactics to monitor and control dissent. As the local elections of March 2026 approached, the urgency to suppress opposition voices reached a fever pitch. Investigations conducted by the SHARE Foundation, with technical support from Amnesty International’s Security Lab, initially uncovered a network of targeted individuals that has since expanded. This surge in digital attacks suggests that the government viewed independent thinkers and social activists as existential threats to its continuity. The environment of constant monitoring has effectively transformed the digital landscape into a battlefield, where those advocating for transparency find themselves outgunned by sophisticated software designed to strip away their anonymity and privacy.
A particularly alarming aspect of this campaign is the sophisticated dual-track strategy employed by the surveillance apparatus. Rather than relying solely on international mercenary tools, the state has integrated homegrown Serbian spyware with the notoriously effective Pegasus system. This hybrid approach allows for a versatile and resilient monitoring infrastructure that can adapt to different levels of technical resistance. Pegasus represents the high-end tier of this weaponry, capable of infiltrating even the most secure modern smartphones. Meanwhile, locally developed tools provide a cost-effective means of monitoring a broader range of protesters and lower-profile activists. This multifaceted strategy ensures that no corner of civil society remains unobserved, creating a comprehensive net that catches both high-level political rivals and the grassroots organizers who form the backbone of democratic movements. The integration of such technologies signals a long-term commitment to maintaining political control through the constant subversion of digital communications.
Targeted Oppression: Academic and Judicial Resistance
The case of Professor Vladan Đokić, the Rector of the University of Belgrade, serves as a poignant example of how academic freedom is under siege. Đokić became a high-priority target after he refused to comply with state directives to penalize student protesters, a stance that made him a hero to the youth but an enemy of the administration. Forensic analysis of his mobile device confirmed that he was targeted with a “zero-click” exploit, an advanced method that installs spyware without requiring the user to interact with any malicious links or files. This level of sophistication is particularly troubling because it renders traditional digital security measures largely ineffective. At the time of the infection, Đokić was being considered as a potential leader for the “Student List” in the upcoming snap parliamentary elections. The timing suggests that the surveillance was a preemptive measure intended to gather intelligence on his political associations and strategies, effectively neutralizing a powerful opposition figure before he could even officially enter the race.
Beyond the academic sphere, the surveillance net has also ensnared key figures within the judicial system, as demonstrated by the experience of Rade Bajić. As a senior prosecutorial associate at the Public Prosecutor’s Office for Organized Crime, Bajić was at the forefront of investigating the “Generalštab” case, a controversial project involving a luxury development on a historically protected site. Allegations had surfaced that high-ranking officials had bypassed cultural heritage laws to facilitate the project, making Bajić’s work a direct threat to powerful political interests. After being removed from the case and speaking out against judicial interference, Bajić began receiving official threat notifications from Apple, indicating that his device had been targeted by state-sponsored actors. The use of spyware in this context highlights a dangerous trend where technology is leveraged to shield high-level corruption from legal scrutiny. By monitoring the communications of investigators and whistleblowers, the state can effectively obstruct justice and ensure that sensitive investigations are derailed before they reach the public eye.
Future Perspectives: Safeguarding Democratic Integrity
The Citizen Lab’s investigation reveals that these surveillance campaigns were characterized by their highly synchronized nature, coinciding perfectly with major political milestones like the March 2026 local elections. This was not a case of random data collection but a strategic application of technology to gain a tactical edge during sensitive periods. By obtaining real-time access to the private conversations of opposition figures, the state could anticipate their movements and respond with targeted hurdles. This capability transforms the democratic process into a rigged game where one side has access to the internal strategies of the other. Furthermore, the technical invisibility of “zero-click” exploits creates a profound chilling effect across society. When activists realize their interactions are monitored without any trace, the psychological burden discourages them from participating in democratic processes. This uncertainty breeds a culture of self-censorship, effectively dismantling the trust necessary for a healthy civil society to function and grow.
To counter this existential threat, the international community and local advocacy groups established a set of actionable defenses and future-looking policies. Experts determined that individuals at high risk should consistently utilize advanced security features such as Apple’s “Lockdown Mode,” which proved effective in blocking many mercenary spyware exploits. Additionally, the collaboration between the SHARE Foundation and technical labs provided a critical framework for identifying infections and supporting victims. Moving forward, the events in Serbia illustrated the desperate need for a global moratorium on the trade of mercenary spyware to regimes with a history of human rights abuses. True democratic resilience will require the implementation of strict export controls and the continuous funding of independent forensic research to keep pace with evolving threats. By treating digital security as a fundamental human right rather than a technical luxury, civil society can begin to reclaim the digital space from those who seek to use it as an instrument of state-sponsored repression.
