"Whoever has nothing to hide has no reason to be afraid of spying," said the President of the Constitutional Court, Vladan Petrov, commenting on the students' claims that their phones were attacked by spyware. That short sentence contains one of the most dangerous assumptions that a surveillance society can rest on: that privacy belongs only to those who have something to hide and that the citizen, instead of the state, should explain why he does not want to be monitored.
At the beginning of September, students held a press conference for the first time since the beginning of the student protests, where they talked about the attacks on their phones. According to the findings of the SHARE Foundation, at least 14 students, activists and opposition MPs were targeted by advanced spyware in 2026. The findings of the SHARE Foundation were confirmed by two forensic laboratories, and the Citizen Lab from the University of Toronto confirmed that Pegasus was found on the phone of a member of the student movement. Amnesty International has also confirmed attacks on the devices, while Pegasus is found on at least two phones, according to findings so far.
It is about software that can provide access to almost the entire contents of the phone, including messages, photos, contacts and documents, but also to turn on the microphone or camera without the knowledge of the owner, take screenshots and send the data to the person controlling the attack. Such an approach is not just eavesdropping on one person. It provides access to the people the person is talking to, their family, friends, colleagues and co-workers.
Most of the people who were targeted, according to the findings of the SHARE Foundation, belonged to the student movement, activists or local opposition structures, and the period of the attacks generally coincides with the campaign for the local elections held on March 29. Andrijana Ristić from the SHARE Foundation estimated that this was the largest recorded wave of the use of this type of spyware in Serbia. She also stated that the case of Pegasus infection, which was confirmed on the device of the student Milica, is, according to current knowledge, the first such confirmed case in the world during the year 2026.
However, this still does not answer the question of who ordered the surveillance and who managed it. It gives an answer to something else, much more specific: the phones of certain people have been attacked by software that allows almost complete control over the device.
ONE NOTIFICATION
photo: Aleksandar Barda / Fonet...
On August 13, Milica received a notification from Apple that her phone was the target of a spyware attack. The message said that Apple had detected a mercenary spyware attack and recommended that Apple take measures to protect its data. She contacted the SHARE Foundation, and her phone was then sent for forensic examination.
"I'm not indifferent to the fact that someone can see, hear or photograph me, but my first reaction was anger," she tells "Vreme".
Milica believes that the communication of the student movement and the way its members cooperate with each other could have been important to the attackers. She assumes that they could be interested in who is talking to whom, why they are talking and how the network of people who joined the protests works.
"I think it is even incomprehensible to such a class of people that something can work without blackmail, without bribery, but only with pure will, desire and enthusiasm to succeed in our fight," she says.
Her reaction also speaks to something that is often lost when talking about spyware as a technical problem. A phone is not just a device that contains the data of its owner. It is the space where his private and public life meet. It contains non-public messages, unpublished photographs, conversations with parents, partners and friends, business communications and contacts from people who never agreed to be part of any investigation.
Milica said at the press conference that she only realized how widespread the attack was when she came to Belgrade to have her phone checked. Someone who had access to the device could only see what was related to student meetings. He could access private conversations, microphone and camera.
"They could have turned on the camera while we were showering, talking about private things. It's not normal what's happening," she said.
Milica especially emphasized that the attack did not threaten only her. If there are other people's contacts in the phone, then monitoring one person turns into monitoring the entire network.
When a phone is compromised, the attacker not only gets the data of the person using it, but also the data of all the people who communicate with it. The volume of data thus collected is difficult to limit to one event, one person or one specific purpose.
HOW TO LIVE WITHOUT PRIVACY
Psychologist Goran Tomin believes that the psychological consequences of such surveillance cannot be reduced to the fear that someone will find out a secret.
"Simply put, psychologically speaking, if we don't have privacy, we live in a situation of persecution," says Tomin for "Vreme". "When you know that at any moment someone can know what you are doing, where you are, who you are with, what kind of messages or emails you send, who you talk to, but also that they intend to use it against you in any way, how can you live relaxed, regardless of the fact that you have nothing to hide?"
Tomin insists on a distinction that is often deliberately blurred in public debates about surveillance. A person can want to keep something private and at the same time have no reason to hide it.
"Hiding something and having privacy are two completely different things," he says.
The consequences of the constant feeling that someone can watch a person can be very concrete. A person can lose the sense of security even in his own home, become anxious, constantly tense and have problems sleeping and concentrating. He may begin to avoid certain places, people, or ways of communicating, and prolonged exposure may lead to depressed mood, irritability, and more serious traumatic reactions.
Tomin especially warns about the feeling of helplessness that arises when a person believes that he cannot control what happens to him.
However, students are not primarily talking about fear for now. Milica says that they are dominated by anger and that, despite knowing that their phones may have been compromised, they do not feel insecure about the goal of the student movement.
Ognjen Rašić, a student at the Faculty of Philosophy in Niš, also received a warning that his phone was the target of an attack. He believes that students and activists are being monitored because they participated in protests and because they were trying to contribute to local elections being conducted legally and fairly.
"We want to talk about these things. We stand for truth, justice and transparency. Someone has been eavesdropping on us, but we have nothing to hide," Rašić said at the press conference.
His sentence brings us back exactly to what the President of the Constitutional Court said, but from a completely different angle. If a citizen has nothing to hide, it does not mean that he has agreed to the state or anyone else having unlimited access to his life.
HOW FAR DOES SUPERVISION GO?
In one of the cases it investigated, the SHARE Foundation found more than 1500 screenshots taken by the spyware at the behest of the attacker. In other cases, forensics have found clues that show the software was able to access the phone's contents and activate its functions.
"It is impossible to control the scope of that surveillance," Ana Toskić Cvetinović, a lawyer from the organization Partners Serbia, said at the press conference.
If someone gets access to the phone, it is difficult to determine in advance where data that could possibly be relevant to an investigation ends, and where private conversations, photos, business communications and data of people who have nothing to do with the investigation begin.
Ana Toskić Cvetinović believes that, if the circumstances in which the devices were monitored are confirmed, there could be more crimes, including unauthorized collection of personal data, introduction of a computer virus and unauthorized access to a protected computer, computer network or electronic communication. She believes that the Prosecutor's Office for High-Tech Crime, the Protector of Citizens and the Commissioner for Information of Public Importance and Protection of Personal Data should respond to allegations of surveillance.
IT DIDN'T START THIS YEAR
This year's cases are just new evidence in a series that sophisticated spyware is being used in Serbia.
At the end of 2024, Amnesty International published findings about a previously unknown Android spyware called NoviSpy. Forensic analysis showed that the software could extract data from the phone and remotely activate the microphone and camera. Amnesty has linked NoviSpy with a high degree of security to the Security and Information Agency.
In February 2025, Amnesty published findings on the phone of a Serbian student activist. Forensics determined that Cellebrite was used to bypass the protection of Android devices, after which an attempt was made to install an application that matched the previously documented cases of NoviSpy. In the same year, Amnesty also published findings according to which two BIRN journalists in Serbia were targeted by Pegasus.
After the publication of Amnesty International's findings, Cellebrite announced that it had suspended the use of its products by "relevant users" in Serbia.
These cases have been before the Prosecutor's Office for High-Tech Crime for two years without a final epilogue.
Now a new wave is emerging. The SHARE foundation states that in two publicly known cases NoviSpy was used and that in one of them the phone was previously taken from the person who was taken to the police premises. According to SHARE's findings, the phone was unlocked there, data was copied, and then spyware was installed, after which the person was sent home with a compromised device.
These allegations should be distinguished from the forensically confirmed fact that the device was infected. Forensics can show what happened to the phone and what software was found on it, but the question of who ordered the attack and who directed it requires further investigation.
MILLIONS FOR STATE VOYAGERISM
photo: miloš milivojević / tanjugTHE PRESIDENT OF THE CONSTITUTIONAL COURT DOES NOT SEE ANYTHING WRONG IN TAPING STUDENT PHONES: Vladan Petrov
Pegasus is produced by the Israeli company NSO Group, and the SHARE Foundation states that this software is sold to states and state institutions and that its use costs millions of euros.
That's why the question is no longer just what a spyware can technically do. The question is who acquired it, who decided to use it against specific people, under what authority, and what happened to the data that was collected.
The only thing left unanswered is the fact that someone had the technology that allowed them to peer into the lives of people who publicly criticized the government, participated in protests or engaged in local politics.
The BIA called the accusations "trivial sensationalism" and assessed that they show the intentions of people and organizations working in the interests of foreign services and various pressure groups. President Aleksandar Vučić said that the students raise suspicions "without any evidence" and added that he himself was eavesdropped when he was president, as well as earlier when he was the opposition leader, but that he never presented himself as a victim and that he "endured it like a man."
The Rector's College of the University of Belgrade, however, expressed concern over allegations of unauthorized collection of data on students and requested an urgent determination of the facts. The collegium condemned any form of illegal surveillance and violation of privacy.
In the meantime, the students decided to talk about everything publicly. Milica says that they knew that in the conditions of media darkness, such a serious matter can remain at the level of private conversations if it is not discussed publicly. That is why they wanted to emphasize that it is not about 14 randomly selected phones, but about the phones of people who are very active in the student movement.
PRIVACY AND SECRET ARE NOT THE SAME
Even if all the people whose phones were targeted turned out to be completely innocent of anything the government could ask them, their privacy would not be made any less valuable.
That is the basic problem with the sentence that a man who has nothing to hide has no reason to fear surveillance. It shifts the responsibility from the one who supervises to the one who is being supervised. Instead of the state explaining why it needs access to someone's conversations, photos and contacts, the citizen should explain why he is uncomfortable with someone reading his messages.
Such an argument blurs the line between privacy and secrecy. A secret can mean information that someone deliberately withholds because its disclosure could harm him. Privacy is a space where a person does not have to account to anyone for their every conversation, movement, relationship or thought. Goran Tomin says that precisely the loss of that space creates a sense of persecution. Even when a person wants to fight back against the one who is monitoring them, they have to assess whether they still feel like someone who is in control of their own life or someone who has to be constantly on guard.
Anger can be a powerful motivator to keep fighting, but it cannot protect against the consequences of constant surveillance. A man can be brave and afraid at the same time. He can continue speaking in public and still start thinking about what he can write in a private message. He can refuse to be silent, and his sense of security changes.
Therefore, the consequence of spyware does not have to be only what the attacker directly does with the data he has collected. The consequence can also arise when people start to change their behavior themselves because they no longer know who is listening to them.
If the citizen is told that he has nothing to fear because he has nothing to hide, then he is actually being asked to accept that privacy is not his right, but a privilege that he must justify.
The students are now waiting for the completion of the forensic analyzes and the answers of the competent institutions. They are waiting to find out who hacked their phones and who had access to the data those phones contained.
In the meantime, there remains a more important question than whether any of them have anything to hide: why anyone would have to have anything to hide in order to have the right to keep their phone, conversations, photos, family and private life theirs.
