Serbia can dispute who installed the spyware. It still has to explain how a private message from a targeted phone ended up on television.
Ngadhnjim Brovina | 3 September 2026
A student in Serbia was taken in for questioning. Police unlocked the phone by force, copied what was on it and, according to forensic investigators, installed software that continued collecting information after the student had left the station. More than a thousand screenshots were recovered from one infected device. Another phone carried the same implant.
That second infection was discovered because something happened that should make the European Commission considerably more interested than another statement about Serbian media freedom.
A private Viber message from the phone was read aloud on Informer television.
How did it get there?
The SHARE Foundation published its findings on 2 September. Fourteen people targeted since the beginning of the year came from a recognisable political category: members of the student movement, activists associated with IT blokada, an opposition member of parliament and a local councillor. Twelve approached researchers after Apple warned users in 110 countries that they had likely been targeted with mercenary spyware. Citizen Lab confirmed Pegasus on one student's iPhone, delivered without any action by the target, with indicators extending from December 2025 into January 2026. Amnesty International's Security Lab examined the Android implant and found software resembling NoviSpy in function but built again from the beginning, with what Donncha Ó Cearbhaill called "posebni napori da se izbegne da ga otkriju stručnjaci za bezbednost," particular effort spent on evading the security researchers who exposed the earlier version.
The targeting period ran across Serbia's 29 March local elections.
Nobody has established who installed Pegasus. Reuters could not determine responsibility. NSO Group says its technology is sold only to government customers. Ana Toskić Cvetinović of Partneri Srbija has pointed out that surveillance of this kind requires judicial authorisation. "To our knowledge, there is no such thing here," she said. Serbia's government did not answer Reuters' questions.
Those uncertainties matter. They are also becoming a convenient place to hide.
Belgrade can say there is no proof that Aleksandar Vučić ordered anybody's phone infected. There isn't. It can say nobody has publicly identified the Serbian institution that deployed Pegasus. Nobody has. It can dispute attribution, methodology, jurisdiction and terminology for as long as Brussels permits the discussion to remain there.
But none of that explains Informer.
A private communication was on a targeted phone. That communication subsequently appeared on television. Somewhere between those two facts is a route nobody has explained, and it is the one part of this case that survives every attribution argument Belgrade can win.
Consider how the European Union will process what happened.
Serbia's annual report will assess police conduct under one heading and intelligence oversight under another. Media freedom will be scored in its own section, by assessors reading different material. Election integrity will appear elsewhere again, and the treatment of political opponents elsewhere after that, with Cluster 1 sitting above all of it in the language of benchmarks and interim assessments. Each section will be defensible. The report will be accurate. It will also be incapable of describing a single unexplained movement from a police station to a broadcast studio, because no section of it is written to hold more than one institution at a time.
The phone does not respect those divisions.
If material obtained through state access to a device travelled into the political media system, then what Brussels measures separately may be operating as one thing.
That possibility is more serious than another hostile television segment. It raises elementary questions that do not require the European Union to establish who purchased Pegasus before asking them.
Was there a judicial order authorising access to the phones?
Which institution obtained the data?
Where was it stored?
Who had access to it?
Was the Viber communication that appeared on television among material extracted from a targeted device?
If it was, who transferred it?
Has anyone investigated how private correspondence from a politically targeted person reached a broadcaster closely aligned with the government?
The Serbian state can answer those questions. Or it can refuse to answer them. Either response would tell Brussels something.
This is where the familiar European excuse becomes harder to use.
The European Union has spent years failing to construct an adequate response to spyware inside its own borders. The European Parliament created the PEGA inquiry in 2022 after Pegasus and equivalent technologies were discovered on phones in several member states. Parliament adopted recommendations in June 2023. Five months later it passed a further resolution, by 425 votes to 108, condemning the Commission's failure to follow up. The Commission's defence was substantially institutional: national security remained principally a responsibility of member states.
That record is bad enough. It is not an excuse in Serbia.
Serbia is not a member state claiming national-security prerogatives against Brussels. It is a candidate asking Brussels to certify that its institutions are converging with the democratic and legal order of the Union. Conditionality exists precisely for this interval.
The Commission does not need a new European spyware regulation before asking whether Serbian police accessed the phone of an anti-government activist under judicial authority. It does not need unanimity among twenty-seven capitals to ask whether information obtained by state institutions reached a partisan broadcaster. It does not need to settle the constitutional division of national-security powers inside the Union before treating surveillance of opposition politicians, students and activists as a rule-of-law problem in a candidate country.
It needs to ask. And then it needs to care about the answer.
At the Belgrade press conference, the first the student movement has held since the protests began, Ela Zeković of the Faculty of Political Sciences put the point without any of the qualifications available to diplomats. "Taj softver prodaje se samo državama i neko za to mora da odgovara." That software is sold only to states, and somebody has to answer for it.
A student enters a police station with a private telephone. Software is allegedly placed on it. Information is extracted. A private communication associated with another targeted device turns up on television.
There may be other explanations for parts of that sequence. Serbia should provide them.
Until it does, one small question sits underneath every larger one Brussels can put into a report, and it is harder to evade than any of them.
How did the message get to Informer?
Ngadhnjim Brovina teaches political science at UBT in Prishtina. He writes on enlargement, conditionality, and the institutional politics of the Western Balkans.
