European Commission concerned about HRW findings on possible misuse of espionage in Serbia

The European Commission has expressed concern about reports of possible misuse of spy and forensic tools for mobile phones to illegally monitor journalists, human rights defenders and other individuals in Serbia.

Brussels responded to a question from REL regarding Human Rights Watch (HRW) findings that Bulgarian authorities have issued licenses for the export of surveillance equipment to countries that have documented spying on government dissidents, including Serbia.

HRW warned that these are countries that could misuse such technology.

A European Commission spokesman said that "any attempt to illegally access the data of citizens, including journalists and political opponents, if confirmed, is unacceptable."

He recalls that the European Commission's report on Serbia for 2025 stressed that such surveillance "produces a frightening effect and can lead to self-censorship."

"In the European Union, the investigation of such matters is the responsibility of each individual Member State. The Commission expects national authorities to fully investigate all such allegations and restore citizens' trust," it said.

Documents obtained by HRW show that the Bulgarian company Circles BG had a license to export to Serbia from August 2023 until the same month of the following year.

The organization stressed that the permit refers to the same time period in which the use of mobile phone hacking tools and spyware against independent journalists and members of civil society has been previously documented.

The permit was issued for the “Pixel Move” mobile phone tracking device by the Bulgarian company Circles, which is capable of intercepting voice communications, messages and internet traffic.

Circles is a Bulgarian company affiliated with NSO Group, the Israeli firm behind the infamous Pegasus spyware program, which is used for secret surveillance all over the world, including Serbia.

HRW was unable to determine whether the company actually used these export licenses, or whether the equipment was actually exported.

REL addressed this question to the authorities in Serbia and Bulgaria, as well as to the company itself, but received no response.

Export control in EU countries

HRW, as well as Amnesty International, have criticized the European Union for insufficient control over the export of surveillance technologies from member states.

Brussels says it is aware of the HRW report and is analyzing its contents.

A Commission spokesperson points out that the EU controls the export, transit, brokering and provision of technical assistance related to dual-use goods – including cyber-surveillance products.

“All with the aim of preventing, among other things, the proliferation of weapons of mass destruction (WMD) and maintaining regional peace, security and stability, as well as respecting human rights and international humanitarian law.”

He points out that the EU has significantly tightened export controls on such products and has issued guidelines to support the implementation of export controls by exporters and competent authorities.

The guidelines mean that cyber-surveillance technologies cannot leave EU territory without an export authorisation (or licence) issued by the competent authority of a member state, he explains.

It also notes that Member States are entirely responsible for issuing or refusing export licenses for dual-use items, as well as for their enforcement.

"The competent authorities of the Member States should consider in particular the risk that these products could be used in connection with internal repression or serious violations of human rights and international humanitarian law," a Commission spokesperson said.

The Commission stresses that export controls must be regularly updated to adapt to changing security risks and threats, as well as to the rapid development of science and technology.

"To this end, the Commission is engaged in a continuous dialogue with industry, academia and civil society, seeking to find the right balance between security and trade," Brussels said.

They announce that a comprehensive evaluation of the EU Dual-Use Regulation will soon be launched, which will also include controls on cyber-surveillance products.

The assessment is expected to be completed in early 2027.

Brussels notes that these principles also apply to Serbia, as a candidate country for membership that has committed to harmonizing its legislation with the EU acquis, as well as with European standards and values.

“The Commission will continue to closely monitor developments in the area of ​​the rule of law and fundamental rights in Serbia,” they say.

The illegal surveillance of journalists and activists in Serbia has been highlighted by numerous international institutions and bodies, including the Council of Europe in its Resolution on the State of Democracy in Serbia, adopted on June 23.