Over the past decade, Serbia has introduced more than 20 IMSI catchers capable of indiscriminately intercepting communications from all mobile phones within a given area. According to experts, their use is not regulated by law.
It was January 2014, and protests in central Kiev against the then pro-Russian president’s refusal to sign an integration agreement with the European Union were reaching their peak. Despite freezing temperatures and heavily armed police, protesters occupied the square and refused to leave.
Reports from the media indicated that at midnight, they suddenly received the same text message on their phones: “Dear participant,” it read, “you are registered as a participant in mass riots.”
The message was transmitted through a device called an International Mobile Subscriber Identity (IMSI) Catcher.
Highly controversial, IMSI catchers pose as cell towers, identify and locate users, and indiscriminately intercept the communications of all mobile phones within a radius of several hundred meters.
According to findings from BIRN’s investigation, Serbia has imported more than 20 such devices over the past decade, but, according to experts, has failed to update its legislation to regulate their use during this period.
Last year alone, Switzerland and Finland issued 16 export licenses for IMSI catchers to Serbia, according to their foreign ministries. A single device purchased by Serbia’s Ministry of Internal Affairs from a Swiss company cost almost two million Swiss francs, or just over two million euros.
Public data shows that suppliers have sold similar technology to a number of countries with questionable human rights records, such as Namibia, Morocco, the United Arab Emirates, and Colombia.
Often portable and small enough to fit into a backpack, IMSI catchers are invisible to their targets, making it nearly impossible to defend against their intrusive features.
Normally, police surveillance of mobile phones requires a court order, and the mobile operator must act as an intermediary. However, Jelena Pejić Nikic, a researcher at the Belgrade Centre for Security Policy, stated that IMSI catchers in Serbia may be used outside of normal procedures. This is especially concerning in light of ongoing protests against the Progressive Party in power.
“There is no public regulation for the application of this particular technology,” Pejić Nikic told BIRN. “There are broader legal provisions under which it may be used, but even then, it remains in a gray area, primarily due to potentially disproportionate surveillance and the lack of oversight.”
“Police,” she added, “should not use this technology preemptively, for example, to identify participants in anti-government protests.”
IMSI Catchers: An Intelligence Tool or a Privacy Threat?
IMSI catchers are used for intelligence purposes, criminal investigations, and search operations. However, they also enable indiscriminate surveillance of large groups of people in specific areas—a practice that civil society organizations and digital rights advocates have long warned against.
“These devices have no restrictions; they can be placed anywhere and in any situation and can continuously monitor a large number of users at the same time,” said an IT expert, who wished to remain anonymous.
“Variants include stationary devices with high capacity, mobile backpack-sized versions, suitcase models, and in recent years, even drones. They are mostly used in urban areas densely covered by base stations.”
Matej Kovacic, a cybersecurity researcher and lecturer at the University of Nova Gorica in Slovenia, told BIRN: “When IMSI catchers are placed in busy areas like shopping centers or downtown areas, they gather data not only from the targeted individuals but also from everyone within a radius of several hundred meters.”
Pejić Nikic emphasized that eavesdropping without a court order is a criminal offense and questioned how an IMSI catcher operator could isolate only the devices listed in such an order.
“If it is technically possible, the question arises of monitoring to prevent excessive or abusive use,” said Pejić Nikic.
“There should be software capable of automatically logging all actions and the identities of authorized users, and this log should be tamper-proof. Prosecutors and judges should then compare this log with police reports and take appropriate actions.”
Pejić Nikic emphasized that there is “no legal basis” for using such technologies in relation to anti-government protests that have continually flared up in Serbia in recent years.
“Such use would not be legitimate or proportional and would seriously jeopardize not only the right to protect personal data but also the freedom of speech and assembly,” she warned.
Pejić Nikic cautioned that the use of IMSI catchers “clearly bypasses operators, who are otherwise obligated to ensure that all requests they receive are based on court orders and to reject incomplete requests.”
Kovacic stated that IMSI capture logs can be deleted and that one possible solution could be the creation of an independent third party to monitor usage by the police and intelligence agencies.
Serbia’s electronic communications regulator, RATEL, told BIRN that it had not discovered any IMSI catchers in the country over the past decade, and security authorities had not informed RATEL about their intended use.
The High Price of Swiss Surveillance Technology
An IMSI catcher is not cheap.
In October 2023, the Zurich-based company NeoSoft delivered two devices—one to Serbia’s Ministry of Internal Affairs and the other to the intelligence service BIA. The Ministry paid 1.95 million Swiss francs, or just over two million euros.
The second device was imported for testing purposes, and the BIA did not retain it for long, according to Switzerland’s State Secretariat for Economic Affairs (SECO).
NeoSoft had already delivered an IMSI catcher to the Ministry of Internal Affairs at the end of 2016, but at a significantly lower price of 147,000 Swiss francs, or 158,000 euros.
According to Kovacic, prices for such devices vary depending on the functionality and sophistication of the interface.
“These devices also have little competition, which explains their high price,” he said.
NeoSoft’s product catalogs from 2010 show that the company spent years developing cell communication monitoring technologies capable of intercepting calls, SMS messages, and geographical locations, selectively blocking signals, decrypting communications, identifying voices, and activating microphones remotely.
Advanced IMSI catchers have features like “silent calls,” which mimic a call to a targeted device and activate its microphone.
In addition to IMSI catchers, NeoSoft offers global geolocation systems using the international telecommunications protocol SS7, enabling precise tracking of electronic devices worldwide. Such capability has been linked to the Israeli company Circles, which is said to have supplied similar technology to Serbian security agencies.
NeoSoft had previously been investigated by Swiss authorities for negotiations with the notorious Rapid Action Battalion (RAB) in Bangladesh. RAB is under the Ministry of Police and the Interior and is frequently accused by human rights organizations of violations, including the killing and abduction of rights activists and journalists.
Tender documents obtained by Privacy International and the Swiss newspaper WOZ in 2014 revealed that NeoSoft had planned to offer training for 10 RAB members in Switzerland that year. NeoSoft did not respond to the report.
In December 2023, the trial of former senior official of Serbia’s Ministry of Internal Affairs Dijana Hrkalović, who was accused of abuse of influence, and former police chief of Novi Sad Milorad Susnjić, who was accused of misuse of position, highlighted the use of IMSI catchers by police when investigator Božidar Drobnjak testified that Susnjić insisted on using an IMSI catcher to monitor Darko Elez, who was convicted of organized crime, because Elez was known to communicate via “special phones.” The verdict for the Hrkalović case is expected in January.
IMSI Catchers Based on Drones
Documents from the Finnish Ministry of Foreign Affairs show that Serbia has also purchased IMSI catchers and other equipment from EXFO, a company specialized in surveillance and communications equipment based in the Finnish coastal city of Oulu.
Serbia has imported at least 20 IMSI catchers from EXFO over the past decade.
As recently as February last year, eight export licenses were issued for such devices.
In May 2016, Serbia bought the NetHawk series from EXFO, designed to intercept and geolocate mobile communications and Wi-Fi, scan radio frequencies, block signals, and detect IMSI catchers.
The equipment was delivered with NetHawk F10 software, developed for “tactical intelligence gathering” in GSM, UMTS, and LTE networks, even in areas without base stations.
In 2018, Motherboard, an online IT magazine by VICE Media, reported that invasive devices produced by EXFO were being exported to countries like Oman, Indonesia, Mexico, Morocco, the UAE, and Colombia—countries with questionable human rights records.
A patent filed by NetHawk with the European Patent Office in 2011 shows that their IMSI catchers are already capable of taking control of cellular devices in real time by blocking legitimate base station signals and redirecting target devices to fake base stations.
A patent filed in the United States in February 2020 shows how far the technology has already advanced. It describes an IMSI catcher mounted on a drone, allowing for precise horizontal and vertical location, as well as “silent calls.”
CellXion: Monitoring from GSM to 5G
Serbia also bought IMSI catchers from MB between 2015 and 2018. Among the suppliers was London-based CellXion, which received licenses to supply Serbia with tools for monitoring wireless communications, blocking signals, and identifying subscribers.
CellXion describes itself as a specialist in intelligent monitoring of cellular communications in GSM and 5G networks.
Older protocols like GSM and 2G are more vulnerable to IMSI catcher attacks than newer 4G and 5G protocols, but Kovacic said to BIRN: “Some IMSI catchers exploit vulnerabilities in 4G and 5G networks by generating noise, causing unsupported phones to ‘fall back
