Over the past decade, Serbia has imported over 20 IMSI catchers, devices capable of intercepting data from all mobile phones within a certain area. These devices, which can collect communications from nearby phones, have raised concerns among experts due to the lack of legal regulation surrounding their use in the country, according to BIRN.
IMSI catchers, also known as International Mobile Subscriber Identity catchers, work by mimicking legitimate mobile network base stations. They identify and track users, collecting data from all mobile phones within a range of several hundred meters. This technology can be used for surveillance and intelligence gathering, but experts argue it operates in a legal gray area in Serbia, where no specific laws have been introduced to regulate its use.
BIRN’s research revealed that Serbia imported 16 IMSI catchers from Switzerland and Finland in just the past year. One such device, purchased from a Swiss company by Serbia’s Ministry of Internal Affairs, cost approximately two million Swiss francs (around two million euros). The same suppliers have sold similar technologies to countries with questionable human rights records, including Namibia, Morocco, the United Arab Emirates, and Colombia.
These IMSI catchers are portable and small enough to fit in a backpack, making them difficult to detect. This portability, combined with the lack of oversight, raises alarms about their potential for invasive surveillance. While regular surveillance of mobile communications typically requires a court order and coordination with mobile operators, IMSI catchers allow for surveillance without the need for a warrant or operator involvement.
Jelena Pejić Nikić, a senior researcher at the Belgrade Center for Security Policy, warned that IMSI catchers could be used outside of the legal framework. “Although there are general laws that could cover their use, there is no specific regulation, which creates a gray area. The police should not use these devices preventively, for example, to identify participants in anti-government demonstrations,” Pejić Nikić explained to BIRN.
Officially, IMSI catchers are meant for intelligence gathering, criminal investigations, and searches. However, they can also enable mass surveillance, allowing authorities to track large numbers of people in specific areas. Civil rights organizations and digital rights advocates have long raised concerns about the potential for abuse, as these devices can monitor numerous mobile phones in any given location, continuously and without limitations.
An anonymous IT expert explained the risks of using IMSI catchers: “These devices have no restrictions—they can operate anywhere, in any situation, and can monitor multiple users simultaneously.” This raises questions about how such surveillance could be regulated and whether there are measures in place to prevent excessive use or abuse of the technology.
Pejić Nikić further pointed out the issues around wiretapping without a court order. “If it’s technically possible to isolate devices covered by a court order, then the real question is how to ensure that these measures are properly supervised to prevent misuse,” she added.
The use of IMSI catchers in anti-government protests has been noted in other countries as well. BIRN recalls that in January 2014, during protests in Ukraine against then-President Yanukovych, protesters received the same text message stating, “Dear user, you are registered as a participant in mass riots.” This message was reportedly sent via an IMSI catcher.
In Serbia, similar concerns arise over the use of IMSI catchers during anti-government protests, which have been recurring in recent years. Pejić Nikić emphasized that there is no legal basis for using this technology in such situations, and such actions would be both illegitimate and disproportionate, threatening the protection of personal data and infringing on the fundamental rights to freedom of expression and assembly.
