Security1 distinct publisher2 min readPublished
A letter signed Friday turns device forensics on Serbian student activists into an enlargement demand, though the signatory who spoke to CyberScoop says spyware will not be the deciding factor if Brussels moves.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
Two spyware families are in the forensic record, and responsibility for only one was assigned. Amnesty International, Citizen Lab and the SHARE Foundation said the NoviSpy evidence pointed to Serbian government authorities, while the Pegasus infection was left unattributed [3]. The state-responsibility argument behind an accession brake therefore rests on NoviSpy alone [12]. The groups' published findings do not say who operated Pegasus on those phones.
The letter itself names the party that would have to act. "It is time for the Commission to demonstrate that compliance with fundamental democratic standards is a non-negotiable requirement, not an option," the signatories wrote, after declaring that "appeasement has failed" [9]. They frame the surveillance as illegal and timed: "With upcoming elections ahead, Aleksandar Vucic's regime is using illegal digital surveillance to systematically dismantle political opposition" [13]. What is public is a request to the Commission; what is not public, so far, is any change to Serbia's negotiating track.
One of the signatories set the ceiling on the claim herself. Hannah Neumann told CyberScoop that "it could very well be that some of these demands will be honored, but for sure the spyware won't be the only reason why" [7], and described the country's history of spyware use as "another straw" on top of criticism the group has been making for some time [8]. In practice, the spyware finding is entering an existing rule-of-law file rather than opening one of its own, which makes it a supporting exhibit rather than a conditionality lever on its own terms.
The standard being applied at the border has not been written into law inside it. EU member states have faced their own spyware allegations, and spyware found on the device of a member of the Parliament's PEGA committee has revived calls to enact that committee's recommendations, which remain unenacted [10]. Belgrade can point at that gap, and the forensic reports on the activists' phones do not close it.
The measurable outcome here is narrow: a spyware condition written into the benchmarks Serbia has to meet, backed by the investigation the letter demands [4]. That is what the twenty-nine signatures are asking for. The Commission decides whether the request becomes text, and Neumann's own read is that Mladic and the wider rule-of-law record will be doing most of the work if it does [7].
Ranked by verification strength, evidence, and original report placement.
A group of 29 members of the European Parliament wrote on Friday seeking to delay Serbia's entry into the European Union over the Serbian government's use of spyware.
The MEPs cited a report published this week by the SHARE Foundation about spyware found on the phones of Serbian student activists and targeting others; the foundation, Amnesty International and The Citizen Lab at the University of Toronto discovered both Pegasus and NoviSpy infections.
The groups did not assign responsibility for the Pegasus infection, but said evidence from the NoviSpy infections pointed to Serbian government authorities.
The MEPs' demands include slowing Serbian accession into the EU until an investigation into Serbia's spyware usage is completed, and making Serbia's accession contingent on improving rule-of-law accountability.
The MEPs said Commission President Ursula von der Leyen should cancel a planned visit to Serbia.
Enlargement Commissioner Marta Kos canceled her own visit to Serbia on Friday over the alleged 'glorification' of former Bosnian Serb army commander and war criminal Ratko Mladic; European leaders were already outraged by Serbia's response to Mladic's death.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · September 4, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
security
Apple threat notifications led one of twelve Serbians to a forensics lab that confirmed Pegasus infection7 distinct publishers
product
Gates revives call for an AI tax, but regulators still aren't listening1 distinct publisher
product
TikTok's $400mn settlement prices the second offence at about 70 times the first6 distinct publishers
product
France's under-15 ban failed on the age check, not the age limit1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
The document is solid, the forensics are second-hand
Two of the three pillars are things CyberScoop can hold in its hands: the letter's text, quoted at length, and a named signatory on the record. The forensic finding arrives at one remove, summarised from SHARE Foundation's report with no indicators or methodology, and the institutions the letter targets say nothing. Belgrade did not answer before publication.
Twenty-nine signatures and no reply from the institutions
A letter from 29 members is not a parliamentary position, and nothing in this reporting shows the Commission acting on it. The one cancellation that actually happened, by Marta Kos, was about Mladic. Neumann's read is that the surveillance findings are additive pressure rather than a trigger.
The letter reaches past its forensics
Researchers tied only the NoviSpy infections to Serbian authorities and left Pegasus unattributed; the signatories describe illegal surveillance systematically dismantling the opposition before elections. Neumann's own phrasing, that spyware 'won't be the only reason' if anything is honoured, sits closer to what the evidence supports than the letter she signed does. CyberScoop's write-up keeps that gap visible instead of closing it.
Everyone quoted is asking Brussels for something
The signatories want leverage in accession talks and say so in the letter. The civil-society groups published forensics into a live enlargement fight. The Mladic row supplied momentum the spyware finding did not have to generate, and Serbia's silence leaves the account one-sided by default. Closing on spyware inside the Parliament itself is the one move in the piece that cuts against its own subjects.
What was sent is documented; what follows is not
Who signed, what they asked for and how they framed it are all documented. What any of it changes is unresolved, and the story's best source is the one saying so. A Commission response, or an independent reading of the forensic report, would move this in either direction.