Serbia’s internet penetration rate has increased in recent years. According to 2020 data from the Statistical Office of Serbia, 74.3 percent of households have a computer, while 94.1 percent have a mobile phone. In 2020, 81 percent of Serbian households had an internet connection, with 90.5 percent using fixed-line broadband service and 71.9 percent using mobile broadband.1 Based on 2020 data from the International Telecommunication Union (ITU), 78.4 percent of Serbians have access to the internet, with a mobile broadband rate of 94.3 percent and a fixed broadband penetration rate of 25.1 percent.2 According to Ookla’s Speedtest data from February 2021, download speeds in Serbia averaged 47.81 Mbps for mobile and 72.93 Mbps for fixed broadband.3

In general, internet service in Serbia is reliable. Most users have some form of digital subscriber line (DSL) connection, and fourth-generation (4G) mobile internet technology is also widely available. According to the ITU, 98.9 percent of Serbians have access to WiMax/LTE (worldwide interoperability for microwave access/long-term evolution) coverage.4 Telekom Serbia, the state-owned telecommunications firm, has dramatically accelerated the development of its fiber-optic network in the last few years. Cable companies, which have long been a major factor in the development of high-speed internet in the country, also continue to invest in fiber optics. In 2020, the state launched a program to build fiber-optic infrastructure in previously neglected areas.5

Serbia has cultivated a strategic partnership in telecommunications with Chinese companies since 2017, when the government and the Chinese firm Huawei signed two nonbinding agreements concerning “smart cities” (see C5) and the development of broadband internet service. The Chinese government has also provided Serbia with loans intended for infrastructure and energy-sector development. The relationship forms part of Beijing’s plan for a Chinese-led “digital silk road,” for which Serbia would be a European hub.6

Over the past few years, many of the countries bordering Serbia have joined the “Clean Network,” a US-led fifth-generation (5G) mobile network security initiative that identifies the Chinese companies Huawei and ZTE as “untrusted IT vendors.” Although Serbia is not formally part of the “Clean Network,” in 2021 the president of Serbia and the prime minister of Kosovo signed a cooperation agreement in Washington, DC, pledging to refrain from using 5G equipment from “untrusted vendors.” However, the Washington agreement did not directly mention either China or specific vendors like Huawei.7

Originally planned to launch in 2021, the 5G network rollout in Serbia has been postponed. While Prime Minister Ana Brnabić publicly stated that citizens of Serbia currently do not need a 5G network, the minister of trade, tourism, and telecommunications, Tatjana Matić, blamed the delay on the COVID-19 pandemic and a related economic crisis.8

Internet service in Serbia is relatively affordable, although access to fixed-line broadband connections is more expensive than mobile access. According to 2020 data from the ITU, a 5 GB fixed broadband subscription costs $16.38 a month, or 2.77 percent of monthly gross national income (GNI) per capita, and 1.5 GB of mobile data costs $6.74, or 1.14 percent of monthly GNI per capita.9 The Broadband Commission for Sustainable Development has stated that “entry level broadband services” should cost less than 2 percent of monthly GNI per capita.

There is a digital divide between urban and less populous areas. According to 2020 annual data from the Statistical Office of Serbia, there are significant differences in terms of internet connectivity between urban centers, where 87.1 percent of residents have access to the internet, and smaller settlements and villages, where 70.4 percent of residents have access to the internet. The highest penetration rate is in Belgrade (94.1 percent), the capital and most populous city in Serbia, while the northern province of Vojvodina (75.3 percent), central and western Serbia (77.5 percent), and southern and eastern Serbia (77.3 percent) all have lower penetration rates.10 The regions with higher levels of internet access are mostly in the central and northern parts of the country.11

Levels of internet access among households also depend on socioeconomic conditions. Internet connections are present in 97.8 percent of households with a monthly income of more than €600 ($720), while in households with a monthly income of up to €300 ($360) it lags behind at 59 percent.12

Although the Law on Electronic Communications stipulates that “a set of basic electronic communication services of a certain scope and quality are available to everyone on the territory of Serbia at affordable prices,”13 in recent years there has been little progress in the implementation of universal service, according to the country’s Regulatory Agency for Electronic Communications and Postal Services (RATEL). A 2019 RATEL report on digital inclusion stated that providers have not built the necessary infrastructure because it would have limited economic viability in areas with fewer and less affluent users.14

The government did not disrupt or restrict access to the internet during the coverage period, and it has no past record of imposing internet shutdowns amid elections or other national events.

The infrastructure of internet service providers (ISPs) is not centralized, even though the state holds a majority stake in Telekom Serbia,15 one of the largest providers. Serbian Open eXchange (SOX),16 the country’s internet exchange point, is a private entity with a decentralized network.17

The telecommunications sector is relatively diverse, though state-owned Telekom Serbia holds the largest shares of both the mobile and fixed-line broadband markets. Telekom Serbia was already the most used and widely distributed ISP, but with its continued acquisition of smaller telecommunications companies, it now controls almost 50 percent of the country’s broadband internet market.18 There are no significant barriers to market entry. According to the Law on Electronic Communications,19 any company can provide telecommunications services if it fulfills general requirements and applies to RATEL.20 Individual licenses are only issued for limited resources such as frequencies. The Law on Electronic Communications mostly aligns with European Union (EU) rules, and there are plans to update it to achieve full alignment.21

Based on RATEL’s electronic communications market report for the fourth quarter of 2020, Telekom Serbia covered 43.5 percent of the estimated 6.58 million mobile subscribers,22 while Telenor Serbia, which is owned by the Czech investment group PPF,23 and A1 Serbia, formerly known as VIP Mobile, cover approximately 31 and 24 percent, respectively. Telekom Serbia and Serbia Broadband (SBB) effectively have a duopoly on the fixed broadband market. Of the 1.7 million fixed broadband subscribers, Telekom Serbia holds almost 40 percent, with SBB servicing 32.2 percent and Moja Supernova, which is part of Telekom Serbia’s group, covering an additional 13.5 percent.24

In January 2021, Telekom Serbia confirmed that it had signed an agreement to rent out fiber-optic cables to Telenor.25 In April 2021, United Media and SBB, which are both part of Netherlands-based United Group,26 filed a criminal complaint against Telekom and Telenor for concluding a restrictive agreement, which they believe could affect media freedom in Serbia because it could set a precedent that makes it more difficult for competitors to enter the market.27

RATEL, which is responsible for regulating the telecommunications and fixed-line broadband sectors, operates transparently.28 The Ministry for Trade, Tourism, and Telecommunications (MTTT) is responsible for oversight of the agency, which is mandated by the Law on Electronic Communications as well as RATEL’s 2016 statute.29 There is no single state body or authority tasked with overseeing or regulating internet content in Serbia.

RATEL has two main operating entities—the Managing Board and the agency director. Members of the Managing Board are chosen by the National Assembly, based on a public competition administered by the MTTT. The board’s members are not formally appointed based on political affiliation, though the assembly’s majority coalition can vote for its preferred candidates. The board in turn chooses the agency director from among candidates who are also selected based on a public competition. In August 2020, Dragan Pejović, who had previously worked on issues related to Serbia’s postal service, was unanimously elected to a five-year term as the director of RATEL, replacing Vladica Tintor.30

RATEL is financially independent from the executive branch, as its funding comes from various fees (for example, those for the use of frequencies) paid by service providers. However, any excess funds must be transferred to the state budget.31

RATEL’s Managing Board appointment process is formally transparent; the competitions are announced publicly, the list of selected candidates is also publicized, and the National Assembly sessions at which lawmakers discuss the appointments are streamed live on the internet. Different stakeholders, including industry associations, cannot officially propose candidates, since that could negatively affect RATEL’s commitment to impartiality. Previous boards have lacked such members in practice.32 Decisions made by RATEL’s director and Managing Board are available on the agency website, along with records of board meetings and the permits the agency has granted.33 RATEL regularly holds public consultations on acts under its jurisdiction, as it and the MTTT are obliged to do under Articles 34 to 36 of the Law on Electronic Communications.34

The Serbian National Internet Domain Registry (RNIDS), a privately owned and operated entity, manages the registry of Serbia’s top-level country code domains (.rs and .срб) and critical internet infrastructure.35

In general, content is widely accessible, and no political, cultural, or social content has been blocked. During the coverage period, however, the government did block a number of gambling sites.

In October 2020, users of certain ISPs were unable to access an array of online gambling websites, which previously operated freely.36 When asked about the issue, the ISPs replied that they were complying with the new Gambling Law, which was enacted in April 2020 and forbids “participation in games of chance that are organized abroad, for which bets are placed and paid for on the territory of the Republic of Serbia.”37

The government rarely removes online content that is protected under international human rights standards from the internet.

In September 2020, Belgrade city inspection officials ordered service providers to remove the rideshare application Car:Go, whose presence in the country has drawn criticism from government bodies and the taxi industry, from their internet domains. Officials did not release any additional information about the order. The Serbian providers, who denied receiving the order,38 did not have the technical ability to remove the app from the mobile app stores run by Apple, Google, and Huawei.39 Despite the controversy, the app continues to operate freely within the country.

Exclusion of intermediary liability for third-party content is established in the Law on Electronic Commerce,40 which is based on the principles of the EU E-Commerce Directive. The law contains a chapter titled “Intermediary Liability” (Articles 16–20), which establishes the criteria for exclusion of intermediary liability for different types of service provision, including hosting and caching, as well as the notice-and-takedown procedure.

However, amendments to Serbia's Trademark Law that were adopted in March 2020 allow claims to be filed not only against those who have infringed upon the rights holder, but also against the intermediaries whose services were being used in the infringement.41 According to the amendments, a breach of license agreement is therefore considered trademark infringement, and violators can be subject to criminal liability. In this instance, the licensee may be obliged to reveal documents related to the breach, as well as the channels and persons who have participated in the infringement.42

In its transparency report covering the period from July to December 2020, Facebook disclosed that it had restricted Serbian users’ access to 12 pages and profiles that supported Brazilian president Jair Bolsonaro, as part of its response to a Brazilian court order that it applied globally.43 During the same period, Twitter received three removal requests from the Serbian government and complied with two of them.44

Restrictions on the internet are largely proportional. To date, there have been no severe cases of digital content restrictions in the country, nor are such restrictions explicitly called for in any of the laws pertaining to electronic or online communication. Serbia does not have a specific law regulating online content, and general media laws, such as the Law on Public Information and Media and the Law on Electronic Media,45 are not currently used to stifle or restrict online speech.

When mobile service provider A1 Serbia blocked access to certain online gambling websites at the request of the Games of Chance Administration of the Ministry of Finance in October 2020 (see B1), SHARE Foundation sent a freedom of information request to the administration, asking for the notice sent to ISPs and the list of banned URLs. The agency refused the request, claiming that releasing the documents in question would affect state revenues. In response to the decision of the Games of Chance Administration, SHARE Foundation filed a complaint to the Commissioner for Information of Public Importance and Personal Data Protection, whose office had not responded by the end of the coverage period.

Self-censorship is not common, but it does occur in Serbia, particularly among government-aligned media outlets. As one journalist described it, “when the risks are assessed, the boundaries become pretty self-explanatory.”46 The most common types of self-censorship are direct results of internal or external pressures. At some media outlets, journalists are implicitly aware of which topics they can and cannot discuss freely.47

Perica Gunjić, the editor in chief of the media portal Cenzolovka, said in an April 2020 interview that self-censorship was fairly widespread in the country.48 He explained that the problem had worsened since the arrival of COVID-19 and the subsequent introduction of a state of emergency, noting that the arrest of journalist Ana Lalić earlier in April 2020 also led to increased self-censorship (see C3).

The state continues to play an active role in influencing the media market. A number of news outlets have close ties to the government, and the political polarization of media is exacerbated by the administration's preferential treatment of tabloids that cover it in a positive light.

A package of media laws passed in 2014 empowered state bodies to cofinance media to serve in the public interest. This gave the government a mechanism to support private media outlets owned by members or sympathizers of the ruling party through direct advertising contracts or less transparent subsidies.49 In practice, the internet portals of tabloids that are close to the government, which constantly manipulate facts and slander independent media outlets, have continued to receive significant public funding at both the state and local levels.50

The case of Tanjug, a formerly state-owned media outlet, is indicative of how the government exercises control in the media sphere. According to the 2014 package of media laws, Tanjug had to be privatized to establish a fairer media market in the country. However, it continued operating, and in December 2020 the rights to Tanjug’s brand were acquired by a private company with close ties to the government.51 Despite the long-awaited privatization, the new owners have retained the media outlet’s original name.52 The move was seen as controversial by independent media because the unchanged identity of the media house as well as its continuous existence since 2015 made it difficult for citizens to separate it from its previous role as a state entity. It is still regarded as a credible source of information and is cited as a mouthpiece of the state in traditional and online media, even though it is no longer publicly owned.53

Additionally, Reporters Without Borders documented the rise of “Ugly Twins” websites, which mimic and plagiarize existing independent media outlets, while also publishing news directly from the ruling party and smearing employees of the actual independent media outlets, in an effort to confuse readers. Media outlets Južne Vesti, Ozonpress, and Kolubarske have been targeted by these sites, and have been unsuccessful in their attempts to challenge these “Ugly Twins” for copyright infringement in court.54

Disinformation campaigns in Serbia occur regularly. Using similar examples in Russia as a model, the current administration has made a concerted effort to produce a sophisticated machinery of online defenders and trolls. Although the trolls are mostly active around elections, the government has used them on other occasions as well. During the monitoring period Serbia grappled with both June 2020 parliamentary elections and the coronavirus pandemic. Disinformation campaigns centered primarily on virus and vaccine disinformation,55 as well as the massive July 2020 protests which ensued after the election.56

In March 2020, Twitter removed approximately 8,500 fake accounts that were linked to the ruling party, the SNS.57 According to Twitter, these clusters of accounts served to promote the interests of President Aleksandar Vučić and the SNS by silencing political opponents and amplifying coverage favorable to the administration. The content produced by the “troll farms” in turn was routinely cited by progovernment tabloids as evidence that the government’s political opponents were deeply unpopular.

The COVID-19 pandemic accelerated the centralization of the media sphere. In March 2020, the government issued a document stipulating that all published information surrounding the spread and status of the coronavirus in the country had to come directly from either high government officials or the official COVID-19 Crisis Response Team.58 As a result, other authorities, medical staff, and news media had to redirect all their information to the government to be vetted before release. However, the March 2020 document was never officially adopted, and the details of its implementation were confusing. Journalist Ana Lalić was arrested and detained for violating the new rules through her reporting on poor conditions in the Vojvodina Clinical Center in April 2020, and amid criticism of the arrest, the government promised to withdraw the March decision (see B4 and C3).

Online media outlets in Serbia face some regulatory and economic obstacles, primarily due to the importance of government funding in the media market.

The state is active in influencing the media sector through public cofinancing (see B5). The 2014 package of media laws gives the government sizable influence over a number of outlets, though these outlets also generate revenue through other means. According to research conducted by IREX, 43 percent of media revenue comes from advertising and 26 percent is generated through other sources, including the sale of print editions of newspapers. An estimated 50 percent of digital advertising expenditures go to global platforms, such as Google and Facebook, while the other half goes to local online media publishers and ad providers.59

The Law on Electronic Communications does not explicitly mention “net neutrality,” but it enshrines a principle of “providing opportunities for end users to freely access and distribute information when using public communications networks and services, as well as to use applications and services of their choice.”60 There have been no recorded attempts to dismantle net neutrality in practice.

However, mobile operators in Serbia do engage in zero-rating, the provision of access to certain sites and services at no cost. A 2017 report from the European Commission on zero-rating practices in broadband markets highlighted Serbia as a country where all operators have such policies, with Facebook and WhatsApp offered by the majority of operators.61 As of 2021, all mobile service providers, including Telenor,62 A1 Serbia,63 and Telekom Serbia,64 continued to offer packages with included data for certain apps, such as Facebook, Viber, and WhatsApp.

Serbia’s media landscape is diverse, though hybrid news websites that amplify misinformation are becoming more prevalent.

SHARE Foundation has compiled a database of more than 1,160 online media platforms as well as print media that also operate as websites.65 The data were obtained from the national Business Registers Agency, which maintains the country’s Media Register.66

The Law on Public Information and Media (Article 30, Paragraph 2) states that online platforms—such as internet forums, social networks, and other services that allow the free exchange of information, ideas, and opinions among their users, or any other independent electronic publication, such as blogs, web presentations, and similar formats—are not legally considered “media” unless they willingly choose to enroll with the Media Register kept by the Business Registers Agency.67

The government’s decision to impose a nationwide lockdown and declare a state of emergency as the coronavirus pandemic spread in March 2020 negatively affected the circulation of information throughout the country (see C1).68 The mass production of content related to the pandemic flooded media outlets and social media platforms, and the dissemination of misinformation increased. Conspiracy theories about the origins and proliferation of the virus, along with supposed alternative cures and prevention methods, gained much traction online. During the shelter-in-place order, daily press conferences were organized by the government’s COVID-19 Crisis Response Team to present up-to-date information on the virus.

Social media platforms have played a large role in amplifying the spread of conspiracy theories and misinformation, including those related to migration. The Facebook group “STOP the settlement of migrants,” which gained notoriety as COVID-19 spread, peddled the conspiracy theory that the government-imposed lockdown was part of an elaborate scheme to settle migrants and refugees in Serbia. The group, which amassed over 362,000 followers at one point, has since been removed because it was in violation of Facebook’s community standards. While it was active, the group posted daily misinformation, mostly generated from news aggregator websites such as Newspanel.rs. The material included debunked stories claiming that the government was housing migrants in Serbian villages and building additional migrant camps across the country.69

The impact of these stories was felt most clearly in May 2020, when a man drove his car into the Obrenovac migrant reception center while live streaming on Facebook. In the video, the man repeated some of the talking points that were propagated through the conspiracist groups, touting xenophobic, racist, and ethnic stereotypes.70 No one was harmed in the incident, as police arrested the man after his car penetrated the camp’s fence. It was quickly discovered that the man was a member of the far-right group Levijatan, which had previously been known for harassing the Romany populations around Belgrade and participating in antimigrant rallies.71

The state-imposed curfews associated with the COVID-19 pandemic in 2020 led to increased online mobilization, including antigovernment protests (see C1). The largest protests of the coverage period occurred in July 2020, when President Vučić announced that nationwide curfews would be reimposed shortly after his party and its allies won a majority in the June parliamentary elections. The announcement prompted mass outrage and resulted in days of protests and violent police responses in Belgrade as well as other cities across the country.72

It remains unclear which specific channels people used to mobilize for these protests, but the majority of vital information related to the assemblies, ranging from the location of police cordons to details about detained protesters, was shared through platforms such as Facebook, Twitter, and Telegram. Citizens have used social media to organize and share information during mass antigovernment protests in the past as well. This type of online mobilization allows for large and diverse groups of people to come together and express their frustrations and demands, though often without a clear unified message or hierarchical leadership.73

Numerous other social movements routinely organize online to address issues concerning the environment, online labor, and local politics. Environmental protests, especially those opposed to the construction of hydroelectric power plants that affect local communities, have become more prominent across the country. Activists have rallied online to live-stream protests decrying the companies and investors that canvass in their areas, and the videos have helped the movement amass more than 100,000 followers on social media.74 In April 2021, thousands of people gathered in Belgrade for an “Environmental Uprising,” with activists, academics, and celebrities advocating for tighter restrictions on pollution and development projects and more accountability from the government on environmental issues.75 The event was shared widely on social media platforms. However, a number of activists who participated in the protests were smeared by pro-government news outlets,76 which is a common occurrence.

Article 46 of the constitution guarantees freedom of thought and expression, as well as the freedom to seek, receive, and impart information and ideas through speech, writing, art, or in any other manner. Article 50 stipulates that everyone has the freedom to establish newspapers and other forms of media without prior permission and in a manner established by law. The article declares that censorship is not practiced in the Republic of Serbia. Article 51 guarantees the right to be informed accurately, fully, and in a timely manner about issues of public importance. Access to information kept by state bodies and organizations with delegated public powers, in accordance with the law, is also guaranteed by Article 51 of the constitution.77

Article 52 of the Law on Public Information and Media defines “journalistic privilege” and establishes that journalists are not obliged to disclose their sources of information, unless the information they hold relates to a criminal offense punishable by a prison sentence of at least five years and cannot be obtained by authorities in any other manner.78

The criminal code also provides protections to journalists, stating that “persons performing work of importance to public information” should be free from threats to their safety and the safety of persons close to them (Article 138, Paragraph 3). The sentence for threatening journalists in connection with their work ranges from six months to five years in prison—the same as that for threatening the highest-ranking state officials.79 However, these rights are not robustly guaranteed in practice.

In March 2020, Serbia became one of the first countries in Europe to impose a statewide lockdown and officially declare a state of emergency in response to the coronavirus pandemic (see B7).80 The lockdown, which initially ended in May 2020 before being reimposed briefly in July, limited journalists’ ability to report on the health crisis.

While the judiciary is nominally independent, it often comes under the influence of government officials who publicly comment on the work of the judicial branch and, in some cases, openly antagonize judges. Moreover, successive reports from the European Commission have noted that judicial reforms intended to bolster judicial independence have stalled.81

Some laws and constitutional provisions leave room for abusive enforcement designed to penalize legitimate online activities. In 2012, amendments to the criminal code decriminalized defamation; while Article 170 still regards insult as a criminal act, it is not punishable by prison time. In recent years, insult charges have rarely been used to suppress online speech, but a recent libel case involving the Millennium Team raised concerns that such tools could be employed more frequently in the future (see C3).

The constitution’s general restrictions on speech and expression are in line with international standards, though they could be interpreted to justify repressive actions. Article 46, Paragraph 2, for example, states that “freedom of expression may be restricted by law, if necessary to protect the rights and reputation of others, to preserve the authority and impartiality of the court and to protect public health, the morals of a democratic society and the national security of the Republic of Serbia.” Article 50, which guarantees freedom of the media, states that a “competent court may prevent the dissemination of information and ideas through the media only if it is necessary to prevent calls for the violent destruction of the constitutional order or violation of the territorial integrity of the Republic of Serbia; and to prevent the propagation of war or incitement to direct violence, or racial, national or religious hatred, which incites discrimination, hostility or violence.”82

The coverage period featured several cases in which users were sued or detained for their online speech, as well as private lawsuits filed against the media.83

In December 2020, a private citizen received a suspended sentence of six months’ imprisonment for allegedly using Twitter to endanger the security of President Vučić. The person in question used foul language to insult Vučić’s children, but the post did not demonstrate any clear intention to harm either Vučić or his family members.84 In April 2021, the conviction was overturned by the Court of Appeals in Belgrade.85

In October 2020, a man from Novi Sad was arrested and searched by police after he commented “wonderful” in response to a Facebook post reporting the news that a police officer had been wounded. The man was released an hour later with the warning that “everything is being listened to and read.”86

In July 2020, members of the BIA arrested the president of the Student Club of the Belgrade Faculty of Law. He was detained and interrogated for seven hours after he posted a call on Facebook for students to assemble in front of the National Assembly and stage a peaceful protest in response to police brutality at that month’s antigovernment protests.87 No subsequent charges were brought against him.

In April 2020, Nova.rs journalist Ana Lalić was held in custody for 48 hours for her reporting on poor hospital conditions related to the coronavirus pandemic. Her work violated the government’s March decision stipulating that all reporting on COVID-19 must rely on facts from the official Crisis Response Team (see B5).88 After Lalić’s release, the government backtracked on its controversial decision to centralize pandemic information, but government-affiliated media continued to harass her.

Libel and insult lawsuits were also used to intimidate journalists. In April 2021, the Belgrade-based company Millennium Team brought libel suits against a number of independent media portals following their coverage of a press conference in which an opposition politician criticized Millennium Team’s close ties to the government.89 The company demanded €100,000 ($120,000) per article from each portal, which commentators described as an “astronomical” sum.90 The move was seen as a clear instance of media intimidation because the company targeted specific news outlets and did not sue the politicians whose claims they reported. Moreover, Millennium Team did not even deny the claims that were published, but instead immediately opted to go to court.91

In July 2020, Interior Minister Nebojša Stefanović filed a lawsuit against the portal Nova.rs after it published an article about an arms-trading affair involving Saudi Arabia and Serbia’s Krušik factory that implicated Stefanović’s late father.92 Stefanović sought 400,000 Serbian dinars ($4,000) in compensation for nonmaterial damages.93

There are no legal repercussions for using encrypted services in Serbia. However, in the context of February 2021 arrests targeting a criminal network linked to Serbian soccer clubs,94 Interior Minister Aleksandar Vulin called for legislation to criminalize the possession of devices and other means that enable encrypted communication. Vulin’s proposal was supported by the Association of Judges and Prosecutors.95

There is no requirement for individuals to register with the government to use online services. However, in November 2020, Minister Vulin suggested that there should be a law requiring citizens to provide accurate personal data when creating a social media account,96 following threats President Vučić received via social media.97

The constitution does not explicitly mention privacy, but it offers clear guarantees for the inviolability of dwellings (Article 40), the confidentiality of letters and other forms of communication (Article 41), and personal data protection (Article 42). Regarding confidentiality of communications, Article 41 states that exemptions are only allowed within a specific time frame and with a court order if they are necessary for the investigation of criminal activities or the protection of Serbia’s national security.

In December 2020, an investigation by Citizen Lab, a research center at the University of Toronto, identified Serbia’s BIA as a likely customer of Circles, an Israeli surveillance company that allows customers to monitor calls, texts, and mobile phone geolocation by exploiting weaknesses in mobile telecommunications infrastructure.98 In addition, a 2015 leak of internal documents and emails from Hacking Team, a well-known Italian surveillance software vendor, suggested that Serbian security services had engaged in negotiations to purchase the company’s products, but there was no evidence that the software in question was actually purchased.99

Telecommunications companies in Serbia are forced to retain communications metadata, and the authorities have accessed this information through dubious legal means (see C6).

In more than one instance, SNS members have made comments about unreleased articles and correspondence between journalists and their sources. The leaks have also found their way onto the front pages of government-affiliated tabloids.100 Stevan Dojčinović, editor of the Crime and Corruption Reporting Network (KRIK), has had his personal correspondence repeatedly intercepted by state agencies and published in Informer, one of the government’s staunchest supporters among the tabloids.101 In 2018, the national ombudsman’s office ordered the BIA to respond to charges that it had released Dojčinović’s personal information to Informer.102 A response was never received.103

KRIK and other media outlets and civil society organizations have recently been accused of cooperating with criminal organizations and working “against the state,” with high-ranking officials publicly threatening journalists with their knowledge of personal information and openly admitting to wiretapping.104 These cases of government surveillance prompted strong objections from domestic media and civil society,105 as well as from international bodies such as the European Parliament.106

In 2017, the Serbian government signed two nonbinding agreements with Huawei, one of which concerned the “Smart Cities” project that included data gathering, storage, and management (see A1). In 2020, during the state-wide lockdown, more than 1,000 surveillance cameras with facial-recognition technology were installed on the streets of Belgrade.107 By the end of the coverage period, the Ministry of Interior has released limited information regarding the capabilities of the cameras, with most of the available information discovered by SHARE Foundation researchers who examined an article on Huawei’s website, which was subsequently removed. However, an archived page is still available.108 All of the collected information on the surveillance cameras and their technology is openly available at the Thousands of Cameras website.109 .

The Law on Personal Data Protection,110 adopted in November 2018, aligned Serbia’s data protection regime with the EU’s General Data Protection Regulation (GDPR) and its 2016 law enforcement directive.111 The Serbian law came into effect in August 2019, giving public and private entities adequate time to adapt to the new standards.

The Law on Electronic Communications requires ISPs and operators of mobile-phone and fixed-line networks to retain all metadata pertaining to communications on their systems for 12 months.112 The competent authorities, including the police and security agencies, can then request access to the metadata for the purposes of investigating crime and protecting national security. In 2013, the Constitutional Court, one of the two most important judicial institutions in the country, declared that access to communications metadata retained by network operators requires a court order, as they are an integral part of communication and as such have constitutional protections.113

However, SHARE Foundation’s research on data retention practices in Serbia has shown that state authorities access the metadata stored by telecommunications firms directly through “applications for independent access,” which are of dubious legality. For example, Telenor’s databases were accessed directly by the police more than 270,000 times between March 2011 and March 2012, according to the Commissioner for Information of Public Importance and Personal Data Protection.114 Additional SHARE research confirmed that direct access to Telenor’s retained metadata continued from 2014 to 2017,115 and it is possible that other telecoms allowed access but did not provide a report to the commissioner. Telenor did not produce any information on direct access to metadata in its annual report to the commissioner for 2018, which is when the company was acquired by PPF Group, the Czech investment firm, but the practice may have persisted thereafter.116

All network operators and state bodies authorized to access retained data are supposed to submit an annual record to the Commissioner for Information of Public Importance and Personal Data Protection. In accordance with Article 130a of the Law on Electronic Communications, the annual records must contain the number of requests for access to retained data, the number of granted requests, and the number of days between the initial data retention and the time of requested access.117 The parliament’s Committee for the Control of Security Services also theoretically has oversight powers,118 but the majority of the committee’s members belong to the ruling party or its coalition partners.119 Serbia does not have a data localization requirement (see C5). Serbian tech companies have yet to publish transparency reports similar to those generated by global platforms such as Facebook and Twitter.

According to the Law on Electronic Commerce,120 which regulates matters including intermediary liability, ISPs are obliged to store data on the users of their services, including the internet protocol (IP) address from which a user gains access, both during use and a minimum of 30 days after termination of service (Article 16, Paragraph 3). The law does not explain the purpose of this collection, who can access the data, and how the rule is to be enforced, which leaves room for broad interpretation by the authorities.

Some major international tech companies, including Facebook and Amazon, had not yet named a local representative for data protection issues in Serbia at the end of the coverage period, a step that is required under the Law on Personal Data Protection.121 The companies that had not appointed representatives were subject to complaints from civil society groups, because Serbian users had no local legal avenues to request the deletion or amendment of their data.122

Journalists often face physical assaults and threats in connection with both online and offline reporting.

The Independent Association of Journalists of Serbia (NUNS) documented 189 attacks on journalists, both online and offline, in 2020, a worrying increase from the 119 attacks documented in 2019.123 Of the 189 cases, 32 were physical assaults. The other attacks included verbal assaults, pressure and threats, and attacks on journalists’ property. When such cases make it to court, the judicial procedures are usually drawn out and frequently obstructed.

The case of Milan Jovanović, an investigative journalist for Zig.info, remains an active reminder of the threats journalists face and the judiciary’s problematic responses. In December 2018, Jovanović’s house was set on fire after a Molotov cocktail was thrown at it in the middle of the night. The attack was quickly connected to the local mayor, high-ranking SNS member Dragoljub Simonović, whose business dealings Jovanović had been writing about for years. Jovanović had previously faced less extreme forms of pressure in reprisal for his reporting on Simonović. The ensuing trial was plagued by obstructions from the defense and interference by progovernment tabloids, with the judiciary itself coming under pressure. The case was especially sensitive given the broader media attention it received, not only in Serbia but across Europe.124 Although the trial carried on for more than two years due to Simonović’s refusal to show up to court hearings, he was ultimately sentenced in February 2021 to four years and three months in prison for inciting the arson of Jovanović’s house.125 Jovanović has been under police protection since the incident.

There were 21 cases of attacks on journalists attempting to cover the July 2020 antigovernment protests from the streets.126 The incidents included physical assaults,127 destruction and confiscation of equipment,128 and verbal threats—perpetrated by protesters as well as police officers.129

Online harassment of journalists has been a common occurrence, including in the context of the COVID-19 pandemic beginning in 2020. In April 2020, the media portal Cenzolovka found itself at the center of debate in the parliament after publishing the Reporters Without Borders 2020 annual index,130 in which Serbia’s global press freedom ranking dropped by three places.131 Parliament members accused Cenzolovka and other independent media portals of waging a negative campaign against the government and President Vučić.132

Gender-based attacks on women journalists remain a recurring theme in the broader intimidation and harassment of media workers in Serbia. In a report compiled from the results of research conducted in 2020 as part of the international Media4Women campaign,133 71 percent of women journalists working in Serbia said they had received misogynistic and gender-based comments online in the past five years, and 54 percent said they experienced some form of online sexual harassment.134

During the coverage period, there were multiple instances of citizens uncovering large-scale Telegram groups focused on sharing nonconsensual intimate images of children and former partners, as well as screenshots of women’s Instagram profiles and photos of women taken on the street.135 The group members solicited information about the women in the images and shared their personal details, including names, addresses, and social media profiles. The largest group consisted of more than 30,000 members, while the smaller groups were organized around individual cities in Serbia.136 Public outrage over the groups spread fast and wide; most of them were shut down, but some resurfaced, and new ones quickly appeared. In one high-profile case in November 2020, photos of a COVID-19 patient were circulated through social media.137 The woman was photographed while changing in a temporary hospital set up in Belgrade for patients with severe respiratory illness. As it turned out, the photos of this patient, along with some others, were also shared in Telegram groups focused on inappropriate and nonconsensual photos taken of women.

The migrant population in Serbia has been subject to online threats and harassment, with scores of fake news websites and portals sharing conspiracy theories regarding the supposed settlement of migrants in the country during the statewide COVID-19 lockdown in 2020 (see B7).138 The proliferation of misinformation around migrant issues ultimately led to antimigrant rallies in cities across Serbia, as well as a violent break-in at one of the migrant reception centers near Belgrade.

Cyberattacks are relatively common in Serbia, and civil society and media outlets are often targeted. From June 2020 through May 2021, SHARE Foundation recorded eight information security breaches that were publicly disclosed. Five of the breaches involved technical restrictions of content, including distributed denial-of-service (DDoS) attacks. SHARE also recorded one instance of computer fraud, one case of destruction and theft of data and programs, and one case of disabling control over an online account or piece of content.139

The largest publicly known cyberattack on a government entity in Serbia occurred in March 2020, when Informatika, a public utility company from Novi Sad, was targeted with ransomware. This attack caused an outage in the operation of the city administration, as its system was housed within Informatika.140 The city refused to pay the Bitcoin cryptocurrency ransom and had to establish a new computer system.

Independent media and civil society groups regularly experience technical attacks. The media portal Peščanik experienced several attacks in 2014 and 2015, after it published texts about the plagiarized doctorate of the former interior minister, current defense minister Nebojša Stefanović.141 The attacks were launched from more than 30,000 IP addresses.142

N1 television, which provided live coverage of the antigovernment protests in July 2020, said on Twitter that its website had experienced difficulties due to technical attacks during this period.143 In March 2021, Eko straža, a Serbian environmental organization, said its website was taken down by a technical attack and that one page had 600,000 access requests.144

Serbia signed and ratified the Budapest Cybercrime Convention and has adapted its criminal laws to conform with the standards of the convention.145 The criminal code of Serbia contains a chapter focused on “crimes against security of computer data” (Articles 298–304a).146 There is a special Prosecution Office for Cybercrime in Belgrade,147 but given the sheer number of incidents and the fact that it is the only prosecution authority tasked with handling such cases in the country, it has struggled to keep up with a growing backlog.