Score Change: The score improved from 5 to 6 because internet penetration increased, according to some measurement sources.

Serbia’s internet penetration rate has increased in recent years. According to 2021 data from the Statistical Office of Serbia, 76.7 percent of households have a computer, while 94.6 percent have a mobile phone. In 2021, 81.5 percent of Serbian households had an internet connection, with 91.7 percent using fixed-line broadband service and 73.3 percent using mobile broadband.1 Based on 2021 data from the International Telecommunication Union (ITU), 81.2 percent of Serbians have access to the internet, with a mobile broadband penetration rate of 101.9 percent and a fixed broadband penetration rate of 26.2 percent.2 According to Ookla’s Speedtest Global Index from May 2022, median download speeds in Serbia were 43.2 megabits per second (Mbps) for mobile connection and 54 Mbps for fixed broadband connection.3

In general, internet service in Serbia is reliable. Most users have some form of digital subscriber line (DSL) connection, and fourth-generation (4G) mobile internet technology is also widely available. Telekom Serbia, the state-owned telecommunications firm, has dramatically accelerated the development of its fiber-optic network in the last few years. Cable companies, which have long been a major factor in the development of high-speed internet in the country, also continue to invest in fiber-optic technology. In 2020, the state launched a program to build fiber-optic infrastructure in previously neglected areas.4

Serbia has cultivated a strategic partnership in telecommunications with Chinese companies since 2017, when the government and the Chinese firm Huawei signed two nonbinding agreements concerning “smart cities” (see C5) and the development of broadband internet service. The relationship forms part of Beijing’s plan for a Chinese-led “digital silk road,” for which Serbia would be a European hub.5

Over the past few years, many of the countries bordering Serbia have joined the “Clean Network,” a US-led fifth-generation (5G) mobile network security initiative that identifies the Chinese companies Huawei and ZTE as “untrusted” technology vendors. Although Serbia is not formally part of the “Clean Network,” in 2020 the president of Serbia and the prime minister of Kosovo signed a cooperation agreement in Washington, DC, pledging to refrain from using 5G equipment from any companies designated as untrusted. However, the Washington agreement did not directly mention either China or specific vendors like Huawei.6

Originally planned to launch in 2021, the 5G network rollout in Serbia has been postponed.7 Tatjana Matić, the minister of trade, tourism, and telecommunications, announced auctions for 5G licenses, which were supposed to be held in the first half of 2022.8 However, there were no updates as of the end of the coverage period.

Internet service in Serbia is relatively affordable, although access to fixed-line broadband connections is more expensive than mobile access. According to 2021 data from the ITU, a 5 gigabyte (GB) fixed broadband subscription costs 2.66 percent of monthly gross national income (GNI) per capita, and 2 GB of mobile data costs 1.48 percent of monthly GNI per capita.9 The Broadband Commission for Sustainable Development has stated that “entry level broadband services” should cost less than 2 percent of monthly GNI per capita.

There is a digital divide between urban and less populous areas. According to 2021 annual data from the Statistical Office of Serbia, there are significant differences in terms of internet connectivity between urban centers, where 85.6 percent of residents have access to the internet within their households, and smaller settlements and villages, where 74.7percent of residents have access to the internet. The highest penetration rate is in Belgrade (92.9 percent), the capital and most populous city in Serbia, while the northern province of Vojvodina (77.8 percent), central and western Serbia (79.2 percent), and southern and eastern Serbia (75.7 percent) all have lower penetration rates.10 The regions with higher levels of internet access are mostly in the central and northern parts of the country.11

Levels of internet access among households also depend on socioeconomic conditions. Internet connections are present in 97.8 percent of households with a monthly income of more than €600 ($680), while households with a monthly income of up to €300 ($340) lag behind at 59 percent.12

Although the Law on Electronic Communications stipulates that “a set of basic electronic communication services of a certain scope and quality are available to everyone on the territory of Serbia at affordable prices,”13 in recent years there has been little progress in the implementation of universal service. The country’s Regulatory Agency for Electronic Communications and Postal Services (RATEL) has attributed this stagnation to poor economic viability of infrastructure investments.14

The government did not disrupt or restrict access to the internet during the coverage period, and it has no past record of imposing internet shutdowns amid elections or other national events.

The infrastructure of internet service providers (ISPs) is not centralized, even though the state holds a majority stake in Telekom Serbia,15 one of the largest providers. Serbian Open eXchange (SOX),16 the country’s internet exchange point, is a private entity with a decentralized network.17

The telecommunications sector is relatively diverse, though state-owned Telekom Serbia holds the largest shares of both the mobile and fixed-line broadband markets. Telekom Serbia was already the most used and widely distributed ISP, but with its continued acquisition of smaller telecommunications companies, it now controls over 50 percent of the country’s broadband internet market.18 There are no significant barriers to market entry. According to the Law on Electronic Communications,19 any company can provide telecommunications services if it fulfills general requirements and applies to RATEL.20 Individual licenses are only issued for limited resources such as frequencies. The Law on Electronic Communications mostly aligns with European Union (EU) rules, and there are plans to update it to achieve full alignment.21

Based on RATEL’s electronic communications market report for the fourth quarter of 2021, Telekom Serbia covered 43.4 percent of the estimated 8.5 million mobile telephone subscribers,22 while Telenor Serbia, which is owned by Czech investment firm PPF23 and rebranded as Yettel in March 2022,24 and A1 Serbia cover approximately 31 and 24 percent, respectively. Telekom Serbia and Serbia Broadband (SBB) tightly control the fixed broadband market. Of the 1.8 million fixed broadband subscribers, Telekom Serbia holds 54 percent, with SBB servicing 31.4 percent of the market.25

In January 2021, Telekom Serbia confirmed that it had signed an agreement to rent out fiber-optic cables to Telenor.26 In April 2021, United Media and SBB, which are both part of Netherlands-based United Group,27 filed a criminal complaint against Telekom and Telenor for concluding a restrictive agreement, which they believe could affect media freedom in Serbia because it could set a precedent that makes it more difficult for competitors to enter the market.28

RATEL, which is responsible for regulating the telecommunications and fixed-line broadband sectors, operates transparently.29 The Ministry for Trade, Tourism, and Telecommunications (MTTT) is responsible for oversight of the agency, which is mandated by the Law on Electronic Communications as well as RATEL’s 2016 statute.30 There is no single state body or authority tasked with overseeing or regulating internet content in Serbia.

RATEL has two main operating entities—the Managing Board and the agency director. Members of the Managing Board are chosen by the National Assembly, based on a public competition administered by the MTTT. The board’s members are not formally appointed based on political affiliation, though the assembly’s majority coalition can vote for its preferred candidates. The board in turn chooses the agency director from among candidates who are also selected based on a public competition. In August 2020, Dragan Pejović, who had previously worked on issues related to Serbia’s postal service, was unanimously elected to a five-year term as the director of RATEL, replacing Vladica Tintor.31

RATEL is financially independent from the executive branch, as its funding comes from various fees (for example, those for the use of frequencies) paid by service providers. However, any excess funds must be transferred to the state budget.32

RATEL’s Managing Board appointment process is formally transparent; the competitions are announced publicly, the list of selected candidates is also publicized, and the National Assembly sessions at which lawmakers discuss the appointments are streamed live on the internet. Different stakeholders, including industry associations, cannot officially propose candidates, since that could negatively affect RATEL’s commitment to impartiality. Previous boards have lacked impartial members in practice.33 Decisions made by RATEL’s director and Managing Board are available on the agency website, along with records of board meetings and the permits the agency has granted.34 RATEL regularly holds public consultations on acts under its jurisdiction, as it and the MTTT are obliged to do under Articles 34 to 36 of the Law on Electronic Communications.35

The Serbian National Internet Domain Registry (RNIDS), a privately owned and operated entity, manages the registry of Serbia’s top-level country code domains (.rs and .срб) and critical internet infrastructure.36

In general, content is widely accessible, and no political, cultural, or social content has been blocked.

During the coverage period, there were no reported instances of the government ordering website blocking or filtering. However, the government did block a number of gambling sites in late 2020 when users of certain ISPs were unable to access an array of online gambling websites, which previously operated freely.37 When asked about the issue, the ISPs replied that they were complying with the new Gambling Law, which was enacted in April 2020 and forbids “participation in games of chance that are organized abroad, for which bets are placed and paid for on the territory of the Republic of Serbia.”38 The websites remained block as of the end of the coverage period.

The government rarely removes online content that is protected under international human rights standards from the internet.

In September 2020, Belgrade city inspection officials ordered service providers to remove the rideshare application Car:Go, whose presence in the country has drawn criticism from government bodies and the taxi industry, from their internet domains. The Serbian providers, who denied receiving the order,39 did not have the technical ability to remove the app from the app store.40 Despite the controversy, the app continues to operate freely within the country.

Exclusion of intermediary liability for third-party content is established in the Law on Electronic Commerce,41 which is based on the principles of the EU E-Commerce Directive. The law contains a chapter titled “Intermediary Liability” (Articles 16–20), which establishes the criteria for exclusion of intermediary liability for different types of service provision, including hosting and caching, as well as the notice-and-takedown procedure.

However, amendments to Serbia’s Trademark Law that were adopted in March 2020 allow claims to be filed not only against those who have infringed upon the rights holder, but also against the intermediaries whose services were being used in the infringement.42 According to the amendments, a breach of license agreement is therefore considered trademark infringement, and violators can be subject to criminal liability. In this instance, the licensee may be obliged to reveal documents related to the breach, as well as the channels and persons who have participated in the infringement.43

In its transparency reports covering the period from January to December 2021, Meta disclosed that it did not remove any content based on requests from the Serbian government.44 During the same period, Twitter received 28 removal requests with 73 accounts specified for removal by the Serbian government and complied with none of them.45 In 2021, Google received nine content removal requests from the Serbian government, but it also did not comply with any of them.46

Restrictions on the internet are largely proportional. As of the end of the coverage period, there have been no severe cases of digital content restrictions in the country, nor are such restrictions explicitly called for in any of the laws pertaining to electronic or online communication. Serbia does not have a specific law regulating online content, and general media laws, such as the Law on Public Information and Media and the Law on Electronic Media,47 are not currently used to stifle or restrict online speech.

When mobile service provider A1 Serbia blocked access to certain online gambling websites at the request of the Games of Chance Administration of the Ministry of Finance in October 2020 (see B1), SHARE Foundation, a nonprofit group that advocates for human rights online, sent two freedom of information requests to the government, asking for the notice sent to ISPs and the list of banned URLs. The Games of Chance Administration refused the initial request made in October 2020. Then, after the Commissioner for the Information of Public Importance and Personal Data Protection annulled the administration’s decision based on complaint from SHARE Foundation, the administration denied SHARE Foundation’s second request in January 2022, claiming that releasing the documents in question would affect state revenues.

Self-censorship is not common, but it does occur in Serbia, particularly among government-aligned media outlets. As one journalist described it, “when the risks are assessed, the boundaries become pretty self-explanatory.”48 The most common types of self-censorship are direct results of internal or external pressures. At some media outlets, journalists are implicitly aware of which topics they can and cannot discuss freely.49 According to the International Research and Exchanges Board’s (IREX) 2022 Vibrant Information Barometer (VIBE) report, “self-censorship is very present” in the country.50 Additionally, SLAPPs filed against independent media outlets during the coverage period raised concerns about self-censorship (see C3).

Perica Gunjić, the chief editor of the media portal Cenzolovka, said in an April 2020 interview that self-censorship was fairly widespread in the country.51 He explained that the problem had worsened since the beginning of the COVID-19 pandemic and the subsequent introduction of a state of emergency, noting that the arrest of journalist Ana Lalić earlier in April 2020 also led to increased self-censorship (see B5).

The state continues to play an active role in influencing sources of information. Several news outlets have close ties to the government, and the political polarization of media is exacerbated by the administration's preferential treatment of tabloids that tend to cover it in a positive light.

The package of media laws passed in 2014 empowered state bodies to cofinance media in an effort to serve in the public interest. This gave the government a mechanism to support private media outlets owned by members or sympathizers of the ruling party through direct advertising contracts or less transparent subsidies.52 In practice, the internet portals of tabloids that are close to the government, which consistently manipulate facts and slander independent media outlets, have continued to receive significant public funding at both the state and local levels.53

Ahead of the April 2022 general and local elections (see B8), SHARE Foundation monitored campaign activities on platforms, such as Twitter and Facebook,54 finding the lack of transparency around political advertisements on these platforms threaten the democratic process. Although Meta took additional steps to verify advertisers on Facebook, Google did not take the same approach as the company only verifies political advertisers in the United States, the EU, and a few other countries.55 The analysis conducted by SHARE demonstrated that the ruling party’s Facebook advertising budget amounted to almost 50 percent of the total budget spent by all candidates for ads on the platform during the campaign. On Twitter, dedicated accounts retweeted SNS and Vučić as a signal for other accounts to do the same. These accounts also quoted opposition actors’ tweets in an effort to discredit them and encourage other SNS sympathizers to pile on. This strategy expanded the ruling party’s reach, which was broader than any of the other parties.

In July 2021, the press freedom organization Reporters Without Borders documented the rise of “Ugly Twins” websites, which mimic and plagiarize existing independent media outlets to confuse readers, publishing news directly from the ruling party and smearing employees of the actual independent media outlets. In December 2021, a court ruled in favor of the media outlet Južne Vesti, which had been targeted by an “Ugly Twin” website, ordering that the plagiarized portal be temporarily removed.56 Media outlets Ozonpress, and Kolubarske, which were also targeted by these sites, had been unsuccessful in their previous attempts to challenge them for copyright infringement in court.57

Disinformation campaigns in Serbia occur regularly. Using similar examples in Russia as a model, the current administration has made a concerted effort to produce a sophisticated machinery of online defenders and trolls. Although the trolls are mostly active around elections, the government has used them on other occasions as well. During the last coverage period,58 disinformation campaigns centered primarily on the June 2020 parliamentary elections—and subsequent massive protests—and the coronavirus pandemic and vaccine.59

The COVID-19 pandemic accelerated the centralization of the media sphere. In March 2020, the government issued a document stipulating that all published information surrounding the spread and status of the coronavirus in the country had to come directly from either high government officials or the official COVID-19 Crisis Response Team.60 As a result, other authorities, medical staff, and news media had to redirect all their information to the government to be vetted before release. However, the March 2020 document was never officially adopted, and the details of its implementation were unclear. Journalist Ana Lalić was arrested and detained for violating the new rules through her reporting on poor conditions in the Vojvodina Clinical Center in April 2020, and amid criticism of the arrest, the government promised to withdraw the March decision (see B4 and C3).

In August 2021, Twitter began labeling various progovernment media as either “operated by a government representative or “a state-affiliated media entity,” sparking major controversy in the country.61 The action has been linked to the platform’s removal of 8,500 progovernment accounts in March 2020.62 According to Twitter, these clusters of accounts served to promote the interests of President Aleksandar Vučić and the SNS by silencing political opponents and amplifying coverage favorable to the administration. In response, President Vučić denounced the move as censorship and openly called on the platform to shut down his own account, comparing himself to former US president Donald Trump.63

Online media outlets in Serbia face some regulatory and economic obstacles, primarily due to the importance of government funding in the media market.

The state is active in influencing the media sector through public cofinancing (see B5). The 2014 package of media laws gives the government sizable influence over several outlets, though these outlets also generate revenue through other means. According to research conducted by IREX, 43 percent of media companies’ revenue comes from advertising and 26 percent is generated through other sources, including the sale of print editions of newspapers. An estimated 50 percent of digital advertising expenditures go to global platforms, such as Google and Facebook, while the other half goes to local online media publishers and ad providers.64

The Law on Electronic Communications does not explicitly mention “net neutrality,” but it enshrines a principle of “providing opportunities for end users to freely access and distribute information when using public communications networks and services, as well as to use applications and services of their choice.”65 There have been no recorded attempts to dismantle net neutrality in practice.

However, mobile operators in Serbia do engage in zero-rating, the provision of access to certain sites and services at no cost. As of 2022, all mobile service providers, including Yettel,66 A1 Serbia,67 and Telekom Serbia,68 continued to offer packages that included data for certain apps, such as Facebook, Viber, and WhatsApp.

Serbia’s media landscape is diverse, though hybrid news websites that amplify misinformation are becoming more prevalent.

SHARE Foundation has compiled a database of more than 1,200 online media platforms as well as print media that also operate as websites.69 The data were obtained from the national Business Registers Agency, which maintains the country’s Media Register.70

The Law on Public Information and Media (Article 30, Paragraph 2) states that online platforms—such as internet forums, social networks, and other services that allow the free exchange of information, ideas, and opinions among their users, or any other independent electronic publication, such as blogs, web presentations, and similar formats—are not legally considered “media” unless they willingly choose to enroll with the Media Register.71

The mass production of content related to COVID-19 flooded media outlets and social media platforms, and the dissemination of misinformation increased with the start of the coronavirus pandemic in early 2020. Conspiracy theories about the origins and proliferation of the virus, along with supposed alternative cures and prevention methods, gained significant traction online. Following the development of the COVID-19 vaccine, the Serbian government secured the second fastest vaccine rollout in Europe.72 While the initial turnout was successful, skepticism concerning the vaccine’s efficacy grew quickly, mainly online, with vaccine disinformation spread on social media.73 The online antivaccine movement organized in-person protests against the government’s COVID-19-related measures. In October 2021, a group of protesters gathered in front of the building of Dr. Predrag Kon, one of the leaders of the government’s COVID-19 Crisis Response Team, calling for his resignation.74

Social media platforms continue to play a large role in amplifying the spread of conspiracy theories and misinformation, particularly regarding migration. The Facebook group previously known as “Stop the Settlement of Migrants,” which has been active since the start of the COVID-19 pandemic and has been removed from the platform multiple times, rebranded itself as “Stop Censorship” in January 2021, amassing 320,000 members. 75 While the focus of the page remains on issues concerning the alleged crimes of the migrant population in Serbia, its scope has increased to include many conspiracy theories surrounding the government's approach to the pandemic, including the vaccine rollout. The page continues to be run by the far-right groups called People’s Patrols, which have organized a number of antimigrant rallies in Serbia’s capital and participated in the July 2020 antigovernment protests.

The impact of these stories was felt most clearly in May 2020, when a man drove his car into the Obrenovac migrant reception center while live streaming on Facebook. In the video, the man repeated some of the talking points that were propagated through the conspiracy groups, touting xenophobic, racist, and ethnic stereotypes.76 No one was harmed in the incident, as police arrested the man after his car penetrated the camp’s fence. It was quickly discovered that the man was a member of the far-right group called Levijatan, which is known for harassing the Romany communities around Belgrade and participating in antimigrant rallies.77

Social media is regularly used to organize social movements and protests.78 In December 2021 sexual abuse survivors took to Twitter and launched a social media campaign resembling the #MeToo campaign, using the hashtag #nisamprijavila (#ididntreportit).79 The campaign quickly spread on social media, with thousands of survivors sharing their stories and offering support to each other (see C7).

Local and general elections took place in April 2022 and several organizations launched the “Three Liberties Platform” to monitor the election campaign as well as to help citizens and voters express their freedom to access information, associate, and assemble.80

In April 2021, thousands of people gathered in Belgrade for an “Environmental Uprising,” with activists, academics, and celebrities advocating for tighter restrictions on pollution and development projects and increased government accountability on environmental issues.81 A number of activists who participated in the protests were targeted by online smear campaigns by progovernment news outlets.82 Subsequent environmental protests (see C3) also featured counter campaigns online, with users claiming protestors were foreign mercenaries from “the West” who were attempting to destabilize the government—closely resembling the government's official narrative.83

Which channels people used to mobilize for these protests remains unclear. However, the majority of information related to the assemblies, ranging from the location of police cordons to details about detained protesters, was shared through platforms such as Facebook, Twitter, and Telegram. Citizens have in the past used social media to organize and share information during mass antigovernment protests.84

Numerous other social movements routinely organize online to address issues concerning the environment, online labor, and local politics. Environmental protests, especially those opposed to the construction of hydroelectric power plants that affect local communities, have become more prominent across the country. Activists have rallied online to live stream protests decrying the companies and investors that canvass in their areas, and the videos have helped the movement amass more than 100,000 followers on social media.85

Article 46 of the constitution guarantees freedom of thought and expression, as well as the freedom to seek, receive, and impart information and ideas through speech, writing, art, or in any other manner. Article 50 stipulates that everyone has the freedom to establish newspapers and other forms of media without prior permission and in a manner established by law. The article declares that censorship is not practiced in the Republic of Serbia. Article 51 guarantees the right to be informed accurately, fully, and in a timely manner about issues of public importance. Access to information kept by state bodies and organizations with delegated public powers, in accordance with the law, is also guaranteed by Article 51 of the constitution.86

Article 52 of the Law on Public Information and Media defines “journalistic privilege” and establishes that journalists are not obliged to disclose their sources of information, unless the information they hold relates to a criminal offense punishable by a prison sentence of at least five years and cannot be obtained by authorities in any other manner.87

The criminal code also provides protections to journalists, stating that “persons performing work of importance to public information” should be free from threats to their safety and the safety of persons close to them (Article 138, Paragraph 3). The sentence for threatening journalists in connection with their work ranges from six months to five years in prison—the same as that for threatening the highest-ranking state officials.88 However, these rights are not robustly guaranteed in practice. In late 2021, amendments to the criminal code were proposed with the intention of providing more protections to journalists, but the proposal also contained articles that could criminalize alleged insults, which threatens real freedom of speech (see C2).89

While the judiciary is nominally independent, it often comes under the influence of government officials who publicly comment on the work of the judicial branch and, in some cases, openly antagonize judges. Moreover, successive reports from the European Commission (EC) have noted that judicial reforms intended to bolster judicial independence have stalled.90

Constitutional amendments drafted to improve judicial independence were put to a referendum in January 2022. Most citizens who voted in the referendum were in favor of the amendments, and Parliament subsequently passed the necessary law to amend the constitution in February.91 The impact of the constitutional changes on the judiciary’s independence are yet to be seen.92

Some laws and constitutional provisions leave room for abusive enforcement designed to penalize legitimate online activities. In 2012, amendments to the criminal code decriminalized defamation; while Article 170 still regards insult as a criminal act, it is not punishable by prison time. However, draft amendments to the criminal code introduced in late 2021 would punish “rude insults or maltreatment, insolence or ruthlessness” with up to one year in prison (see C1).93 In recent years, insult charges have rarely been used to suppress online speech, but a recent libel case involving the Millennium Team raised concerns that such tools could be employed more frequently in the future (see C3 and C5).

The constitution’s general restrictions on speech and expression are in line with international standards, though they could be interpreted to justify repressive actions. Article 46, paragraph 2, for example, states that free expression may be legally restricted if necessary to protect “the rights and reputation of others,” the authority and impartiality of the courts, public health, “morals of a democratic society,” and national security. Article 50, which guarantees freedom of the media, states that a competent court may prevent “the dissemination of information and ideas” only if it prevents calls for “the violent destruction of the constitutional order”; the violation of Serbia’s territorial integrity; the propagation or incitement of war or direct violence; or racial, national, or religious discrimination, which could incite hostility or violence.94

Users have been sued or detained for their online speech and private lawsuits are filed against the media.95

In December 2021, when environmental protests against Rio Tinto’s lithium mining project erupted across Serbia, citizens, journalists and local community activists were visited by the police, a tactic that is seen as a means to intimidate them.96 In seven cases, police came to the homes of activists who had posted about the protests on Facebook and discouraged them from attending.97

Journalists and activists who were branded as organizers of the environmental protests and roadblocks received misdemeanor charges, which can carry prison time, simply for sharing information on social media or reporting from these events. Journalists of SOinfo portal Sava Majstorov and Sara Mikić, as well as local activist Danijel Mirkov, were targeted with complaints for the protest in Sombor98 , while journalist and photographer Mina Delić received a complaint in relation to the protest in Senta.99

Libel and insult lawsuits are used to intimidate journalists. In April 2021, the Belgrade-based company Millennium Team brought libel suits against a number of independent media portals following their coverage of a press conference in which an opposition politician criticized the company’s close ties to the government.100 The move was seen as a clear instance of media intimidation, because the company demanded €100,000 ($113,000) per article from each portal, and the company did not have any interest in suing the politicians whose claims the media had reported on.101 Moreover, Millennium Team did not deny the claims that were published, but instead immediately opted to go to court,102 stating that the purpose of the lawsuits was to prove their innocence without exerting any pressure on the outlets.103

In late 2021, the Crime and Corruption Reporting Network (KRIK), a nonprofit investigative journalism outlet, was subject to a wave of lawsuits from individuals with close ties to the government. The suits largely concerned reputational and financial damage, and the total amount demanded was triple KRIK’s budget.104 The outlet’s editorial board claimed the suits were a form of legal intimidation known as SLAPPs. The Independent Association of Journalists of Serbia (NUNS) highlighted the damaging effects that these lawsuits can have against independent media portals.105

In December 2020, a private citizen received a suspended sentence of six months’ imprisonment for allegedly using Twitter to endanger the security of President Vučić. Though the Twitter post in question used vulgar language to insult Vučić’s children, it did not demonstrate any clear intention to harm either Vučić or his family members.106 In April 2021, the conviction was overturned by the Court of Appeals in Belgrade.107

In April 2020, Nova.rs journalist Ana Lalić was held in custody for 48 hours for her reporting on poor hospital conditions related to the coronavirus pandemic. Her work violated the government’s March decision stipulating that all reporting on COVID-19 must rely on facts from the official Crisis Response Team (see B5).108 After Lalić’s release, the government backtracked on its controversial decision to centralize pandemic information, but government-affiliated media continued to harass her.

There are no legal repercussions for using encrypted services in Serbia. However, in the context of February 2021 arrests targeting a criminal network linked to Serbian soccer clubs,109 Minister of the Interior Aleksandar Vulin called for legislation to criminalize the possession of devices and other means that enable encrypted communication. Vulin’s proposal was supported by the Association of Judges and Prosecutors, but there were no legislative proposals on that matter as of June 2022.

There is no requirement for individuals to register with the government to use online services.

The constitution does not explicitly mention privacy, but it offers clear guarantees for the inviolability of dwellings (Article 40), the confidentiality of letters and other forms of communication (Article 41), and personal data protection (Article 42). Regarding confidentiality of communications, Article 41 states that exemptions are only allowed within a specific time frame and with a court order if they are necessary for the investigation of criminal activities or the protection of Serbia’s national security.

In December 2021, an investigation by Citizen Lab, a research center at the University of Toronto, identified customers in Serbia that were likely operating Predator, a spyware tool with advanced capabilities used to target and extract information from mobile phones. The tool is developed by Cytrox, a member of Intellexa, which bills itself as the “Star Alliance” of spyware.110 In May 2022, Google’s Threat Analysis Group reported that “government-backed actors” in Serbia likely used Cytrox’s spyware to exploit zero-day vulnerabilities in Android devices.111 This revelation followed a December 2020 Citizen Lab report that mentioned Serbia’s Security Intelligence Agency (BIA) as a possible customer of Circles, a spyware tool that allows customers to monitor calls, texts, and mobile phone geolocation by exploiting weaknesses in mobile telecommunications infrastructure.112

Telecommunications companies in Serbia are forced to retain communications metadata, and the authorities have accessed this information through dubious legal means (see C6).

In more than one instance, SNS members have made comments about unreleased articles and correspondence between journalists and their sources. The leaks have also found their way onto the front pages of government-affiliated tabloids.113 Stevan Dojčinović, editor of KRIK, has had his personal correspondence repeatedly intercepted by state agencies and published in Informer, one of the government’s staunchest tabloid supporters.114

KRIK and other media outlets and civil society organizations have recently been accused of cooperating with criminal organizations and working “against the state,” with high-ranking officials publicly threatening journalists using knowledge of their personal information and openly admitting to wiretapping.115

In 2017, the Serbian government signed two nonbinding agreements with Huawei, one of which concerned the “Smart Cities” project that included data gathering, storage, and management (see A1). In 2020, during the state-wide lockdown, more than 1,000 surveillance cameras with facial-recognition technology were installed on the streets of Belgrade.116

The Law on Personal Data Protection,117 adopted in November 2018, aligned Serbia’s data protection regime with the EU’s General Data Protection Regulation (GDPR) and its 2016 law enforcement directive.118 The Serbian law came into effect in August 2019, giving public and private entities adequate time to adapt to the new standards.

Serbia’s independent data protection authority is the Commissioner for Information of Public Importance and Personal Data Protection,119 which acts as a body for both freedom of information issues and personal data protection. Since its inception, the Office of the Commissioner has defended citizens’ data rights. According to its annual report for 2021, the Commissioner’s Office resolved proceedings in more than 12,000 cases, with about 3,300 of them concerning personal data protection issues.120

The Law on Electronic Communications requires ISPs and operators of mobile-phone and fixed-line networks to retain all metadata pertaining to communications on their systems for 12 months.121 The competent authorities, including the police and security agencies, can then request access to the metadata for the purposes of investigating crime and protecting national security. In 2013, the Constitutional Court, one of the two most important judicial institutions in the country, declared that access to communications metadata retained by network operators requires a court order, as they are an integral part of communication and as such have constitutional protections.122

However, SHARE Foundation’s research on data retention practices in Serbia has shown that state authorities access the metadata stored by telecommunications firms directly through “applications for independent access,” which are of dubious legality. Data from 2020, obtained by SHARE Foundation from the Commissioner for Information of Public Importance and Personal Data Protection, demonstrates that Telekom Serbia received 1,417 official access requests from the authorities, followed by Telenor (now called Yettel) and A1 Serbia with 422 and 122 respectively.123

Telenor’s databases were accessed directly by the police more than 270,000 times between March 2011 and March 2012, according to the Commissioner for Information of Public Importance and Personal Data Protection.124 Additional SHARE research confirmed that direct access to Telenor’s retained metadata continued from 2014 to 2017,125 and it is possible that other telecommunications companies allowed access but did not provide a report to the commissioner. Telenor, the only operator that reports on requests for independent access, did not produce any information on direct access to metadata in its annual report to the commissioner for 2018, which is when the company was acquired by PPF Group; the practice may have persisted thereafter.126

All network operators and state bodies authorized to access retained data are supposed to submit an annual record to the Commissioner for Information of Public Importance and Personal Data Protection. In accordance with Article 130a of the Law on Electronic Communications, the annual records must contain the number of requests for access to retained data, the number of granted requests, and the number of days between the initial data retention and the time of requested access.127 The parliament’s Committee for the Control of Security Services also theoretically has oversight powers,128 but the majority of the committee’s members belong to the ruling party or its coalition partners.129 Serbia does not have a data localization requirement (see C5). Serbian tech companies have yet to publish transparency reports similar to those generated by global platforms such as Facebook and Twitter.

According to the Law on Electronic Commerce,130 which regulates matters including intermediary liability, ISPs are obliged to store data on the users of their services, including the internet protocol (IP) address from which a user gains access, both during use and a minimum of 30 days after termination of service (Article 16, Paragraph 3). The law does not explain the purpose of this collection, who can access the data, and how the rule is to be enforced, which leaves room for broad interpretation by the authorities.

Some major international tech companies, including Meta and Amazon, had not yet named a local representative for data protection issues in Serbia at the end of the coverage period, a step that is required under the Law on Personal Data Protection.131

Journalists often face physical assaults and threats in connection with both online and offline reporting.

The Independent Association of Journalists of Serbia (NUNS) documented 151 attacks on journalists, both online and offline, in 2021.132 Of the 151 cases, 6 were physical assaults. The other attacks included verbal assaults, pressure and threats, and attacks on journalists’ property. When such cases make it to court, the judicial procedures are usually drawn out and frequently obstructed.

Beginning in late 2021, police showed up to citizens’ houses in response to posts on social media about environmental protests. In some cases, police raided their homes and charged them with misdemeanors (see C3).133

The case of Milan Jovanović, an investigative journalist for Zig.info, remains an active reminder of the threats journalists face and the judiciary’s problematic responses. In December 2018, Jovanović’s house was set on fire after a Molotov cocktail was thrown at it in the middle of the night. The attack was quickly connected to the local mayor, high-ranking SNS member Dragoljub Simonović, whose business dealings Jovanović had been writing about for years. The ensuing trial was plagued by obstructions from the defense and interference by progovernment tabloids, with the judiciary itself coming under pressure. Although the trial carried on for more than two years due to Simonović’s refusal to show up to court hearings, he was ultimately sentenced in February 2021 to four years and three months in prison for inciting the arson of Jovanović’s house.134 Jovanović has been under police protection since the incident. However, in December 2021, the Appeals Court in Belgrade overturned the initial ruling and ordered a retrial, based on a technicality and a procedural error.135

Online harassment of journalists has been a common occurrence. Gender-based attacks on women journalists remain a recurring theme in the broader intimidation and harassment of media workers in Serbia. In a report compiled from the results of research conducted in 2020 as part of the international Media4Women campaign,136 71 percent of women journalists working in Serbia said they had received misogynistic and gender-based harassment online in the past five years, and 54 percent said they experienced some form of online sexual harassment.137

Prior to the December 2021 #nisamprijavila (#ididntreportit) campaign,138 in which sexual abuse survivors shared their experiences with sexual abuse on Twitter (see B8), there had been reporting on Telegram groups in which members shared nonconsensual intimate images of former partners as a form of retaliation, as well as nonconsensual screenshots of women’s Instagram profiles and photos of women taken on the street.139 The group members solicited information about the women in the images and shared their personal details, including names, addresses, and social media profiles. The largest group consisted of more than 30,000 members, while the smaller groups were organized around individual cities in Serbia.140

The migrant population in Serbia has been subject to online threats and harassment, with scores of fake news websites and portals sharing conspiracy theories regarding the supposed settlement of migrants in the country during the statewide COVID-19 lockdown in 2020 (see B7).141 The proliferation of misinformation around migrant issues ultimately led to antimigrant rallies in cities across Serbia, as well as a violent break-in at one of the migrant reception centers near Belgrade.

Cyberattacks are relatively common in Serbia, and civil society and media outlets are often targeted. From June 2021 through May 2022, SHARE Foundation recorded 24 information security breaches that were publicly disclosed. Three of the breaches involved technical restrictions of content, including distributed denial-of-service (DDoS) attacks. SHARE also recorded 16 instances of computer fraud, and two cases of disabling control over an online account or piece of content.142

In July 2021, a Turkish group of hackers, known as Cyber-Warrior Tim Akincilar, attacked the official website of the Public Debt Administration of Serbia and left a message on the homepage seemingly in protest of the Serbian government’s refusal to recognize the Srebrenica genocide.143 The largest publicly known cyberattack on a government entity in Serbia occurred in March 2020, when Informatika, a public utility company from Novi Sad, was targeted with ransomware. This attack caused an outage in the operation of the city administration, as its system was housed within Informatika.144 The city refused to pay the Bitcoin cryptocurrency ransom and had to establish a new computer system.

Independent media and civil society groups regularly experience technical attacks. In early April 2022, the website of the Beta news agency was targeted with a DDoS attack, rendering it inaccessible.145 Also in April, Danas daily newspaper experienced a “flood” attack, which is a type of DDoS attack, for more than 10 days, but public access to the site was not jeopardized.146

Serbia signed and ratified the Budapest Cybercrime Convention and has adapted its criminal laws to conform with the standards of the convention.147 The criminal code of Serbia contains a chapter focused on “crimes against security of computer data” (Articles 298–304a).148 There is a special Prosecution Office for Cybercrime in Belgrade,149 but given the sheer number of incidents and the fact that it is the only prosecution authority tasked with handling such cases in the country, it has struggled to keep up with a growing backlog.