Citizen Lab says Serbian prosecutor Bajić was likely targeted with spyware

Prosecutors indicted officials over General Staff building protection

Rade Bajić, a member of Serbia’s specialised organised-crime unit, investigated the authorities’ allegedly illegal scheme to help the Trumps build a tower in Belgrade. In August, Bajić received a message from Apple saying it had “detected a targeted mercenary attack against your iPhone”. Citizen Lab researchers analysing his phone called the notification “a high confidence indicator that his device was likely targeted with mercenary spyware, such as Pegasus”. Citizen Lab, a digital forensics laboratory, has not so far established who was behind the attack.

The Guardian wrote:

“The finding suggests a disturbing new element in the authoritarian Serbian regime’s campaign to undermine what is believed to be the first criminal case related to global moneymaking drive of the US president’s family, which critics describe as a “pay to play” scheme trading the Trump administration’s favour for business opportunities.”

Prosecutors brought an indictment last year against senior members of Vučić’s government, accusing them of abusing their office to unlawfully strip the General Staff building of its protected status. The building was described as a monument to Serbia’s recent difficult history, and the defendants face years in jail if convicted.

The proposed Belgrade development attracted protests; one banner read, “We won’t give up the General Staff building.” Jared Kushner, Donald Trump’s son-in-law, had been leading plans for the development. The Guardian reported last week that Serbia’s president, Aleksandar Vučić, personally ordered the General Staff site’s legal protection removed so it could be handed over for a $500m Trump hotel and tower.

The Guardian described Vučić as “one of the Balkans’ most influential nationalists” and said he hosted the US president’s son Donald Trump Jr. — “dear Don”, as he calls him — and son-in-law Jared Kushner as he “ingratiated himself with the Trumps”.

At the weekend, Vučić responded to The Guardian’s account by confirming details of a previously secret meeting and indicating he had done nothing wrong. “I fought for my people,” he said. “And that’s what I’ll continue to do in the future.” Kushner, who had been leading the Trump Belgrade development, called off the plans after the charges became public.

Vučić vowed reprisals and denounced the prosecutors, including Bajić, who was a member of the specialised organised-crime unit that brought the indictment. Representatives of the Trumps and Kushner denied they engaged in “pay to play” arrangements and said they were not involved in the Serbian authorities’ decision to strip the building of its protected status.

Bajić said, “In my opinion, my involvement in this case was the sole reason for this unlawful spyware attack.” He has said he was taken off the case without explanation shortly before the indictment was published. In February, he addressed a protest and told demonstrators, “The law will be equal for all.”

The Guardian reported that “the Serbian regime has previously been caught using spyware against its opponents.” Citizen Lab analysts, working with the Share Foundation, a Serbian rights group, previously identified spyware attacks against anti-government protesters. In at least one case, they discovered Pegasus on a protester’s phone. “A zero-click infection with Pegasus spyware would not have been visible to the target, and would give the Pegasus attacker total access to the device,” they said of that discovery.

The Guardian’s Pegasus Project revealed how journalists, activists, politicians and others have been targeted by governments using the spyware. NSO Group, the Israel-based company that makes Pegasus, was approached for comment.

Vučić, who cannot run for a third presidential term, stepped down late last month and called snap elections for 25 October. He is attempting to become Serbia’s prime minister, switching from the presidency after a 12-year rule. He has been approached for comment, as has the prosecutors’ unit, which has said it may bring more charges in the General Staff building case.