Prosecutor in Belgrade Trump tower case ‘targeted with spyware’

A Serbian prosecutor who investigated an allegedly illegal scheme to clear the way for a Trump-branded tower in Belgrade has been targeted with advanced spyware, according to forensic analysis of his phone.

Rade Bajić, a member of Serbia’s specialised organised crime prosecution unit, received a message from Apple in August warning that it had “detected a targeted mercenary attack against your iPhone”.

Researchers at the Citizen Lab, a digital forensics laboratory at the University of Toronto, said the warning was “a high confidence indicator that his device was likely targeted with mercenary spyware, such as Pegasus”. They have not established who was behind the attack.

“In my opinion, my involvement in this case was the sole reason for this unlawful spyware attack,” Bajić said, according to The Guardian, which first reported the findings.

The General Staff building

The case concerns the former Yugoslav army General Staff building in central Belgrade, a modernist landmark designed by the architect Nikola Dobrović that was badly damaged by Nato bombing in 1999 and has stood as a ruin ever since. Many Serbs regard it as a memorial to the bombing.

Last year prosecutors brought a landmark indictment against senior officials, accusing them of abusing their office to unlawfully strip the site of its protected status so that it could be redeveloped. The accused face years in prison if convicted.

The site was earmarked for a $500m hotel and tower development led by Jared Kushner, Donald Trump’s son-in-law. Kushner called off the plans after the charges were made public.

Last week The Guardian reported that Aleksandar Vučić, Serbia’s president at the time, had personally ordered that the site be stripped of its legal protection. At the weekend Vučić confirmed details of a previously secret meeting but indicated he had done nothing wrong. “I fought for my people,” he said. “And that’s what I’ll continue to do in the future.”

Representatives of the Trump family and Kushner have denied engaging in “pay to play” arrangements and said they were not involved in the Serbian authorities’ decision to remove the building’s protection.

Removed from the case

Vučić vowed reprisals after the indictment and denounced the prosecutors involved, including Bajić. The prosecutor has said he was taken off the case without explanation shortly before the indictment was published. In February he addressed one of the protests against the government that have been fuelled by anger over corruption, telling demonstrators: “The law will be equal for all.”

Vučić stepped down as president late last month and has called snap elections for 25 October, seeking to extend his 12-year rule by becoming prime minister. He has been approached for comment, as has the prosecutors’ unit, which has said it may bring further charges in the case.

A pattern of surveillance

Working with the Share Foundation, a Serbian digital rights group, Citizen Lab researchers have previously identified spyware attacks against anti-government protesters in the country. In at least one case they found Pegasus on a protester’s phone.

“A zero-click infection with Pegasus spyware would not have been visible to the target, and would give the Pegasus attacker total access to the device,” they said of that discovery. Zero-click attacks require no action from the victim, such as opening a link, and can give an attacker access to messages, photographs, the microphone and the camera.

Pegasus is made by the Israeli company NSO Group, which says it sells its products only to government agencies for use against serious crime and terrorism. NSO has been approached for comment. Investigations by journalists and researchers in recent years have documented the spyware being used against journalists, activists and politicians in many countries.

The Serbian authorities have previously been found to have used spyware against opponents. Apple sends threat notifications when it believes a user has been individually targeted by state-sponsored or mercenary attackers, but does not say who is responsible.

Why it matters

The case is believed to be the first criminal prosecution linked to the Trump family’s global business ventures, which critics describe as trading favour with the administration for commercial opportunities. If confirmed, an attempt to hack the phone of a prosecutor involved would raise serious questions about the independence of Serbia’s justice system days before an election in which Vučić is seeking to remain in power.