Serbian Police’s Expanding Drone Arsenal Draws Concern – Analysis
Serbia has been acquiring ever more sophisticated drones for years – but experts say the lack of regulation and oversight is disturbing, and creates opportunities for abuse.
By Aleksa Tesic
Brian Brkovic, an environmental activist, was surprised by a motionless drone a few meters in front of the window of his apartment in Novi Sad, northern Serbia, on a March morning in 2022. Across the street, the Belgrade-Novi Sad railway line was being inaugurated by Serbian President Aleksandar Vučić and Hungarian Prime Minister Viktor Orban. It remains unclear if the drone was recording the gathering or Brković’s apartment.
“The drone with a camera stood there for 30 minutes; the scene was Orwellian. I received no prior notification,” Brkovic told BIRN, adding that he’d noticed drones before – at environmental protests.
Serbia’s Ministry of the Interior, MUP, in recent years has acquired various advanced drones, a BIRN analysis of public procurement data reveals. These aircraft use sensors and artificial intelligence for flights, real-time imaging, as well as high-quality cameras and powerful zooms. Some have the option of additional features, allowing them to gather biometric data.
Police use of drones, however, is characterised by a lack of regulation and restrictions over their use, the data they collect and their storage, the experts say.
“Drones are a tool for civilian and military purposes that gather a vast amount of data, and if there is no clear legal regulation on how this data is stored, it is normal that they pose a threat to everyone’s privacy,” Svetlana Stanarevic, a professor at the Faculty of Security in Belgrade, told BIRN.
“If the recordings are used to identify individuals and create dossiers on citizens who’ve [publicly] expressed dissatisfaction, that is prohibited. Citizens are quite uninformed about the possibilities of this new technology,” she added.
Police use drones, among other things, for rescue missions, border surveillance, monitoring illegal migration, firefighting, tracking individuals under investigation or on the run, and to access physically inaccessible terrain.
The use of cameras is loosely regulated under Serbia’s Law on Police, last amended in 2018, and under the Regulation on recordings in public places and the manner of communicating the intention to record, adopted in 2020.
The law states that the police have the right to record events in public spaces, “when there is a danger that during a public gathering there may be a threat to the life and health of people or property” – but that it is obliged to publicly announce it is recording in a specific public space.
Use of biometric cameras and surveillance of citizens is not legal in Serbia. The MUP tried to introduce amendments to laws allowing it to start gathering biometric data in 2021, after a series of protests against lithium mining, but the drafts met a public backlash and were withdrawn.
The ministry did not respond to BIRN’s questions about the models of drones it uses, the protocols specifying their usage, data collection and storage, pilot licensing, collaboration with private companies, and the security and privacy measures used to prevent the misuse of collected data.
Few details on what police are buying
Although Serbian state institutions are obliged to publish data on public procurements on the public procurement website, it is almost impossible to find information on the police’s purchase of drones.
However, the website of the Public Procurement Office does provide data on purchases of software, maintenance services and additional equipment for drones. BIRN analysis of these data and of publicly available photographs and news of police equipment reveal some of the drone models that the police in Serbia use.
Chinese DJI drones are most commonly mentioned in procurements. Through public procurement searches, BIRN has also found data showing that the Serbian police possess Chinese Yuneec Typhoon Q500 drones as well as Romanian unmanned aerial Hirrus vehicles.
Publicly available photos of the Serbian Gendarmerie show that this police unit uses DJI Mavic 2 Pro Zoom drones, while news from the police website reveals that the traffic police received donated Yuneec Typhoon Q500 drones. The MUP itself procured maintainance for Hirrus drones, promoted for military and civilian purposes, for control of protests, firefighting, border and coastal surveillance, and tactical-intelligence reconnaissance.
Most Chinese DJI drones have an integrated intelligent flying option and automated “active tracking” of objects, people, boats, and moving vehicles or circling around a predetermined “point of interest”, allowing the operator to control other functions, such as zooming, image sharpening, and framing.
The intelligent tracking mode in the DJI Matrice 300 model has the option of detecting, identifying, and counting objects or persons, measuring the area they occupy, detecting their geo-location from a distance of more than a kilometre, and tracking them in real-time.
This so-called “Spot-check” option allows the drone’s camera to memorise a specific object or face and recognise it during subsequent recordings.
The DJI offers flight route automation, allowing predetermined coordinates and parameters to be set for the drone to fly automatically and use sensors to bypass obstacles.
DJI Matrice 300 and 210 V2 models also have a “stealth mode” option that turns off all lights on the drone, making it inconspicuous in the night sky.
The load that the Serbian police’s drones can carry ranges up to several kilograms. Greater load capacity means larger cameras or ability to carry more devices; besides cameras, these can include, among other things, speakers, radars, or lights. BIRN has no data on whether the Ministry of the Interior has purchased additional equipment for DJI aircraft. The police did not respond to BIRN’s questions about acquisitions of additional equipment.
The prices of cameras purchased separately for DJI drones can cost as much as the aircraft itself, i.e. several thousand euros. The Chinese DJI catalogue, in addition to thermal cameras intensively used at night to detect thermal radiation, offers attachments for speakers and lights that are most commonly used in rescue missions.
Under certain conditions, thermal cameras can be used to measure body temperature, determine population density, count and detect faces in night-time conditions or in inaccessible terrain. A source close to the Serbian police told BIRN that such drones are most commonly used at borders to monitor illegal migration.
The official DJI user manual recommends avoiding the use of tracking functions on children and people and emphasises compliance with local laws.
In a brochure sponsored by the Chinese company DJI, which the Serbian police used, it is advised to justify the “public purchase of drones” by establishing clear rules for their application in public security services, transparency in storing recordings, and training drone pilots.
Romanian Hirrus aircraft can reach over 100 kilometres per hour, while newer DJI models can go faster than 50 kilometres per hour. The newer models that the Serbian police uses also have durable batteries lasting at least 30 minutes, excluding the option of external power.
These aircraft can also fly kilometres away from the control console and pilot. Hirrus aircraft have a transmission range of up to 15 kilometres. The Romanian company AFT, the manufacturer, refers to this option as “over-the-hill” transmission.
While in some countries, like the United States and Canada, police and other authorities mainly may not operate a drone beyond the line of sight of the pilot, in Serbia this field is not legally regulated.
Chinese drones come with powerful cameras
The cameras on police drones are characterised by high-quality video recording and a resolution of up to 4K, making them a powerful tool for monitoring and documenting events. DJI Mavic 2 models have a 32x zoom, Mavic 3 has a 56x zoom, and aircrafts from the Matrice series have a maximum zoom of 200x.
Dragan Simic, owner and director of the company Cyber Security and Defence, told BIRN that even lower-class drones than those used by Serbian police could be used for secret recording, as their high-quality cameras allow them to clearly record faces from great distances.
“With higher-quality zoom, it is possible to obtain quality footage without the aircraft being in the field of view of the observed person”, says Simic. He emphasised that there is no regulation limiting private individuals from modifying the aircraft and their cameras.
Since 2018, all DJI drones have the option of transmitting video signals to a control centre, allowing real-time monitoring and analysis of drone footage from police monitoring centres. BIRN has previously reported on analytical software procured by the Serbian police.
Regulations don’t apply to the police
The use of drones in Serbia in general is regulated by the Regulation on Unmanned Aerial Vehicles, but this regulation does not apply to the police, army and customs. Therefore, restrictions such as those stating that drones cannot fly higher than 100 meters, near to people or government institutions, do not apply to the police.
Ana Toskic Cvetinovic, from the non-governmental organisation Partners Serbia, say the police use of drones is poorly regulated.
“Unlike street cameras that cannot move, drones are much more invasive, having unlimited capability to intrude into any private space, yards, terraces; they can fly over these areas. For cameras, there is a prior assessment of why each camera is in a specific location; drones do not have that kind of restriction, someone controls the drone, and it is a question of how the person operating it assesses which positions are necessary for recording,” Toskic Cvetinovic says.
Drones have been used in Serbia to record civil protests, and a former Commissioner for Personal Data Protection Rodoljub Sabic says the police have failed often to inform the public about the details of these recordings in recent years.
“Informing the public about recording is not a matter of goodwill but a strict obligation of the police. Both the Law on Police and the corresponding sub-law act […] explicitly stipulate the obligation of the police to inform the public about the intention to record.
“While the police generally fulfils its obligation to inform, there have been cases when this obligation was neglected,” Sabic says.
Sabic believes that police drones with integrated capabilities for automatic tracking of a person or object, determining their exact geolocation, counting people or objects in a crowd, as well as the possibility to additional instal face recognition features, “can be very effectively abused for covert tracking purposes”.
“There are no legal grounds in our country for the use of any option involving tracking and identification based on biometric characteristics, and the possibilities of abuse are obvious. Especially in the absence of precise instructions on use of these features and any oversight, it is possible to track not only criminals but also political opponents, people from the civil sector, critically inclined journalists, and the like,” Sabic points out.
Toskic Cvetinovic says the Ministry of the Interior should inform the public not only about recordings but also about the devices it will use.
“Citizens should know if the software installed on the drone restricts any of their rights. If the police apply covert surveillance to a large number of people, if drones are being used for recordings, the capabilities of the devices should be specified. The same goes for the street cameras, regardless if they only record streets or also recognise license plates. A drone cannot be treated like an ordinary camera,” Toskic Cvetinovic says.
Sabic accepts that the trend towards police robotisation and depersonalisation is global but adds that, “despite this, there is no doubt that the issue of police use of drones must be regulated as precisely as possible”.
“Although the use of new technologies in police work can significantly contribute to its efficiency, it must inevitably have limits”, he concludes.
Risk of being hacked
Chinese DJI drones, predominantly used by the MUP, have numerous vulnerabilities and are susceptible to hacking according to data obtained and published by foreign cybersecurity experts in recent years.
In March this year, German researchers discovered 16 vulnerabilities in the DJI aircrafts’ systems and accompanying applications, including those in the series of Mavic 2 drones, such as those owned by the Serbian police.
Instructions for hacking DJI no-fly zones, which protect strategic positions and airports, are available online, and data from the DJI Aeroscope drone detection program leaked at the end of last year, reveal serial numbers and pilot locations.
“In terms of architecture, DJI is a specific system where certain information is sent to central DJI servers, such as the pilot’s location and drone route. This storage itself poses a serious security risk, it’s something other drones do not have,” a Serbian expert on unmanned aerial vehicles told BIRN.
