Greek Journalists Testify on Spyware Affair to European Parliament Inquiry

A group of Greek journalists and government officials on Thursday testified to a European Parliamentary inquiry about the “use of spyware in Greece” – part of a Committee of Inquiry on the use of Pegasus and equivalent spyware in Greece.

The PEGA invited the Greek journalist Thanasis Koukakis, who was targeted with Predator, Stavros Malichoudis, a victim of wire-tapping, and Eliza Triantafillou, an investigative journalist at the Greek media outlet Inside story, to share their experiences as targets and investigators of surveillance.

However, Koukakis was put out of the Investigative Committee after the Greek parliamentary majority voted against a proposal to summon the journalist, the main protagonist of the wiretapping scandal, as a witness.

“The PEGA committee has shown a sincere interest in the case of surveillance in Greece and I am sure that it will exert a lot of pressure to highlight aspects of the case that have not yet been clarified. I think this will become clear when the committee visits Greece,” Koukakis had earlier told BIRN.

Koukakis discovered that his phone had been infected with Predator and that he was being wiretapped as well.

In November 2021, BIRN contributor Malichoudis found that he was among a number of journalists, lawyers dealing with refugee cases, civil servants and anti-vaxxers being wiretapped by the Greek National Intelligence Service, NIS.

Koukakis and Malichoudis both believe they were targeted because of their work.

“We received questions from all MEPs from all parties, who even asked for our opinion in which direction they would move legislatively regarding spyware’s use,” Triantafyllou told BIRN of the hearing.

Triantafyllou, together with her colleague Tasos Telloglou, from Inside Story, revealed the “Predator-gate scandal” in Greece. Triantafyllou stressed that in Greece official investigations into privacy violations seemed to proceed slowly – while investigations into leaks to the media advanced much faster.

She added that spyware provider Intellexa’s activities should be investigated as well.

In the meantime, Ta Nea, a Greek media outlet, wrote that the records of the monitoring of Koukakis and Nikos Androulakis, head of the left-wing PASOK-KINAL, the third-largest party in the Greek parliament, almost fell victim to Predator surveillance software, and have been destroyed by NIS. Androulakis was not invited to the hearing.

When PEGA MEPs asked about the destroyed files, Christos Rammos, president of the independent Hellenic Authority for Communication Security and Privacy, did not deny destruction of the files but noted that the investigation is still ongoing and that he is not allowed to comment. MEPs called for more transparency and faster investigation of the case.

Panos Alexandris, Secretary General of the Greek Ministry of Justice and Human Rights,  told the committee: “I heard about a scandal, why is it a scandal? I don’t know if it is just because it is expressed in the press? Because some people believe so? … We [should] wait for the official results [of the Greek probe].”

“The appearance of the two government officials at the hearing was deeply disappointing. They refused to offer explanations, acted as if they don’t recognise their obligation to accountability and at one point even challenged whether there is an actual issue with state surveillance of journalists and politicians in Greece,” Malichoudis noted to BIRN.

“It’s embarrassing for state representatives that MEPs present in the room responded by openly laughing to their statements,” he added.

Another issue that is raising questions is that the Greek parliament’s own Investigative Committee, set up to investigate the state surveillance scandal, is operating in a state of complete secrecy.

Vouliwatch reported that minutes from the meetings will not be made public, while the transcribed texts will not be distributed to the MPs who are members of the committee but kept in a safe place.

Opposition MPs from SYRIZA, PASOK-KINAL and the Communist Party have disagreed with this practice.

Albania’s Rama Savages Media Reporting on Child’s Death at Sea

Albania PM Edi Rama during a press conference following the Western Balkans Summit in Tirana. Photo: LSA

Prime Minister Edi Rama lashed out at local media after an off-duty police officer accidentally killed a child with his boat at sea, likening them to animals.

The death on Tuesday shocked the country, where many have been asking for more protection on beaches; this is not the first such case during this year’s touristic season.

Prime Minister Rama, after consoling the child’s family members, focused on attacking the media.

“Even in this case, the political-media animalism of those who wish and expect nothing but disaster to fuel the fire of their unjust and hopeless political war, was not missing!” he wrote on Twitter.

State Police late on Tuesday fired the entire chain of command of the local Directorate for Border and Migration of Vlora, “for not implementing additional measures to prevent incidents with watercraft in coastal areas”.

Communications expert Edlira Gjoni on Facebook said the Prime Minister should seek forgiveness from the media he had insulted.

“What about you, a prime minister that calls us ‘political-media animals’! That’s what we call you too … Get over the animalism and make your deputies deal with initiatives that save, no take, lives!” she wrote.

Citizens have called for a protest meeting at the Ministry of Interior under the motto “The boat did not kill her, the state did”.

Rama is well known for his battles with the media. Last month, when Albania faced another cyber attack, he attacked the media for reporting about it.

Media outlet Top Channel reported that Iran was behind the cyber attack, sending a political message to Albania, which is hosting around 3,000 exiled Iranians in Albania belonging to the People’s Mujahedin of Iran, MEK.

Reports also said the attackers demanded 30 million euros in bitcoin. But Rama denied the report of blackmail on Twitter, calling the news about the “demand for 30 million euros completely fake”.

On Twitter, on July 24 he asked: “Why does Top Channel continue to speculate irresponsibly, without any basis, proof, or fact, on the developments on the cyber war front? I don’t know.”

The relationship between Rama and the local media has long been fraught.

This year Rama ordered two journalists to undergo “re-education”, meaning that they don’t have the right to attend his press conferences or ask him any questions for a certain period.

This year, Albania fell 20 places in the latest press freedom index compiled by international watchdog Reporters Without Borders, falling from 83rd to 103rd place.

Reporters Without Borders said that journalists in Albania are targeted by organised crime groups and even by police violence and that the state is failing to protect them, while private media outlets are owned by businessmen who have links with politicians.

North Macedonia Ministry Denies Covering up Ransomware Attack


North Macedonia’s Agriculture Minister, Ljupco Nikolovski. Archive photo: mzsv.gov.mk

North Macedonia’s Agriculture Ministry has admitted that on September 12 it was attacked by the ransomware group BlackByte, previously known most for attacking key US infrastructure and agencies.

The admission came after the head of the agriculture committee for the main opposition VMRO DPMNE party, Cvetan Tripunoski, on Sunday accused the ministry of keeping silent about the attack.

The ministry has now confirmed some documents were compromised during the attack and its work blocked for some time, but it denied having lost any significant documents and data in the process.

“There has been damaging or decryption of data from office documents such as Word, Excel and PDF, while the applications of the ministry … were not damaged by the attack but were shut down as a preventive measure, and are now active again,” the ministry told BIRN on Monday.

It did not reveal what kind of data were contained in these documents that are among the most commonly used document formats in many public institutions.

It added that the ministry’s “archive is also [now] functional and works, without a single document gone missing or damaged”.

“From sources inside the ministry, we found out that a large part of the documents from ministry’s archive have gone missing,” Tripunovski said on Sunday, alleging that they had heard of data gone missing from the ministry’s register of farms, wine buyers, agricultural companies and organic producers.

The opposition official added that the register of active contracts for leasing agricultural land was also missing, as well as the list of ministry’s debtors and the documentation on all the administrative disputes that the ministry is involved in.

Tripunovski also gave the entire affair an unexpected spin by speculating whether the digital attack was for real, or a device to cover up crimes.

“The silence of the Agriculture Minister, Ljupco Nikolovski, casts serious doubt on whether this is even a hacker attack, or whether this was done to cover up criminal actions and misuses by the government of the Anti-Macedonian SDS [the main ruling Social Democrats],” he said.

The ministry on Monday said the allegations were “nonsense”.

Asked about why the public only found out about the attack that happened on September 12 in a press release on its website on Sunday, the ministry insisted that while the website had functioning properly all the time, it had informed the public about the attack on the day it happened, but only on its Facebook page.

According to research done by the online security company Trend Micro, published in July, BlackByte ransomware group has been building a name for itself since 2021 by going after “critical infrastructure for a higher chance of a getting a pay-out”.

The North Macedonian Ministry did not clarify whether the group demanded a payout, or if and how it responded to such demands.

BlackByte made its debut in July 2021, the research notes, adding that in Its first year of activity it garnered the attention of the US FBI and the US Secret Service, USS, for going after “at least three US critical infrastructure sectors, notably the government facilities, financial, and food and agriculture.”

The research notes: “At present, BlackByte continues to target organizations from all over the world. However, like LockBit, RansomEXX, and many other ransomware families, BlackByte avoids attacking Russia-based entities.”

The latest attack on a North Macedonian ministry comes after the country’s education ministry’s site was downed earlier this month, seemingly by an unrelated group of hackers, prompting North Macedonia’s National Centre for Computer Incident Response to urge all state institutions and companies to beef up their online security protocols against potential cyber-attacks.

It follows a spate of cyber-attacks on state institutions in Montenegro, Kosovo and Albania, which some observers suspect it might lead to a connection with Russia, which Moscow has denied.

Albania’s Ministers Promote Private Social Media Pages Using Public Resources

Albania’s Prime Minister, Edi Rama, starts his workday at 8 a.m. on his Facebook page, posting photos or videos that foster an aura of optimism, often showing fragments of infrastructure projects from across the country.

Rama has turned his private Facebook page into the main communications channel between the government and the public; it has some 1.6 million likes and posts appear six or seven times a day. Each post gets hundreds of comments and thousands of likes.

Since 2013, the Prime Minister’s office has had another Facebook page, called Kryeministria. However, it’s a lot less popular, with just 3,500 followers, few interactions and no real public influence.

Rama is not the only member of the Albanian government to concentrate public communications in his private channels. Most of his ministers follow the same model; they have more followers and much more content on their personal pages than on the pages of the official institutions they lead.

Social media has been transformed over the last decade into a major political tool in elections; however, to be efficacious, they need to be fed continuously.

Data obtained through a Freedom of Information request also show that Prime Minister Rama and his ministers use public funds and resources and for this, alongside an extensive network of public employees, to produce content and promote their social media accounts.

By analyzing data collected by Crowdtangle, a tool developed by Facebook, BIRN discovered that the personal Facebook pages of Rama and his ministers are fed with far more posts, videos and lives than their institutional pages. About 98 per cent of the total interactions go to their personal pages, compared to just 2 per cent to their institutions’ pages.

The management of the digital communication channels of the Prime Minister, ministers, the Prime Minister’s office and the ministries is the responsibility of the Media and Information Agency, MIA, a body created amidst debate a year ago, which is led by his spokesperson, Endri Fuga.

Although the Socialist government’s communications through social media networks are not regulated by law, civil society groups accuse it of using public resources for political purposes.

“Ministers’ political profiles are supported by ad money from the state budget, while their official duties are later used as weapons to support their parties in election campaigns,” said Rigerls Xhemollari, from the Qëndresa Qytetare, an NGO.

Fuga, director of the MIA, told BIRN that the management of the content of the social media accounts of the Prime Minister and his ministers serves to inform the public. He dismisses suggestions that public resources are being misused.

“Employees of the MIA, including the spokespersons of the ministries, are engaged in producing content that is related only to the government duties of the Prime Minister and members of the government,” Fuga said.

“Their work serves the purpose of informing the public through the social networks about the government’s activities, not the personal or political-party activities of the ministers,” he added.

Private accounts much busier than public ones


Albania’s Prime Minister Edi Rama flashes a Victory gesture to the media as he casts his ballot at a polling station near Tirana, Albania, 25 June 2017. Albanians head to the polls on 25 June for parliamentary elections. EPA/MALTON DIBRA

The MIA was created in September last year through a decision of the Council of Ministers. It is responsible for providing transparency over the policies and activities of the Council of Ministers, ministries and any central government body.

The agency also produces government propaganda and manages and supplies the social networks of the Prime Minister, the Prime Minister’s Office, the ministers and their ministries with content.

MIA told BIRN in an answer to an FoI request that the content for the social networks of the Prime Minister and his office is the responsibility of four employees of the sector for informing the citizens, and is supported by the sector handling Design and Creative Product. The MIA did not divulge the number of employees engaged in this latter sector.

The MIA answer stated that the social network accounts of the members of the government and their ministries are managed by their spokespersons, supported by “structures responsible in each ministry”.

On Rama’s and his ministers’ pages on social media networks they often post personal statements or about their political or party activities, but the MIA insisted these are not their responsibility.

“The publication of posts of a personal character, such as opinions… are the responsibility of the Prime Minister or the ministers, while the publication of the activities or materials of political character and their publication on the social media accounts of the Prime Minister and the ministers are prepared and managed by their political staff, attached to the Socialist Party,” the MIA said.

The number of PR officers that work for the Prime Minister and ministers and their ministries is difficult to ascertain. However, a former ministerial adviser told BIRN on condition of anonymity that there are far more people engaged in this than the official numbers.

“Apart from the spokesperson, each minister has an advisor for media relations and three or four specialists that produce the content for social media,” he said, adding that part of the PR staff usually are paid formally for other positions not directly related to the job they actually do.

In the virtual world of the Facebook, the most popular social network in the country, the success of a page or profile is measured by the number of posts, shares or likes – which are counted as “interactions”.

Using data obtained through the Crowdtangle tool, BIRN discovered that the private pages of Rama and the ministers have an aggregate content and interactions that dwarf the activity of the official pages of the respective institutions. In this analysis, the private profile of Deputy Prime Minister Belinda Balluku is excluded, as she doesn’t have a page on Facebook.

Over a one-year period, the personal page of Rama and ministers together had some 8,801 posts while their official pages have some 5,342 posts. About 62 per cent of posts went to the private pages while 38 per cent to the official ones.

The private pages also had 53 per cent of the all videos posted on Facebook and 69 per cent of live transmissions.

However, the gulf is much wider when views or videos and interactions are also taken into account.

Data collected by using Crowdtangle shows that the private pages of Rama and the ministers together secured more than 15.2 million interactions during a one-year period, while their official pages had just 292,000 interactions. It means that some 98 per cent of the interactions went to the personal pages, compared to just 2 per cent to the official ones.

‘Historical memory ending up on mobile phones’


Albanian Prime Minister Edi Rama speaks to media as he arrives for an EU-Western Balkans leaders’ meeting in Brussels, Belgium, 23 June 2022. The progress on EU integration and the challenges which the Western Balkans countries face in connection to the Russian invasion of Ukraine are topping the agenda when EU and Western Balkan leaders meet prior a European Council meeting. EPA-EFE/STEPHANIE LECOCQ

The normal practice of Western leaders in communicating through social networks involves a clear division between their personal pages and the official pages of the public institutions, which carry most of the burden in communicating with the wider public.

In Albania, the strategy of the government effectively favours the individual pages at the expense of the institutional ones.

Afrim Krasniqi, director of the Institute for Political Studies, criticizes the practice of publishing official acts on social networks, claiming it has effectively “personalized” the state.

Krasniqi says there is cause for concern over the consequences this might have for the documentation of the government’s work.

“Historical memory is ending up on mobile phones or on the personal emails of officials,” Krasniqi said, providing examples of when official conduct was never properly documented elsewhere, except on the personal social media pages of the Prime Minister.

“From a legal aspect, this is a violation of the law, while from an administrative aspect, this is a violation of the rules; from a political aspect, this is an abuse of public office while from a historical aspect this is an investment against the memory of the state and the archives,” Krasniqi said.

Xhemollari, from Qendresa Qytetare, told BIRN that channelling official communications via personal Facebook pages is a reflection of the general practice of the current government, which is based on the individual and not on the institution.

“This communication philosophy creates a party state, individuals that are stronger than institutions, while at the same time it violates the election law and the ethical codes on communication and erodes the rule of law and the transparency of governance,” he said.

However, not all believe in a complete separation between the political leaders and the institutions in terms of communications.

Erla Mehilli, a journalist and former spokesperson of former PM Sali Berisha, told BIRN that while social networks should not replace official channels through which the state communicates to citizens, personal pages can be useful in sharing some informal moments.

Mehilli believes officials cannot be banned from using their personal accounts for official communications, though she also believes that some form of regulation is needed.

“It is not easy to separate the individual from the office that he/she holds. I am not aware whether any law bans an official from using their personal pages along with the official ones for communicating, even for official communications,” she said.

MIA didn’t answer queries from BIRN about what happens with the ministers’ personal pages once they leave office, and have the possibility of using social media created at public expense for their future political careers.

Fuga said the content doesn’t change and is not deleted from these pages. “Such content continues to be accessible for the public in these pages beyond the time of the holding of the office by a minister,” he said.

Journalists from Greece Ask PEGA Committee to Check Their Devices

Photo: Lianhao Qu / Unsplash

Greek journalists and foreign correspondents in Greece have asked the EU’s Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware, PEGA, regarding protection of their devices. 

“After the revelation of the ‘Greek Watergate’ scandal, Greek democracy is in danger and the safety of journalists and any other critical voice is at stake,” their joint letter says. 

It adds that there is no trust in the Greek parliament’s in-house investigative committee, set up to investigate the state surveillance scandal, and asks PEGAs and the European Parliament to support them. 

The 24 journalists also call on the European Parliament to provide funding and facilities to check their smartphones and devices for wiretapping and any illegal or legal spyware, or use the existing EU cyber-security structures already available to MEPs.

According to the letter, the journalists who signed it are either directly related to the case, covering the scandal, or have suspicions that their phones may have been infected.  

The initiative was launched by Dutch journalist Ingeborg Beugel, a freelance correspondent who has lived in Greece for 41 years.

After a heated dialogue with PM Kyiriakos Mitstotakis at a press conference in November 2021, she experienced online and physical harassment, and had to leave Greece. 

“The whole letter is a statement. We journalists have grown tired of the Greek government’s words and promises. The rule of law is violated in Greece. We ask PEGA Committee to help us in practice,” Beugel told BIRN. 

Political and Ethnic Hatred Dominates Latest Online Breaches

Political figures targeted in many online spaces

The first half of September saw a flare-up of episodes linked to political motives in different countries.

Serbia, Hungary and North Macedonia are the countries where most such episodes were recorded. This only shows how divisive political clashes and rhetoric remain a major problem in the region.

On September 1, Serbian President Aleksandar Vučić and his sons received death threats via Instagram. A 47-year-old man from Zrenjanin was arrested on suspicion of committing the crime of endangering security in connection with the threats and was placed in pre-trial detention for 48 hours.


Serbian President Aleksandar Vucic attends a joint press conference with Turkish President Recep Tayyip Erdogan (not pictured) in Belgrade, Serbia, 07 September 2022. Photo: EPA-EFE/ANDREJ CUKIC

In Hungary, a deceptive video aimed at an MEP started circulating on Facebook on September 6. A video of a band playing a concert in the Parliamentary Assembly building of the Council of Europe was leaked on Facebook in Hungarian falsely claiming to be showing EU politicians “celebrating their salaries” to “Jewish music” – as European citizens face record energy prices.

In another incident, on September 8, a photo supposedly of former Estonian president and activist Mikk Pärnits wearing a women’s pink dress started circulating on Facebook in Hungarian. The image is actually from a 2020 awards ceremony, where the winner wore a women’s dress to raise awareness about domestic violence and sexual abuse.

North Macedonia is the country where the largest number of episodes have occurred. A photomontage of ex-Finance Minister Nina Angelovska, depicturing her with a plate of cake in the shape of a penis, was published on Twitter on September 2. The author wrote: “Dear viewers, this one was a minister in the cabinet of the bonehead from Murtino.”  The “bonehead from Murtino” refers to former prime minister Zoran Zaev.

In North Macedonia, on September 5, a Twitter user posted a print screen of news about a press conference from the President, about the recent security session. Above the print screen, an inscription read: “It occurred to the louse to say that we are bankrupt!”.

Finally, a last incident on September 9 recorded by our monitors saw former PM Zaev being insulted on Facebook, in which Zaev was quoted about a potential referendum. Facebook users used threatening and offensive words about Zaev, such as “Smelly”, “Idiot”, “Shit traitor”, “Traitor soul”, and, “Crazy monster, the only option for you is a knife or a razor and be cut piece by piece.”

Minority and LGBT communities systematically attacked online

Following Serbia’s government ban of the EuroPride 2022 celebration in Belgrade, where right-wing anti-LGBT groups also announced they would march through the Serbian capital, police arrested more than 64 people, after thousands of LGBTQI+ activists turned out for the march, despite the ban.

At the same time, activists and supporters of the LGBT movement, along with various ethnic minorities, were subjected to an increasing number of online attacks on social networks.


A participant during the EuroPride march in Belgrade, Serbia, 17 September 2022. Photo: EPA-EFE/ANDREJ CUKIC

At the end of August, for example, Serbian filmmaker Stevan Filipović and actor Viktor Savić argued on social media about the holding of the EuroPride in Belgrade. The argument ended a friendship of almost 15 years. After the debate, Filipović shared threatening and insulting messages from Savić’s supporters on Instagram.

North Macedonia also saw anti-LGBT incidents. On September 5, a Twitter account posted: “You open your timeline, and what can you see? all the faggots jumping on your dick from early morning. Fuck off, I have romance to tweet about, fuck you, you ass- fucking tribe”. Other users also used similar insulting and threatening words.

Meanwhile, both the country’s Albanian and Roma communities were repeatedly attacked and abused in North Macedonia’s digital environment. Most incidents occurred on Twitter. One user on September 2, addressing the Albanian minority, wrote: “Shiptars, hippers, who don’t pay electricity, don’t pay, will some cheap electricity be able to boil beans for us on Friday?” The following day, another user on Twitter published a post with a picture of a parking ticket from City Mall in Skopje written only in Albanian. Above the picture he wrote: “Boycott Skopje City Mall, they only give receipts in ‘shiptar’ language”.

“Shiptar” is a highly insulting term for Albanians.

Between 16 and 18 September, three different episodes were also recorded on Twitter. First, while sharing a headline from a media outlet that refers to the appointment of ambassadors from North Macedonia, a Twitter user wrote: “Shiptars are messing with the whole country” and referred to “servants of the Shiptar mafia”.

Another Twitter user, referring to reports that the state administration will be filled with Albanians from the diaspora, wrote: “We’ve returned the shippers from the diaspora”. Finally, another Twitter account wrote an offensive post with hate speech towards Albanians, saying that he does not know any country “that loves Shiptars as a minority.

Data leaks, hacking attacks and online scams also recorded

Serbia, Romania, Bosnia, Hungary, and North Macedonia were all hit by cyber-fraud incidents in recent weeks. In fact, cyberattacks targeting IT systems in the whole region continue to endanger many institutional and private actors due to the absence of a prevention system and a political strategy for this purpose.


A source code on a computer in Taipei, Taiwan, 13 May 2017. Photo: EPA-EFE/RITCHIE B. TONGO

On September 4, personal data of more than 500,000 citizens collected since 2008, such as names, surnames, addresses, emails and dates of birth, from a Serbian employment website called Lako do posla were leaked online.

Initial analysis by cybersecurity experts said the data may have been extracted from the database using a security vulnerability on the website. Meanwhile, the Facebook page of the Bosnian online outlet Gracija was hacked last September 7. The announcement of the new edition of the online media was changed into vulgar and misogynistic words. Editors immediately removed the content. Gracija reported: “The cover could have been the reason for this incoherently written insult”. It said it would not censor its content, however, to show what “dirty games” take place during the pre-election period.

In Romania, several online attacks also occurred. A media website from Vaslui, a county on the border with Moldova, was the target of a Flooding/Denial of Service attack. The attacks don’t seem connected, as the IP addresses involved in the attack on the local media outlet were mostly from Asia, while G4Media was targeted through IP addresses mostly from the US. The local media website was left unavailable for more than an hour during the DDoS attack. At the same time, on September 8, G4Media, a Romanian online media known for investigative pieces on the judiciary, was the target of a massive Flooding/Denial of Service DDOS attack. The newsroom said the unknown attackers were likely targeting an investigative piece on a probe into how the judiciary system silenced plagiarism accusations against PM Nicolae Ciuca.

In Hungary, UniCredit Bank issued a warning that fraudsters are acting as buyers for a product advertised on the internet and asking for the sellers’ banking details (internet banking ID/password/banking activation code) by referring to a mail order service.

The information they obtain is then used to make unauthorised credit card purchases and transfers. Another hacking episode was recorded in North Macedonia, where the website of the Ministry of Education and Science was hacked by a Greek hacker group.

The attackers posted their text on the website: “Hacked by the Greek hacker team Netwatchers”. After the attack, the ministry insisted citizens’ data was not at risk.

Montenegro Seeks Foreign Help on Solving Attacks on Journalists

Montenegrin government session in Podgorica. Photo: Government of Montenegro

Montenegro on Thursday asked for foreign experts’ help in solving old cases of attacks on journalists. Minister without portfolio Zoran Miljanic said the government will continue to insist on solving these attacks.

“We already asked the US and United Kingdom for expert help in investigating old cases of attacks on journalists. Experts from the FBI and other foreign intelligence services will be hired as consultants to help Montenegrin authorities close the old cases of attacks,” Miljanic told a government session.

“Our key priority is solving the case of Dusko Jovanovic’s murder,” he added.

On May 27, outgoing Prime Minister Dritan Abazovic said the government was ready to ask foreign experts to help solve the failed investigation into the murder of Jovanovic 18 years ago.

Abazovic called on the Special State Prosecution to reopen the investigation, stressing that people who can still testify in this case should get the status of cooperative witnesses.

The editor-in-chief and owner of the daily newspaper Dan, well known for his opposition to the then government, was shot dead on leaving his office in Podgorica on May 27, 2004. He had received numerous death threats.

European Affairs Minister Jovana Marovic said there would be no media freedom in the country without solving these attacks.

“Political parties and state officials should also refrain from verbal attacks on journalists and media whatever the disagreements with their editorial policy,” Marovic said.

The government adopted the Commission for Monitoring Violence against Media’s report, which suggests including foreign experts help in investigations.

The report also said the Commission’s cooperation with Special State Prosecution and the National Security Agency and police has improved.

The Commission for Monitoring Violence against Media was formed in December 2013, led by Dan’s then editor, Nikola Markovic. He accused the former government of obstruction and of lacking the political will to clarify the attacks, saying the Commission had been denied access to relevant data.

After a change of power in 2020, the new government appointed new members of the Commission, stressing that it should cooperate with the authorities and propose concrete measures after investigations.

In its 2021 progress report, the European Commission called on the country’s authorities to step up efforts to effectively investigate, credibly solve and adequately sanction cases of attacks against journalists.

“The authorities should promote an environment conducive to investigative journalism and media freedom by promptly reacting to and publicly condemning hate speech and threats, and by refraining from exercising political pressure on journalists, including through their public statements,” the Commission report said.

On March 30, the US State Department’s latest human rights report said unsolved attacks against journalists as violence and harassment remained a significant problem in Montenegro.

FBI: Iranian Hackers Accessed Albanian Systems Over Year Ago


A digital screen displays a live cyber hack attack during a press conference at the Federal Criminal Police Office (BKA) in Wiesbaden, Germany, 11 November 2019. Photo: EPA-EFE/RONALD WITTEK

A report by the FBI and the Cybersecurity and Infrastructure Security Agency, CISA, published on Wednesday, on the wave of hacking attacks in Albania, says Iranian attackers gained access to Albanian systems some 14 months ago, long before the actual attacks started.

The first cyber-attack was reported on July 13, when Albanian government services became unavailable for some days.

“An FBI investigation indicates Iranian state cyber actors acquired initial access to the victim’s network approximately 14 months before launching the [July] destructive cyber attack, which included a ransomware-style file encryptor and disk wiping malware,” the report says.

“The actors maintained continuous network access for approximately a year, periodically accessing and exfiltrating email content,” it adds.

From May to June 2022, “Iranian state cyber actors conducted lateral movements, network reconnaissance, and credential harvesting from Albanian government networks.” it continues.

In June and August, messages against the Iranian dissident group hosted in Albania, the People’s Mujahedin of Iran, MEK, were released.

The hackers also posted polls on their channels, the website called “Homeland Justice” and a Telegram group with the same name, in which they asked Albanians what would they like them to publish.

One poll asked if they would like them to publish Albanian Prime Minister Edi Rama’s emails.

“In September 2022, Iranian cyber actors launched another wave of cyber attacks against the Government of Albania, using similar TTPs [Tactics, Techniques, and Procedures] and malware as the cyber attacks in July. These were likely done in retaliation for public attribution of the cyber attacks in July and severed diplomatic ties between Albania and Iran,” the report explains.

Albanian PM Rama on September 7 expelled Iran’s diplomats from the country after the massive cyber-attack on the government’s key servers in July.

After blaming Iran for July’s cyber-attack, fresh attacks occurred two days later, this time targeting the Traveller Information Management System, TIMS.

This caused queues ar border points, where the registration of citizens and vehicles entering and leaving the country had to be done manually.

Attacks continued on September 19, when emails of the former Chief of Police were released by a group that calls itself “Homeland Justice”.

Police said the prosecution had issued a ban on the publication or reposting of any information released by those behind the cyber-attacks, tasking cybercrime police, the broadcasting regulator and the Electronic and Postal Communications Authority to monitor the information and its use.

The order was condemned by the journalists and journalists’ rights organizations, however.

Hackers Likely Accessed Emails of Serbia’s Cadastre Staff, BIRN Reveals


Illustration by Pixabay

A BIRN investigation shows that Serbia’s cadaster system, RGZ, was infected by not just one malware computer virus but by at least three malicious programs and that at least one of them entered the server via the RGZ mail server, from where it tried to spread.

The servers of the Republic Geodetic Institute stopped working on June 14, when it was announced that a hacker attack had been carried out.

For this reason, management said they locked the entire system preventively, which made it impossible to use its services, including the cadastre of property ownership.

RGZ later said the computer sabotage was carried out from abroad using the ransomware virus “Phobos”.

This works by locking the device, disks and databases that only become available again when the hackers are compensated. However, RGZ insisted that “so far, the message with a request for redemption [cash] has not been identified”.

But BIRN discovered that, beside Phobos, the system was infected with Qakbot and Mirai Botnet as well.

Vladimir Cicovic, a cyber security expert, told BIRN that hackers may have used Qakbot to insert the Phobos virus into the system of the Geodetic Institute.

“One group is selling access, and the other is breaking in. The cooperation of several groups is not excluded. In the institution, they were looking for Phobos, but they didn’t look at how it got in, that is, who opened it,” explained Cicovic.

In special databases, the date of detection of the Mirai botnet on the RGZ mail server is May 8, 2022, while the version of Qakbot from the infected email was detected on May 13.

This is about a month earlier compared to the date officially listed as the start of the hacker attack, and two weeks before the virus allegedly entered the system.

A BIRN journalist had himself received an email from RGZ employee with whom BIRN journalists had been in contact in recent months. The title of the email, as well as other details, made everything look like a continuation of the correspondence, but the content of the email was in Dutch!

Cicovic believes that the fact that the author of the infected email wrote in a foreign language indicates that the malicious program was most likely not intended for Serbia. “If a professional was doing this, the email would be in Serbian. The campaign, or whatever, was not intended for Serbia,” Cicovic said.

He added that the infected email, received by a BIRN journalist, is directly related to the hacker attack on the Geodetic Institute because it shows that the earlier correspondence between the RGZ official and the BIRN journalist was leaked and is now in the hands of hackers.

“The BIRN journalist’s correspondence with the RGZ official is in someone’s hands. A hacker can sell, give, publish this data, but the fact is that the data has been stolen. The email received by the BIRN journalist is sufficient evidence for such a thing. It is possible that other information is also available,” he said, stating that this shows there was a threat of compromising private data.

It is not known whether any other citizen received a similar malicious email.

BIRN contacted the office of the Commissioner for the Protection of Information of Public Importance, which replied that the infected email is not proof that personal data has been compromised and that, as such, it has nothing to do with the hacker attack on RGZ.

According to a report by Kaspersky antivirus solutions company , in the first half of this year, Serbia ranked 13th in the world in terms of the number of cyber-attacks on management systems and critical infrastructure, after Vietnam, Sudan, Tanzania, Yemen and Bangladesh.

MEPS Quiz Commission on BIRN-Solomon Report on Greek Surveillance Systems

Photo: Security stand in the camp as Pope Francis delivers a speech during a meeting with refugees at the Reception and Identification Centre (RIC) in Mytilene on the island of Lesbos, Greece, 05 December 2021. Photo: EPA-EFE/LOUISA GOULIAMAKI POOL.

Members of the European Parliament sent written questions to the European Commission on September 16 about the EU-funded “Centaur” and “Hyperion” surveillance systems deployed in reception areas in Greece. Their questions came after BIRN and Greek investigative outlet Solomon published a joint investigation on this on September 9.

BIRN and Solomon revealed inAsylum Surveillance Systems Launched in Greece without Data Safeguardsthat the “Centaur” and “Hyperion” systems were crafted and initially implemented with funds from the EU’s Recovery and Resilience Facility – without prior recruitment of a Data Protection Officer at the Ministry of Migration and Asylum, a requirement under the GDPR, the EU’s General Data Protection Regulation, to ensure adequate oversight. 

Nor were mandatory Data Protection Impact Assessments, DPIA, conducted in the design phase.

Tineke Strik, a member of the Group of the Greens, one of the eight MEPs who signed the questions to the Commission, published it yesterday on her Twitter account. 

EU funding of surveillance technology used on migrants in violation of fundamental rights must stop,” Strik said. 

The MEPs asked the Commission how much money the EU spent on the two surveillance systems, from which funds this came, and how much funding has been or will be provided for similar systems. 

BIRN and Solomon established that the planning of Hyperion and Centaur began in 2020. The Hyperion system monitors movement in and out of state-run asylum camps. Centaur deploys behavioral analysis algorithms and transmits CCTV and drone footage to a control room inside the Greek Ministry of Migration and Asylum. 

Humanitarian organisations say the two surveillance systems violate asylum seekers’ fundamental rights and freedoms. 

The MEPs said the Greek government was clearly unwilling or unable to conduct an “independent investigation” following allegations of non-compliant expenditure of EU funds in violation of fundamental rights. 

“What is the Commission’s assessment of compliance with fundamental rights, and how is the Commission investigating this?” they asked.

“Is the Commission taking action to reject cost reimbursement or retract funding for the Centaur and Hyperion projects? What measures are being taken to prevent future EU-funding of projects in violation of fundamental rights?” they added. 

BIRD Community

Are you a professional journalist or a media worker looking for an easily searchable and comprehensive database and interested in safely (re)connecting with more than thousands of colleagues from Southeastern and Central Europe?

We created BIRD Community, a place where you can have it all!

Join Now