A Global Tour of 2019’s Top Investigative Podcasts

Compiling a list of the best investigative podcasts of 2019 may well be an impossible task. In the five years since Serial became a break-out hit, an avalanche of investigative podcasts has followed — and no, not all of them about true crime — with more coming out every year.

With that in mind, here are just some of the most interesting investigative podcasts that aired in 2019. This non-exhaustive list includes quite a few podcasts that get into the nitty-gritty of how reporters do their digging, which can be just as riveting as the stories themselves. Happy listening — and please share your own picks in the comments!

The Tip Off

In each episode of The Tip Off, host Maeve McClenaghan goes behind the scenes of a major investigation from recent years — many from the UK, where she’s based, but lots of international stories, as well. The journalists who uncovered these cases take listeners through their process step-by-step, starting with the eponymous tip-off — which ranges from chatter at a party to an anonymous fax — through pitching and reporting and all the way to publication. This year’s roster is wide-ranging, with a music critic who spent years looking into abuse allegations against the singer R. Kelly, an open-source investigator who analyzed a video of a killing by soldiers in Cameroon, a reporter who traveled across the world to report on the rise of antibiotic resistance, and many more.

The Bellingcat Podcast

For its first foray into podcasting, the Netherlands-based investigative collective Bellingcat chose to delve deep into the case of Malaysian Airlines Flight MH17, which was shot down in eastern Ukraine in 2014, killing 298 people. Hosted by founder Eliot Higgins, The Bellingcat Podcast features the voices of dozens of journalists and analysts, including direct eyewitnesses and, of course, Bellingcat’s own investigators. This six-episode series offers an intricate look at how they used open-source investigative techniques — scouring social media posts, geolocating images, and much more — to find the weapon and track down those responsible. It’s a masterful case study for anyone interested in open source investigation.

In the Dark 

Okay, we’re cheating a bit with this one: Most of In the Dark’s second season came out in 2018, but its last two episodes aired this year. This season of the award-winning podcast looks at the ongoing case of Curtis Flowers, who has been tried six times for the same crime: the shooting deaths of four people in Mississippi in 1996. Though Flowers has won appeal after appeal, the prosecutor keeps trying the case anew. As the season progresses, it becomes clear that the In the Dark team is not just investigating one man’s case, but systemic failings in the US judicial system.

Bundyville: The Remnant

Last year, season one of Bundyville took a close look at the notorious Bundy family: Cliven Bundy, an anti-government US rancher who led an armed standoff in Nevada in 2014, and his sons, who led an armed occupation at an Oregon wildlife refuge in 2016. Season two, Bundyville: The Remnant, begins with a bombing. What might at first seem like an isolated incident — in rural Nevada, a man blows up a house — is the eerie starting point for untangling a web of extremist violence. The podcast investigates how this violence is linked to conspiracy theories that are popular with the anti-government movement in the American West, and looks at who is fanning the flames.

White Lies

In NPR’s White Lies, the hosts dig into a US Civil Rights Era case: the 1965 murder of Reverend James Reeb, a pastor who had travelled south to Selma, Alabama, to join protests against police violence. The case riveted the nation because both the victim and the alleged attackers were white. The three men who were put on trial were acquitted, and the case had remained unsolved ever since. When the White Lies hosts set out to tell the definitive story of what happened on that night half a century ago, they found strong resistance from residents of a city still grappling with its past. But after an investigation that took them several years, they finally get some answers. Along the way, they tackle difficult questions about how to investigate a story after so much time has gone by.

The Catch and Kill Podcast

Ronan Farrow’s brand-new podcast is based on his bestselling book “Catch and Kill: Lies, Spies, and a Conspiracy to Protect Predators,” which told the story of his years of investigating Harvey Weinstein. The podcast features interviews with the book’s protagonists, starting with a private investigator who was contracted to follow Farrow — but who ended up as one of his sources. It also includes audio that Farrow recorded throughout the course of his investigation.

Running from COPS

If you live in the United States, you’ve probably seen at least one episode of COPS. It’s the longest-running reality TV show in the country, and it’s spawned a slew of similar shows. The COPS formula is simple: Cameras follow police officers as they patrol the streets and make arrests. But how real is it? And how has it impacted policing in the US? The podcast Running from COPS takes a look under the hood by crunching data on the types of crimes and the demographics represented on COPS; tracking down people who were filmed during arrests to find out whether they actually consented to being on television; and obtaining raw, unedited footage and comparing it to what aired on TV.

Trump, Inc.

In this joint project from ProPublica and WNYC Studios, reporters follow the money — of the President of the United States. They dig into the Trump Organization to figure out how it operates, what business is being conducted during his presidency, and how one affects the other. And nearly two years after this podcast started airing, there is still plenty to look into. One recent episode compared tax documents obtained by ProPublica through FOIA requests to financial documents that Trump filed with his lender, and showed that key numbers didn’t match. Another took listeners into a conference held at a Trump resort that attracted prominent conspiracy theorists.

1000 Degrés 

This podcast is in French. GIJN’s French Editor Marthe Rubio says:

“In 2003, Frenchman Daniel Massé was sentenced to 25 years in jail. He was accused of having put a parcel bomb in the letterbox of his former friends, Joseph and Dominique Hernandez, who were injured in the attack. Ever since, Massé has claimed his innocence. The Hernandez couple, on the contrary, is convinced that Massé is guilty. Twenty-five years after the bomb exploded, French journalists Adèle Humbert and Emilie Denètrese plunge back into this case, interview all the actors, dissect the court records, and return to the scene of the crime in Toulouse. As the episodes of this gripping podcast unfold, the listener discovers a story of friendship gone sour and an aggressive police investigation that raises doubts about Massé’s guilt. Throughout the podcast, the journalists discuss their ethical dilemmas, their difficulties accessing sources, and their own uncertainties as to the truth.”

The Missing Cryptoqueen

This eight-episode podcast from the BBC delves into the strange story of Dr. Ruja Ignatova, a Bulgarian businesswoman who got rich selling a cryptocurrency called OneCoin. In front of stadiums full of adoring fans, she described it as the “Bitcoin killer.” It was supposed to bring blockchain to the masses. But two years ago, Ignatova vanished into thin air. She left behind many angry and disappointed investors, who had believed in what host Jamie Bartlett called “a new and hugely successful take on the old pyramid scheme.” He goes searching for Ignatova, who he believes is hiding somewhere in Europe — and tries to untangle the far-flung effects of the OneCoin business, which still operates today.

Reveal 

Reveal is a weekly radio show and podcast from the Center for Investigative Reporting (CIR), a nonprofit news organization based in California. It features investigative reporting both from CIR and from other media partners, for the most part focused on the United States. This year, topics included the spread of hate groups, the exploitation of elder care workers, the use of genetic genealogy to catch criminals, and plenty more.

IRE Radio Podcast

In this podcast from the US nonprofit Investigative Reporters and Editors (IRE), journalists take listeners behind the scenes of some of their biggest stories, like Christine Kenneally’s years-long investigation into the violent deaths of children at Catholic orphanages. The podcast also includes highlights from IRE conferences, like audio from a session in which reporters T. Christian Miller and Ken Armstrong explain how they wrote their Pulitzer-winning investigation “An Unbelievable Story of Rape,” which was turned into the Netflix series Unbelievable.

Caixin’s Most Important Investigations of the Decade

This one is for Mandarin speakers. GIJN’s Chinese Editor Joey Qi says:

“Caixin is one of China’s leading investigative media outlets. Over the past 10 years, it has reported on lots of important stories that had a significant impact nationwide, from former senior politician Zhou Yongkang’s abuse of power and corruption case to the 2015 Tianjin port explosions; from the former Anbang Insurance chief Wu Xiaohui’s fraud and embezzlement to the children abandoned due to the one-child policy. In 2019, Caixin started a podcast to tell the stories behind all these headlines. In recent years, China’s investigative journalism has been dying out very fast, and there is no doubt that this podcast is an ode to the golden age of China’s investigative journalism.”

BBC’s The Documentary (select episodes)

While this program is not investigative per se, with topics ranging from the legacy of Woodstock to an interview with the Dalai Lama, it regularly features stellar BBC investigations. For example, it recently revealed how professors were sexually harassing and blackmailing students at top West African universities. Also, you won’t want to miss the incredible story of how one young man from Ghana used spy glasses to go undercover on the migrant trail.

Radio Ambulante (select episodes)

This podcast is in Spanish. GIJN Spanish Editor Catalina Lobo-Guerrero says:

“NPR’s Radio Ambulante started out in 2011, with the aim of bringing what in Spanish is known as ‘crónicas’ (narrative longform journalism) to the radio. There was nothing like that in traditional stations across Latin America, nor was there a Spanish podcast in the US that focused on this type of storytelling. Soon they started recruiting a team of talented journalists and producers from many different countries and airing fantastic stories, showcasing the diversity of accents and sounds across Latin America, but also in the United States. Many of the episodes are great investigations: the business behind bail bonds in the US for undocumented migrants; the uncounted deaths in Puerto Rico after hurricane Maria; the lost children of Armero in Colombia after the 1985 volcano eruption; and how a spiritual guru sexually abused his followers for years. There are plenty of episodes to choose from, and all of them have English transcripts. Most recently, Radio Ambulante launched an app (Lupa) for listeners who want to learn Spanish through their shows.”

Longform Podcast (select episodes)

The Longform Podcast features interviews with nonfiction storytellers of all stripes, who discuss their craft over the course of an hour-long conversation. Frequently, these are journalists who do investigative work. This year’s batch, for example, featured interviews with two hosts of investigative podcasts: Julie Snyder of Serial and Madeleine Baran of In the Dark. Several reporters covering Silicon Valley, like Casey Newton and Mike Isaac, also shared fascinating details about how they investigate tech giants like Facebook and Uber. Spoiler alert: It’s no easy feat to cultivate sources at tech companies that go to great lengths to prevent leaks.

Popular Front 

Another podcast that regularly features interviews with investigative journalists is Popular Front, which looks at modern warfare and conflicts through the eyes of all sorts of researchers. Recent topics include: looking at war crimes via open-source tools like Google Earth, with The New York Times’ Christiaan Triebart; how the EU turns a blind eye to the abuse of refugees in Libya, with freelance journalist Sally Hayden; and the weaponizing of commercial drones, with Bellingcat’s Nick Waters.

This article was originally published by Global Investigative Journalism Network.

Freedom on the Net: Tracking the Global Decline

Freedom on the Net is a comprehensive study of internet freedom in 65 countries around the globe, covering 87 percent of the world’s internet users. It tracks improvements and declines in internet freedom conditions each year. The countries included in the study have been selected to represent diverse geographical regions and regime types. In-depth reports on each country can be found at freedomonthenet.org.

More than 70 analysts contributed to this year’s edition, using a 21-question research methodology that addresses internet access, freedom of expression, and privacy issues. In addition to ranking countries by their internet freedom score, the project offers a unique opportunity to identify global trends related to the impact of information and communication technologies on democracy. Country-specific data underpinning this year’s trends is available online. This report, the ninth in its series, focuses on developments that occurred between June 2018 and May 2019.

Of the 65 countries assessed, 33 have been on an overall decline since June 2018, compared with 16 that registered net improvements. The biggest score declines took place in Sudan and Kazakhstan followed by Brazil, Bangladesh, and Zimbabwe.

In Sudan, nationwide protests sparked by devastating economic hardship led to the ouster of President Omar al-Bashir after three decades in power. Authorities blocked social media platforms on several occasions during the crisis, including a two-month outage, in a desperate and ultimately ineffective attempt to control information flows. The suspension of the constitution and the declaration of a state of emergency further undermined free expression in the country. Harassment and violence against journalists, activists, and ordinary users escalated, generating multiple allegations of torture and other abuse.

In Kazakhstan, the unexpected resignation of longtime president Nursultan Nazarbayev—and the sham vote that confirmed his chosen successor in office—brought simmering domestic discontent to a boil. The government temporarily disrupted internet connectivity, blocked over a dozen local and international news websites, and restricted access to social media platforms in a bid to silence activists and curb digital mobilization. Also contributing to the country’s internet freedom decline were the government’s efforts to monopolize the mobile market and implement real-time electronic surveillance.

The victory of Jair Bolsonaro in Brazil’s October 2018 presidential election proved a watershed moment for digital election interference in the country. Unidentified actors mounted cyberattacks against journalists, government entities, and politically engaged users, even as social media manipulation reached new heights. Supporters of Bolsonaro and his far-right “Brazil over Everything, God above Everyone” coalition spread homophobic rumors, misleading news, and doctored images on YouTube and WhatsApp. Once in office, Bolsonaro hired communications consultants credited with spearheading the sophisticated disinformation campaign.

In Bangladesh, citizens organized mass protests calling for better road safety and other reforms, and a general election was marred by irregularities and violence. To maintain control over the population and limit the spread of unfavorable information, the government resorted to blocking independent news websites, restricting mobile networks, and arresting journalists and ordinary users alike.

Deteriorating economic conditions in Zimbabwe made the internet less affordable. As civil unrest spread throughout the country, triggering a violent crackdown by security forces, authorities restricted connectivity and blocked social media platforms.

China confirmed its status as the world’s worst abuser of internet freedom for the fourth consecutive year. Censorship reached unprecedented extremes as the government enhanced its information controls in advance of the 30th anniversary of the Tiananmen Square massacre and in the face of widespread antigovernment protests in Hong Kong. In a relatively new tactic, administrators shuttered individual accounts on the hugely popular WeChat social media platform for any sort of “deviant” behavior, including minor infractions such as commenting on environmental disasters, which encouraged pervasive self-censorship. Officials have reported removing tens of thousands of accounts for allegedly “harmful” content on a quarterly basis. The campaign cut individuals off from a multifaceted tool that has become essential to everyday life in China, used for purposes ranging from transportation to banking. This blunt penalty has also narrowed avenues for digital mobilization and further silenced online activism.

Internet freedom declined in the United States. While the online environment remains vibrant, diverse, and free from state censorship, this report’s coverage period saw the third straight year of decline. Law enforcement and immigration agencies expanded their surveillance of the public, eschewing oversight, transparency, and accountability mechanisms that might restrain their actions. Officials increasingly monitored social media platforms and conducted warrantless searches of travelers’ electronic devices to glean information about constitutionally protected activities such as peaceful protests and critical reporting. Disinformation was again prevalent around major political events like the November 2018 midterm elections and congressional confirmation hearings for Supreme Court nominee Brett Kavanaugh. Both domestic and foreign actors manipulated content for political purposes, undermining the democratic process and stoking divisions in American society. In a positive development for privacy rights, the Supreme Court ruled that warrants are required for law enforcement agencies to access subscriber-location records from third parties.

Only 16 countries earned improvements in their internet freedom scores, and most gains were marginal. Ethiopia recorded the biggest improvement this year. The April 2018 appointment of Prime Minister Abiy Ahmed led to an ambitious reform agenda that loosened restrictions on the internet. Abiy’s government unblocked 260 websites, including many known to report on critical political issues. Authorities also lifted a state of emergency imposed by the previous government, which eased legal restrictions on free expression, and reduced the number of people imprisoned for online activity. Although the government continued to impose network shutdowns, they were temporary and localized, unlike the nationwide shutdowns that had occurred in the past.

Other countries also benefited from an opening of the online environment following political transitions. A new coalition government in Malaysia made good on some of its democratic promises after winning May 2018 elections and ending the six-decade reign of the incumbent coalition. Local and international websites that were critical of the previous government were unblocked, while disinformation and the impact of paid commentators known as “cybertroopers” began to abate. However, these positive developments were threatened by a rise in harassment, notably against LGBT+ users and an independent news website, and by the 10-year prison term imposed on a user for Facebook comments that were deemed insulting to Islam and the prophet Muhammad.

In Armenia, positive changes unleashed by the 2018 Velvet Revolution continued, with reformist prime minister Nikol Pashinyan presiding over a reduction in restrictions on content and violations of users’ rights. In particular, violence against online journalists declined, and the digital news media enjoyed greater freedom from economic and political pressures.

Iceland became the world’s best protector of internet freedom, having registered no civil or criminal cases against users for online expression during the coverage period. The country boasts enviable conditions, including near-universal connectivity, limited restrictions on content, and strong protections for users’ rights. However, a sophisticated nationwide phishing scheme challenged this free environment and its cybersecurity infrastructure in 2018.

How Exiled Journalists Keep Investigating in China, Burundi, Venezuela, Russia, and Turkey

Even in the best of times, it was difficult for Mamatjan Juma to maintain professional distance from his work. A former art teacher from the Uighur province of Xinjiang in China, he came to the US in 2003 and has worked as a journalist for Radio Free Asia’s Uighur service for 12 years. But in recent years, his family back in Xinjiang has been caught up in China’s mass detention of the Muslim minority population.

“When your relatives are detained and your colleagues are in trouble, it’s very hard to stay neutral,” Juma said, speaking at the 11th Global Investigative Journalism Conference in Hamburg. “We’re not an activist organization but it is a mission for us. We keep our emotions in check, then we cry at home.”

Today, Juma is deputy director of the US government-funded network’s Uighur service. His small team of Uighur exiles first broke the story of the mass internment camps in the western region of China in 2017. Since then, their reporting on the scale and conditions of the camps has won acclaim and provided a vital information lifeline in the Uighur language.

“We have been ignored for many years, but we’re gaining credibility, for example because we’re being cautious with our figures on the number of people in the concentration camps,” Juma said.

Reporting from exile is a tightrope walk of ethical quandaries and practical obstacles. Exiled journalists often have the language skills and local knowledge to provide crucial reporting on areas where few independent journalists have direct access, like Xinjiang. Yet they must also contend with the hostility of the governments that they fled.

While exiled reporters may now be practicing journalism from a place of relative safety, repressive governments can still interfere with their ability to report stories, reach audiences, and make a living.

Developing Sources

Ines Gakiza was working at the popular independent radio station Radio Publique Africaine when protests broke out in Burundi in 2015. Amid a violent government crackdown, the station was burned to the ground, and Gakiza fled to neighboring Rwanda. From there, she and other exiled colleagues continue broadcasting news about Burundi.

The biggest challenge of reporting from exile, Gakiza said, is to develop new sources inside the country, especially finding people from a variety of areas and walks of life. “Some people feel afraid to talk to people in exile, even if we don’t give their real names,” she said. “They might be seen as a collaborator.”

But the station is slowly gaining the trust of Burundians, despite its reporters’ exile. “People initially thought we wanted to use the radio for revenge, but four years later they see this is not our mission,” Gakiza said. “We want to tell Burundians and the world what is happening in our country.”

While Burundian officials usually hang up on the radio journalists whey they call for an official response, they often end up responding indirectly, by giving quotes to media inside the country, which Radio Publique Africaine can then use in their reporting.

And Gakiza and the other exiled journalists have been able to develop critical whistleblower sources inside the government. Some of these people joined the government or ruling party out of fear, and now they do not know how to leave, Gakiza said.

“We have some sources now we would never have dreamed of having before,” said Venezuelan investigative journalist Ewald Scharfenberg. He fled his country in January 2018 with colleagues from investigative news site Armando.info after being sued for criminal defamation over their corruption reporting. The former El Pais correspondent ended up in Colombia after Bogota-based magazine Semana invited the team to work out of its newsroom.

“We have sources in Venezuela who trust us with leaks because we are in Bogota — they are secure that we are not under certain pressures,” Scharfenberg said. This makes information security critical; the Armando.info team has received training on using secure communications in order to protect sensitive sources.

Reaching Audiences

When its journalists first left Burundi, Radio Publique Africaine was able to continue broadcasting in the country via the eastern Democratic Republic of Congo. But Burundian authorities soon demanded that the DRC shut down the frequency.

Today, they broadcast online only, using multiple channels like YouTube, SoundCloud, and WhatsApp in order to maximize their reach. They received some grant funding to get 10 computers and a small studio, but still struggle to keep afloat.

Armando.info is intermittently blocked in Venezuela, but most of its traffic still comes from inside the country. Raising funds from readers is difficult: Venezuela’s currency has collapsed amid an economic and political crisis. So the news site also turned to grant funding, even though they knew some of its readers might have reservations about US donors.

“Our idea was if we made [our funders] clear and transparent, then the reader can decide for themselves,” Scharfenberg said.

By contrast, Can Dündar, the former editor-in-chief of Turkish newspaper Cumhuriyet, relies on crowdfunding. In 2016, after being charged with treason and surviving an assassination attempt, Dündar fled to Germany. In 2017, he founded Özgürüz, an online magazine covering Turkey in German and Turkish, in collaboration with German investigative nonprofit Correctiv.

Finding funders was a major challenge. “You can’t ask Turks [to fund your journalism] as they’re afraid,” Dündar said. “You can’t ask Germans, as then you’re seen as a foreign agent.” Özgürüz now has around 500 individual donors, who mostly make small contributions to the news site. “It’s not big money but it’s like a solidarity campaign,” Dündar said.

Multiple Jurisdictions

When Galina Timchenko was fired as editor of the independent Russian site Lenta.ru in 2014, many of her colleagues followed her to Latvia, where she set up a new site called Meduza. Investigations editor Alexey Kovalev recently joined the team after leaving Russian state news agency RIA Novosti.

Meduza was funded by seed grants but also offers B2B (business-to-business) services, like an annual editors’ bootcamp. Around one-third of the staff — mainly reporters — are based in Russia. They don’t have an office there, as they fear it would be targeted. Meduza’s headquarters — and the majority of its staff — are based in the Latvian capital of Riga.

Besides the protection it offers to the journalists, Latvia was an obvious choice for Meduza because of the ease of setting up a business there and its proximity to Russia. “You don’t really feel foreign there,” said Kovalev.

But remote teamwork can be hard. “The physical disconnection between the teams, holding editorial meetings every day on Google Hangouts, can be very tiresome,” said Kovalev. “It’s demoralizing to work alone.”

It can also be challenging to adhere to both Russian and Latvian law, for example on how to refer to Crimea, the territory Russia annexed from Ukraine in 2014. The European Union, of which Latvia is a member, does not recognize the annexation. In Russia, it’s a criminal offense to challenge “Russia’s territorial integrity,” including the status of Crimea.

“You’re damned if you do, damned if you don’t call Crimea Russian,” said Kovalev. “So we keep two in-house lawyers — one Latvian and one Russian.”

Maintaining Independence 

Turkish editor Can Dündar was flanked by bodyguards as he spoke at the Global Investigative Journalism Conference in Hamburg last September. Turkish President Recep Tayyip Erdogan has labeled him a traitor. His face is well-known and he’s regularly harassed by pro-Erdogan supporters, even in Germany.

When Erdogan came to Germany in September 2018, the Turkish president refused to go to a press conference if Dündar was there. “Unfortunately, you find yourself to be a political figure rather than a journalist when you go to exile,” Dündar said.

He struggles with this new identity. German colleagues caution him against being too activist-like and, as a former journalism lecturer, Dündar used to give his students the same advice. “But imagine that your house is burning and people expect you to just take pictures of it,” he said. “We are not only journalists; we are fathers, mothers, human beings.”

“I’m always struggling to not feel like an activist,” said Scharfenberg, from Armando.info. “We have to be restrained by the rules of journalism. It’s the only way we can preserve our capital, which is reputation.”

Sometimes Scharfenberg wonders if Armando.info’s Venezuelan audience really wants to consume investigative reporting. “In a society that is as polarized as ours, both sides want information to weaponize it, to use it against the other,” he said. When Armando.info published corruption investigations about the Venezuelan opposition as well as the government, some opposition supporters turned on them.

It can be frustrating to be attacked by all sides, but Scharfenberg is convinced that independent investigative journalism from exile is vital work. “Exile is the natural destination of the dissidents, so it becomes very fertile ground for propaganda against the government,” he said. “I think it’s important to show the difference, and to show that it is still possible to do journalism.”

Huawei Hoopla: ‘Business as Usual’ After Czech 5G Warning

Tech is the lifeblood of the Czech city of Brno, where IT startups rub shoulders with global names like Motorola and IBM as well as home-gown giants such as Avast and Kiwi.com.

Nestled between two rivers, the southeastern castle town is also home to the highest concentrations of tech universities in Central Europe. No wonder it is a hub for budding entrepreneurs.

But for IT geeks who prefer the public sector, one employer in the Czech Republic’s second-largest city stands out — the National Cyber and Information Security Agency (NCISA), the government’s cyber security watchdog.

Established in Brno in 2017, the agency attracts some of the country’s top talent — even if the work is rarely as glamorous as the Hollywood version of cyber intelligence might suggest.

“It’s routine, administrative, even clerical work that we do here,” NCISA spokesman Radek Holy told BIRN.

Even so, every once in a while the atmosphere at the Brno office gets heated. And possibly the “hottest” day in the agency’s history was December 17, 2018. 

That is when the NCISA issued an official — and unprecedented — warning that “the use of technical or program tools of Huawei Technologies and ZTE Corporation poses a cyber security threat”. 

Suspicion towards the Chinese telecom giants had been swirling since August 2018 when US President Donald Trump first branded the companies a security risk.

But in the winter of 2018, no European country had joined Trump in his crusade against the firms amid fears their hardware could be used to spy for the Chinese government.

The Czech Republic broke that silence.

Panic and confusion ensued. Czechs were desperate to know if it was safe to keep using gear made by Huawei, the world’s largest producer of telecoms equipment. ZTE was less of a concern since its presence in Czech Republic was far smaller.

Quickest on his feet was Czech Prime Minister Andrej Babis, who ordered his office to stop using Huawei equipment — only to find out later the warning only applied to entities deemed critical to the country’s information infrastructure.

As a major supplier of data centre equipment and IT infrastructure to the Czech state, Huawei was in pole position to help roll out the country’s next-generation 5G cellular network promising super-fast connectivity.

What followed was political theatre as the Czech Republic’s two most powerful men — the prime minister and the president — tried to turn the alleged security threat to their advantage.

Analysts say the “Huawei affair” quickly morphed into a hullabaloo that said as much about the country’s east-west political divide as anything to do with national security — with millions of euros of business at stake.

A year after the NCISA sounded the alarm, public tender records show that Huawei continues to win contracts to supply hardware for vital Czech infrastructure.

If the warning was meant to keep the company’s tech out of the 5G network, it has hardly made a dent.

A woman uses her mobile phone as a lightning storm breaks in Prague. After the National Cyber and Information Security Agency issued a warning about potential security risks associated with Huawei, many Czechs wanted to know if it was safe to use gear made by the world’s largest producer of telecoms equipment. Photo: EPA/MARTIN DIVISEK

Geopolitical struggle

The NCISA alert thrust the Czech Republic into a geopolitical tug-of-war between the Washington and Beijing.

Ever since Trump signed an executive order in May adding Huawei to the US Department of Commerce’s sanctions list, Washington had pressured its European allies to blacklist the firm, warning of possible security risks for the whole transatlantic alliance.

Arguing that vulnerabilities in Huawei’s equipment could allow snooping and sabotage by malign actors, the US government was particularly concerned about Huawei’s participation in 5G networks set to revolutionise the way data flows. 

“We’ve been clear: our task is that our allies and our partners and our friends don’t do anything that would endanger our shared security interests or restrict our ability to share sensitive information,” US Secretary of State Mike Pompeo said in a speech in The Hague in June. 

Our task is that our allies and our partners and our friends don’t do anything that would endanger our shared security interests or restrict our ability to share sensitive information.

– US Secretary of State Mike Pompeo

5G, the fifth generation of cellular network technology, promises speeds a hundred times faster than current broadband technology allows.

This will make possible the so-called internet of things, in which everyday objects like clothes or vehicles are always connected to the web. Many see 5G’s blistering speed and super-broad bandwidth as a game changer in everything from entertainment to healthcare.

They dream of real-time medical diagnostics, immersive virtual reality and self-driving cars.

But where some see promise, others see pitfalls. 

Given the importance of 5G networks in future communications infrastructure, the US government and other critics of Huawei are calling for a blanket ban on the Chinese vendor’s participation in building 5G networks in Europe and elsewhere. 

Some US allies have been quick to oblige.

Australia was the first country to introduce a broad ban on Huawei technology in 5G networks. New Zealand soon followed with a similar ban. Another US ally in the region, Japan, excluded Huawei from public procurement. 

Much to Washington’s dismay, the Europeans did not follow suit.  

According to Emir Halilovic, head of the global telecom technology and software team at British data analytics firm GlobalData, countries near China geographically tend to be much more cautious about their powerful neighbour. 

“The dominant position of China in the Asia-Pacific region is undisputed,” Halilovic told BIRN. “It’s only natural that countries from that region are much more careful about Huawei. For them, the risk is much more tangible.”

Despite the fact that many European countries share US concerns about allowing a Chinese company to participate in the development of such sensitive technology as 5G, no country in Europe has yet sided with Washington and imposed an outright ban on Huawei. 

Instead, most European states favour an evidence-based approach.

This requires them to first present clear evidence that Huawei gives Beijing access to personal data from EU users or installs in its devices so-called backdoors that could expose EU critical infrastructure to foul play. 

“So far, there is no, at least publicly available, information that such things have been happening,” Halilovic said. “Looking at the issue from this perspective, one can think that the whole campaign against Huawei has been a bit exaggerated.” 

Also important is Huawei’s already dominant position on the European telecommunications market, Halilovic said. 

“Huawei is extremely strong in Europe. There is very little that can be done about it now. It is impossible to just get rid of Huawei equipment overnight. Moreover, it would be an absolute disaster for everyone.”  

Concerns about ZTE were less of an issue, he added, since government tenders affected by the warning mainly concern equipment for data centres and other IT infrastructure.

“ZTE doesn’t really make those so they don’t really play a major role in this.”


Visitors look at a Huawei 5G booth at the 2019 Mobile World Congress in Shanghai, China, in June 2019. Photo: EPA-EFE/LONG WEI

Cold, hard cash

Huawei Technologies (Czech) s.r.o., Huawei’s Czech branch, did not respond to an interview request.

However, in September, Huawei’s vice-president of Central Europe and the Nordics, Radoslaw Kedzia, told Reuters that Czech security concerns over their equipment had not had a significant impact.  

“It is pretty much business as usual with a little bit more attention to show that we are transparent, open and inclusive and we have nothing to hide,” Kedzia said. 

Huawei’s rising profit numbers

YearRevenue (EUR)Profit (EUR)Number of
employees
200612.7m-240,18731
200712.3m-2.8m42
200823.2m2.6m60
200947.6m1.8m102
201051.8m-1.6m240
201140.2m-589,205244
201260.5m1.6m310
201357.5m1.1m378
201473.2m1.3m361
2015113.8m1.3m358
2016207m3.4m330
2017254m3.8m275
2018294.7m6.1m195

Source: https://or.justice.cz/ias/ui/rejstrik | Source for exchange rate: Infor Euro

Crucially, the NCISA’s warning only applied to “administrators and operators of the critical information infrastructure communications systems” that are subject to the Cyber Security Act. That amounts to 160 state institutions and companies. 

Those entities are obliged to carry out extra risk assessments and steps to manage any risks before introducing Huawei and ZTE technologies to their systems. 

That is a far cry from a ban on the Chinese vendors’ hardware. The measure merely asks state institutions to do some extra homework before granting contracts to Huawei or ZTE. 

As of late September, Huawei’s partner companies have won more than two dozen contracts from state institutions in 2019, worth over 1.5 million euros (40 million Czech crowns), according to tender records.  

Huawei partner company Number of state contracts in 2019Value of contracts (EUR)
Huatech a.s.201.3m
Atos IT Solutions and Services, s.r.o.18,823
Inowit a.s.2146,119
M Computers s.r.o.1119,960
S&T CZ s. r. o.19,558

Like many other large IT companies, Huawei does not compete for state procurements directly. Instead, it relies on a network of partner companies that offer Huawei’s equipment and technical solutions to the state. 

“The partner companies are typically much smaller firms that are better positioned to respond flexibly to the needs of their end customers,” Martin Vitek, a board member of one such partner company, Huatech a.s., told BIRN.

“This is a very common practice in the sector.”

Jan Sedlak, a Czech tech analyst and a China expert, said the reason why Huawei’s market position has not been badly hit by the warning has to do with cold, hard cash. 

“Nearly all public procurements have price as the only criteria; whichever provider offers the lowest price for its services gets the contract,” he said. “This is something that Huawei is quite good at.”

Nearly all public procurements have price as the only criteria; whichever provider offers the lowest price for its services gets the contract.

– Tech analyst Jan Sedlak

Since the warning, there have been only three instances of Huawei not being allowed to bid for a state contract. In two of these, the tenders were eventually canceled altogether, to avoid legal disputes with Huawei. 

Vitek from Huatech said such obstructions wasted time, hindered technological progress and resulted in a lack of transparency.

“There are some people who don’t like China/Huawei, and those people currently have the upper hand,” he said. “They use the NCISA’s warning to further their own interests.”

Not that Huatech — known as Huawei’s “gold partner” in the Czech Republic — has reason to complain about contracts this year.

According to an official registry of public procurements, Huatech had won 20 contracts in 2019 as of late September. Clients included the Czech police and Czech National TV. 

“It’s hard to say whether this number is high or low compared to last year,” Vitek said. “It’s impossible to estimate how many contracts we would’ve got in the absence of the warning.”

US President Donald Trump and First Lady Melania Trump meet with Czech Prime Minister Andrej Babis and his wife Monika Babisova in the Oval Office at the White House in March 2019. Photo: EPA-EFE/ALEX EDELMAN

Risks versus evidence

Whatever the impact on Huawei’s sales, tech expert Sedlak said the NCISA’s warning last December immediately boosted the Czech Republic’s political clout in the United States. 

“It was because of the warning that Prime Minister Andrej Babis eventually received an invitation to the CIA and the White House,” Sedlak told BIRN. 

However, the Czech cyber security watchdog denies any political motivations behind its decision. 

“Our work is strictly apolitical,” the NCISA’s Holy said. “We are concerned with security matters only. Over a certain period of time, we have been systematically gathering pieces of the puzzle. Once it all came together, we issued the warning.” 

Asked if the NCISA actually had hard evidence that Huawei is conducting espionage on behalf of the Chinese state, Holy shed light on the way the agency operates. 

“In general, we’re not concerned primarily with evidence,” he said. “We focus on risks. Once we have enough information leading us to the conclusion that there are risks associated with certain technology, we are legally obliged to take certain steps.”

He added: “In this particular case, there was so much information coming to us that we had to issue the warning. We might or might not have evidence. This is something that, for a multitude of reasons, we don’t specify.”

Once we have enough information leading us to the conclusion that there are risks associated with certain technology, we are legally obliged to take certain steps.

– NCISA spokesman Radek Holy

This risk-based approach contrasts with the evidence-based approach favoured by other European countries including Germany and France.

The Czech cyber watchdog appears to have adopted a similar methodology for evaluating risks allegedly posed by Chinese tech companies as the United States, Australia or New Zealand. 

Sedlak said that the NCISA was well plugged into the intelligence communities of the United States, Britain and Israel. 

“The Czech Republic has three cyber attachés: in Tel Aviv, Washington and Brussels,” he said. “The country has a lot of useful connections in those cities and a good reputation.” 

An anonymous source familiar with the decision-making processes behind Czech foreign policy said that the country tends to follow the US lead on key security matters. 

But NCISA director Dusan Navratil rebuffs any suggestion that the agency is swayed by other actors. He says it always acts independently.

“Our job is not to just sit and wait for orders from elsewhere,” he said in an interview (in Czech) with online daily Novinky in February. “Neither the Kremlin nor Brussels can tell us what to do. Our job is to act in a sovereign manner to defend the Czech Republic in cyberspace.”

Navratil conceded that the NCISA’s approach to Huawei had made NATO and EU allies sit up and listen. 

“While other states are looking for backdoors in Huawei equipment — something nearly impossible to prove — we chose a different approach,” he said.

“We defined what a threat in this context means. This made an impression on our allies; I think we have developed some sort of a blueprint for dealing with this problem.”

Czech President Milos Zeman speaks during a press conference in September 2019. Photo: EPA-EFE/KOCA SULEJMANOVIC

Populist instincts

Whatever the motivation behind the agency’s warning, it created a buzz — and Prime Minister Babis, known for his populist instincts, was quick to capitalise on it.

Sniffing growing anti-Chinese sentiment in the country, he immediately threw his weight behind the NCISA. 

Ordering his office to stop using Huawei mobile phones, Babis told the media he took warnings about the two Chinese companies “very seriously”. 

A few days later, Babis met China’s ambassador in Prague, Zhang Jianmin. After the meeting, the Chinese embassy announced on Facebook that the prime minister had said the warnings did not represent the position of the Czech government.  

In a reaction to the Facebook post, Babis told Czech Radio, a national public broadcaster, that he was “rather surprised” by the Chinese ambassador’s interpretation of events.  

“I do not know what the ambassador is talking about,” he said. “His communication is … very unusual.”

After the Czech position on Huawei opened the doors for Babis to visit the White House, and made him the first Czech Prime Minister to ever receive an invitation to the CIA, in March this year, he continued promoting the Czech cyber security approach. 

In May, Babis opened the Prague 5G Security Conference, inviting experts from around the world to develop common plans for 5G network security.

Although the conference did not produce any binding agreements, it temporarily put Babis and the Czech Republic at the center of the 5G debate in Europe. 

The reaction to the warning at Prague Castle, where the Czech president has his office, could not be more different.

President Milos Zeman said it could cause China to retaliate, potentially putting Czech business in China in danger.

In 2018, China was the Czech Republic’s 17th-largest export partner, with Czech exports to the country valued at 2.2 billion euros, according to Trading Economics. 

During an official visit to China in April, Zeman also said the West’s allegations of espionage against Huawei were not supported by evidence. 

Zeman, who has called for referendums on Czech membership of the EU and NATO, has long been a supporter of Chinese investment in the Czech Republic. 

“A few years ago, Zeman came up with the idea of making the Czech Republic a sort of an entrance point for China to Europe,” China expert Sedlak told BIRN.

“He was convinced that they would bring a lot of money here, which never really happened. This is the reason why he defends Huawei.” 

While Zeman’s protestations may or may not have helped Huawei’s fortunes in the Czech Republic, affiliates of the firm say the fug of controversy has created an unwarranted stigma.

“Even if Huawei didn’t lose any market share for state contracts, the warning certainly widened the barrier between Huawei and its customers,” Vitek from Huatech said.

“There are many people who just don’t want to get embroiled in this whole controversy. They would rather avoid talking to Huawei to safeguard their reputations.”

Activists, Artists Declare ‘Guerrilla War’ On Facial Recognition

Beyond the tear gas and barricades, images of young demonstrators in Hong Kong hauling down facial recognition towers have become iconic of the resistance to what they say is the erosion of freedoms in the semi-autonomous former British colony since its handover to Beijing in 1997.

China is at the vanguard of facial recognition technology, a fact not lost on pro-democracy protesters taking to the streets of Hong Kong since June and increasingly met with tear gas and police batons.

The toppling of surveillance towers provides a disturbing snapshot of the possible future of anti-government demonstrations, as states enlist the growing power of human identification technologies to track citizens and their behaviour.

In the West, too, a growing number of artists, intellectuals and activists are pushing back and channelling their creativity against the growing use of Big Brother-type technologies.


Protesters cover a city monitoring camera as they walk to Kowloon station to take part in a protest event in Hong Kong, China, 22 September 2019. EPA-EFE/CHAN LONG HEI

Scott Urban is one of them, an American who since 2005 has been making custom wood eyewear.

“I thought that being an eyeglasses creator, I could make an impact to protect people’s privacy with something as simple as a pair of sunglasses,” Urban told BIRN in an email interview.

In 2016, Urban created the Reflectacles Ghost, a model that, according to Urban, “reflects both visible and infrared light to obscure the wearer’s face on cameras using infrared for illumination, as well as blocking the face to cameras using a flash.”

‘Surveillance capitalism’

But while Hong Kong’s rebellious youth is concerned with China’s surveillance state, artists like Urban say they are more worried by private companies selling facial recognition technologies rather than states like China imposing it on their citizens.

In her 2019 book The Age of Surveillance Capitalism, American author and scholar Shoshana Zuboff writes that a substantial part of the material collected by facial recognition systems and other data gathering technologies is “fed into advanced manufacturing processes known as ‘machine intelligence’, and fabricated into prediction products that anticipate what you will do now, soon, and later.”

Such products are then “traded” in a marketplace Zuboff calls behavioural future markets’ and which comprise companies “willing to lay bets on our future behaviour.”


An unidentified man wears the prostethic mask with the face of Leo Selvaggio. Photo: LEO SELVAGGIO

“After testing the Face ID system for a long time, I realised that to block 3D infrared facial mapping all we had to do was block our eyes from being seen from these technologies,” he told BIRN.

“If 3D IR mapping/scanning does not see the eyes, it is not able to understand the information as a face.”

Asked who buys his glasses, Urban, who sells via his website, said his customers come from across the political spectrum.

“In these days of polarisation and division, privacy is a unifier,” he said. “Nobody talks about it because it actually brings us closer together, but privacy advocates can be found from the far-right to the far-left and everywhere in between.”

“Surveillance capitalism,” Zuboff writes, “unilaterally claims human experience as free raw material for translation into behavioural data.”

When Apple released its new iPhone X, which included a facial recognition system, in 2017, Urban responded with new models of eyeglasses that blocked infrared.

Overfeed the beast

Like Urban, most activists have focussed their efforts on hiding the facial traces that recognition systems are taught to identify.

American conceptual artist Leo Selvaggio, however, is doing the exact opposite.

Selvaggio has made available online an unlimited number of prosthetic masks reproducing his own features to help the public hide their real identity from facial recognition systems.

In a telephone interview with BIRN, Selvaggio describe his work as an “attempt to disrupt surveillance and facial recognition systems” by “creating disinformation” about the individuals who unwillingly feed them.

Instead of starving the beast, Selvaggio overfeeds it with fake information.

The artist has personally tested its results with photos of friends wearing his masks posted on Facebook and that were identified by the system and tagged as Selvaggio.

Asked about the legal risks, Selvaggio said that if he was mistakenly arrested for a crime committed by someone wearing his mask it would provide an opportunity to prove his point and expose the perils of relying on automated facial recognition in court.

Well aware of the limited scope of his initiative, Selvaggio nevertheless said such “guerrilla warfare” had the power to inspire others.

“If one person with almost no money can activate this type of resistance, imagine what would happen if we all did something similar,” he said.

 Serbia: Activists Demand Face Recognition Information

Belgrade-based NGO CRTA organised a street action called ‘We Have the Right to Know: Where are They Monitoring Us?’ on Wednesday, urging people to demand the authorities provide information about a project to introduce surveillance camera with facial recognition capabilities in the Serbian capital.

It called on locals to write requests to the Interior Ministry, asking about the impact of the surveillance on personal data collection and protection, which the NGO will then pass on.

“This is a story about our privacy. It is not a problem if we know where we are being monitored or for what purpose, the problem is when we do not know that,” said CRTA activist Ivana Markovic.

In January, the Interior Ministry said that over next two years, police in Belgrade will install almost 1,000 stationary video surveillance cameras at 800 locations, some of which will have software for face and licence plate recognition.

Meanwhile Share Foundation, an NGO that deals with digital security and privacy, said that Chinese tech company Huawei has published a case study about cameras already installed in Belgrade on its website.

The Huawei case study says that 100 of these cameras have been installed and that “many criminal cases were solved” as a result and “police are now able to find suspects based on the stored video materials thanks to Huawei intelligent technology”.

Croatian Journalist Fined for ‘Anti-Police’ Twitter Message

Gordan Duhacek, a journalist from Croatian website Index.hr, was fined around 100 euros at Zagreb’s Misdemeanour Court on Monday for posted a Twitter message in July last year, which discussed police treatment of arrested people and contained the anti-police acronym ‘ACAB’ (‘All Coppers are Bastards’).

Duhacek was arrested at Zagreb airport when he was about to leave Croatia on Monday morning and spent the day in custody before the hearing.

He also faces a court judgment this week for another Twitter message he posted, a satirical rewrite of the lyrics of a Croatian patriotic song.

“They charged me for one tweet that said ‘ACAB’. And another thing, I am charged because I satirically published a version of [Croatian patriotic song] ‘Vila Velebita’ which refers to faeces spilling into the Adriatic,” Duhacek said on Monday evening outside the Misdemeanour Court building when he was released.

“I am accused [in the case of the second tweet] of offending citizens’ moral feelings of citizens – they are offended by the rewriting of an old song that nobody sings,” he added.

He said that the verdict on the ‘Vila Velebita’ tweet will be issued in three days.

According to a Croatian law dating back to the 1970s, which was quoted by police while giving their explanation for the ‘ACAB’ arrest, “whoever discredits or insults public authorities or officials while carrying out, or in connection with carrying out their duties or their lawful orders, shall be punished by a fine equivalent in the national currency of 50 to 200 Deutschmarks or imprisonment for up to 30 days”.

Incredible. Croatian police arrested @indexhr journalist Gordan Duhaček (@Prajdizan) over two tweets. One featured the acronym “ACAB” and the other one is a satirical poem. @VladaRH #mediafreedom hello??

cc @Dunja_Mijatovic @IndexCensorship @article19org https://t.co/1cZ4LC1Gyp

— Tena Prelec (@tenaprelec) September 16, 2019

Croatian police and Interior Minister Davor Bozinovic insisted that Duhacek was not detained for his Twitter posts but for not responding to a police summons.

As Duhacek was returning from Bosnia and Herzegovina to Croatia last weekend, he was told on the border that the police were looking for him.

“On that occasion, an invitation was given to him, instructing him to report to the official premises of the Zagreb Police Department in Heinzelova Street on September 16, which he did not do,” the Zagreb Police Department said in a statement.

It is deeply worrying to see that a journalist has been arrested in Croatia for his tweets. In an EU member-state, whose EU Commissioner-nominated, Dubravka Šuica should soon be in charge of Democracy promotion. Solidarity with @Prajdizan.

— Dejan Jovic (@DejanFpzg) September 16, 2019

But Duhacek insisted that he went to the police station in Heinzelova Street on Sunday to see what the summons was about as he planned to leave Zagreb for a business trip to Germany.

He said that a police officer told him that he could travel but and that he should contact the police when he returned. However, police officers then arrested him at Zagreb airport on Monday morning.

The Croatian Journalists’ Association, HND, said in a statement that it strongly condemned the treatment of a journalist who was “arrested like a hardened criminal at Zagreb airport for two satirical postings on his Twitter profile”.

“The Croatian Journalists’ Association warns that the police treatment of Duhacek is unprecedented and cannot be interpreted as anything other than intimidation,” the HND added.

Meanwhile reporters from neighbouring Bosnia and Herzegovina have signed a petition in support of Duhacek.

Data Leaks and Ship Tracking: BIRN’s 10th Summer School Begins

The 10th edition of the BIRN Summer School of Investigative Journalism kicked off on Monday in the Montenegrin coastal town of Herceg Novi.

The weeklong summer school brings together journalists from Albania, Bosnia and Herzegovina, Belgium, Bulgaria, Croatia, Greece, Kosovo, Macedonia, Romania, Serbia and the United States.

On the first day, after an introduction by Marija Ristic, regional director of the Balkan Investigative Reporting Network, those attending heard from Reuters investigative projects editor and the school’s lead trainer Blake Morrison about how to approach complex investigative stories, pitch ideas and find the right words to craft them.


BIRN Summer school in Herceg Novi. Photo: BIRN

“Experts aren’t simply meant to be quoted in stories,” Morrison said in one of his tips for those attending.

“The best ones – the most helpful, at least – are the ones who serve as your guide to understanding what you cover. Find a few. Be aware of their biases and treat them with a reporter’s skepticism. Ask them what are you missing. What do they see?”

Suddeutsche Zeitung journalist Frederik Obermaier, who was part of the Panama Papers investigation, spoke about investigating data, verifying leaks and the problems he and his team faced as they trawled though terabytes of data.

“Authenticity, public interest, no conditions, request for comment and known identity of the source, are 5 tips on what to check for when dealing with data leaks,” said Obermaier.

The debate continued during Obermaier’s second session when he looked at the case of the video leak that brought down Austria’s right-wing vice-chancellor, Heinz-Christian Strache, and eventually the country’s coalition government.

After a break, the reporters discussed story proposals and heard from BIRN’s investigative editor, Ivan Angelovski, about how to track ships and planes online.

BIRN’s Summer School is organised in cooperation with the Media Program South East Europe of the Konrad-Adenauer-Stiftung, headed by Hendrik Sittig, The Balkan Trust for Democracy and Austrian Development Agency, the operational unit of Austrian Development Cooperation and with support from the European Union.

Anonymous Hackers Leak Millions of Bulgarian Taxpayers’ Data

Anonymous hackers have got hold of 11-Gigabytes of the private information of millions of Bulgarian taxpayers, Bulgarian media announced on Monday.

The files, sorted into 57 folders, include personal details such as Personal Identification Numbers, names, addresses and even the declared income of Bulgarians.

The leak, which is likely to be named the biggest hacker attack in Bulgarian e-history, targeted the National Revenue Agency, NRA.

The authenticity of the hacked data is being checked by the NRA, while the National Security Agency, DANS, and the Interior Ministry are investigating the case, all three institutions announced on their respective websites.

“Your government is retarded. The state of your cyber security is a parody,” the email which sent the link said.

It added that this was only part of the total information that the hackers had accessed, which includes 10 more Gigabytes of information and a total of 110 compromised folders of data.

The personal information includes input from the employment agency, pension fund contributions and address registrations. Some of it is as old as 2007, but other information is dated June 2019.

The hackers also praised WikiLeaks creator Julian Assange and called for his immediate release.

Cyber Attackers Strike Fear Into Romanian Hospitals

Romanian hospitals are on heightened alert since late last week, when the authorities told doctors and hospital administrators to be vigilant after a wave of cyber attacks against several medical centres.

Romania’s Ministry of Health says hackers targeted nine hospitals in Bucharest and other towns in recent weeks. “Some hospitals have had problems with admissions and with access to their databases,” the ministry’s spokesperson, Oana Grigore said.

“They are criminal attacks,” Ovidiu Marincea, from the Romanian Intelligence Service, SRI, told BIRN. “They were conducted by hackers to gain money.”

“After encrypting the institutions’ data, they demand a ransom, which can be paid in money into an account or in cryptocurrency or any other way,” Marincea explained. “If those who are targeted pay up, the hackers tell them their data will be decrypted.”

The SRI, whose investigation into the attacks is still underway, believes the criminals behind the attacks are from China. Marincea previously told local media that “the times in which the hackers were active” and the traces they left in their messages to their victims pointed to that scenario.

One of the targeted hospitals is the Dimitrie Castroian Municipal Hospital of Husi, in northeastern Romania. Its manager, Lucia Rotaru, told the media last week that the centre had lost part of its data.

“On April 21, the server was attacked and encrypted. The data was lost. We haven’t fully solved [the problem] yet,” he said. The attack took the hospital by surprise, Rotaru added, saying the hospital could not repel it despite having “a security system in place”.

The Romanian National Computer Security Incident Response Team, CERT-RO, the SRI and a private cybersecurity company, Bitdefender, have issued advice to hospitals to help them deal with further attacks.

“Don’t open files received via email unless you know the sender,” the advice reads. It warns against “irresistible promotions” in emails and recommends having all files backed up offline and an antivirus program installed. The Ministry of Health has sent the advice to all medical units in the country.

With more than 500 million users worldwide, Romanian anti-virus developer Bitdefender is one of the sector’s leaders. It collaborates with the Romanian authorities and with Interpol in preventing and investigating malware attacks.

Security agencies and private cyber companies warned earlier of the country’s vulnerability on the internet. In April, the National Cyberint Center, which is part of the SRI, warned of possible cyberattacks on the IT systems of public institutions during the EU and presidential elections this year.

Bitdefender said that Romania could be the most vulnerable country in the world to a new type of cyber attack, called Scranos, which steals all of the victims’ passwords and banking info and compromises their activity on social media.

The international cybersecurity company Kaspersky said the attacks on hospitals in Romania form part of an alarming global trend. There have been similar cases in the US and Germany.

“In many cases of ransomware, their success is based on four main types of problems: not all systems in the network have an antivirus; operation systems are old and not upgraded; passwords used by administrators and users are weak; users open email attachments without checking their source,” Kaspersky representatives said on June 21.

Faustino Blancos, Secretary General for Health and Consumer Affairs of Spain, is welcomed by Romanian Health Minister Sorina Pintea in Bucharest, Romania, 2019. Photo: EPA-EFE/ROBERT GHEMENT

Attacks on medical institutions and other institutions are often launched through “phishing” messages or messages containing infected attachments.

“They pretend to come from a legitimate source and encourage the victim to open a link or attachment,” Bitdefender’s senior e-threat analyst, Liviu Arsene, told BIRN.

The content of the messages are tailored specifically to entice the victim, he explained, and take into consideration the industry the person is working and even their department within the institution.

If sent to a human resources worker, for example, the email might come as a job application, and the ransomware be disguised as the candidate’s CV, Arsene noted.

The virus can also be installed on the computer after the hackers take control of it remotely. In both cases, the procedure is the same. “The victim sees a message on the screen with all the instructions he needs: how much the ransom is and how much it will grow by if he doesn’t pay within 24 or 72 hours, where he should buy the cryptocurrency from…” the same expert said.

Sometimes, he continued, those affected are instructed to start negotiations with the hacker at an email address. “The data doesn’t leave the computer. It remains on it, only you can’t access it,” Arsene said, explaining how ransomware works.

When the ransomware used has a vermin-type of behaviour, the malicious virus doesn’t only infect one computer but the whole system. “It can paralyze an entire hospital,” warns Arsene, who names patient data and the information needed to keep medical equipment working as some of the material that is vulnerable.

“The hacker’s goal is to create panic so they can convince the victim to pay,” the Bitdefender analyst said.

In line with the Romanian authorities, Bitdefender discourages targeted victims from paying ransoms to hackers. But the institutions targeted do not always listen to them. Desperate to have their systems back on track fast, some decide to pay up, as one Bucharest hospital did two years ago. “They paid the equivalent of 10,000 euros in Bitcoin,” Arsene recalled.

“If they pay a ransom, the victims have no guarantee that the perpetrators will honour their promise and give them back access to their data,” a CERT-RO statement on the latest wave of attacks read.

“They could be targeted again by the same group, as they already have a history of being a good payer,” the same text warned. Ransom payers thereby risk funding “the development of increasingly sophisticated cybernetic threats”, it concluded.

Bitdefender experts and Romanian authorities have revealed ransomware Maoloa has been used in some of the attacks against hospitals.

“Maoloa is a malware family relatively new,” a CERT-RO statement reads. This kind of ransomware appeared in February this year and has many common traits with Globelmposter type of ransomware, the official communications goes on. It is installed in computers through malicious attachments sent via email or by hackers who gain access to unprotected systems.

The other ransomware used to encrypt data from Romanian medical centres’ computers is Phobos, “one of the many varieties of prolific [ransomware] family Crysys.” Phobos gets makes it into the targeted computers after cyber criminals have breached in with Remote Desktop Protocol.

Online Abuse Now Commonplace for Balkan Women Reporters

As a female journalist in Serbia, Tatjana Vojtehovski had faced online intimidation before.

But the attacks grew worse in 2015 after she hosted a talk show on Serbian television on paedophilia in the Serbian Orthodox Church, a taboo subject for many socially conservative Serbs.

“I admire people who claim they’re not afraid. I am afraid,” said 49-year-old Vojtehovski. “People say, ‘it’s only online, it’s the virtual world’. I say that’s not true because those people exist. They exist and they are on the streets.”

Last month, the appeals court in the Serbian capital, Belgrade, sentenced a Serbian man named Branko Tomic to eight months of home confinement after he pleaded guilty to making death threats against Vojtehovski and her 28-year-old daughter via Twitter.

Tomic’s crime was just one in a growing global epidemic of online attacks against women journalists.

The Balkan region is no exception, and while Vojtehovski received a measure of justice, others say they see little point in complaining to employers or the police given what critics say is a systematic failure to punish the perpetrators, according to the findings of a BIRN analysis.

“What struck me the most was how people looked away, letting it happen,” said Milena Perovic Korac, a journalist at the Montenegrin weekly magazine Monitor, who has been the target of such abuse since 2011. “There was no reaction, and right then that was the most terrifying thing.”

Global trend

In a 2018 survey by the Washington-based International Women’s Media Foundation, IWMF, nearly two thirds of women journalists who responded said they had been threatened or harassed online at least once.

Also in 2018, the International Federation of Journalists, IFJ, reported that 66 per cent of women journalists who were victims of online harassment had been attacked based on their gender.

And for the assailants, access has never been easier.

Social media has become an indispensible tool for journalists, but simultaneously exposes them to instant praise and persecution, 24 hours a day.


According to the IWMF survey, 90 per cent of respondents reported a rise in online threats over the past five years and 82 per cent said digital attacks had increased too, “including such activities as having social accounts hacked or data stolen or compromised.”

Online abuse of women journalists target not only their work but their gender, frequently referencing their appearance, family life and personal relationships.

‘Whore’, ‘slut’ and ‘prostitute’ are just some of the insults women journalists report receiving online every day.

Experts say such attacks are sexist in nature and used to intimidate, discredit and frighten, often affecting how the journalist does her work and how she behaves in her private life.

Tracking such threats in the Balkans is not easy. Authorities and journalist associations rarely differentiate online threats from other forms of intimidation, such as verbal or physical abuse.

Serbia’s climate of intimidation

In its latest report, U.S.-based democracy watchdog Freedom House characterised Serbia as ‘partially free’, and cited an “environment of intimidation and harassment that inhibits journalists’ day-to-day work”.

“Smears and verbal harassment from politicians and online accounts are omnipresent, and attacks by government-friendly tabloids are a regular occurrence. Media workers are frequently called “traitors” and “foreign mercenaries,” it wrote.

Statistics gathered by the SHARE Foundation, a Serbian-based non-governmental organisation dealing with digital rights, support the report’s findings.

In 2018, SHARE registered four cases of online threats against female journalists. One person was arrested in May of that year.

SHARE registered another four just in the first five months of this year, including two against the prominent female investigative journalist Brankica Stankovic, who received police protection in 2009 due to death threats made against her.

SHARE said the deputy mayor of the southern Serbian city of Nis had also insulted female journalist Sena Todorovic via Twitter and the editor of the website Kolubarske, Darija Rankovic, had also been subjected to pressure.

In 2017, SHARE registered two such cases, six in 2016 and seven in 2015.

In Bosnia, for example, the local association of journalists said it had registered 52 attacks against female journalists, online and otherwise, between 2016 and April 2019.

While a number of cases resulted in convictions, “a significant number of cases have been closed due to the non-existence of grounded suspicion that they represented criminal acts,” said Una Telegrafcic, a lawyer at the Free Media Helpline of the Association of BH Journalists.

Safejournalist.net, a regional platform partly funded by the European Union and which advocates for media freedom and the safety of journalists, has documented 34 attacks in general against women journalists in Bosnia since 2015, 32 in Serbia, 13 in Kosovo, 10 in North Macedonia and eight in Montenegro.

Each country was once part of the socialist Yugoslav federation, which unraveled in the war in the 1990s.

Over the same period, the Council of Europe, Europe’s chief rights body, has received reports of seven such cases in Serbia, six in North Macedonia, six in Bosnia and four in Montenegro.

In Montenegro, Perovic Korac and others at the weekly Monitor were the target of an orchestrated campaign by Montenegrin media supportive of the ruling Democratic Party of Socialists, DPS.

Neither the government nor the prosecutor’s office responded to her complaints about a litany of online threats, so Perovic Korac and another journalist launched a private lawsuit in 2011.

A verdict was issued in the first instance in June last year, ordering Montenegrin government spokesman Srdjan Kusovac and the state to pay them 2,000 euros for insults and hate speech published in the state daily Pobjeda, where Kusovac was formerly editor-in-chief.

“In that first moment, you are on your own,” Perovic Korac told BIRN.

Psychological impact

The IWMF, in its 2018 survey, reported that a majority of abused women, 63 per cent, said the attacks against them had left psychological scars in terms of anxiety, fear or stress.

Another “alarming conclusion” of the IFJ report was that a huge majority of the cases go unpunished, with only 53 per cent of victims of online abuse reporting the attacks to their media management, union or police. In two thirds of those cases, nothing happened, it said.

Of those who chose not to report the abuse, 75 per cent said they did not believe doing so would make any difference, while 23 per cent were concerned about the effect on their work.

“It is worrying that women journalists are getting used to dealing with online harassment by themselves and assuming these situations as “common”,” the IFJ said.

Ivana Stoimenovska, a psychologist in Skopje, capital of North Macedonia, said trauma experienced by women who are the targets of sexual harassment often goes unnoticed by society, “because of the culture of concealment and silence that does not provide women with a proper venue to share their experiences and overcome fears.”

Meri Jordanovska, a Macedonian journalist at the Makfax news agency who has herself been targeted by such abuse, said that speaking out was vital for emotional healing and preventing more such attacks.


“By sharing, by opening up, you realise that you are not alone with this problem and that many other women journalists are facing the same forms of harassment, be it online or offline”, Jordanovska told BIRN.

For Jovana Gligorijevic, a journalist at the liberal Serbian weekly Vreme, such abuse has become a part of everyday life.

“Someone calling himself Damian Ky messaged me just to tell me I’m an Albanian whore, that he wants to bash my head in and that journalists are the worst kind of people who constantly disparage Serbia,” Gligorijevic told BIRN.

In his next message, ‘Ky’ asked why Gligorijevic did not kill herself.

For this story, Gligorijevic recorded all the online threats she received over a period of one week.

They ranged from calls on her to take her own life to messages describing her as “a sack of crap that lives in a shop window in the Red Light district,”  a “vaginal entrepreneur”, a “frustrated childless whore” and a “low-paid journalist who occasionally goes to Amsterdam to work as a prostitute to make ends meet”.

Perfect storm

Telegrafcic, the lawyer at the Free Media Helpline in Bosnia, said those who abused female journalists often assumed they would not resist or report the attacks and that comments regarding a journalist’s physical appearance or marital status reflected entrenched chauvinistic attitudes in the Balkans.

Female journalists are also the victims of chauvinistic comments by politicians, interviewees and their own editors or directors, Telegrafcic said.

Media expert Mehmed Halilovic said female journalists in the Balkans faced a perfect storm of widespread misogyny and disdain for journalists in general.

“There is an assumption when it comes to these macho men – they think it is easier to deal with female journalists, be it through direct threats or disparagement,” Halilovic told BIRN.

“Violence is the basic tool used by the public, which has a negative attitude towards male and female journalists, but unfortunately the authorities are also using it.”

In Kosovo, the head of the Kosovo Association of Journalists, Gentiana Begolli, said management and editorial positions in media outlets were dominated by men.

“Women journalists themselves hesitate to report the threats against them, taking into consideration thegeneral approach towards women in our society,Begolli told BIRN.

In North Macedonia, Kristina Ozimec, chief editor of the Platform for Investigative Journalism and Analysis, said threats and harassment directed against female journalists “have been left largely unaddressed for so long that they have unfortunately become commonplace, sort of an accepted form of professional risk for women engaged in this profession.”

“The harassment, often on a sexual basis, does not only come from individuals outside the workplace but also often in various forms from male colleagues in a position of power,” Ozimec told BIRN.

In Serbia, Vojtehovski said she was still dealing with the psychological impact of the online abuse she receives.

“I don’t know what they look like and whether they will cross the boundaries of written communication,” she said of her tormentors. “You live with it and you are supposed to get used to it. I never did.”

BIRD Community

Are you a professional journalist or a media worker looking for an easily searchable and comprehensive database and interested in safely (re)connecting with more than thousands of colleagues from Southeastern and Central Europe?

We created BIRD Community, a place where you can have it all!

Join Now