Politicians and Public Targeted in Online Intimidation Cases

Political targeting has become a worrying issue in the Balkans, with threats and online harassment of politicians and individuals who criticise people in power, according to BIRN’s review of digital violations for the period from January to March this year.

Several cases of political censorship, intimidation and legal suppression of dissent have been reported across the region in the period.

These incidents include threatening messages sent to political figures on Twitter, the erasure of the digital profiles of dissenters, and legal indictments of critical journalists.

The spread of misinformation on social media platforms has also continued to be a significant problem, with cases reported in Hungary, Romania, Montenegro and Croatia.

Several countries, including Albania, Serbia, Hungary, North Macedonia, Romania and Croatia, have reported an increase in cyber threats in recent months.

Phishing attacks have been rampant, with hackers sending malicious messages and emails posing as reputable organisations and authorities, such as Díjnet in Hungary and Interpol in Serbia. Companies and individuals have also fallen victim to online scams, losing thousands of euros in the process.

Politicians and public figures under attack

There has been an increasing number of cases involving the political of targeting of critics in the period from January to March. Such actions have a chilling effect on freedom of speech and the press, as well as on the ability of civil society to hold governments accountable for their actions.


President of Serbia, Aleksandar Vucic addresses the media after the High-level Meeting of the Belgrade-Pristina Dialogue in Ohrid, Republic of North Macedonia, 18 March 2023. Photo: EPA-EFE/GEORGI LICOVSKI

On March 30, users of an anonymous forum on the Klix.ba website made alarming calls for the liquidation of two high-profile Bosnian individuals: Foreign Minister Elmedin Konakovic and Nermin Niksic, the president of the Social Democratic Party.  This caused widespread concern and condemnation among politicians and members of the public alike. Many politicians called for the security agencies to take action.

On January 16, Biljana Stojkovic, co-president of the Zajedno party in Serbia, was alarmed when she received a threatening message on Twitter. She reported the incident to the police, but said that she could not shake off the feeling of being watched and targeted.

The same day, Petar Djuric, president of the Citizens’ Association, was detained for criticising Serbian President Aleksandar Vucic on social media. He was taken into custody by the Service for Combatting Organised Crime, SBPOK, questioned and then later released.

Another incident occurred in Montenegro, where the opposition Social Democratic Party MP Draginja Vuksanovic Stankovic was insulted in obscene and degrading comments on daily newspaper Vijesti’s Facebook page on January 12.

Meanwhile online political censorship is a tool that has been used by those in power. In Hungary, the Facebook profile of politician Orsolya Besenyi, who supported by the ruling Fideszparty but ran in the Jászberény local by-election as an independent, disappeared on January 16. Several days of posts on the Fidesz Jászság Facebook page were also deleted after Besenyi lost the by-election. The erasure of her digital presence was seen as a warning to other dissenters.

Online intimidation has also been used to silence critics in Hungary. After Ákos Hadházy, an independent MEP, reported that István Eged, the Fidesz party mayor of Pétervására, used EU funds for the benefit of his family, Eged sent Hadházy a threatening message on January 30, saying: “Be sure to see me again. … You will beg.” The message was seen as an indication that Eged wanted to stop any scrutiny of his actions.

Another case showed how social media can also be used by members of the public to intimidate and threaten others.

In Bosnia and Herzegovina on January 15, Emir Suljagic, the director of the Srebrenica Memorial Centre, posted a series of tweets commenting on an attack on a group of Serbs in Sarajevo.

Suljagic’s tweets included a picture of Bosnian Serb soldiers on the hills above Sarajevo during the 1992-95 siege. A Twitter user named SavoljuB responded: “Once Republika Srpska becomes part of Serbia, Potocari [where the memorial centre is located] will be flattened with an excavator and turned into a landfill.”

Misinformation in Montenegro, Hungary, Romania, Croatia

The spread of misinformation remains a significant problem on social media platforms as several recent cases in Montenegro, Hungary, Romania and Croatia show.


Visiting Speaker of the Hungarian Parliament Laszlo Kover and the President of the Parliament of Montenegro Ivan Brajovic (unseen) arrive for a joint news conference following their meeting at the Vila Gorica in Podgorica, Montenegro, 10 September 2018. Photo: EPA-EFE/BORIS PEJOVIC

On February 21, the German ambassador to Podgorica, Peter Felten, accused the Montenegrin news website Borba of publishing falsehoods. Felten told the newspaper Vijesti that Borba published a false story about a presidential election survey and said the German embassy had never done such a survey.

In Hungary, after a far-right march in Budapest, extreme right-wing media outlets Vadhajtások and Pesti Srácok on February 11 falsely accused last MP András Jámbor, his movement Szikra and left-wing news Mérce of organising violence that broke out, despite evidence that foreign members of Antifa being responsible.

The personal data of Hungarian left-wing activists was also published on social media and Telegram, leading to threats of physical violence. Meanwhile, a manipulated photo of László Kövér, the ruling Fidesz party speaker of the Hungarian parliament, was circulated on Facebook on February 6, falsely showing Kövér as a young man standing next to János Kádár, who was the Communist leader of Hungary.

In Romania on March 9, the Defence Ministry issued a warning to the public about misinformation on social media platforms such as Facebook and Instagram regarding mandatory military mobilisation. The ministry identified at least seven misinformation campaigns on this subject since the start of the Russian war in Ukraine, with the latest targeting citizens of Bucharest. The ministry said it believes that the aim of the campaigns is to generate confusion, panic and uncertainty among the population.

Also in Romania, dozens of mainstream media websites shared a piece of false information on February 12 about a change in the Romanian Road Code making it mandatory for drivers to carry a shovel and a supply of sand in the car during winter months, with drivers who weren’t equipped facing fines of up to 600 euros. However, police confirmed that no such change had been made to the Road Code. No original source was established for the fake news, which was shared by media outlets with large followings, including Newsweek, Capital, Click and Antena 3.

On January 20, a fake news article entitled “Secret CDC report confirms that 118,000 young people ‘suddenly died’ after vaccination” was published by SHTFplan, a conspiracy theory website, and circulated on social media in Croatia. The article falsely claimed that US presidential medical advisor Dr. Anthony Fauci used propaganda, lies, and manipulation to force parents to vaccinate their children and that 118,000 young people died after receiving the COVID-19 vaccine.

However, none of the information in the article no unusual increase in deaths after vaccination against the coronavirus has been reported. Fact-checkers at Faktograf concluded that the story was false.

Navigating cybersecurity threats

In recent months, several cyber threats have been reported across Europe. On March 31, a 28-year-old man from Albania was arrested for engaging in online fraud. The man is believed to have illegally obtained 100,000 euros by stealing personal account information from Kosovo citizens on various social media platforms. Once the perpetrator gained access to the accounts, he proceeded to demand money from the victim’s family members and close acquaintances.


A photo illustration shows the logo of social media messaging application Telegram on a mobile telephone screen, in Paris, France, 27 January 2021. Photo: EPA-EFE/IAN LANGSDON

On March 21 in North Macedonia, scammers used several humanitarian cases to lure donations on various social media channels, posing as relatives or close friends of people who are in need of donations for operations or other reasons.

On January 19, Russian hackers launched targeted phishing attacks on popular Facebook pages of Hungarian influencers, while on January 25, people in Serbia received false malicious messages from the Stara Pazova Health Centre and the Moj Doktor website as part of a phishing campaign in Serbia.

In Croatia, a company from Valpovo was scammed out of 31,000 euros when an unknown perpetrator falsely presented themselves as a director and requested a transaction to an account of another foreign company on January 18.

On January 24 meanwhile, a company from Zagreb lost hundreds of thousands of euros in a matter of minutes in an online scam. An employee received a message to update the company’s mobile banking app, which led to several hundred thousand euros being paid from the company’s account to ones owned by the unknown perpetrator

Phishing attacks have also been on the rise, with unknown people sending emails on behalf of Díjnet, an electronic bill service in Hungary, the Hungarian police and Interpol, accusing the recipients of involvement in child pornography.

In Bosnia and Herzegovina, sellers on the OLX.ba platform were targeted by cyber fraudsters who contacted them via Viber or other communication networks and requested bank card data after agreeing to purchase an item. Similarly, Bosnian lawyer Veronika Jancik fell victim to internet fraud when an unknown person asked for a voucher worth around 25 euros using a relative’s fake Instagram profile.

On February 17, hackers broke into the email system of the International Investment Bank in Budapest in Hungary and stole emails, documents, and other sensitive information.

On February 22, an unknown perpetrator blackmailed a company in Osijek in Croatia by making some of its computer data inaccessible and demanding payment of 0.5 bitcoin (around 11,400 euros) to a virtual account in order to unlock it.

Hate Speech and Disinformation Fuel Digital Rights Abuses in Balkans

The Western Balkans has faced ongoing political tensions and “culture wars” that have migrated from the physical world to the digital space, leading to human rights violations in digital environments.

BIRN’s latest annual report, “Distorting the Truth: Hate Speech and Disinformation Fuel Digital Rights Abuses in the Balkans,” covers digital rights in eight countries of the region, Bosnia and Herzegovina, Croatia, Kosovo, Montenegro, North Macedonia, Romania, Serbia, plus Hungary.

From September 1, 2021, to August 31, 2022, BIRN documented 782 digital rights violations in our database. The breakdown of these cases is: Bosnia and Herzegovina (77 cases), Croatia (70), Hungary (146), Kosovo (89), North Macedonia (83), Montenegro (65), Romania (128) and Serbia (124) recorded by the SHARE Foundation.

The report highlights that human rights violations in fragile democracies differ in type, nature, scope, and target, which, combined with rapidly changing technology, has led to violations of human rights in digital environments. Journalists, public officials, human rights activists and the public face different attacks online, including smear campaigns, trolling, and hate speech.

Identifying key trends in digital rights violations, the report warns against the spread of digital rights violations in the region. More robust accountability measures are needed to address these issues, and promoting the responsible exercise of freedom of speech in both online and offline domains is crucial.

BIRN’s goal is to equip policymakers, civil society organizations and citizens with the tools needed to safeguard digital rights now and in the future. The report presents recommendations for policymakers, regional regulators, media and technology entities and individuals, aimed at promoting and protecting digital rights in online media and journalism, including freedom of expression, access to information, and privacy.

BIRN’s recommendations include making all types of online aggression illegal, providing specific training and resources to law enforcement authorities and prosecutors, taking interim measures to combat hate speech, prioritising the development and implementation of robust cybersecurity measures, collaborating with local civil society players on content moderation and freedom of speech, and improving data collection to combat hate speech and hate crime.

By following these recommendations, policymakers and regulators can help ensure that digital platforms and technologies respect users’ rights and freedoms, contributing to a healthier, more vibrant digital public sphere where diverse voices can be heard and informed public debate can flourish.

Kremlin’s Ukraine disinformation campaign

The war in Ukraine, which started in February 2022, has not only been fought on the battlefield but also on the digital frontlines. It has become a hotbed for online disinformation and propaganda campaigns, with Russia and its supporters using every tool at their disposal to shape public opinion and sow discord across the region.

This resulted in a surge of digital human rights abuses, as documented in our latest annual report. The report notes that over 60 cases of online violations have been verified, ranging from fake news and hate speech to cyberattacks and digital surveillance.

The impact of these violations is far-reaching and can have severe consequences. They fuel political tensions, stoke nationalistic sentiments and contribute to the erosion of democratic institutions. Moreover, they create an environment of fear and distrust, where people are hesitant to express their opinions freely or seek out reliable sources of information.

The highest number of cases recorded by BIRN was in Hungary and Romania, followed closely by Serbia. In Hungary, fake news about the war in Ukraine has led to political clashes and concerns that the pro-government media is spreading a pro-Russia narrative. For example, the false claim that Ukrainian President Volodymyr Zelensky had fled the country reached approximately 1.2 million Facebook users.

Moscow also uses fake news and propaganda to shore up support in Serbia, where many feel culturally far closer to Russia than to Western Europe. In addition, Moscow’s refusal to recognise Kosovo – which declared independence in 2008 – has further endeared Russia to Serbs who refuse to accept Kosovo’s independent status.

However, while many Serbs might view President Vladimir Putin as willing and able to return Kosovo to Serbia, Belgrade in reality is negotiating a trickier path. Serbian President Aleksandar Vucic is pursuing relations with both the West (notably EU-membership) and Russia. This balancing act has seen Belgrade refuse to join sanctions against Moscow while at the same time stopping short of recognising Crimea (annexed by Russia in 2014) as Russian territory, claiming that could create problems regarding Kosovo’s status.

An image taken with a slow shutter speed of Ukrainian national flags waving over the graves of fallen Ukrainian soldiers in a military cemetery in Kharkiv, northeastern Ukraine, late 22 February 2023. Photo: EPA-EFE/PAVLO PAKHOMENKO

Exploiting disquiet in Bosnia and Kosovo

In the wake of the war in Ukraine in early 2022, the Balkans has become a battleground for disinformation and propaganda, fuelling political tensions and culture wars across the region. Nowhere is this more evident than in Bosnia and Herzegovina, where Russia’s supporters have been publishing denials of war crimes allegedly committed by Russian troops in Ukraine and disseminating a slew of sometimes contradictory fake news and social media posts in the divided country. Power in Bosnia has been divided between two entities since the 1995 Dayton Peace Accords, the mainly Bosniak (Muslim) and Croat Federation of Bosnia and Herzegovina and the Serb-dominated Republika Srpska.

Observers warn that Moscow is trying to scare Bosnia off from joining the NATO alliance by raising the spectre of renewed violent conflict, also to frustrate its EU-accession progress. They caution that Russia uses misinformation and conflicting fake news stories to sow discord and keep Bosnians in a state of anxiety and confusion.

The day after Russia invaded Ukraine, Dusanka Majkic, a Bosnian MP and member of the main Bosnian Serb party, the Alliance of Independent Social Democrats, SNSD, tweeted: “In March 2021, Moscow promised to react if Bosnia takes any further steps towards NATO. Don’t say you haven’t been warned.”

The SNSD president and leader of Republika Srpska, Milorad Dodik, is a staunch supporter of Putin’s Russia and an opponent of NATO. Dodik actively advocates the break-up of Bosnia and Republika Srpska’s independence, and is a frequent guest in Serbia, whose presidents and prime ministers have shown him strong support. Many right-wing Serbian groups and ultra-nationalistic opposition parties, such as the Dveri movement also back him.

A few days after Majkic’s tweet, Serbian MP and Dveri leader Bosko Obradovic told TV Prva, a Belgrade-based television channel, that it would be “justified for the Serbian Army to get involved” in Bosnia “to protect Serbs in Republika Srpska, if aggression is launched against them”. He even said Serbian military intervention would be “an obligation in every kind of sense, both moral and historical”. The video went viral and was covered by numerous media outlets.

In Kosovo, Moscow’s supporters among the Serbian minority have also used widely shared fake news to exploit deep-seated divisions and tensions between ethnic groups and generate fear among people that the violent conflicts between Kosovo Serbs and Albanians could erupt again. Long-standing tensions between the Kosovo government and ethnic Serbs who maintain close ties with Belgrade regularly spill over into violence in the Serb-dominated north of the country. Russia, a long-time supporter of Serbia, is viewed as a potential threat among the ethnic Albanian majority.

President Milorad Dodik speaks at a parade in East Sarajevo, Bosnia and Herzegovina, 09 January 2023. Photo: EPA-EFE/FEHIM DEMIR

Journalists face threats and intimidation

The intimidation of journalists remains one of the greatest challenges to media freedom in the Balkans. According to the 2022 Reporters Without Borders World Press Freedom Index, media freedom remains a major concern in many Balkan states, with journalists working in polarised political environments and facing threats from criminal groups. It also noted the information chaos is a result of “a globalised and unregulated online information space that encourages fake news and propaganda”.

Independent media and investigative journalists who expose abuse of office and seek to hold those in power to account are routinely threatened and targeted by media outlets that support Serbian President Vucic and his Serbian Progressive Party, SNS, which has ruled Serbia since 2012.

Of cases relating to threats against journalists, BIRN logged the most in Serbia (50). This echoes the findings in BIRN’s previous report on digital rights abuses, which suggested journalists in Serbia were the most frequently targeted party online (38 of 111 cases verified by BIRN). In addition, public figures who have been the subject of critical media coverage or have been investigated or charged by the police with offences related to corruption have launched legal actions against independent journalists/outlets in what are widely regarded as attempts to silence critical voices and stifle public debate.

There is growing concern about the development of a chilling effect on independent critical reporting across the region due to the apparent impunity for those making on and offline threats against journalists.

Political smears threaten democratic process

Smear campaigns have become commonplace across the region and pose a serious threat to democratic values, where many of the monitored countries have hybrid regimes that combine democratic elections with elements of authoritarian rule. Election campaigns held in 2022 in Bosnia, Hungary and Serbia spawned a torrent of online attacks between political rivals.

In May 2022, the president of the Women of the Party of Democratic Action, SDA, in Sarajevo, Alma Omerovic, insulted the vice president of the Social Democratic Party, SDP, Denis Becirovic in a Facebook post. She called him a traitor, writing: “Get smart Bosniaks, this [the election] is the jihad of our time”. After the post went viral and drew criticism from many media outlets, Omerovic defended her characterisation of the elections with: “Jihad, you bet! Because we truly need it!”.

There are also concerns over censorship, particularly when it comes to media outlets that support ruling parties. In March 2022, Serbia’s Happy TV removed a video from its YouTube channel which featured a heated debate involving political analyst Boban Stojanović, who criticised the government’s economic policy and noted that salaries in Serbia are now the lowest they have been since the fall of former strongman Slobodan Milosevic in October 2000.

In Hungary, where Viktor Orban secured another term as prime minister following general elections, he used his victory speech to criticise European Union “bureaucrats” and Ukraine’s President Volodymyr Zelensky, calling them “opponents”. Zelensky has criticised Hungary’s refusal to unequivocally condemn Russia’s invasion of Ukraine or allow weapons intended for Ukraine through Hungary. Orban’s Fidesz party launched numerous smear campaigns and attacks against political opponents in the run-up to the elections.

Hungary’s Prime Minister Viktor Orban leaves after an EU summit at the European Council building in Brussels, Belgium, 24 March 2023. Photo: EPA-EFE/Olivier Matthys / POOL

Homophobia remains endemic online

Pride parades in Bosnia and North Macedonia met incidents of online hate speech and incitement to violence against the LGBTQ+ community. In the Sarajevo and Skopje parades on 25 June 2022, numerous digital rights violations occurred, including comments calling for violence against Pride parade participants and other members of the LGBTQ+ community.

During the build-up to the October 2022 general elections in Bosnia and North Macedonia, some politicians used the controversy over the Pride parades to appeal to voters. This involved making discriminatory statements and, Bosnia, even comparing the parade to the brutal Bosnian Serb siege of Sarajevo during Bosnia’s 1992-5 war. Such statements left members of the LGBTQ+ community concerned about their future rights.

In Serbia, thousands protested against the parade while insults and homophobic content were shared on social media. In Hungary, several pro-government media shared homophobic articles targeting the newly appointed Deputy Assistant Secretary at the US Department of Energy, Sam Brinton, who identifies as non-binary. Some articles called Brinton a “dog fetish drag queen” with a “deviant” personality.

In Romania on August 10, 2022, MozaiQ, one of the most active gay rights NGOs in the country, condemned what it called a worrying increase in hate speech against the LGBTQ+ community. In the following weeks, some members of the organisation received death threats and received online attacks, Vlad Viski, executive director of MozaiQ.ms, said.

Participants raise their fists and shout slogans during Sarajevo’s third gay pride parade, in Sarajevo, Bosnia and Herzegovina, 14 August 2021. Photo: EPA-EFE/FEHIM DEMIR

Scams, phishing and data breaches

Online scams, fraud, data breaches and cybercrime are commonplace across the region including hacking attacks targeting websites belonging to public and government institutions.

BIRN recorded serious attacks in North Macedonia and Romania involving cyber-attacks and computer fraud targeting public systems. On July 4, 2022, one of North Macedonia’s most popular IT websites, IT.mk, suffered a series of devastating DDoS attacks. The hackers demanded a ransom in bitcoin. After IT.mk refused to pay it was targeted again on August 17, 2022, by another DDoS attack.

In Romania, websites of several key public institutions were also hit by DDoS attacks. Responsibility for the attacks was claimed on Telegram by Killnet, a hacking group based in Russia. The hackers justified the attacks by accusing Marcel Ciolacu, President of the Chamber of Deputies, of promising “maximum assistance” to Ukraine. For about seven hours, users could not access online government services including the defence and border police websites.

The full version of BIRN’s annual digital rights report, “Distorting the truth: Hate speech and disinformation fuel digital rights abuses in the Balkans”, can be downloaded here.

BIRN’s Digital Rights Programme has recently launched three new databases covering digital rights violations in Kosovo, Albania and Montenegro

New Pegasus Target Identified in Poland

Jacek Karnowski, currently mayor of Sopot on Poland’s Baltic Sea coast, was monitored by state surveillance in 2018-2019 when he was one of the key politicians promoting an opposition alliance to win the Senate elections, according to Friday’s daily Gazeta Wyborcza. (The united opposition did win the Senate in 2019).

“This is a violation of privacy and human dignity,” Karnowski told Wyborcza in response to the revelations. “Those who monitored their political opponents should be brought before the Tribunal of the State.”

Wyborcza says it found Karnowski’s name on a list of monitored individuals made available to multiple media outlets that were part of the Pegasus Project consortium.

According to the paper, the Polish Central Anti-Corruption Bureau CBA tapped Karnowski’s phone 10 to 20 times between 2018 and 2019.

It is impossible to say what data the services took from Karnowski’s phone, Wyborcza reports, because the device was “cleaned up” of data.

In Poland, secret services are obliged to delete data they collect if they do not uncover or confirm a crime during the investigation.

Karnowski is currently head of an alliance of mayors that is a major actor in the coalition of liberal opposition parties confronting the ruling PiS in this year’s parliamentary elections, due in the autumn.

Polish intelligence services used Pegasus until November 2021, after which the Israeli company producing the software, NSO Group, did not renew its contracts with either Poland or Hungary.

This followed media revelations that these two governments used the spyware to monitor journalists and opposition politicians.

Albania Prosecutors Seek to Grill Five Officials Over Cyber-attacks

The Tirana Court has received a prosecution request to arrest and investigate five civil servants over the recent cyber attacks that disabled various state institutions.

Its response was an “investigative secret”, a press statement said on Wednesday.

The prosecution request, which reached the court earlier Wednesday, is related to the crime of “abuse of duty” and accuses the five employees of not implementing safety regulations.

“The IT staff at DAP (public administration) could and should have requested a report from the economic operator contracted by DAP for the implementation and maintenance of the system in time, regarding the state in which this system was located, despite the lack of knowledge about how to implement the contract for the implementation of the administrata.al system,” the prosecution office said.

Albania has been hit by cyber-attacks since July 15, when the governmental portal e-albania was attacked. Since then, the hackers, through their website and Telegram group, both called “Homeland Justice”, have been releasing information, mostly from the police and State Information Service.

The Tirana Prosecution banned domestic media from reporting the content of the leaks in September, a move that was widely condemned by journalists and media watchdogs in Albania as censorship.

The hackers are believed to be Iranian; Tirana hosts a group of exiled Iranian dissidents called the MEK – People’s Mujahedin of Iran. The staff of the Iranian embassy in Tirana were expelled on September 7 over the attacks.

Since then, the hackers have conducted other operations, targeting the Traveler Information Management System, TIMS, on September 19, which caused chaos on the borders.

They also released the emails of Gledis Nano, the former chief of police, on September 19. Data from various databases was released after that, including the personal data of Prime Minister Edi Rama and Helidon Bendo, director of the State Information Service, and his wife.

According to an FBI report, Iranian hackers first accessed Albanian systems 14 months before the first cyberattack was reported on July 15, when government services became unavailable for some days.

“An FBI investigation indicates Iranian state cyber actors acquired initial access to the victim’s network approximately 14 months before launching the destructive cyber attack [in July], which included a ransomware-style file encryptor and disk wiping malware,” the report said.

Iranian Hackers Leak Database of Albanian Criminal Suspects

An Iranian hacking group called “Homeland Justice” published new information on Monday related to people supposedly “suspected” by the Albanian police authorities.

The file, simply titled “Suspected”, contains information allegedly related to people in the State Police database connected to different crimes.

The data shared from the Telegram channel also called “Homeland Justice” includes photos of these people, their ID numbers, names and surnames, names of their fathers, dates of birth, birth cities and nationality. The database is thought to have 100,000 items of data.

The prosecution has ordered local media not to report the content of data that hackers released. Albania’s government has not reacted to the latest leak.

Sali Berisha, veteran boss of the centre-right Democratic Party in opposition, said that the leak was very dangerous.

He said the leak likely came from the police’s MEMEX system, which gathers data from the State Police on people suspected and investigated for crimes.

“Names have been exposed from the system in order to warn all those who are under surveillance, are under investigation, or are under consideration for various criminal activities,” he said.

“This is a moment when Albania has become the most dangerous country in the Balkans and Europe, as it [the leak] warns contingents of criminals that they are under police pursuit and surveillance and must leave in order to be saved,” Berisha said on Monday.

Ervin Karamuco, a professor in criminology at Tirana University, also described the leak as very worrying.

“What we had suspicions about but were afraid to say out loud, has happened; 1.7 gigabytes of criminal data from the Memex police system was released today by hackers. Public safety is under question,” Karamuco wrote on Facebook.

However, State Police denied that the information leaked on Monday is from MEMEX.
“State Police informs that, so far, sensitive data that is being administered in this system is not affected or damaged,” the police said.

It added that they are investigating the origin of the leak and called on the media not to publish this kind of data.

Albania has been subjected to cyber-attack for months, which the government has connected to Iranian groups. (Tirana hosts a group of exiled Iranian dissidents). The Iranian embassy staff in Tirana were expelled on September 7.

Since then, the hackers have conducted other operations, targeting the Traveller Information Management System, TIMS, on September 19, which caused chaos on the borders. They also released emails of Gledis Nano, former Chief of Police, on September 19.

According to an FBI report, Iranian hackers first accessed Albanian systems a full 14 months ago.

The first cyber-attack was reported on July 13, when government services became unavailable for some days.

“An FBI investigation indicates Iranian state cyber actors acquired initial access to the victim’s network approximately 14 months before launching the [July] destructive cyber attack, which included a ransomware-style file encryptor and disk wiping malware,” the FBI report said.

Montenegro Blames Slowed Court Processes on Cyber-Attacks

Montenegro’s Judicial Council said on Wednesday that the court system had been slowed down by the massive cyber-attacks which have hit the country since August 22.

The digital infrastructure of a major part of Montenegro’s public administration has been offline since August 22 following an unprecedented series of a ransomware attacks on government servers.

The Judicial Council told BIRN that some trials had to be postponed due to technical problems.

“The reason for the postponement of certain trials lies in the fact that a small number of users are unable to access the Judicial Information System, PRIS, and enter the necessary data due to problems with the links provided by the Ministry of Public Administration.

“We are actively working on finding alternative ways to access the system for users who do not currently have it, until the establishment of a regular operating regime,” the Judicial Council’s press office said.

“So far, no data were compromised in the court system, nor was direct damage to the system detected,” it added.

On September 5, the Higher Court in Podgorica postponed the so-called “coup plot” trial, as it couldn’t provide technical conditions for the trial. It postponed the trial to November 28.

After the second cyber-attack on August 26, certain services were switched off temporarily for security reasons, causing problems in the functioning of the public administration. The websites of the government and the president are still offline.

Courts and the prosecution service are also working only offline, as are the State Property Administration, the Central Register of Business Entities and the fiscal system.

Government servers were hit with ransomware, a type of malware attack in which the attacker locks and encrypts the target’s data and important files and then demands a payment to unlock and decrypt the data. The head of State Cyber Security Service, Dusan Polovic, said on September 5, that some service could be switched to online mode in future days, stressing that a team from the FBI had joined the investigation.

“In the next few days, we expect developments. Citizens should understand the complexity of the attack. The situation we have, many countries have gone through,” Polovic told television Vijesti.

After the second wave of cyber-attacks on August 26, the Agency for National Security, ANB, accused Russian services of organizing the attacks. On September 1, Russia’s Foreign Ministry dismissed the claims as part of a “continuous policy of dismantling relations with Moscow in order to please the United States”.

On August 31, Public Administration Minister Marash Dukaj blamed Cuba Ransomware for the attack. He said this group had created a special virus for this attack, costing about 10 million dollars and which has not been used anywhere so far.

BIRN Hit by Cyber-Attacks After Turkish Fraudster Investigation

The Balkan Investigative Reporting Network and its Greek partner media outlet Solomon’s websites came under DDoS attack by hackers from early Saturday morning onwards in the wake of the publication of an investigation into a controversial Turkish businessman.

The attack began on Saturday morning and continued into Sunday. BIRN’s server was not compromised but at one point, BIRN’s flagship Balkan Insight website was completely inaccessible.

“The attack started on Saturday at 7.30am. That’s when the alarms went off, and around eight we had already started to react. It was a fierce battle, I never experienced a fight like that,” said an IT security expert whose company works for BIRN.

“At one point on Saturday, we had 35 million different IP connections from all over the world.  The site was brought down by the number of connections,” he explained.

BIRN’s technical experts determined that the attack was specifically aimed at bringing down the page on which the investigation into how a Turkish businessman who had been convicted of fraud bought his way to honorary Greek citizenship.

By Sunday evening, the attack had been repelled. But Solomon’s website remained under attack and was still offline on Monday morning.

Solomon, a Greek independent media outlet which worked with BIRN on the investigation, initially announced on Twitter on Saturday that it was experiencing difficulties because of a “massive DDoS attack on our site”.

A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic.

It is often used in attempts to target specific content published online and strike a blow at websites that need time to recover from such huge amounts of visits.

The investigation believed to have caused the DDoS attack looks at the case of Yasam Ayavefe, a Turkish businessman who was convicted of defrauding online gamblers in his home country in 2017 and arrested in Greece in 2019 while trying to cross the border into Bulgaria on a false Greek passport. He was later awarded honorary Greek citizenship.

The BIRN and Solomon investigation “examined how honorary citizenship, a state honour long reserved for those who have significantly promoted Greek culture, was turned into a golden visa scheme for those with deep pockets”, Solomon said in a Twitter post on Monday.

The investigative outlet Inside Story first broke the news in July, triggering a fierce debate over Ayavefe’s suitability for such an honour. Inside Story also came under DDoS attack after publishing its report on Ayavefe.

Albania Blames ‘Massive Cyber Attack’ as Govt Servers go Down

Albania has come under a “massive cybernetic attack”, the government announced on Monday, which pro-government media blamed on Russia.

The main servers of the National Agency for Information Society, which handles many services, were all down on Monday after being hit on Sunday by “an attack from abroad”.

“Albania is under a massive cybernetic attack that has never happened before. This criminal cyber-attack was synchronized… from outside Albania,” the Council of Ministers said in a press release.

“In order to not allow this attack to damage our information system, the National Agency of Information Society had temporarily shut down online services and other government websites,” it added.

The National Agency for Information Society, AKSHI, is a controversial institution, which some accuse of  misusing citizens’ personal data for political purposes. It has been also suspected of funneling millions of euros to progovernment media through procurements of various services.

The government of Prime Minister Edi Rama closed desk services for the population lately and ordered mandatory use of its online services for everything from enrolling in school to obtaining an ISBN number for a new book at the National Library.

However, several important services, such as online tax filing, are still working, as they use separate servers.

Sali Berisha, a former PM and opposition leader, blamed the ineptitude of the government rather than Russia for the meltdown, pointing out that the government had concentrated too many services in the AKSHI.

“How did it it happen that the government ordered almost all important services to go through this website?’ he asked. “How can such initiatives be undertaken while no professional policing against cyber crime is yet in place?” he added.

Internet Freedoms in Turkey Continue to Deteriorate: Report

The Media and Law Studies Association, MLSA said in a report published on Friday that internet freedoms continued to decline in 2021 due to increasing censorship and surveillance.

The Free Web Turkey 2021 Annual Report funded by the Netherlands shows that at least 11,050 URLs were blocked in Turkey in 2021.

“While 1,593 of the blocked URLs contained news articles, a total of 49 news websites were banned during the monitoring period, some even more than once,” the report said.

“The project’s findings bring to light that 53 per cent of blocked news articles pertain to information directly related to Turkish President and AKP leader Recep Tayyip Erdogan, his family, and to mayors or officials of the AKP,” the report added.

According to Mumtaz Murat Kok, project and communications coordinator at the MLSA, the situation is not getting any better in 2022.

“The results of this report, which covers a period of only one year and reveals the dimensions of digital censorship in Turkey, becomes much more frightening when considered together with the ‘disinformation bill’ submitted to parliament very recently,” Kok told BIRN.

The new disinformation bill currently waiting to be considered by parliament makes ‘disinformation’ a crime that can lead to a jail term and paves the way for an even more repressive and coercive media environment, he said.

“As the report reveals, there is the intent to strengthen censorship practices that currently aim to protect a certain group and further violate the public’s right to receive information. In a country where there is almost absolute uniformity in media ownership, social media – on which many journalists rely on to report and many citizens rely on for news – is also being stifled,” Kok said.

The report also recommends that awareness of censorship and surveillance should be increased and social media platforms should bear the responsibility of being ‘media’.

According to a report published by Google covering data from the first six months of 2021, Turkey requested the removal of a total of 4,776 items. The majority of the requests were made on the grounds of ‘defamation’.

Google removed 1,686 of these items for legal reasons and 219 for company policy reasons.

“Considering the censorship practices that the government aims to increase, and that social media companies have so far submitted to the demands of the government without resistance, I think the next report [by the MLSA for 2022] will not be a more pleasant report,” Kok said.

EU Urged to Withdraw Child Abuse Law amid Privacy Concerns

The European Federation of Journalists (EFJ), together with 72 NGOs and professional bodies, on Wednesday sent an open letter to the European Commission demanding it withdraw proposed child abuse legislation and replace it with a provision that secures privacy, security and free expression for all.

The European Commission published on May 11 new draft legislation, called the CSA Regulation, that aims to prevent and combat child sexual abuse. Under the proposal, private message services (like WhatsApp and Signal), web-based emails, social media platforms, app stores, image hosting providers and others would be liable for obligations to scan, filter and/or block content – including encrypted messages.

“When you fundamentally undermine how the internet works, you make it less safe for everyone. If passed, this law will turn the internet into a space that is dangerous for everyone’s privacy, security, and free expression. This includes the very children that the legislation aims to protect,” the 73 civil society and professional groups wrote in the open letter to the EU Commission.

The CSA Regulation would cause severe harm in a wide variety of ways, the groups argued.

The new regulation would force private technology companies to put communications and materials that citizens share under surveillance, which would have a direct impact on respect for the privacy of every citizen, while also leading to a restriction of freedom of expression in digital communications, these groups argued.

“The provisions of the proposed legislation for the restriction and suppression of child exploitation material on the internet, while dealing with such an important issue, fail to safeguard the protection of all of us in the digital space and put the privacy of our communications in immediate danger,” Homo Digitalis, a Greek digital rights NGO that co-signed the open letter, told BIRN.

Journalists and human rights activists would see their communications monitored under the new law, which the EFJ argues “could jeopardise the fundamental protection of journalistic sources.”

“This will put in immediate danger not only the continuation of their important work, but even their personal safety, in cases of authoritarian regimes. We are already seeing important facts coming to light that show that journalists are being monitored illegally, even in Greece. Imagine the direct impact that the imposition of this legislation will have on the entire journalistic field, on human rights lawyers, etc. It will give the tools to authoritarian governments to put – legally now – any control over the internet,” said Homo Digitalis.

In Greece, in November last year, the Greek journalist and BIRN contributor Stavros Malihoudis, as well as human rights activists found themselves the targets of surveillance by the country’s National Intelligence Service. Recently, the Greek journalist Thanasis Koukakis, a financial editor for CNN Greece and a regular contributor to local and international outlets including the Financial Times and CNBC, found that his mobile phone had been surveilled by Predator spyware.

BIRD Community

Are you a professional journalist or a media worker looking for an easily searchable and comprehensive database and interested in safely (re)connecting with more than thousands of colleagues from Southeastern and Central Europe?

We created BIRD Community, a place where you can have it all!

Join Now