Category: Uncategorized

Experts say private individuals are paying the price of the lax online security put in place by public institutions. 

“Citizens’ data is being exposed because of logical errors and a failure to take appropriate technical-logical measures to protect privacy and prevent data being exposed to third parties,” said Kosovo cyber expert Mentor Hoxhaj.

Long-lasting fallout

Mentor Hoxhaj, Kosovo cyber expert. Photo courtesy of Mentor Hoxhaj

The fallout from the data breach in Albania is still being felt.

A 42-year-old woman from Tirana, who asked not to be named, told BIRN the data revealed a discrepancy in salaries between herself and others doing the same job.

“I’m the oldest in my workplace and I learned that the others working with me in the same sector are paid way better than me,” she said. “It came as a blow to me when I learned this fact and it pushed me to take a decision and change my employer to one where I will have a better salary.”

But Albanian lawyer Bledi Meminaj said worse is still to come. 

“We will have cases when someone will take out a loan on behalf of a family member or buy an expensive item by giving the data of an acquaintance,” he told BIRN.

Meminaj said that the Tax Administration should have been held accountable. “We will feel the effects of this leak after three years,” he said.

For Elton [not his real name], the reckoning has come far sooner.

“My wife learned about my salary and the situation deteriorated,” said Elton, who had told his wife he earned less.

“We need an afterwork beer, but this didn’t look normal in her eyes. She wanted all my money in the house, for the family. We quarrelled for many months until she filed for divorce a few days ago.”

Playing politics

In the Balkans, Albania is seen as the worst when it comes to protecting the personal data of its citizens. 

The December 2021 leak was not the first. Eight months earlier, as Albania braced for a parliamentary election, the Tirana-based portal Lapsi.al published a database of more than 900,000 voters that was being used by the ruling Socialist Party.

The document contained personal data such as phone numbers, ID numbers, polling station numbers, employment details and a description of the political affiliation of every Tirana voter. It even named the party member tasked with tracking a voter’s political preferences. 

Lapsi editor Armand Shkullaku could hardly believe his eyes.

“Someone I know told me that a Socialist Party group was receiving data from the National Information Society Agency (NISA) for all citizens, not only for Tirana,” Shkullaku told BIRN. “In total, only five senior members of the Socialist Party had access to the data, and then they were distributed according to a pyramid in the party,” until it reached those tasked with tracking individual voters.

The Socialists won the election, securing an unprecedented third consecutive term.

But even before prosecutors could release their findings, there was another leak, this one involving vehicle licence plates.

Eventually, after the election, four people were arrested, from NISA and the Tax Administration.

But Shkullaku accused the prosecution of dragging its feet for political reasons.

“They threatened to raid our office and the case went to court. Then we appealed to Strasbourg,” he said. “But we understood that their goal was to drag the issue out until April 25, election day, because if the result of the investigation was published before the elections it would have a huge impact on the result.”

The four suspects were later released and the investigation continues.

In Kosovo – many violations, few complaints

Krenare Sogojeva Dermaku, Kosovo Privacy Commissioner. Photo: BIRN

In Kosovo, Donika dropped her case when her harasser apologised.

“The offender admitted wrongdoing; he told how he succeeded in getting hold of my data and expressed his remorse. He also pledged he would never do the same thing again.”

“This was enough for me. I didn’t want to take the case to court because it would take years to get a verdict.”

Surprisingly, Krenare Sogojeva Dermaku, the Commissioner of the Agency for Information and Privacy, AIP, said the agency had not received a single complaint from private individuals concerning data privacy breaches by public institutions.

Sogojeva Dermaku was elected to the post in June 2021 by parliament after years in which the agency was unable to carry out its work because of political disagreement over who should run it.

Since January, AIP has received 64 complaints against private entities concerning publication of personal data, direct marketing, processing of biometric data for aims of identification and surveillance in public spaces.

“Perhaps citizens are not informed of our services, so that could be the reason why they do not file complaints,” said Sogojeva Dermaku. “We will organise a campaign which will inform people how their privacy could be breached, how they should act and what can we do.”

Likewise, the office of the Ombudsperson in Kosovo told BIRN it had not received any complaints concerning violations of privacy via government e-services.

Tax Administration officials admit shortcomings and say that they are working to improve the service.

“We have received complaints and we have addressed them with the Agency for Information and Privacy,” said Tax Administration spokeswoman Valentina Bytyci Sefa.

She told BIRN that improvements would be made to the administration’s mobile app to avoid breaches.

Hoxhaj, the cyber expert, said that public institutions had simply failed to take the appropriate measures.

“The institutions have not applied the ‘privacy by design’ rule/standard, which means that in the case when a service is applied, appropriate measures should be taken so that personal data is safe and privacy is protected,” he said.

“From the information security point of view, there is a violation of ‘confidentiality’ because the data can be exposed to third parties.”

Call for radical measures

In Albania, experts say that beyond increasing security, the law on the protection of personal data must also be amended.

IT expert Genti Progni called for punishments to be toughened up.

“We believe and hope that we have all the conditions, because money has been given for security,” Progni told BIRN. “There is no 100 per cent security in any country, but I think that the punishment of persons who are authorised to have access and abuse this access should be increased.”

Meanwhile, the office of the Commissioner for Data Protection said that, following an administrative investigation, it had recommended to relevant authorities that they update security protocols and limit the access to and use of data in state databases.

“A decision has also been taken to impose a sanction on the tax authority for refusing to cooperate,” the Commissioner said. “These recommendations must be implemented quickly, without prejudice to other proceedings of the competent authorities that aim to assess the integrity of the electoral process.”

Albanian legal expert Ervin Karamuco said that more than 150 people had so far gone to court over violations of their privacy but no verdict had yet been passed.

“Currently, any criminal organisation or structured cyber group finds it very easy to clone an individual’s identity and use it for cover purposes for the criminal acts they intend to commit,” Karamuco said.

He says that the state should take urgent, radical measures to change all identity cards and the ID numbers of Albanian citizens. 

“The publication of personal data has put the lives of Albanians in danger in many ways.”

While such warnings should result in reduced visibility for sites that continue to promote fake news, it is unlikely that content containing false information will actually ever be removed by Meta unless it goes against community standards, such as hate speech.

Small publishers in the Balkans say they are being unfairly punished for relying on pickups that turn out to be false, while fact-checkers find themselves caught in the crossfire, demonised by social media users and media outlets that appear not to understand the real nature of their work while taking the flak for the continued scourge of fake news.

Meta “used us as a scapegoat for why there was still ‘fake news’ out there, instead of taking any responsibility for their own massive role in spreading it and pushing it to the screens of the people they had identified as being most likely to believe it and be motivated to act on it,” said Brooke Binkowski, a former managing editor of Snopes, a fact-checking site that has partnered with Facebook.

BIRN asked Facebook for data concerning content in Balkan languages but received no response. Meta also did not respond to a request for comment on the third-party fact-checking programme, commonly known as TPFC.

System widely misunderstood

Illustration, visitors take picture of billboard sign featuring a new logo and name ‘Meta’ in front of Facebook headquarters in Menlo Park, California, USA, October 2021. Photo: EPA-EFE/JOHN G. MABANGLO

Facebook fact-checking took off following the 2016 election of Donald Trump as US president, when the social networking giant was accused of contributing to deep political polarisation and a failure to clamp down on misinformation designed to manipulate voters.

The work was outsourced to independent media organisations specialised in debunking false reports.

To become a Meta fact-checking partner, an organisation must be a signatory of the International Fact-Checking Network’s Code of Principle, meaning it must have a track record of doing fact-checking in its respective country or countries. With Meta’s own algorithm struggling to detect content that violates community standards in non-English speaking areas, the work of local fact-checkers is seen as essential.

Based on algorithms and user reports, Meta flags to fact-checkers content they should take a look at; fact-checkers can also identify hoaxes on their own.

“Istinomer journalists on a daily level scan the platforms and media outlets in order to find viral potentially false information that could harm and influence citizens’ decision-making, or for which it is in the public interest that they are fact-checked,” said Milena Popovic of Belgrade-based fact-checker Istinomer.rs.

Popovic said that “it is not fully transparent” how Meta identifies potentially false information, but the company itself says it picks up on posts based on a number of signals, including how people are responding and how fast the content is spreading.

During major news events or for topics that are trending, Meta also uses keyword detection to gather related content in one place, making it easier for fact-checkers to find it, but BIRN has reported before on the problems Facebook’s AI has in detecting content that violates its standards in languages other than English.

Once the content has been fact-checked, it receives a rating on Meta’s platforms, from ‘false content’ to content containing ‘some factual inaccuracies’ to content that implies a false claim without stating it directly. Such posts are not removed, but Meta reduces their spread and the advertising earnings that can be made off them.

“The content removed by Facebook is content that does not comply with its advertising policies, content that contains hate crimes, and posts related to terrorism from fake accounts,” said Emre Ilkan Saklica of Turkish fact-checking organisation Teyit. “We have no involvement there.”

Fact-checkers say this is frequently misunderstood, to dramatic effect.

“Fact-checkers do not have the technical or any other ability to remove content or ‘suspend pages’ and this is not at all what TPFC is about,” said Tijana Cvjeticanin from Sarajevo-based Raskrinkavanje.ba.

“Nevertheless, people who make money off spreading disinformation, toxic political propaganda or conspiracy theories (or, in some cases, people who genuinely believe such narratives) often publish outrights lies about the work that we do”, Cvjeticanin told BIRN.

“This has morphed into a form of harassment fuelled by false arguments like the made-up claims that we ‘surveil’ private profiles or that we censor, remove, or ban content on Facebook.”

No right to appeal for personal accounts

Illustration. Photo: EPA-EFE/ANDREJ CUKIC

In a BIRN questionnaire aimed at Meta users in the Western Balkans, Turkey and Greece, of all posts that respondents said were flagged as false, 21 per cent concerned public individuals such as politicians, journalists, celebrities, sportspeople or businessmen; 17 per cent concerned issues related to COVID-19.

Some two thirds of COVID-19 content that was flagged was shared by private individuals, while journalists were behind most flagged content concerning domestic politics and armed conflicts.

Some 15 per cent of flagged content reported by the questionnaire respondents concerned armed conflict, including in Ukraine, Yemen and Syria, while 13 per cent was about domestic politics.

Fact-checkers who spoke to BIRN said it is difficult to single out any one topic that triggers most fake news. But photos were more likely to be flagged than text articles; 41 per cent compared to 30, according to the BIRN questionnaire.

Meta directs fact-checkers to prioritise analysing content about the use or effects of medicine, products or jobs that could risk major financial loss, elections or crises or those targeting a particular ethnic, social or religious group.

One third of respondents said they didn’t remember the exact rating applied to their content; around a quarter said their posts were labelled ‘false’. Under Meta’s rules, most of these people cannot appeal since this is only possible for individuals if the post was shared on a page or within a group, not on personal profiles.

Almost half of respondents said they noticed their posts received less attention after being flagged; in 59 per cent of cases, the posts were later removed, apparently for violating Meta’s community standards.

Politicians spared much scrutiny

Illustration: Unsplash.com/Sergey Zolkin

In terms of media outlets, some appear keen to correct content flagged by fact-checkers given their sensitivity to the hit to their earnings if Facebook reduces their visibility.

Since joining Meta’s fact-checking programme in 2020, Darvin Muric, editor in chief at Raskrinkavanje.me in Montenegro, said the organisation began receiving “a dramatically higher number of corrections.”

“Media started correcting their inaccurate articles themselves and sending requests to correct the rating,” Muric told BIRN. “Media outlets sent us literally hundreds of such corrections, and recently they started sending us corrections for articles that they didn’t even share on Facebook.”

But, said Muric, it’s a different story when it comes to “individual pages, fake profiles, extreme right-wing portals, places designed to spread false news and hate.”

“They don’t use the options of appeal or correction,” he said. “They prefer to launch online campaigns targeting Raskrinkavanje.me editorial staff, journalists, or management.”

Currently, Meta does not apply such warning labels to the posts of ads of politicians, despite their clear role in spreading false information.

While fact-checking organisations continue to fact-check politicians’ statements in their regular work, Meta has rebuffed calls to include them in its ratings system. To do so would have a significant effect, said Cvjeticanin of Raskrinkavanje.ba.

“Statements from political actors often reach more people than other types of content, especially if the actors in question are skilled at using social media,” she told BIRN.

“If these statements contain false claims, particularly dangerous ones that promote conspiracy theories like QAnon and such, it’s important that people who see or hear them are also able to see the facts and accurate information about those claims.”

Meta justifies its approach as “grounded in its fundamental belief in free expression, respect for the democratic process.”

“Especially in mature democracies with a free press, political speech is the most scrutinised speech there is,” the company says on its website. “Just as critically, by limiting political speech, we would leave people less informed about what their elected officials are saying and leave politicians less accountable for their words.”

Muric points out, however, that people in the Balkans do not live in ‘mature democracies’ with a free press.

“Raskrinkavanje.me currently does not have a special section or newsroom that would check politicians’ statements,” he said, “but we analyse media articles in which false claims of politicians are transmitted without verification, or when biased reporting favours facts, positions and conclusions that fit a certain narrative, often without respecting the rule of contacting the other side.”

Azem Kurtic based in Sarajevo, Bosnia and Herzegovina contributed to this article.

As far as who runs the page and what the source of the money that was used to buy the Facebook ads on it, BIRN/Telex has been unable to find out officially. All that can be gleaned from Facebook’s public database is the number of Hungarian users who have administrative privileges to the page (there are three of them) and a phone number, an email address and a website through which they can be reached – supposedly. This reporter’s attempts to contact the administrators of the “Nem is Jámbor” page based on the information provided – by phone, text or email – were all in vain.

Although this particular Facebook page, which concentrates on discrediting Jámbor, stands out in many ways and is probably the most striking example of the phenomenon of such pages campaigning against opposition candidates, it is far from being the only one. By monitoring primarily political Facebook ads, BIRN/Telex has identified a total of 45 pages campaigning along similar lines during the run-up to the election.

Together, these pages cover 42 different parliamentary constituencies – i.e., 37 per cent of the country’s 106 constituencies. What these pages all have in common is that they invariably push pro-Fidesz narratives and that, despite a public database of Facebook ads that is designed to ensure transparency, it is impossible to know who exactly is behind them, who is maintaining them and – crucially – who is funding them.

This is adding to further worries about the free and fair nature of the April 3 election, which will pit Viktor Oban’s Fidesz against the joint six-party opposition, called United for Hungary, in what is expected to the closest election since 2010. Fears about the conduct of the 2022 election after 12 years of Fidesz rule has already led to OSCE election monitors being dispatched to Hungary – the first time Europe’s main security and rights watchdog will have conducted such extensive oversight of an election within an EU member state.

At the last Hungarian parliamentary election in 2018, the OSCE found that, “intimidating and xenophobic rhetoric, media bias and opaque campaign financing constricted the space for genuine political debate, hindering voters’ ability to make a fully-informed choice”.

Since then, little has improved. In the last four years, the state media has almost exclusively invited pro-government politicians to appear on its programs, while Hungary has fallen 19 places in Reporters Without Borders’ World Press Freedom Index.

What gives them away?

Taking the page “Nem is Jámbor” as an example, one might assume it is easy to spot similar pages, but that is not actually the case. Not all of these pages, for example, have been newly created. The oldest, “Otthonom Pécs” (literally, “Pécs is my home”), dates back to 2009, while most were created in 2017-18.

Furthermore, the pages’ aggregate of shared content, descriptions and titles are not always directed against a single figure of the opposition.

There are indeed a few pages that target an opposition parliamentary candidate in their very title. For example, one honed in on Bernadett Szél under the name “Ellenszél” (a pun based on the candidate’s name meaning “headwind”); another was called “Hiller István igazi arca” (literally, “The real face of István Hiller”). However, this tactic was uncommon among most of the pages we encountered.

More often, the page name refers to the area or perhaps a local landmark, such as “Vasi Srácok”, (“The Guys from Vas”), “Kaposvári Fricska” (“The Kaposvár Flick”), “A Tűztorony hangja” (“The Voice of the Fire Tower”, named after a landmark in Sopron), or “Tétény vezér” (referring to one of the Seven Chieftains of the Magyars and the 22nd district of Budapest).

Often, the name isn’t even directly related to any particular constituency, like “Csak Szólok” (literally, “I’m just saying”) or “A szomszédja már tudja – Ön is tudja meg” (literally, “Your neighbour already knows – You should know too”).

There are pages that are more concerned with generally bashing the opposition in their posts and often re-share content created by pro-government influencers aligned with government-allied organisations like Megafon Center or Aktuális Media, but there are also examples where, on the face of it, everything posted appears to simply be local pro-Fidesz news.

However, what ties the less obvious examples of attack pages to our first blatant example is that most, if not all, the Facebook ads on these pages over the last few months strive to discredit the opposition candidate of a particular constituency. Thus, the already well-documented campaign tactics on Facebook using a jumble of pro-Fidesz narrative and local attacks is now combining with another, lesser-known phenomenon of targeting individual candidates on Facebook pages, especially using paid ads.

It is important to note that while opposition-supporting groups also advertised heavily during the election campaign period, spending an average of half a million forints a month on their Facebook pages targeting the provinces, neither the pages themselves nor their ads were aimed directly at discrediting the government candidate of the area.

What’s the point?

Politicians and pundits alike have been arguing for some time that the key battleground of the 2022 election campaign would be Facebook.

The number of Facebook users in Hungary totalled 7.29 million as of February, making this social media platform by far the most widely used in the country. Alarmed by the power of Big Tech, government media allies attempted to create an alternative platform to deliver their messaging, but Hundub, the self-developed, conservative “safe space” that was supposed to replace the so-called ‘censoring’ Facebook, went out of business after just six months of operation and its owner was subject to enforcement proceedings by the tax authorities.

As research shows, several factors persuaded Fidesz’s communication advisors in 2021 to turn back to Hungary’s most popular social media platform to implement a centralisation strategy similar to the one the party carried out in the traditional news media segment since coming to power in 2010.

Although campaign spending in Hungary is capped by law, in practice this has no impact on platforms that are not officially linked to any parties or politicians. Consequently, the political sphere has almost completely outsourced online campaigning to a grey area, regardless of which side we are talking about. But if larger, well-established websites are already pumping out party political propaganda, what is the point of producing pro-Fidesz content specifically for smaller groups of followers, mostly ranging from a few hundred to several thousand?

If the focus of these projects was to build up a following, it could be argued that it is easier to engage locals directly rather than, say, for a broader propaganda page to target a nationwide audience. Some of the pages that are active in the smear campaigns also seem to be trying to exploit or build a kind of local identity in a way that is resolutely directed against the opposition alliance United for Hungary. However, this turned out to be rare among the pages that we came across, just as it is rare for defamatory pages to focus explicitly on addressing local issues. If the usual tactics of alarmism about the danger of the left or the drumming of pro-Fidesz messages were involved, they were simply adapted to the character, name or work of the opposition politician in question.

However, experts say there is a clear advantage in putting a local focus on paid advertising on these Facebook pages. Since the crosshairs of Facebook ads can be skilfully adjusted based on the geographic location of users, even with small amounts of money these pages can effectively engage potential – and, thus, impressionable – voters of particular opposition politicians.

How much spent in the last month?

The total spending of around 11 million forints (almost 30,000 euros) on these defamatory sites between February 17 and March 18 pales in comparison to the 1.2 billion forints (more than 3.2 million euros) that was spent to win over Hungarian voters on Facebook during the first month of the official campaign period. But considering how much easier it is to target a particular constituency with campaign messages, it is certainly surprising that, of the pages identified by BIRN/Telex as campaigning against an opposition candidate, 26 had a monthly expenditure of over 100,000 forints (more than 250 euros) and seven had a monthly expenditure of over 500,000 forints (more than 1,300 euros). These amounts would be sufficient for advertising targeted at the entire population of Hungary, not just at single constituency areas.

During this period the page “V-Akták” spent the most on Facebook ads at 1.6 million forints (almost 4,300 euros), but “Öreg Huszár” also spent over 1 million forints (almost 2,700 euros).

The underrepresentation of pages that do not spend on paid advertising on our list does not necessarily imply there are few such pages campaigning against an opposition candidate without advertising. Rather, the ones included are just those we happened to stumble across.

Ad libraries and dead-ends

So, if there is a definite benefit to putting a local focus on paid advertising on these Facebook pages and the cost of running the pages is remarkably low, then the next question is, who is behind all this?

Since Facebook, like other tech giants, has come under fire in the past for providing a platform for disinformation and political manipulation, in the spring of 2019 the US tech giant decided to make public who is spending on political and public interest ads, how much they are spending, and what kind of exposure they are getting in return.

Anyone can browse this data on Facebook’s Ad Library page, but as we saw in case of the page called “Nem is Jámbor”, this does not necessarily result in full transparency.

Although some of the information provided to register an ad account is generally made public – phone number, email address, website and, in some cases, even physical address – if it isn’t actually associated with any person or group, then critics say it is about as useful as Facebook blindly accepting – and proudly declaring – that the contributor of a given political ad was “Átvert Elek” (a pun resembling a Hungarian name that translates as “I fooled you”).

This is not a gross exaggeration. The ads on the page campaigning against opposition candidate Gergely Arató, which goes by the name X.ᴛʀᴀ, were paid for by “Team Gyurcsány” – the name of the former premier who is a party leader in the opposition alliance – and the contact information contains the address “contact@teamgyurcsany.com”.

Of the 45 pages identified as being defamatory in nature, 35 of them included telephone contact information. After going through the entire list, calling each number, it turned out that:

• Two of the pages provided the numbers of public payphones: “Kaposvár Fricska” was registered to the number of a payphone in Csombárd, while “Kommegmondó” had the number of a payphone at a gas station in Komárom.
• Eight of the numbers were no longer in use or at least didn’t ring when called, 12 of them were turned off, and of the 13 numbers that did ring through, four of them never picked up.
• Of the nine phone numbers that were active, two of them were owned by individuals who claimed to have no knowledge of the Facebook pages and no idea how anyone could have verified this contact information (either by call or text) when registering a Facebook ad account for a given page.
• In total, BIRN/Telex was only able to find four phone numbers that were at least able to confirm their existence and that the contact information was indeed associated with the given page.

Thus, only seven of the 45 defamatory pages listed a phone number through which this reporter managed to speak to someone who might be associated with the Facebook page in question. Upon learning the nature of our inquiries, five of them hung up almost immediately and proceeded to ignore all subsequent calls and texts:

• The number listed for the page “BalonKabat” was answered by a man who did not introduce himself. He claimed not to be affiliated with the page, but, somewhat suspiciously, hung up right after being told that, according to Facebook, someone had officially verified his number at some point.
• Our call to the number for the page “Fehérvár Hangja” was also answered by a man who introduced himself, but as soon as he heard mention of the Facebook page he hung up even before this reporter was able to finish the question. The number then became unavailable.
• We also managed to reach Gergő Bozóky – a familiar figure who back in 2020 ran for representative in a special election for the local government of Balatonszepezd. His campaign was notable for posters in Fidesz’s orange colour, the support of pro-government figures, and his team not being considered locals. Despite having given an interview to this reporter two years ago, this time he hung up and made the number unavailable when he realised the call was related to the Facebook page “BALfake – Soha többé Baloldal” (literally, “FAKEleft – Never Again Left”, or as a pun, “Twit – Never Again Left”).
• Our call to the number listed for “Palotai Poloska” was picked up by a woman who was not surprised to hear the purpose of our inquiry. She went so far as to confirm that the number was correct, but didn’t want to answer any questions. When asked whether it would be possible to talk to any of the other six administrators of the page, she hung up.
• Calling the number associated with the “Csak Szólok” page, a man answered who knew which page was being referred to. He said he was working at the moment and promised to call back later. He then hung up quickly. Despite contacting him again via text and email, he never replied.

Perhaps the two cases where BIRN/Telex made the most progress were those that led to local radio personalities.

We managed to get in contact with someone via the number provided under the page that was campaigning against Sopron city’s Koloman Brenner, “Tűztorony Hangja”. The man introduced himself and provided the phone number of a local public figure with the same name as a presenter on Radio 1. The man promised this person would be able to answer any questions about the page. From there, the story continued along the same lines as those mentioned above: the new contact didn’t pick up and the old one became unavailable.

The phone number for “Vasi Srácok” went through to a presenter for Hit Radio, who didn’t understand what we were talking about at first. Later, he called back and related a story about how, as a private contractor, he had helped someone launch a website and navigate Facebook’s advertising platform. As to who that individual was, however, he couldn’t say for reasons of client confidentiality. He claimed the page’s contact number was set to his private number in early February and never updated. He continued by explaining that he “didn’t deal with content or with ad launches” and his clients “didn’t provide much in the way of contact information anyway – perhaps an email address.” He asked what the issue was about the Facebook page in question – a page he considers merely “funny and humorous”. He promised that if he managed to get in touch with his client, he would pass along our contact details. This also ended up being a dead end.

Doing Fidesz’s bidding

There are several reasons to surmise it is not the actual opposition politicians that the defamatory pages are intended to discredit, but rather the six-party opposition coalition, United for Hungary, as a whole. In other words, these pages are not motivated by a personal dislike of the candidate, but are designed rather to work in Fidesz’s favour.

The most notable example of this is the page “Voksoló”, which was originally gunning for Miklós Gér. After he withdrew from the election, it switched immediately to targeting the new opposition candidate, Rebeka Szabó.

Then there is the page “Öreg Huszár”, which simultaneously speaks out against Márta V. Naszályi, the opposition mayor of Budapest’s 1st district, and Antal Csárdi, the opposition parliamentary candidate. And the page “Cívis Polgár”, which divides its ire between the opposition candidates of two constituencies in Debrecen.

Two outstanding questions remain: who has the time, money and energy to maintain a few unpopular pages that campaign against the opposition by focusing on specific constituencies? And is there any connection between the various pages that follow a similar logic.

What is certain is that, although these pages are clearly designed to bolster Fidesz’s election campaign, they are not officially a part of Fidesz and have no clear link to the governing party. Yet at the same time, it is also apparent that:

• Several defamatory pages are deeply integrated into the propaganda machine orbiting the government by resharing the content (and sometimes even repurposing it against local opposition candidates) of Megafon Centre’s pro-government influencer army (Megafon is an outfit that spends a lot on Facebook for ads of the pro-government influencers that it promotes. It remains unclear where the financing originates, though Megafon has previously denied having received public money).
• We uncovered a link between the contact information of two apparently different pages: the phone number for “Nem is Jámbor” (mentioned in the introduction) is identical to the one for “Tétény Vezér”, a page launched in 2017, which is currently campaigning against Endre Tóth (opposition candidate for the 21st district of Budapest).
• We also found an example of a page, “Salgótarjáni Aktuális”, currently being used as a defamatory platform targeting the opposition candidate Beatrix Godó, but which existed in 2015 under the name “Tibor Simon for Mayor”, a Fidesz candidate.

With respect to the page “Salgótarjáni Aktuális”, BIRN/Telex managed to contact Tibor Simon, who has since retired from party politics and now works as a government official. He informed BIRN/Telex that the page’s predecessor was created by his campaign staff when he was running in the special mayoral election for Salgótarján in 2015. As far as he knew, the page was deleted following the election, and he has had nothing to do with it since February 2016. According to Facebook’s public data, the page’s name was changed to “Polgári Salgótarjánért” (literally, “For a Civil Salgótarján”) in March 2016 and then to its current name in February 2021.

Ultimately, perhaps the most puzzling outstanding question centres on what the people and groups who run and fund these pages are so worried about. Why do they make themselves so inaccessible to the public? Why do they hide behind bogus Facebook pages, paid ad managers and untraceable phone numbers that become inactive or belong to public payphones?

Data was collected from Facebook’s public advertising database, the Facebook Ad Library. We reached out to all Facebook pages in this article that had placed paid ads. In the event the pages publicly displayed an active phone number, we contacted them both by calling and text. We also sent them our questions via email if the pages included such an address. For pages that only had the name of an individual as the advertiser and no contact details, we reached out to them via message on Facebook. However, at the time of writing this article, we had yet to receive any response to our written inquiries.

“Today, it is not uncommon for groups to hire attackers on the dark web who will do a certain amount of work for a certain amount of money,” said Metodi Hadji-Janev, associate professor of international law at the ‘General Mihailo Apostolski’ Military Academy in Skopje. “The fact is that cyberspace is an attractive channel for attacks with various motives.”

Cybersecurity analyst Suad Seferi told BIRN: “There is always the potential for far-right ideological threats in cyberspace. While they may be rare, they can still be very dangerous.”

From homegrown to state-sponsored

Illustration: EPA-EFE/SASCHA STEINBACH

Several global institutions have already felt the wrath of far-right extremism; in April 2020, far-right extremists published more than 25,000 email addresses belonging to major organisations such as the World Health Organisation, the World Bank, and the US National Institutes of Health.

The threat isn’t always homegrown.

Over the past couple of years, North Macedonia has been targeted by hackers in neighbouring countries, most notably a group calling itself ‘Powerful Greek Army’.

Two years ago, the group hacked dozens of e-mail addresses and passwords of employees in North Macedonia’s finance and economy ministry and the municipality of the city of Strumica.

Then in February this year, Powerful Greek Army struck again, this time targeting the North Macedonia’s education ministry.

Motives can vary – from political, ideological, to financial. Sometimes, it’s just about showing off.

“In the region there are these types of cyber incidents where the main goal of the attacker is to boast that they have successfully breached the defence systems of the governmental institutions of the targeted country,” said Milan Popov, a Skopje-based cybersecurity engineer.

“They usually deface the landing page of the institution to mark their presence. While institutions usually deny these attacks, in most cases they are indeed happening.”

There is also the state-sponsored variety, Popov told BIRN.

“China, Russia, and North Korea have been using them for different purposes from disabling the enemy’s major infrastructure to special operations to gather useful information. For example, North Korea mostly uses such attacks to finance itself with extortion from ransomware and all kinds of malwares.”

Big potential for cyber-attacks in the Balkans

Illustration: EPA-EFE/FELIPE TRUEBA.

In the Balkans, a region still grappling with the legacy of conflict, the potential for malicious cyber activity is enormous, experts say. Hacking groups from Turkey and Greece, for example, have frequently traded blows in recent years, with hackers targeting state institutions in either country depending on the issue of the day.

Far-right groups in other countries can capitalise on similar disputes to further their political goals, as Anonopsmkd tried.

“I remember that during the 90s there were similar cyber wars going on between Albanians and Serbs, when hacking was simpler and chaos could be created in most institutions with just a few clicks,” said Seferi, recalling the period when socialist Yugoslavia was falling apart and Serbs and Albanians were at odds over Kosovo.

IT systems used by state institutions today are much more advanced, but much still depends on their level of preparedness and the expertise they have to hand.

“The risks for state institutions are constant and they should be equipped with experts in that field that can help prevent such cyber-attacks,” said Seferi.