Online Threats Soar Ahead of Easter Holidays

Easter holiday triggered online threats in Serbia and Bosnia

Existing tensions in Serbia and Bosnia prompted a new round of online threats targeting journalists and top politicians in both countries. The attacks surged ahead of the Easter holidays in both countries where religious divisions remain as alive as ever.

On April 28, Teresa Ribeiro, OSCE Representative on Freedom of the Media, expressed concern about attacks on media staffers in Serbia following a rise in violent threats, verbal attacks and allegations of being foreign mercenaries and “traitors”. Ribeiro said: “I am increasingly concerned by the latest barrage of threats and tone of accusations against media workers in Serbia. Such targeted anti-media manifestations – which are all too often perpetrated in direct reprisal for journalists’ work – have a chilling effect, not only on their ability to serve the public in a democratic society, but also on their physical and psychological wellbeing.”


The head of the Bosnian Serb, Orthodox Church in Bosnia and Herzegovina Metropolitan Hrizostom conducts an Orthodox Easter service in Orthodox Cathedral in Sarajevo, Bosnia and Herzegovina, 28 April 2019. Photo: EPA-EFE/FEHIM DEMIR

In Serbia, on April 22, the inbox of the daily newspaper and portal Danas was flooded with threats reacting to the published quote, “Truth, not God”, attributed to Indian independence leader Mahatma Gandhi, published on the Instagram of their portal.

According to the Independent Journalists’ Association of Serbia, this was the sixth attack on journalists that week, just before Easter. On April 18, the email address of the N1 portal received a threatening email, which the editorial office called the latest in a series of threats sent to this media outlet.

In another case, criminal proceedings were initiated against a man accused of threatening President Aleksandar Vučić on Instagram on April 16.

In Bosnia, a song threatening the international community’s top official in Bosnia, High Representative Christian Schmidt, with death, was widely shared on social networks on April 20, including YouTube, where it has attracted several hundred comments.

The song was sung by protesters at a rally in the mainly Bosnian Serb city of Banja Luka after Schmidt used his executive powers to suspend a property law in Bosnia’s mainly Serbian Republika Srpska RS entity.

In another case, Žarko Kovačević, deputy mayor of Prijedor, insulted his fellow Catholic citizens on Easter day. “When I remember what the Catholic clergy did and are doing to the Serbs, how many victims there were under their blessing, it’s not just that I cannot congratulate them [at Easter], but they disgust me,” he wrote. Kovacevic’s Facebook profile is currently blocked, and no posts are visible.

Pro-Kremlin propaganda rages on in Hungary

The re-election of Prime Minister Viktor Orbán and his Fidesz party drew opposition claims that freedom and pluralism of the media remain at risk. The editor of the independent weekly HVG, Márton Gergely, accused the Fidesz party of winning by “lies”. He said: “It is quite certain that this election was won with lies”, adding: “Since the election, we have seen that Orbán and Fidesz will not step back from their path.”


Ukrainian President Volodymyr Zelensky answers questions of journalists during his press conference in Kyiv, Ukraine, 23 April 2022. Photo: EPA-EFE/SERGEY DOLZHENKO

A few days ago, Tilos Rádió, an independent radio station based in Budapest, learned that its broadcasting license would not be extended in September, following a decision of the Hungarian government.

A video, which began circulating on Facebook in Hungary on April 28, showed cocaine on Ukrainian President Zelensky’s desk. However, it was a montage and the footage has been altered. The white powder was added afterwards. No powder was visible on the table in the original video. The Ukrainian President was also victim of another slur when an article on an anonymous website falsely claimed that Zelensky called Hungarian people “disgusting”. The article has been circulating in Hungarian-language pro-Russian groups on Facebook.

Two different incidents of pro-Russian disinformation and propaganda also occurred in Hungary on April 19. In the first, András Kovács, a journalist for the pro-government news website Origo, shared a post from a right-wing site called Szamok complaining about “the murderous Ukraine regime” and about EU aid for Ukraine’s reconstruction. In a second case, an article from RT (formerly Russia Today), media outlet, banned in the EU, claimed that the notorious massacre in the town of Bucha, attributed to Russian forces, was not committed by the Russians. This reposted by two extremist news sites close to the Hungarian government, Vadhajtások and Szent Korona Rádió.

Cyber-attacks hit Romania and North Macedonia

Hacking attacks targeting websites belonging to public and government institutions continue to occur in many online environments. Macedonia and Romania’s digital landscape, in particular, are struggling to react to the continued cyber-attacks and computer fraud targeting their public systems.


Marcel Ciolacu (C), the new leader of Romania’s main opposition party, the Social Democrat Party (PSD), arrives at his party congress surrounded by coleagues at the Parliament Palace in Bucharest, Romania, 22 August 2020. Photo: EPA-EFE/BOGDAN CRISTEL

On April 21, the website of the North Macedonia Public Procurement Bureau was reportedly targeted by a ransomware attack, according to several online portals in the country. According to the reports, hackers demanded a ransom paid in bitcoin. However, the head of the Public Procurement Bureau, Borche Hadziev, denied the report, saying that there just was a technical problem, which took time to fix. According to this institution, because of the incident, all tender calls would be extended for several weeks.

Meanwhile, in Romania, just few days after the visit to Kyiv of the Prime Minister and head of the Chamber of Deputies, websites belonging to several key public institutions were hit by DDoS attacks. The attacks were soon claimed on Telegram by Killnet, a hacking group based in Russia. The hackers blamed the attacks on Marcel Ciolacu, the Chamber of Deputies’ President, who promised Romania’s “maximum assistance” to Ukraine. For about seven hours, users couldn’t access the websites belonging to the Ministry of Defence, the government, the Border Police and the railway company.

However, the attack was dismissed as the “work of amateurs” by Vasile Dincu, Romanian Defence Minister. He further added that the hackers didn’t compromise the databases or the command and control systems. “Such attacks exist on government sites even without an ongoing war. Our cyber security divisions are ready. Episodes like this are from amateurs. Some are institutionally orchestrated,” Dincu said.

How Online Violence Against Women Goes Unpunished

The harmful effects of online violence against women and girls, thus, exceed the issue of safety. Ultimately, this violence prevents women and girls from fully enjoying their human rights and hinders the achievement of gender equality.

Online violence against women takes many different forms: from harassment and intimidation to stalking, rape and death threats. New forms constantly emerge in the digital dimension. And while “doxing”, “trolling”, “sextortion” and “revenge porn” may be terms most of us have heard of, but aren’t sure how to define, studies have shown that over half the women and girls using the Internet have experienced these or other forms of online violence. Women and girls in the Balkans are just as exposed to digital forms of gender–based violence, but there remains a lacuna of research and statistics for the region.

Noting the significance of regional and context specific data – and the lack of it – as part of our efforts to detect digital rights violations in the Southeastern and Central Europe, we have analyzed over 35 instances of online gender-based violence against women and girls that took place from January 2021 to March 2022 in Albania, Bosnia and Herzegovina, Kosovo, Montenegro, North Macedonia and Serbia, which we collected as part of our Digital Rights Monitoring Database.

The selected cases demonstrate prevailing trends and contemporary forms of online violence against women and girls, which are worsening discrimination against women and hindering full enjoyment of their rights in the Balkans. They do not in any way represent the overall scale of violence committed against women in in the region. This is just a small piece of the puzzle that helps us to better understand trends and responses.

BIRN monitoring reveals six prevailing trends in which digital violence occurs:

  • Online attacks with clear manifestation of hate speech
  • Online attacks that follow domestic violence
  • Online attacks that lead to physical violence
  • Online attacks that include or lead to privacy breaches
  • Online attacks on publicly exposed women groups, in particular journalists and politicians
  • Online attacks on already vulnerable groups, in particular minorities, migrants and members of the LGBTQ community

Right to hold and express opinions v. Right to live free from violence


International Woman’s day March in Skopje in 2021. Photo: EPA-EFE/GEORGI LICOVSKI

More than half of the documented cases demonstrate a recurring theme of verbal harassment of women intertwined with sexist, misogynistic, degrading and disparaging comments, insults and threats, including threats of physical and sexual violence, rape, death and encouragement of others to inflict harm.

Triggers vary in nature. In some cases they are nonexistent, as some social media users deem it their personal right to share sexist, misogynist and hateful content and comments about women, regardless of whether the targeted woman is a public figure or not, and invite others to participate in their smear campaigns.

For example, in North Macedonia, a woman was subjected to a surge of hateful, sexist and misogynistic comments on social media after a news portal published an article about the amount of books she reads each year. According to the website, the woman read more than 438 books a year, which led to a number of hateful comments and mockery of her, personally, her family, her ability to be a mother, her professional record, etc. Most of the comments were posted on Facebook in the comments section on the pages where the article was shared and posted. The comments remained available despite their clear violation of Facebook’s community standards on hate speech.

Very often, discrimination and gender-based violence against women is incited and perpetuated by online portals that publish misogynistic, sexist and degrading articles about women. From tabloid to mainstream media, click-bait culture and lack of ethical standards, as well as poor (self) regulation, women and girls, through images and words, are subjected to violence and discrimination.

For instance, in two documented cases, internet portals in Bosnia and Herzegovina published articles depicting women’s physical appearance in a sexist manner with clear elements of “age shaming”. The articles resulted in further verbal harassment, ridicule, mockery, stigmatization and discrimination of the women by social media users in the comments section. In both cases, neither the media outlet nor the social media platforms removed the content despite their violation of journalistic ethical standards and community guidelines.

These two cases are not unique to the media landscape in Bosnia and Herzegovina; cases of misogynistic and sexist content published by media then going viral on social media with the surge of hateful comments are common in other countries in the region, too – with a similar lack of response from media or big tech companies.

Online violence against women as extension of domestic violence


A Bosnian woman looks at artist’s paintings in Sarajevo. Photo: EPA/Fehim Demir

In many cases, violence in the digital world is an extension of domestic violence committed by an intimate partner. Very often, domestic violence serves as a trigger for online attacks and gender-based violence. In Bosnia and Herzegovina, for instance, both news about a femicide and news about a victim reporting rape attracted misogynistic and offensive comments, with particularly concerning “victim blaming” and “victim shaming” comments from users who claimed that the victim “got what she deserved”.

Such comments reflect a prevailing attitude towards victims of domestic violence and sexual abuse in the region. This often pushes victims into self-censorship and silence, as they refrain from speaking out about the violence they suffered due to the concerns about prejudice and damage to their own reputation.

In many cases, online violence on social media is triggered by media reporting on domestic violence against women and girls. A BIRN investigation showed that media in North Macedonia still tend to sensationalise coverage of gender-based violence and point the finger of blame at the victim. According to research  done by the group Female Journalists against Violence, 27 per cent of articles in Serbia focused on domestic violence use sensationalistic or stereotypical terminology when describing a victim. The same report also showed that, in at least 40 per cent of the articles, the identity of the victim was revealed in the media. It often happens that, following this revelation, the victims are targeted on social media. In some countries, however, like Albania, Kosovo and Montenegro, domestic and a follow-up online violence has triggered protests in support of victims, as well as calls for stronger legislation to protect those exposed to violence.

When online violence moves offline


Kosovans take part in a march to mark International Women’s Day in Pristina, Kosovo, 08 March 2019. Photo by EPA-EFE/VALDRIN XHEMAJ

While the right to hold and express opinions applies to offensive and unfavourable ideas, this right is not unlimited. Incitement to violence, hostility or discrimination is not protected speech and cannot be justified under this right. Words and other forms of expression can and do lead to physical assault of those against whom the speech is directed. And while alarms would go off if this happened in the “real” world, when it comes to violence in the digital environment, many – in some cases including law enforcement authorities – regard virtual things as “not real”, as something that cannot inflict “real” harm. This seems to be the prevailing attitude even when threats of physical violence and assault are made online. However, online violence is not confined by the screen. The fact that in many cases online violence finds its way into the “real” world was demonstrated by a case in Serbia where, before physically assaulting a female gym employee, a man made online threats to her and even announced his plans to assault her on social media.

Furthermore, a case in which an unlawful action taking place offline was transferred and disseminated online, to subject the victim to further harm and suffering, demonstrates how online and offline violence are often intertwined and even dependent on each other to achieve full effect.

In another case in Serbia, a man was reported to the police for covertly taking intimate photos of a woman through the window of her home while she was undressing, and posting them online, violating not only her privacy rights and subjecting her to gender-based violence in the offline world but furthering violations in the digital environment as well.

Research also showed a correlation between online violence and human-trafficking, leading to increased cyber-trafficking of women, in particular during the global COVID pandemic. More than 40 per cent of female victims of human trafficking have also been subjected to some form of online abuse, according to a report by a Serbian NGO, Atina, looking at the correlation between the two. In interviews with 178 women and girls who received support from Atina over the past five years, 42 per cent reported being the target of online abuse, ranging from cyber-bullying, cyber-stalking, hacking, catfishing, revenge porn and “doxing” to online publication of private information intended to publicly expose and shame the victims. For 31 per cent of the interviewees, online abuse was directly linked to the process of human trafficking.

Explicit content sharing and privacy violations


A woman takes a picture of a contemporary art installation by Turkish artist Vahit Tuna that aims to raise awareness on women killed by domestic violence, in Istanbul. Photo: EPA – EFE

Online gender-based violence against women is often perpetrated through non-consensual accessing, manipulation and sharing of private information and content, including explicit content and photoshopped photos and videos that are sexualized or created with the intent to humiliate and stigmatize women.

In Bosnia and Herzegovina, a photomontage of a woman artist’s naked body was shared online and accompanied by sexist and misogynistic insults and mockery, done not only directly by the perpetrator but by his numerous followers as well.

“Sextortion” is a similar form of online gender-based violence. This refers to the use of digital means to blackmail a victim, usually involving the perpetrator threatening to release intimate pictures of the victim, or other content, in order to obtain more explicit content, sexual acts or sexual contact with the victim. Such forms of online violence against women have been documented in the Balkans as well. For instance, in Bosnia and Herzegovina, a man was reported to the police for “sexual blackmail” after he had been harassing a woman online for a long time, by sending her offensive messages and threatening to publish explicit images of her, if she did not agree to have a relationship with him.

A particularly worrying trend noted in the monitored countries is the sharing of explicit photos and videos of women, as well as their personal information, including their names and addresses, via social media, messaging apps and secret groups.

For example, a notorious Telegram group where users post and share explicit sexualized content about women and girls has been reactivated in North Macedonia. Alongside the photos, users share the addresses and telephone numbers of the victims, many of whom are underage. In a similar case in Serbia, chat groups containing explicit photos and videos of women and seeking sexual services were detected. Some of these chat groups were named after cities in Serbia, further identifying the location of the victims. Such cases do not only violate the privacy rights of the women and girls whose images and personal information have been shared; they pose a direct threat to their safety.

Female politicians are frequent targets


A Romanian masked woman plays in a street theatre act, meant to show women’s condition in Romanian society. Photo: EPA-EFE/Robert Ghement 

Certain groups of women are more often at the receiving end of online violence due to the role they play in society, or their public positions. Politicians, journalists, human rights defenders and activists are increasingly targeted, threatened and harassed, our monitoring shows.

Previous BIRN research showed that women journalists in the Balkans face online abuse on a daily basis. Most see little point in complaining to employers or the police, given the systematic failures to punish the perpetrators, according to the findings of a BIRN analysis. For the purpose of this research, we explored violence against a group that is prominent in terms of the number of online threats it receives – female politicians. In a large number of cases, female politicians are targeted by online threats that are generally misogynistic, sexualized and specifically gendered. This further institutionalizes patriarchal norms whereby most politicians in the region in leadership positions are male.

For instance, in Montenegro, three female members of the Democratic Party of Socialists, DPS, Drita Llolla, Amina Brahic and Nina Perunovic, were insulted and targeted with sexual harassment by a Twitter user. Similarly, a Montenegrin opposition MP, Draginja Vuksanovic Stankovic, was targeted with threats of physical violence and incitement to violence by a Facebook user. In both cases, although these threats violated the community standards of Facebook and Twitter, the networks failed to sanction hate speech in both cases.

In many cases where female politicians suffer online violence, their male counterparts are perpetrating the violence, further confirming power dynamics in Balkan politics whereby men take most senior and decision making posts and are the majority in the political and governance circles. For instance, in Bosnia and Herzegovina, Social Democratic politician Vojin Mijatovic insulted Sabina Cudic, a representative of the party Nasa Stranka, on the basis of her gender and repeated his insults on his Facebook profile. In a similar case, the Mayor of Zenica, Fuad Kasumovic, commenting on a presentation by a city councilor, Emina Tufekcic, said that she “deserved a slap for every word”. After other councilors condemned him for misogyny, Kasumovic insisted that he had not referred to Tufekcic herself but her party, the Party of Democratic Action, SDA. Tufekcic was not sanctioned for his attack, and his speech went viral, attracting further sexist and misogynistic comments and threats.

Cases of online gender-based violence targeting female politicians are particularly alarming as they threaten to undermine women’s political engagement, silence their voices and hinder their democratic participation. This correlates with studies conducted in Albania by the Ombudsman and Commissioner for Protection from Discrimination. These showed that women in Albanian politics still face routine discrimination, abuse and offensive language. Data analyzed by BIRN on online media coverage shows that sexist and derogative language was still being used against women in the last Albanian elections. Media coverage of women candidates in the election was also lower, compared to coverage of their male colleagues. A sample of some 6,900 articles analyzed by BIRN shows that 30 per cent of online media monitored had a clear gender bias. Data drawn from the monitoring showed that only 15.3 per cent of the political statements published by the media in their online sites came from women candidates as opposed to 84.7 per cent from their male colleagues.

Intersecting forms of discrimination


A Romanian young woman (L) takes care of her partner’s hair during the Gay Pride 2019 parade, in downtown Bucharest. Photo: EPA-EFE/ROBERT GHEMENT 

Women and girls who are subjected to intersecting forms of discrimination on other grounds, apart from gender, are particularly vulnerable to online violence. Women of colour and women who belong to religious or ethnic minorities are often targeted. For these women, gender-based violence in the digital world is intertwined with xenophobic, racist, misogynistic, sexist comments and hate speech.

The toll is particularly high for groups that already experience discrimination in society and are pressured on almost every societal level, – in particular Roma, refugees and migrants and LBGTQ persons. In a case in North Macedonia, explicit photos and videos of Roma women and girls were shared on Facebook, followed by insults, xenophobic and racist comments. In Bosnia, Antimigrant.ba, an anti-migrant internet portal, shared a testimony of an Afghan woman who was sexually harassed by a Croatian border police officer. The testimony was originally published by the UK Guardian, but the Bosnian internet portal misused the article and shared its own review of the story, filled with sexist, misogynistic, xenophobic and racist comments. The administrator and the editor of Antimigrant.ba portal, Fatmir Alispahic, was charged with inciting and spreading hatred through textual, photo and video content on several occasions in 2019 and 2020. However, in 2021, the Court of Bosnia and Herzegovina acquitted him. In Albania, the prominent LBGTQ activist Xheni Karaj and members of her association, Aleanca, have been exposed to threats and insults on social media and have also experienced  derogatory treatment from other media outlets.

Reasons for failing to protect


A woman holds a poster reading ‘Men Should Not Be Making Laws About My Body’ as pro-abortion protesters demonstrate at the West Hollywood City Hall in Hollywood, California, USA, 21 May 2019. Nationwide protests have activists calling for reproductive freedom and a halt to new laws limiting and criminalizing abortion services. EPA-EFE/ETIENNE LAURENT

As outlined, violence against women, including online gender-based violence, is a form of discrimination against women and a human rights violation that prevents women from fully enjoying their human rights, from actively participating in society and, ultimately, from achieving gender equality.

Our monitoring shows that online gender-based violence is growing in the Balkan region for four main reasons: inadequate legislation and an already poor institutional response to discrimination and hate speech; lack of response from big tech companies in implementing their own community policies related to digital violence; media enforcing gender stereotypes and failing to publish violations of professional ethical guidelines; and deep-rooted patriarchal norms on societal level that legitimize and normalize  violence and discrimination against women.

According to relevant regional and international human rights instruments, by which Balkan states are bound, states have an obligation to combat all forms of discrimination against women, including online violence, and to protect their human rights, including every woman’s right to live free from violence. Furthermore, states have an obligation to prevent, investigate and punish acts of violence against women and girls.

Despite their legal obligations, however, many Balkan countries, including those monitored for this study, have poor legal frameworks that do not adequately treat and sanction online violence and its perpetrators. Namely, domestic laws do not explicitly regulate online gender-based violence. Considering the scale of this problem and its detrimental effects on human rights, equality and participation of women, it is essential for countries to adopt specific laws or adapt existing laws to combat and prevent gender-based online violence and its contemporary forms, bearing in mind its continuing evolvement. Here, particularly relevant are violence against women and gender equality domestic legal frameworks, including family laws and laws on domestic violence, and applicable criminal codes.

Even when handling offline gender violence, institutions have a poor record. Criminalization of online violence against women and girls is essential to ensure a deterrent effect. States should criminalize all elements and forms of online violence, including subsequent re-sharing of harmful content. Members of legal and regulatory mechanisms, including law enforcement and prosecutors’ offices, need to be properly trained and equipped with knowledge, human and technical resources, including special divisions for digital crimes, to adequately and effectively implement the law, minimize harmful effects, sanction perpetrators and ensure prevention.

Just as the legal framework fails to regulate online gender-based violence, the laws of monitored countries do not contain provisions specifically regulating online hate speech either. The absence of words “online” or “internet-facilitated” does not and should not, however, prevent relevant authorities from combating online hate speech through the use of existing legal provisions, particularly criminal law provisions. Overall, while existing legal and institutional frameworks for combating hate speech in the Balkan countries seem robust in theory, their practical application is lacking. The rate of sanctioned incidents of reported hate speech is worryingly low, even when it comes to the instances documented in the “offline environment”. For instance, despite data indicating that hate speech in Bosnia and Herzegovina is on the rise, only 13 convictions for hate speech were issued by courts between 2015 and 2020, according to research conducted by Youth Initiative for Human Rights in Bosnia and Global Analytics as part of the project “Suppressing Hate Speech Through Empowerment of Youth”.

An additional issue is that laws regulating hate speech recognize only several protected grounds, and gender is not one of them. However, as BIRN monitoring shows, it is women and girls that are increasingly being targeted with hate speech and subjected to hatred, hostility and discrimination based on gender. Considering that authorities are obliged to uphold women’s rights and combat discrimination, they should interpret and apply laws in the light of contemporary trends and the issues that women and girls in the Balkans are facing, including, but not limited to, gender-based violence and hate speech.

The issue is not only limited to the lack of adequate legal frameworks or poor implementation.

One major obstacle to combating online violence against women is a general perception that online violence is not a serious crime and cannot cause serious harm. Such attitudes reinforce a culture of impunity and come with dire consequences. They send the message that perpetrators of online violence won’t suffer legal consequences, thereby encouraging further violence. Out of fear, loss of trust in the authorities and a sense of hopelessness, victims silence themselves, retreat from the internet and the public space, fearing consequences of their own exposure, and further exacerbating gender inequality and stigmatization of women in the Balkans. This is even truer in patriarchal societies where women are traditionally segregated and excluded from public life and where men dominate the narrative. Such societies favour men, as shown in elections where the dominant candidates are male and where there is a clear gender cap. It is the same within institutions.

Media also favour male candidates. But it doesn’t end there. The media also amplify violence against women by publishing articles that promote sexists and misogynist attitudes, by revealing personal data about victims of sexual, domestic and general gender-based violence, and by targeting vulnerable groups simply because they belong to certain groups. Although bound by respective ethical codes in journalism, self-regulation has not done much to achieve accountability in terms of unprofessional reporting.

The reasons for increased digital violence are not only internal. They are also external. Social media companies have proved to be great enablers for digital violence against women. The platforms, especially Facebook and Twitter, have failed to uphold their responsibility to protect women’s rights online by failing to adequately investigate and respond to reports of violence and abuse in a transparent manner, leading many women to silence or censor themselves on the platform.

Facebook has its own well developed policy rationale when it comes to hate speech and sanctioning this type of content. In reality, its moderators are blind to the violations of their guidelines in the Balkans. This also reflects the fact that the company has limited content managers who understand the local languages, and relies on mix of algorithms and the human factor. Previously, Facebook told BIRN that it primarily relies on AI to detect violating content on Facebook and Instagram, and in some cases take action on the content automatically.

According to Facebook, they “utilize content reviewers for reviewing and labelling specific content, particularly when technology is less effective at making sense of context, intent or motivation”. BIRN’s investigation shows that the tools used by social media giants to protect their community guidelines are failing: posts and accounts that violate the rules often remain available even when breaches are acknowledged, while others that remain within the rules are suspended without clear reason. Almost half of reports in Bosnian, Serbian, Montenegrin or Macedonian made to Facebook and Twitter are about hate speech. One in two posts reported as hate speech, threatening violence or harassment in Bosnian, Serbian, Montenegrin or Macedonian language, remains online.

When it comes to reports of threats of violence, such content was removed in 60 per cent of cases, and in 50 per cent of cases of targeted harassment. Distinguishing harsh criticism from defamation, or radical political opinions from expressions of hatred and racism or incitement to violence, requires contextual and nuanced analysis. In the absence of that, clear violations of social media networks’ community standards allow offensive and violent content not only to stay but to flourish.

Revisionism and Ukrainophobia Agitate Online Spaces

Killed Children’s Remembrance Day sparks online violations in Bosnia

On May 5, Sarajevo’s Day of Remembrance for Fallen Children was celebrated in Children’s Square in Sarajevo with parents and officials laying flowers and addressing gathered residents. The event was also attended by Sefik Dzaferovic and Zeljko Komsic, members of the Presidency of Bosnia and Herzegovina.

The Memorial to Children Killed in the 1992-1995 siege was inaugurated on May 9, 2009, in Veliki Park in the municipality of Centar, by artist Mensud Kečo. A year after its opening a pedestal was erected containing the names of 521 children, out of an estimated total of 1,621 dead.


A Bosnian woman prays on the 30th anniversary of the Bosnian Independence at a memorial to the fallen soldiers in the Bosnian War (1992-95), in Sarajevo, Bosnia and Herzegovina, 01 March 2022. Photo: EPA-EFE/FEHIM DEMIR

Three days after this year’s commemoration day, political analyst and psychologist Srdjan Puhalo wrote an article querying the figures used, titled: “Prove that 1,601 children were killed in Sarajevo or stop using that number”.

“The media in Sarajevo know that this number is not based on reliable research, but still transmit inaccurate information without any evidence. I don’t know why they do that, but in any case, it is not correct, professional, or fair,” Puhalo added.

Following the controversial statements, Puhalo was targeted by several insults and threats on Twitter.

Puhalo was also supported by film director Jasmila Žbanić however, who on May 13 on social media urged institutions to publish accurate data on the number of children killed. The director, who was backed by the Director of the Museum of War Childhood, Jasminko Halilović, and political analyst Ivana Marić, said she had since been exposed to “a wave of anger from those who disagree on the important truth”, adding that, “every child killed deserves to know his or her name and to know exactly how he was killed and who killed him!”

In her police report, she stated that some threats were sent from the Facebook profile of Haris Zahiragić, an MP. “Zahiragić put her name and picture in a false context and provoked a mob calling for a lynch with her lies,” she wrote. Another comment about her had read: “Žbanić should be killed as a matter of urgency”.

Fake news on Ukrainian President continues to go viral in Hungary

Following the April 28 episode of misinformation where Ukrainian President Zelensky was falsely accused of using drugs, online violations targeting Zelensky have not slowed in Hungary’s digital environment.

Disinformation campaigns and misleading news about Zelensky are now commonplace in several countries where social media channels linked to Russia and Belarus aim to destabilize digital environments.

Recently, Pro-Russia online operatives falsely claimed that the Ukrainian President had committed suicide in an attempt to undermine the Ukrainian government and deceive the public.

In an opinion poll launched by Statista, in May, about 65 per cent of Hungarian citizens expressed a negative opinion about Zelensky. This could reflect the disinformation campaigns that pro-Fidesz media outlets have started since the conflict began in Ukraine.


Supporters of Ukraine attend a counter-event against a pro-Russian rally held nearby in Budapest, Hungary, 30 April 2022. Photo: EPA-EFE/Zoltan Balogh

On May 10, an episode was recorded in Hungary where a picture of a weeping girl with a caption calling her the daughter of Zelensky spread among Hungarian Facebook users. The text circulating online says “Zelensky’s daughter” hates her father, who is a “fascist” and “murderer of the Ukrainian people”. However, the picture did not actually show Zelensky’s daughter. It was from a Russian-language video, available online since 2017, in which the crying girl complains that her boyfriend didn’t buy her a new phone.

A further episode of online manipulation occurred on May 16 in which Zelensky was accused of wearing a Nazi swastika. Several social media posts of Zelensky holding a soccer jersey with a swastika in place of a number went viral on Hungarian social media. However, after the detection of pixel discrepancies by AFP, it was found that the picture had been digitally manipulated by adding a swastika to an original photo that Zelensky posted last year, on June 8.

The caption read: “The new jersey of Ukraine’s national football team is special. It can shock. It features several important symbols that unite Ukrainians from Luhansk to Uzhgorod, from Chernihiv to Sevastopol. Our country is one and indivisible. Crimea is Ukraine.”

In polarised Serbia, online attacks on journalists keep going

Although Serbia has some of the most advanced legislation on the media, journalists are routinely threatened by political pressures, and by the impunity of crimes committed against them. In a highly polarised political climate, journalists remain subjected to political attacks instigated by members of the ruling elite that are amplified by certain national TV networks, according to RSF.


A protestor wears a mask while blocking the streets in front of the government headquarters during a protest against Rio Tinto’s plans to open a lithium mine in Belgrade, Serbia, 18 December 2021. Photo: EPA-EFE/ANDREJ CUKIC

Mina Delić, a journalist and photographer from Senta, in the northern province of Vojvodina, received a court summons over the environmental protests and roadblocks organized across Serbia in December last year. She was allegedly marked as a protest organizer because she had posted a call to a protest in a Facebook group. She was summoned to attend the Senta Misdemeanor Court on May 23, and if she does not respond or justify her absence, her arrest would be ordered.

Another case was related to a local government official who used Facebook to insult a journalist and the television station employing her, as well as an opposition activist. Zdravko Mladenović, president of Batočina municipality, posted insulting remarks about Zlatija Labović and Dragan Biočanin, a local opposition activist who Labović had interviewed. Mladenović said: “What else can you expect from such appearances, deserters, traitors, clowns and jukeboxes, to whom you insert something, and they play and sing when you press a button?” Last December, Mladenović also insulted the correspondent of H1 Television shouting: “Why are you filming?” and “You did not announce yourself to come,” expelling the journalist from the Assembly session.

Cyber-attacks and Russian-sponsored DDoS attacks target Romania and North Macedonia

Hacking attacks continue to be registered with alarming frequency in Romania and North Macedonia, where large public companies and institutional sites are targeted by groups that are often linked to Russia.

In the most prominent case of digital rights violations in North Macedonia in the first half of May, scammers targeted one of the biggest banks, NLB Bank and its customers, asking them for their personal data and accounts. The bank warned customers not to share any details with those asking for it, even if they say they are bank representatives.

In another incident, recorded on April 30, the Romanian National Cybersecurity Directorate said its own website was temporarily taken down by a DDoS attack one day after key public institutions in the country were hit by a wave of cyber-attacks claimed by Killnet, a pro-Russia hacking group. The DDoS attack blocked user access to the website for six hours.

A further incident occurred on May 1 when Digi24.ro, the most read news site in Romania, remained unreachable for some hours after a DDoS attack, later also claimed by Killnet. “The Mirai Team is causing massive damage to Digi24 servers. We are waiting for the next success,” the message posted on Killnet’s Telegram said.

Violent Acts and Sensationalism Distort the Web

Romanian Far-Rightists Storm Digital Environment

Following the rejection of the so-called “Sovereignty Bill” by Romania’s Chamber of Deputies on May 10, the political climate has further deteriorated.

The law initiative, signed by 23 MPs from the Alliance for the Union of Romanians, AUR, two from the Social Democratic Party, PSD, and two unaffiliated MPs, and which was on the list for a vote in the Chamber of Deputies, aimed, among other things, to extend the powers of the Intelligence service, empowering it to oblige civilians or companies, as well as public authorities and institutions, to collaborate with the institution.

Police officers secure the entrance from the protestors in the yard of the parliament during the ‘No Green Pass’ rally in front of Parliament building in Bucharest, Romania, 21 December 2021. Photo: EPA-EFE/ROBERT GHEMENT

On May 10, two AUR MPs live-streamed themselves harassing Alfred-Robert Simonis, leader of the Social Democratic parliamentary group in the hallway of the Chamber of Deputies. One of the two MPs, Dumitru-Viorel Focșa, as he left the plenary hall, threatened Simonis, telling him: “I will walk over your body. You are a bastard!” Following this, Simonis also hurled insults at the two MPs. This angered supporters of the far-right party, who further insulted and harassed Simonis on Facebook. Later that day, AUR politician also admitted threatening to beat Simonis

A second case saw George Nicolae Simion, leader of the AUR, storm his way into a media outlet. On May 18, after Virgil Popescu, the Minister of Energy, accused him of defending Russian interests in Romania, he live-streamed himself breaking into the newsroom of Digi24 news TV station. Two security guards accused him of forcing his way into the TV studio premises and called the police. Simion initially refused to leave but left after the arrival of the police, shouting: “The state authorities are at the disposal of Digi24. This is the headquarters of the SRI [Romanian Intelligence Service].”

Misinformation about Ukraine spreads in Hungary, Serbia

Since the Ukrainian war started in February, the digital environments in Hungary and Serbia have experienced increasing amounts of disinformation about what is happening there. Online violations involving propaganda and fake news have become endemic and routine. Hungary remains at the top of the list of countries with the largest number of such digital breaches.

Kyiv’s mayor Vitali Klitschko speaks with the press near the Monument of Friendship in Kyiv (Kiev) Ukraine, 26 April 2022. Photo: EPA-EFE/OLEG PETRASYUK

On May 15, news was published on several Hungarian-language news portals that McDonald’s had introduced a “neo-Nazi menu in Norway”. This referred to the so-called “Bandera burger” that the news portals said was named after the World War II Ukrainian ultra-nationalist Stepan Bandera. In fact, the name “Bandera” referred to the sauce in the hamburger, which recalled the colours of the Mexican flag and was inspired by a particular ingredient of Mexican cuisine.

A further episode of disinformation in Hungary occurred on May 30. After Ukrainian soldiers defending the Azovsztal plant in the port of Mariupol surrendered in May, a photo of an American admiral Eric Olson, shown among the prisoners-of-war, began to spread in the Hungarian social media. Fact-checking websites revealed that the photo was taken a month before Mariupol surrendered and was published on April 14 by the Russian state news agency Sputnik.

Hungary is not the only country where false news about the Ukraine conflict is spreading. On May 27, several news portals in Serbia also reported on an alleged statement by the Mayor of Kyiv, Vitali Klitschko comparing the war in Ukraine and the conflict in Kosovo.

Klitschko has since denied saying this. The news, which went viral in the Serbian digital space, reported an interview given by Klitschko to a Swiss portal in which he supposedly stated: “The Ukrainians will get rid of the Russians like the Albanians got rid of Serbs.” Klitschko also allegedly said: “I am very glad to have met an Albanian journalist for the first time, which is a good opportunity to convey a message to the Albanian people in the Balkans. We have heard and read that you Albanians, like us Ukrainians, are people of peace and freedom-loving. Today we are fighting the Russian regime that is trying to occupy our country, as you were once occupied by Serbia.”

Later that day, on his Facebook profile, the Mayor denied making the quote. “I did not comment on that. Even before they transmit such information and quote anything, journalists should look for audio or video evidence for such an exclusive,” Klitschko wrote.

Political tensions and discrediting strategies in Bosnia, North Macedonia

Ahead of the general elections on October 2, Bosnia has experienced an increasing number of party clashes and internal tensions.

“Bosnia and Herzegovina remain a country traumatized by war,” said Christian Schmidt, the international community’s High Representative, in a letter to the President of the UN Security Council on April 29. Outlining the main challenges ahead of the elections, Schmidt also said that the authorities of the mainly Serbian Republika Srpska entity have increasingly embraced rhetoric and actions that could undermine Bosnia’s constitutional framework and render state laws inapplicable.

The new High Representative and EU Special Representative in Bosnia and Herzegovina, German diplomat Christian Schmidt, looks on during his inaugural press conference in Sarajevo, Bosnia and Herzegovina, 04 August 2021. Photo: EPA-EFE/FEHIM DEMIR

On May 23, meanwhile, Alma Omerović, president of the Women of the SDA (Democratic Action Party) in Sarajevo, invited all voters to vote for her Bosniak party in the elections. Omerović who is also the president of the municipal assembly in Ilijas, insulted the vice-president of the Social Democratic Party, SDP, Denis Bećirović, who will be her opponent in the race for the Bosniak post on the three-member state presidency.

Omerović, who called Bećirović a “traitor” also declared an election “jihad” on social media. “Bosniaks, this is the jihad of our time,” she said on Facebook.

The statement drew numerous reactions, including from the US embassy in Bosnia. “Such a comment is contrary to the sincere commitment to inclusive and collaborative participation in government, for the benefit of all BiH citizens, which is exactly what voters in this country want and deserve,” the embassy said.

In North Macedonia, meanwhile, our monitors also registered a case related to political tensions. On May 25, several Twitter users, in order to discredit the local city government, shared a photo depicting a project that the city of Skopje is carrying out regarding an access ramp in one of its municipalities. The photo, however, turned out to be cropped and the circumstances of the project weren’t stated, which led many Twitter users to accuse the city authorities of not doing a good job on the project.

Albania’s Rama Savages Media Reporting on Child’s Death at Sea

Albania PM Edi Rama during a press conference following the Western Balkans Summit in Tirana. Photo: LSA

Prime Minister Edi Rama lashed out at local media after an off-duty police officer accidentally killed a child with his boat at sea, likening them to animals.

The death on Tuesday shocked the country, where many have been asking for more protection on beaches; this is not the first such case during this year’s touristic season.

Prime Minister Rama, after consoling the child’s family members, focused on attacking the media.

“Even in this case, the political-media animalism of those who wish and expect nothing but disaster to fuel the fire of their unjust and hopeless political war, was not missing!” he wrote on Twitter.

State Police late on Tuesday fired the entire chain of command of the local Directorate for Border and Migration of Vlora, “for not implementing additional measures to prevent incidents with watercraft in coastal areas”.

Communications expert Edlira Gjoni on Facebook said the Prime Minister should seek forgiveness from the media he had insulted.

“What about you, a prime minister that calls us ‘political-media animals’! That’s what we call you too … Get over the animalism and make your deputies deal with initiatives that save, no take, lives!” she wrote.

Citizens have called for a protest meeting at the Ministry of Interior under the motto “The boat did not kill her, the state did”.

Rama is well known for his battles with the media. Last month, when Albania faced another cyber attack, he attacked the media for reporting about it.

Media outlet Top Channel reported that Iran was behind the cyber attack, sending a political message to Albania, which is hosting around 3,000 exiled Iranians in Albania belonging to the People’s Mujahedin of Iran, MEK.

Reports also said the attackers demanded 30 million euros in bitcoin. But Rama denied the report of blackmail on Twitter, calling the news about the “demand for 30 million euros completely fake”.

On Twitter, on July 24 he asked: “Why does Top Channel continue to speculate irresponsibly, without any basis, proof, or fact, on the developments on the cyber war front? I don’t know.”

The relationship between Rama and the local media has long been fraught.

This year Rama ordered two journalists to undergo “re-education”, meaning that they don’t have the right to attend his press conferences or ask him any questions for a certain period.

This year, Albania fell 20 places in the latest press freedom index compiled by international watchdog Reporters Without Borders, falling from 83rd to 103rd place.

Reporters Without Borders said that journalists in Albania are targeted by organised crime groups and even by police violence and that the state is failing to protect them, while private media outlets are owned by businessmen who have links with politicians.

Albania’s Ministers Promote Private Social Media Pages Using Public Resources

Albania’s Prime Minister, Edi Rama, starts his workday at 8 a.m. on his Facebook page, posting photos or videos that foster an aura of optimism, often showing fragments of infrastructure projects from across the country.

Rama has turned his private Facebook page into the main communications channel between the government and the public; it has some 1.6 million likes and posts appear six or seven times a day. Each post gets hundreds of comments and thousands of likes.

Since 2013, the Prime Minister’s office has had another Facebook page, called Kryeministria. However, it’s a lot less popular, with just 3,500 followers, few interactions and no real public influence.

Rama is not the only member of the Albanian government to concentrate public communications in his private channels. Most of his ministers follow the same model; they have more followers and much more content on their personal pages than on the pages of the official institutions they lead.

Social media has been transformed over the last decade into a major political tool in elections; however, to be efficacious, they need to be fed continuously.

Data obtained through a Freedom of Information request also show that Prime Minister Rama and his ministers use public funds and resources and for this, alongside an extensive network of public employees, to produce content and promote their social media accounts.

By analyzing data collected by Crowdtangle, a tool developed by Facebook, BIRN discovered that the personal Facebook pages of Rama and his ministers are fed with far more posts, videos and lives than their institutional pages. About 98 per cent of the total interactions go to their personal pages, compared to just 2 per cent to their institutions’ pages.

The management of the digital communication channels of the Prime Minister, ministers, the Prime Minister’s office and the ministries is the responsibility of the Media and Information Agency, MIA, a body created amidst debate a year ago, which is led by his spokesperson, Endri Fuga.

Although the Socialist government’s communications through social media networks are not regulated by law, civil society groups accuse it of using public resources for political purposes.

“Ministers’ political profiles are supported by ad money from the state budget, while their official duties are later used as weapons to support their parties in election campaigns,” said Rigerls Xhemollari, from the Qëndresa Qytetare, an NGO.

Fuga, director of the MIA, told BIRN that the management of the content of the social media accounts of the Prime Minister and his ministers serves to inform the public. He dismisses suggestions that public resources are being misused.

“Employees of the MIA, including the spokespersons of the ministries, are engaged in producing content that is related only to the government duties of the Prime Minister and members of the government,” Fuga said.

“Their work serves the purpose of informing the public through the social networks about the government’s activities, not the personal or political-party activities of the ministers,” he added.

Private accounts much busier than public ones


Albania’s Prime Minister Edi Rama flashes a Victory gesture to the media as he casts his ballot at a polling station near Tirana, Albania, 25 June 2017. Albanians head to the polls on 25 June for parliamentary elections. EPA/MALTON DIBRA

The MIA was created in September last year through a decision of the Council of Ministers. It is responsible for providing transparency over the policies and activities of the Council of Ministers, ministries and any central government body.

The agency also produces government propaganda and manages and supplies the social networks of the Prime Minister, the Prime Minister’s Office, the ministers and their ministries with content.

MIA told BIRN in an answer to an FoI request that the content for the social networks of the Prime Minister and his office is the responsibility of four employees of the sector for informing the citizens, and is supported by the sector handling Design and Creative Product. The MIA did not divulge the number of employees engaged in this latter sector.

The MIA answer stated that the social network accounts of the members of the government and their ministries are managed by their spokespersons, supported by “structures responsible in each ministry”.

On Rama’s and his ministers’ pages on social media networks they often post personal statements or about their political or party activities, but the MIA insisted these are not their responsibility.

“The publication of posts of a personal character, such as opinions… are the responsibility of the Prime Minister or the ministers, while the publication of the activities or materials of political character and their publication on the social media accounts of the Prime Minister and the ministers are prepared and managed by their political staff, attached to the Socialist Party,” the MIA said.

The number of PR officers that work for the Prime Minister and ministers and their ministries is difficult to ascertain. However, a former ministerial adviser told BIRN on condition of anonymity that there are far more people engaged in this than the official numbers.

“Apart from the spokesperson, each minister has an advisor for media relations and three or four specialists that produce the content for social media,” he said, adding that part of the PR staff usually are paid formally for other positions not directly related to the job they actually do.

In the virtual world of the Facebook, the most popular social network in the country, the success of a page or profile is measured by the number of posts, shares or likes – which are counted as “interactions”.

Using data obtained through the Crowdtangle tool, BIRN discovered that the private pages of Rama and the ministers have an aggregate content and interactions that dwarf the activity of the official pages of the respective institutions. In this analysis, the private profile of Deputy Prime Minister Belinda Balluku is excluded, as she doesn’t have a page on Facebook.

Over a one-year period, the personal page of Rama and ministers together had some 8,801 posts while their official pages have some 5,342 posts. About 62 per cent of posts went to the private pages while 38 per cent to the official ones.

The private pages also had 53 per cent of the all videos posted on Facebook and 69 per cent of live transmissions.

However, the gulf is much wider when views or videos and interactions are also taken into account.

Data collected by using Crowdtangle shows that the private pages of Rama and the ministers together secured more than 15.2 million interactions during a one-year period, while their official pages had just 292,000 interactions. It means that some 98 per cent of the interactions went to the personal pages, compared to just 2 per cent to the official ones.

‘Historical memory ending up on mobile phones’


Albanian Prime Minister Edi Rama speaks to media as he arrives for an EU-Western Balkans leaders’ meeting in Brussels, Belgium, 23 June 2022. The progress on EU integration and the challenges which the Western Balkans countries face in connection to the Russian invasion of Ukraine are topping the agenda when EU and Western Balkan leaders meet prior a European Council meeting. EPA-EFE/STEPHANIE LECOCQ

The normal practice of Western leaders in communicating through social networks involves a clear division between their personal pages and the official pages of the public institutions, which carry most of the burden in communicating with the wider public.

In Albania, the strategy of the government effectively favours the individual pages at the expense of the institutional ones.

Afrim Krasniqi, director of the Institute for Political Studies, criticizes the practice of publishing official acts on social networks, claiming it has effectively “personalized” the state.

Krasniqi says there is cause for concern over the consequences this might have for the documentation of the government’s work.

“Historical memory is ending up on mobile phones or on the personal emails of officials,” Krasniqi said, providing examples of when official conduct was never properly documented elsewhere, except on the personal social media pages of the Prime Minister.

“From a legal aspect, this is a violation of the law, while from an administrative aspect, this is a violation of the rules; from a political aspect, this is an abuse of public office while from a historical aspect this is an investment against the memory of the state and the archives,” Krasniqi said.

Xhemollari, from Qendresa Qytetare, told BIRN that channelling official communications via personal Facebook pages is a reflection of the general practice of the current government, which is based on the individual and not on the institution.

“This communication philosophy creates a party state, individuals that are stronger than institutions, while at the same time it violates the election law and the ethical codes on communication and erodes the rule of law and the transparency of governance,” he said.

However, not all believe in a complete separation between the political leaders and the institutions in terms of communications.

Erla Mehilli, a journalist and former spokesperson of former PM Sali Berisha, told BIRN that while social networks should not replace official channels through which the state communicates to citizens, personal pages can be useful in sharing some informal moments.

Mehilli believes officials cannot be banned from using their personal accounts for official communications, though she also believes that some form of regulation is needed.

“It is not easy to separate the individual from the office that he/she holds. I am not aware whether any law bans an official from using their personal pages along with the official ones for communicating, even for official communications,” she said.

MIA didn’t answer queries from BIRN about what happens with the ministers’ personal pages once they leave office, and have the possibility of using social media created at public expense for their future political careers.

Fuga said the content doesn’t change and is not deleted from these pages. “Such content continues to be accessible for the public in these pages beyond the time of the holding of the office by a minister,” he said.

North Macedonia Ministry Denies Covering up Ransomware Attack


North Macedonia’s Agriculture Minister, Ljupco Nikolovski. Archive photo: mzsv.gov.mk

North Macedonia’s Agriculture Ministry has admitted that on September 12 it was attacked by the ransomware group BlackByte, previously known most for attacking key US infrastructure and agencies.

The admission came after the head of the agriculture committee for the main opposition VMRO DPMNE party, Cvetan Tripunoski, on Sunday accused the ministry of keeping silent about the attack.

The ministry has now confirmed some documents were compromised during the attack and its work blocked for some time, but it denied having lost any significant documents and data in the process.

“There has been damaging or decryption of data from office documents such as Word, Excel and PDF, while the applications of the ministry … were not damaged by the attack but were shut down as a preventive measure, and are now active again,” the ministry told BIRN on Monday.

It did not reveal what kind of data were contained in these documents that are among the most commonly used document formats in many public institutions.

It added that the ministry’s “archive is also [now] functional and works, without a single document gone missing or damaged”.

“From sources inside the ministry, we found out that a large part of the documents from ministry’s archive have gone missing,” Tripunovski said on Sunday, alleging that they had heard of data gone missing from the ministry’s register of farms, wine buyers, agricultural companies and organic producers.

The opposition official added that the register of active contracts for leasing agricultural land was also missing, as well as the list of ministry’s debtors and the documentation on all the administrative disputes that the ministry is involved in.

Tripunovski also gave the entire affair an unexpected spin by speculating whether the digital attack was for real, or a device to cover up crimes.

“The silence of the Agriculture Minister, Ljupco Nikolovski, casts serious doubt on whether this is even a hacker attack, or whether this was done to cover up criminal actions and misuses by the government of the Anti-Macedonian SDS [the main ruling Social Democrats],” he said.

The ministry on Monday said the allegations were “nonsense”.

Asked about why the public only found out about the attack that happened on September 12 in a press release on its website on Sunday, the ministry insisted that while the website had functioning properly all the time, it had informed the public about the attack on the day it happened, but only on its Facebook page.

According to research done by the online security company Trend Micro, published in July, BlackByte ransomware group has been building a name for itself since 2021 by going after “critical infrastructure for a higher chance of a getting a pay-out”.

The North Macedonian Ministry did not clarify whether the group demanded a payout, or if and how it responded to such demands.

BlackByte made its debut in July 2021, the research notes, adding that in Its first year of activity it garnered the attention of the US FBI and the US Secret Service, USS, for going after “at least three US critical infrastructure sectors, notably the government facilities, financial, and food and agriculture.”

The research notes: “At present, BlackByte continues to target organizations from all over the world. However, like LockBit, RansomEXX, and many other ransomware families, BlackByte avoids attacking Russia-based entities.”

The latest attack on a North Macedonian ministry comes after the country’s education ministry’s site was downed earlier this month, seemingly by an unrelated group of hackers, prompting North Macedonia’s National Centre for Computer Incident Response to urge all state institutions and companies to beef up their online security protocols against potential cyber-attacks.

It follows a spate of cyber-attacks on state institutions in Montenegro, Kosovo and Albania, which some observers suspect it might lead to a connection with Russia, which Moscow has denied.

Journalists from Greece Ask PEGA Committee to Check Their Devices

Photo: Lianhao Qu / Unsplash

Greek journalists and foreign correspondents in Greece have asked the EU’s Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware, PEGA, regarding protection of their devices. 

“After the revelation of the ‘Greek Watergate’ scandal, Greek democracy is in danger and the safety of journalists and any other critical voice is at stake,” their joint letter says. 

It adds that there is no trust in the Greek parliament’s in-house investigative committee, set up to investigate the state surveillance scandal, and asks PEGAs and the European Parliament to support them. 

The 24 journalists also call on the European Parliament to provide funding and facilities to check their smartphones and devices for wiretapping and any illegal or legal spyware, or use the existing EU cyber-security structures already available to MEPs.

According to the letter, the journalists who signed it are either directly related to the case, covering the scandal, or have suspicions that their phones may have been infected.  

The initiative was launched by Dutch journalist Ingeborg Beugel, a freelance correspondent who has lived in Greece for 41 years.

After a heated dialogue with PM Kyiriakos Mitstotakis at a press conference in November 2021, she experienced online and physical harassment, and had to leave Greece. 

“The whole letter is a statement. We journalists have grown tired of the Greek government’s words and promises. The rule of law is violated in Greece. We ask PEGA Committee to help us in practice,” Beugel told BIRN. 

Montenegro Seeks Foreign Help on Solving Attacks on Journalists

Montenegrin government session in Podgorica. Photo: Government of Montenegro

Montenegro on Thursday asked for foreign experts’ help in solving old cases of attacks on journalists. Minister without portfolio Zoran Miljanic said the government will continue to insist on solving these attacks.

“We already asked the US and United Kingdom for expert help in investigating old cases of attacks on journalists. Experts from the FBI and other foreign intelligence services will be hired as consultants to help Montenegrin authorities close the old cases of attacks,” Miljanic told a government session.

“Our key priority is solving the case of Dusko Jovanovic’s murder,” he added.

On May 27, outgoing Prime Minister Dritan Abazovic said the government was ready to ask foreign experts to help solve the failed investigation into the murder of Jovanovic 18 years ago.

Abazovic called on the Special State Prosecution to reopen the investigation, stressing that people who can still testify in this case should get the status of cooperative witnesses.

The editor-in-chief and owner of the daily newspaper Dan, well known for his opposition to the then government, was shot dead on leaving his office in Podgorica on May 27, 2004. He had received numerous death threats.

European Affairs Minister Jovana Marovic said there would be no media freedom in the country without solving these attacks.

“Political parties and state officials should also refrain from verbal attacks on journalists and media whatever the disagreements with their editorial policy,” Marovic said.

The government adopted the Commission for Monitoring Violence against Media’s report, which suggests including foreign experts help in investigations.

The report also said the Commission’s cooperation with Special State Prosecution and the National Security Agency and police has improved.

The Commission for Monitoring Violence against Media was formed in December 2013, led by Dan’s then editor, Nikola Markovic. He accused the former government of obstruction and of lacking the political will to clarify the attacks, saying the Commission had been denied access to relevant data.

After a change of power in 2020, the new government appointed new members of the Commission, stressing that it should cooperate with the authorities and propose concrete measures after investigations.

In its 2021 progress report, the European Commission called on the country’s authorities to step up efforts to effectively investigate, credibly solve and adequately sanction cases of attacks against journalists.

“The authorities should promote an environment conducive to investigative journalism and media freedom by promptly reacting to and publicly condemning hate speech and threats, and by refraining from exercising political pressure on journalists, including through their public statements,” the Commission report said.

On March 30, the US State Department’s latest human rights report said unsolved attacks against journalists as violence and harassment remained a significant problem in Montenegro.

Political and Ethnic Hatred Dominates Latest Online Breaches

Political figures targeted in many online spaces

The first half of September saw a flare-up of episodes linked to political motives in different countries.

Serbia, Hungary and North Macedonia are the countries where most such episodes were recorded. This only shows how divisive political clashes and rhetoric remain a major problem in the region.

On September 1, Serbian President Aleksandar Vučić and his sons received death threats via Instagram. A 47-year-old man from Zrenjanin was arrested on suspicion of committing the crime of endangering security in connection with the threats and was placed in pre-trial detention for 48 hours.


Serbian President Aleksandar Vucic attends a joint press conference with Turkish President Recep Tayyip Erdogan (not pictured) in Belgrade, Serbia, 07 September 2022. Photo: EPA-EFE/ANDREJ CUKIC

In Hungary, a deceptive video aimed at an MEP started circulating on Facebook on September 6. A video of a band playing a concert in the Parliamentary Assembly building of the Council of Europe was leaked on Facebook in Hungarian falsely claiming to be showing EU politicians “celebrating their salaries” to “Jewish music” – as European citizens face record energy prices.

In another incident, on September 8, a photo supposedly of former Estonian president and activist Mikk Pärnits wearing a women’s pink dress started circulating on Facebook in Hungarian. The image is actually from a 2020 awards ceremony, where the winner wore a women’s dress to raise awareness about domestic violence and sexual abuse.

North Macedonia is the country where the largest number of episodes have occurred. A photomontage of ex-Finance Minister Nina Angelovska, depicturing her with a plate of cake in the shape of a penis, was published on Twitter on September 2. The author wrote: “Dear viewers, this one was a minister in the cabinet of the bonehead from Murtino.”  The “bonehead from Murtino” refers to former prime minister Zoran Zaev.

In North Macedonia, on September 5, a Twitter user posted a print screen of news about a press conference from the President, about the recent security session. Above the print screen, an inscription read: “It occurred to the louse to say that we are bankrupt!”.

Finally, a last incident on September 9 recorded by our monitors saw former PM Zaev being insulted on Facebook, in which Zaev was quoted about a potential referendum. Facebook users used threatening and offensive words about Zaev, such as “Smelly”, “Idiot”, “Shit traitor”, “Traitor soul”, and, “Crazy monster, the only option for you is a knife or a razor and be cut piece by piece.”

Minority and LGBT communities systematically attacked online

Following Serbia’s government ban of the EuroPride 2022 celebration in Belgrade, where right-wing anti-LGBT groups also announced they would march through the Serbian capital, police arrested more than 64 people, after thousands of LGBTQI+ activists turned out for the march, despite the ban.

At the same time, activists and supporters of the LGBT movement, along with various ethnic minorities, were subjected to an increasing number of online attacks on social networks.


A participant during the EuroPride march in Belgrade, Serbia, 17 September 2022. Photo: EPA-EFE/ANDREJ CUKIC

At the end of August, for example, Serbian filmmaker Stevan Filipović and actor Viktor Savić argued on social media about the holding of the EuroPride in Belgrade. The argument ended a friendship of almost 15 years. After the debate, Filipović shared threatening and insulting messages from Savić’s supporters on Instagram.

North Macedonia also saw anti-LGBT incidents. On September 5, a Twitter account posted: “You open your timeline, and what can you see? all the faggots jumping on your dick from early morning. Fuck off, I have romance to tweet about, fuck you, you ass- fucking tribe”. Other users also used similar insulting and threatening words.

Meanwhile, both the country’s Albanian and Roma communities were repeatedly attacked and abused in North Macedonia’s digital environment. Most incidents occurred on Twitter. One user on September 2, addressing the Albanian minority, wrote: “Shiptars, hippers, who don’t pay electricity, don’t pay, will some cheap electricity be able to boil beans for us on Friday?” The following day, another user on Twitter published a post with a picture of a parking ticket from City Mall in Skopje written only in Albanian. Above the picture he wrote: “Boycott Skopje City Mall, they only give receipts in ‘shiptar’ language”.

“Shiptar” is a highly insulting term for Albanians.

Between 16 and 18 September, three different episodes were also recorded on Twitter. First, while sharing a headline from a media outlet that refers to the appointment of ambassadors from North Macedonia, a Twitter user wrote: “Shiptars are messing with the whole country” and referred to “servants of the Shiptar mafia”.

Another Twitter user, referring to reports that the state administration will be filled with Albanians from the diaspora, wrote: “We’ve returned the shippers from the diaspora”. Finally, another Twitter account wrote an offensive post with hate speech towards Albanians, saying that he does not know any country “that loves Shiptars as a minority.

Data leaks, hacking attacks and online scams also recorded

Serbia, Romania, Bosnia, Hungary, and North Macedonia were all hit by cyber-fraud incidents in recent weeks. In fact, cyberattacks targeting IT systems in the whole region continue to endanger many institutional and private actors due to the absence of a prevention system and a political strategy for this purpose.


A source code on a computer in Taipei, Taiwan, 13 May 2017. Photo: EPA-EFE/RITCHIE B. TONGO

On September 4, personal data of more than 500,000 citizens collected since 2008, such as names, surnames, addresses, emails and dates of birth, from a Serbian employment website called Lako do posla were leaked online.

Initial analysis by cybersecurity experts said the data may have been extracted from the database using a security vulnerability on the website. Meanwhile, the Facebook page of the Bosnian online outlet Gracija was hacked last September 7. The announcement of the new edition of the online media was changed into vulgar and misogynistic words. Editors immediately removed the content. Gracija reported: “The cover could have been the reason for this incoherently written insult”. It said it would not censor its content, however, to show what “dirty games” take place during the pre-election period.

In Romania, several online attacks also occurred. A media website from Vaslui, a county on the border with Moldova, was the target of a Flooding/Denial of Service attack. The attacks don’t seem connected, as the IP addresses involved in the attack on the local media outlet were mostly from Asia, while G4Media was targeted through IP addresses mostly from the US. The local media website was left unavailable for more than an hour during the DDoS attack. At the same time, on September 8, G4Media, a Romanian online media known for investigative pieces on the judiciary, was the target of a massive Flooding/Denial of Service DDOS attack. The newsroom said the unknown attackers were likely targeting an investigative piece on a probe into how the judiciary system silenced plagiarism accusations against PM Nicolae Ciuca.

In Hungary, UniCredit Bank issued a warning that fraudsters are acting as buyers for a product advertised on the internet and asking for the sellers’ banking details (internet banking ID/password/banking activation code) by referring to a mail order service.

The information they obtain is then used to make unauthorised credit card purchases and transfers. Another hacking episode was recorded in North Macedonia, where the website of the Ministry of Education and Science was hacked by a Greek hacker group.

The attackers posted their text on the website: “Hacked by the Greek hacker team Netwatchers”. After the attack, the ministry insisted citizens’ data was not at risk.

BIRD Community

Are you a professional journalist or a media worker looking for an easily searchable and comprehensive database and interested in safely (re)connecting with more than thousands of colleagues from Southeastern and Central Europe?

We created BIRD Community, a place where you can have it all!

Join Now