balkan insight Archives - Page 4 of 24

Kosovo Court Postpones Govt Decision to Close TV Channel

Posted on August 3, 2023August 17, 2023 by BIRD

Kosovo’s Commercial Court decided on Thursday to postpone the execution of government decision to close down privately-owned TV channel Klan Kosova by removing its business certificate until a final court decision is taken.

In its verdict, Kosovo’s Commercial Court said that Klan Kosova has fulfilled the legal criteria to continue operating.

“Since according to the certificates presented [to the court], it transpires that the plaintiff [Klan Kosova] has made the [required] changes in business registries in North Macedonia and Kosovo, the court assessed that postponing the execution of the contested decision does not conflict with the public interest,” judge Arnis Dumani said in the verdict.

The verdict also said that it would be “contrary to the public interest” and the media freedom guarantees in Kosovo’s constitution if it did not postpone the execution of the decision to suspend the channel’s business certificate.

The Association of Journalists of Kosovo, AJK, welcomed the verdict which it said allows Klan Kosova to stay on air “despite the government’s decision to shut it down”.

“The AJK will closely monitor further procedures, hoping that a swift epilogue will close this episode of the government attemptting to undermine freedom of media in Kosovo,” the AJK said.

The European Centre for Press and Media Freedom also welcomed the court’s decision, saying that “this interim decision protects media pluralism and counters the government’s attempts to undermine press freedom”.

The dispute started in June when news website Kosovanews published an investigation that suggested irregularities in Klan Kosova’s registration in Kosovo’s business registry.

The ministry then suspended Klan Kosova’s business certificate and initiated a criminal complaint against the company, its managers and officials from the Business Registration Agency on suspicion of misuse of office.

According to the decision, which was made public by the Association of Journalists of Kosovo, the ministry suspended Klan Kosova’s business certificate because the owners’ residential address is allegedly registered as “Peje-Serbia and Gjakove-Serbia… [which is] in violation with the basic principles of the constitution of the Republic of Kosovo”. Both towns are in Kosovo, not Serbia.

The Independent Media Commission, the institution responsible for the regulation, management and oversight of broadcasters in Kosovo, gave TV channel a month to correct the documentation, but on the final day, July 28, the ministry said that Klan Kosova failed to comply with the request.

Klan Kosova insisted on Monday however that it has corrected all the data in the business registry and accused the ministry of “fraudulently presenting a situation that does not exist”.

But the ministry said that its commission, which reviewed the case, acted in accordance with the law when it suspended the certificate.

“The commission decision closes this case within the ministry while the complaining entity has the right to take the case to the court,” the ministry said in a statement.

The ministry’s decision sparked angry reactions and hundreds of journalists and civil society activists marched on Monday to Pristina’s main square to protest, holding a banner with the slogan “Democracy dies in darkness”, calling the move to suspend the business certificate an attempt to curb the freedom of the media.

Anonymous Online Videos Target Serbian-Language Media in Kosovo

Posted on August 3, 2023August 3, 2023 by BIRD

The Independent Association of Serbian Journalists, NUNS on Wednesday condemned an online campaign targeting Serbian-language media operating in Kosovo.

Anonymous videos posted on a Telegram channel targeted news websites KosSev and Kosovo Online, radio stations Kontakt Plus and Kosovska Mitrovica and television station TV Most, claiming that they are pro-NATO, an intended insult.

The video posts said that the media outlets “persistently talk about how they are objective and ‘honest’”, but claimed “they have been broadcasting NATO and KFOR [NATO’s Kosovo force] commercials for years”.

The posts claimed that the media outlets’ aim was “to be financially rewarded for their ‘hard work’”.

KosSev was described as a media outlet that “defends Shiptar [derogatory term for Albanians] terrorists” and “works for the government in Pristina and for NATO”.

“NUNS points out that this is not the first case of the serious targeting and threating of journalists from the KoSSev website, and we call on the relevant authorities to investigate all the circumstances of this event and the threats that threaten the safety of all journalists in Kosovo,” NUNS said in a press release.

A separate series of anonymous videos was posted on social networks at the end of July, targeting journalists from N1, Nova and Danas, media outlets seen as critical of the Serbian government.

One video said that “their evil intention is to destroy Serbian identity, culture, tradition and religion”.

The head of the European Federation of Journalists, Maja Sever, called on the Serbian authorities on Tuesday to publicly condemn attacks on journalists.

“I have to admit that when I saw these videos, I was shocked. I can’t fathom how anyone could make something like this. Just because it’s on Tuesday in a semi-amateur way doesn’t mean it’s not very dangerous and scary,” Sever told Nova TV.

The European Union’s annual report on human rights and democracy in the world for 2022, published on Monday, said that in Serbia, “cases of threats and violence against journalists remain a concern and the overall environment for the exercise of freedom of expression without hindrance still needs to be further strengthened in practice”.

Turkish Journalists Feel Unsafe Because of Physical, Online Attacks: Report

Posted on August 2, 2023August 3, 2023 by BIRD

Turkey’s Media and Law Studies Association, MLSA told BIRN that its latest report shows that most journalists in the country do not feel safe at work.

“The report shows that, in addition to physical and judicial violence, attacks against journalists, especially women and LGBTI+ journalists, have increased on social media platforms,” Baris Altintas, co-chair of the MLSA, told BIRN.

According to the MLSA report, ‘Journalism in Turkey: I Do Not Feel Safe’, more than 80 per cent of the 57 journalists surveyed have encountered physical violence in the last five years and 79 per cent have been attacked online at least once during the same period.

“The most frequent form of violence that journalists face is insults and hate speech. This is followed by pushing and pulling and assault with tear gas, pepper spray, or other gas,” the report said.

The online medium in which journalists said they were most exposed to threats was Twitter, where 70 per cent of the respondents said they had experienced attacks.

A total of 87 per cent of the journalists surveyed said they do not feel safe while doing their jobs.

However, nearly 51 per cent said they feel very unsafe and only 1.8 per cent said they feel safe.

According to Altintas, the main reason is that the perpetrators are able to act without fear of prosecution.

“The root of the problem is impunity, as we have seen in other countries. Because the state and the judiciary encourage attacks on journalists, law enforcement agencies, security guards or online trolls see [they have] the right to do it,” Altintas said.

The report’s findings indicated that officials were involved in significant numbers of cases.

“The identity of 18.7 per cent of the perpetrators of threats and physical attacks was unknown to the survey participants. Of the perpetrators, 17.6 per cent were public officials, and 28.6 per cent were police officers,” the report said.

Altintas added that the state and the judiciary have rewarded some perpetrators instead of punishing them.

“For example, a police chief who sexually harassed an activist in front of cameras and did the similar to many journalists in the field was promoted last month,” he said.

The MLSA is a leading rights organisations working on the protection of journalists, press freedom, freedom of information and promoting the rights of oppressed groups including minorities and LGBT communities.

Kosovo Journalists Protest After Govt Suspends TV Station’s Permit

Posted on July 31, 2023August 2, 2023 by BIRD

Hundreds of journalists and civil society activists marched on Monday to Pristina’s main square to protest against the decision by the Kosovo government to suspend Klan Kosova TV’s business certificate, calling it as an attempt to curb the freedom of media.

Carrying a banner with the slogan “Democracy dies in darkness”, protesters called on the Ministry of Industry, Entrepreneurship and Trade to reconsider the decision.

“We see this decision as political and an interference in freedom of expression and freedom of the media in Kosovo,” said Nain Sadiku, a board member of the Association of Journalists of Kosovo.

“We ask the court to address Klan Kosova’s case in with right way, not being influenced by politics,” Sadiku said.

Klan Kosova has said it will take its case to court after the Ministry of Industry, Entrepreneurship and Trade three days ago rejected its complaint about the suspension of its business certificate last month.

But the ministry said that its commission, which reviewed the case, acted in accordance with the law when it suspended the certificate.

“The commission decision closes this case within the ministry while the complaining entity has the right to take the case to the court,” the ministry said in a statement.

The dispute started in June when news website Kosovanews published an investigation that suggested irregularities in Klan Kosova’s registration in Kosovo’s business registry.

Klan Kosova insisted on Monday however that it has corrected all the data in the business registry and accused the ministry of “fraudulently presenting a situation that does not exist”.

While Klan Kosova remains on air, the issue will be decided by a court after the TV channel announced it will file a legal complaint.

On Sunday, Prime Minister Albin Kurti intervened in the dispute, writing on Twitter that “following registration rules is a legal duty, not a ‘technicality’”.

“Enforcing such rules against a single violator does nothing to threaten media pluralism,” Kurti said.

“Media freedoms are vital: an attack on them is an attack on democracy. But democracy is also assaulted when powerful businesspeople break the law for financial gain. And enforcing the law against such people’s violations does not – in any way – constitute an attack on media freedom,” he added.

However, the Pristina embassies of the US, Germany, Britain, France and Italy in Kosovo – known collectively as the Quint – have expressed “deep concern” about the ministry’s decision.

“We are especially concerned that revoking Klan Kosova’s business licence is a disproportionate decision that will have repercussions on media plurality in Kosovo. The revocation of any media outlet’s license is a significant step requiring rigorous consideration,” the Quint said in a statement on Friday.

Turkey Fines Major Digital Platforms for ‘Challenging’ Family Values

Posted on July 27, 2023August 2, 2023 by BIRD

Turkey’s Radio and Television Supreme Council, RTUK, which monitors and sanctions radio and television broadcasts, fined various big digital streaming platforms on Wednesday for productions addressing LGBT issues and “normalising obscenity”.

“Not recognizing the boundaries of gender, sexuality and relationships, constructing an alternative ideal world based on gender, changing the universal family form, showing scenes of intense obscenity in detail, and normalizing all these and even defining them as ‘healthy’ were considered contrary to the principle of protecting the family,” RTUK said in its decision to fine Netflix over its series called “Anne”.

Other digital platforms fined by the RTUK are Amazon Prime, Disney+, MUBI, BluTV and Radio Virgin, again for productions promoting LGBT stories. RTUK has not yet specified the amount of the fines.

In the case of Disney+’s series “Love, Victor,” an administrative fine at the upper limit was applied due to the presence of “disturbing and morally objectionable behaviours” in one of its episodes.

The production “Modern Love,” aired on Amazon Prime, also received an administrative fine at the upper limit for containing scenes contrary to “the moral values of society and the principle of protecting the family”.

In August 2019, RTUK was given authority to oversee digital streaming platforms with a regulation change that increased government control. Following this, several fines were imposed on digital platforms in parallel with the government’s increased pressure and censorship of media and the internet.

RTUK plans an extraordinary meeting with the representative of digital streaming platforms in September. At the meeting, “the values of the Turkish family, national and moral values and the indivisible integrity of Turkey” will be explained to the platforms, RTUK announced.

‘For the Right Price’: Email Credentials from Serbian State Bodies Sold Online

Posted on July 27, 2023August 2, 2023 by BIRD

Late last year, reports surfaced in the online forum ‘Bezbedan Balkan’ [Secure Balkan] concerning the black market sale of email account credentials associated with a number of Serbian state institutions and public companies.

“Multiple sources” reported the phenomenon, said Ivan Markovic, a cybersecurity expert and co-founder of the forum.

“This means that someone, for the right price, was able to read through the official communication of the public enterprise Elektroprivreda Srbije [Serbia’s power utility] or [main gas distributor] Srbijagas, or send a message pretending to be from the National Employment Service,” Markovic told BIRN.

When Markovic and his colleagues dug deeper, they found that the email credentials of several public enterprises and state institutions had been compromised for more than a year and offered for sale for $100 or less.

The email accounts contained information on contracts, redundancy notices, bank statements, public procurement, and union meetings. Sale ads included screenshots of open email inboxes as proof for potential buyers.

Yet almost all of the bodies concerned told BIRN the reports were false.

According to Markovic and other cybersecurity experts, their failure to act only makes things worse.

“Black market platforms depend on their credibility and usually don’t sell fake data; those sellers who do quickly get sanctioned,” he said. “What’s more dangerous is that this data is sold multiple times to different malicious groups.”

Inbox of one of the email accounts offered on the market – Anonymous Source (Screenshot)
Ads selling addresses linked to public enterprise Beogradski vodovod i kanalizacija were the first to appear online. Since January 2022, at least four ads were posted, with their total value at $367,5. BIRN inquired about the incidents, but “Beogradski vodovod i kanalizacija” did not respond to our questions.

Ads for email accounts for Elektroprivreda Srbije appeared alongside other compromised addresses – Bezbedan Balkan (Screenshot)
First two ads offering access to email accounts related to Elektroprivreda Srbije, Serbia’s power utility, are posted on an online market. This, along with information on breaches for other public and private companies, was revealed in November on the Bezbedan Balkan forum, which analyses cybersecurity incidents.

Inbox of one of the email accounts offered on the market – Anonymous Source (Screenshot)
Ads continued to pop up throughout the summer. In September, at least seven ads were published, the most of any previous month. Their total value was almost $700. The screenshots of inboxes posted by the sellers indicated the legitimacy of the ads. They contained information on bank statements, public procurement plans, and union meetings.

Cybersecurity site detects malicious activity – Bezbedan Balkan (Screenshot)
Spam messages were sent from an IP address linked to Elektroprivreda Srbije. The same IP address was reportedly abused again several months later, for other malicious activities. At the time,the National CERT, the state body dealing with the prevention of cybersecurity incidents, said it had informed the institutions whose email accounts were suspected of having been compromised

Four new ads appeared between January and March 2023 – Bezbedan Balkan (Screenshot)
Ads selling access to email accounts of Elektroprivreda Srbije continued appearing online. In total, at least fifteen ads were posted since they were first published in March last year, which is more than for any other public company whose email accounts were compromised.

Inbox of one of the email accounts offered on the market – Anonymous Source (Screenshot)
Since December 2022, at least two ads offering accounts connected with state-owned Telekom were posted online. Their total value was $129. Telekom told BIRN it ran internal checks after information appeared online, but determined no accounts were compromised.

Inbox of one of the email accounts offered on the market – Anonymous Source (Screenshot)
One ad, worth $30, selling email address linked to public utility company Infostan appeared. BIRN inquired about the incidents, but Infostan did not respond to our questions.

Inbox of one of the email accounts offered on the market – Anonymous Source (Screenshot)
One ad, worth $30, selling email address related to the National Employment Service, was posted on the internet. The Service told BIRN it was not aware of email accounts being offered online, nor that it identified any incidents related to this. However, they said that email accounts of private citizens, not employees, on their platform did get compromised in the past.

Inbox of one of the email accounts offered on the market – Anonymous Source (Screenshot)
One ad, worth $85, selling accounts related to grid operator Elektromreža Srbije was posted online. Previously, another ad appeared in January 2023, offering data for $14. Elektromreža Srbije told BIRN they identified the incident, which was a result of a phishing campaign. It received information on this from the National CERT.

Inbox of one of the email accounts offered on the market – Anonymous Source (Screenshot)
An ad, worth $10, selling email account linked to public gas company Srbijagas surfaced online. BIRN inquired about the incidents, but Srbijagas did not respond to our questions.

Conclusion in the Commissioner’s report on the oversight – Bezbedan Balkan (Screenshot)
After being informed of the incidents in early April, the Commissioner for Information of Public Importance and Personal Data Protection initiated a review of Elektroprivreda’s information security and safety protocols. Taking into consideration the technical limitations of the review, as well as measures the public enterprise has in place, the Commissioner was not able to identify any harm related to personal data handled by the company. Responding to BIRN, Elektroprivreda Srbije dismissed the claims concerning the breaches as inaccurate.

Reluctant to report

Since January last year, according to Markovic, email accounts related to Elektroprivreda Srbija, EPS, have been compromised at least 15 times.

But EPS told BIRN this was untrue.

State-owned telecoms provider Telekom Srbije also said the email accounts of its employees were secure, as did the National Employment Service. Srbijagas did not respond to a request for comment for this story.

Only grid operator Elektromreza Srbije confirmed an incident involving a compromised corporate email account.

Alerted by the state CERT – the regulatory authority for electronic communications and postal services – to a case of phishing, Elektromreza Srbije said it “blocked the account, examined the activities on the system of the compromised user, changed the passwords and initiated additional training on information security and potential threats”.

CERT, however, has no authority to monitor the implementation of such security measures. That rests with the Ministry of Information and Telecommunications, which has just one inspector dedicated to the task.

Last year, leading cybersecurity firm Kaspersky tracked posts on the dark net offering access to compromised corporate data and found some 260,000 passwords, PIN numbers and other biometric data belonging to users in Serbia, though without identifying specific companies.

According to Kaspersky, the mere appearance of a corporate email address on the dark net, even without a password, already puts the security of the organisation in question at risk.

“The attack surface within its infrastructure increases as the number of potentially vulnerable targets grows,” Kaspersky told BIRN. “The public availability of corporate email addresses can pique the interest of cybercriminals and trigger discussions on dark net resources such as forums, messengers, onion sites, and more, regarding potential attacks on the organisation. Additionally, a corporate email address is more likely to be used for phishing and social engineering purposes.”

Kaspersky’s investigation also revealed a worrying lack of corporate preparedness and a tendency to deny claims that their protections have been breached.

This was also documented by the Serbian State Audit, which reported in xxxx that public enterprises and the state administration are reluctant to report incidents to CERT. A lack of awareness about whom to turn to and a fear of the hit to a company’s reputation are among the reasons why.

This is worrying, said Bojan Perkov, digital policy coordinator at SHARE Foundation, which works to promote and protect digital rights.

“Unauthorised access to email accounts and their abuse can be an entry point for other, far more serious attacks,” Perkov told BIRN.

“If the same combination of credentials – let’s say email, username or password – was used for multiple accounts, of which some contain highly sensitive information such as a large database with the details of private citizens, this can be quite damaging. The attacker can also continue to abuse the email address for phishing schemes and social engineering in order to gain further access to the system.”

Phishing for employees

It’s not only companies that are reluctant to admit to cybersecurity breaches. Employees are also often unwilling to admit they may have unwittingly compromised their employer.

“A member of staff said that she received an email, but did not click on it. But her computer was blinking,” an employee in the IT department of a Serbian public company told BIRN, speaking on condition of anonymity.

The case in question was phishing. A bot introduced itself as an administrator to a staff member, and the email she received contained a link which allegedly led the person to change the password.

“It took us a month to solve the problem,” the IT employee said. “First, the Outlook file, where the emails were stored, started duplicating her emails. Once that was fixed, suddenly she couldn’t receive any emails, then the ports would get mixed up, the configuration I set up would turn off. I thought we could just repair the file, but ended up taking down the entire system of her computer.”

The use of an official email address for private purposes is one of the most common mistakes made by employees in public companies and institutions, CERT told BIRN.

“This leaves them particularly vulnerable to phishing attacks and social engineering. Also, sending sensitive and private data via instant messaging apps, such as Viber and WhatsApp, can have similar undesirable consequences.”

Most email accounts of Serbian public enterprises sold on the black market used Outlook’s Web App.

“The problem with this, or any other webmail app accessed through a browser, arises when the user chooses the option for remembering the password,” said another IT employee at a Serbian public institution, who also spoke on condition of anonymity.

“The browser on the computer or laptop doesn’t have any additional protection when someone accesses their account through remembered credentials,” he said. “Once the computer is infected with a virus, the data will become available. And since most institutions attempt to network all their computers, the virus spreads really fast within the system and can collect their accounts.”

In the case of EPS, Markovic informed authorities about the compromised emails, but only the Commissioner for Information of Public Importance and Personal Data Protection took any action, he said. Limited in the degree it can inspect, the Commissioner also failed to find any issue.

“Given this outcome, we can only say that this problem is being ignored,” Markovic said.

Turkish Journalists’ Detention for Reporting Judicial Couple’s Transfer Condemned

Posted on July 26, 2023August 2, 2023 by BIRD

Turkish and international media organisations condemned the arrest of a journalist for reportng the new posting of a married judge and prosecutor couple who had previously jailed dozens of journalists.

Four other journalists were also taken into police custody for retweeting the news report. They have since been released.

“Raids and the detention/arrest of five journalists are unacceptable. This is an assault on media freedom and society’s right to access information. Journalists cannot be subjected to judicial harassment because of their work and become the target of investigations and raids for uncovering something wrong,” said the Coordinator of Media Freedom Rapid Response at the European Centre for Press and Media Freedom, a nonprofit that promotes and defends media freedom.

Evrim Kepenek, the last of five journalists taken into police custody in Istanbul, was released by a court on Wednesday with a judicial review measure and a travel ban, due to her retweet of a news report about the new posting of the married judge and prosecutor couple who had previously jailed dozens of journalists.

“You cannot prosecute Kepenek and other detained journalists. Journalism is not a crime,” the Journalists’ Union of Turkey, TGS, said on Wednesday.

The prosecutors’ office said the five journalists had targeted the couple and pressed charges of “marking counter-terrorism officials as a target”.

The arrested journalist, Fırat Can Arslan, a reporter for Mezopotamya Agency, MA, had covered a separate case involving 18 Kurdish journalists accused of “terrorism.”

He was arrested on Tuesday after he reported on the issue of the married judge and a prosecutor and having their work locations changed.

The other four detained for retweeting Arslan’s report and later released by the courts were: T24 news website reporter Sibel Yukler, MA reporter Delal Akyuz, journalist Evrim Deniz and Bia.net’s editor Kepenek.

Except for Arslan, all the journalists are banned from travelling abroad and have to visit police station on a regular basis.

Ozturan, of the Media Freedom Rapid Response, told BIRN that the detentions and arrests were no surprise.

“This comes as no surprise considering the long-term pressure targeting media freedom in Turkey which has been escalating especially since the beginning of the year. This pressure needs to stop and journalists need to fulfil their duties as witnesses of the time they are living in,” Ozturan said.

Media organisations and rights groups say that Turkey under President Recep Tayyip Erdogan has become one of the world’s worst jailers of journalists, also exerting pressure on the media through court cases, fines and prison sentences.

Turkey ranked 165th out of 180 countries in 2023 in the latest press freedom index issued by the watchdog organisation Reporters Without Borders, RSF.

Turkish Fraudster Seeks to Delete BIRN Investigation Into Citizenship Acquisition

Posted on July 26, 2023August 2, 2023 by BIRD

A representative of Turkish businessman Yasam Ayavefe – a convicted fraudster who was revealed in an investigation by BIRN and Greek media partner Solomon to have acquired honorary Greek citizenship via his political ties – has asked BIRN to delete its report.

He also urged BIRN to delete articles about cyberattacks that targeted the Balkan Insight website after the publication of the investigation.

“These kinds of posts affect the business life of my client [Ayavefe]. He has invested in so many countries and posts like this cause my client material and moral damage,” Bener Ljutviovski, who introduced himself as Ayavefe’s representative, told BIRN in an email.

His request for the removal of BIRN’s reports came after Turkish courts, in two separate judgments in Istanbul and Ankara, ruled that Turkish online media articles about based Ayavefe’s activities in gambling, crime and business in Cyprus, Greece and Turkey should be removed.

The Turkish court rulings said that Ayavefe’s rights had been violated by the articles, citing “the presumption of innocence”.

BIRN has confirmed that at least 114 news pieces about Ayavefe have been removed from Turkish websites as a result.

Ljutviovski also said that a case had been launched in Greece to ask websites to remove articles about Ayavefe, but after checking with judicial authorities in Greece, BIRN could not verify this.

Ljutviovski further claimed that Ayavefe won a case in Greece to have arrests removed from his criminal record.

He said that all this proved that Ayavefe “has nothing to do with these accusations” and that he was being accused “without any proof” of being connected to the DDoS attacks on BIRN’s Balkan Insight website and Solomon’s site after the publication of the investigation.

He called on BIRN to take down the articles in line with the Turkish court rulings although one of the judgments clearly stated that domestic courts cannot remove content of “foreign origin”.

“Please help us in this situation and let’s fix this without prolonging… We are open to suggestions from your side,” Ljutviovski wrote.

He appeared to offer BIRN financial incentives in return for compliance: “My client Dr. Yasam Ayavefe has advertising company, if you help us in this case we can provide advertising service to your organisation, so you can grow to bigger organisation. We would love to cooperate with you,” he wrote.

BIRN declined Ljutviovski’s offer and rejected his repeated demands to remove the articles about Ayavefe.

Ljutviovski sent a series of requests to BIRN, initially from an email address under his own name but then from an email address under the name Igor Stefanov.

BIRN and its Greek partner media outlet Solomon’s websites came under DDoS attack by hackers in 2022 following the publication of the investigation into Ayavefe and how he acquired honorary Greek citizenship.

Solomon said on Twitter at the time that honorary citizenship is “a state honour long reserved for those who have significantly promoted Greek culture”, but has been “turned into a golden visa scheme for those with deep pockets”.

The investigative outlet Inside Story first broke the honorary citizenship story in July 2022, triggering a fierce debate over Ayavefe’s suitability for such an honour. Inside Story also came under DDoS attack after publishing its report on Ayavefe.

Chatty Machines: Can AI Language Models Pass the Turing Test?

Posted on July 25, 2023August 2, 2023 by BIRD

As artificial intelligence, AI, continues its rapid advancement, language models are becoming increasingly sophisticated, capable of producing text that closely resembles human conversation.

Take the impressive GPT-3.5 architecture, which features models like ChatGPT, developed by OpenAI in San Francisco. However, as these models become more human-like, questions arise about their ability to pass the famed Turing test, proposed by the visionary mathematician Alan Turing, often hailed as the father of modern computer science.

Let us delve into the concept of applying the Turing test to Language Learning Models, LLMs, and explore the potential implications of this endeavor.

The Turing test, conceived in 1950, initially known as the “Imitation Game” serves as the gold standard for estimating a machine’s capacity for intelligent behaviour. In this evaluation, a human judge engages in a natural language conversation with both a machine and another human. If the judge is unable to reliably differentiate between the machine and the human, the machine is deemed to have passed the test. The emergence of language models like GPT-3.5 has sparked discussions about their potential to pass the Turing test.

Photo: Pexels

On a hot summer day, in the Centre for the Promotion of Science in Belgrade, we applied the Turing test. Guided by Danica Despotovic, a data scientist, and an expert from the Serbian AI Society (SAIS), our experiment involved 14 participants who were tasked to determine whether the answers to specific questions were provided by a human or a machine.

Evaluating LLMs using the Turing test requires careful preparation. Models like ChatGPT are trained on vast amounts of (our) internet data labeled by workers in low-income countries to generate text that mimics human conversation, but they supposedly lack genuine understanding and consciousness. Instead, they rely on patterns and statistical associations. Assessing their performance on the Turing test demands a comprehensive examination of their contextual comprehension, empathetic capabilities, and proficiency in engaging in nuanced, natural conversations. We must evaluate not only the quality of their responses but also their capacity to exhibit authentic human-like understanding.

To put ChatGPT to the test, Danica, our SAIS expert, provided the guidance to participants with selected prompts designed to challenge its capabilities. The following limitations that surround ChatGPT were considered:

Time-sensitive information: ChatGPT’s knowledge is limited to data available up until September 2021. Therefore, questions concerning events or developments after that time are beyond its reach. For instance, it cannot answer questions about the winner of the 2022 Wimbledon tournament.
Personal and subjective experiences: ChatGPT lacks personal experiences and emotions. It struggles to respond convincingly to questions asking for subjective opinions or personal perspectives. Questions like “How are you?” or “How does vanilla taste” or profound philosophical inquiries about the meaning of life or the nature of consciousness are challenging for ChatGPT.
Highly specialized or technical knowledge: While ChatGPT is well-versed in a wide range of topics, there are specialized domains where its knowledge may be limited. Complex scientific, medical, or technical questions might require expertise beyond its capacity.
Predictions and speculative questions: While ChatGPT can offer plausible outcomes based on available information, questions regarding future transportation dominance, the impact of AI on the job market, interstellar travel possibilities, and the outcome of conflicts and political disputes receive generalized responses. In all honesty, neither can humans provide better answers, but still…
Time-related questions: Queries about future weather forecasts (What will the weather be like next week?) or the specific timing of job application responses are beyond ChatGPT’s abilities..
Context: asking ChatGPT a question that requires it to be aware it is a part of the “imitation game” might lead to the chatbot to “hallucinate” in order to provide some answer.

Photo: Pexels

Armed with these and similar questions, the 14 human participants prepared for a tough battle. Amazingly, humanity emerged victorious –at least in that moment! In over 70 per cent of cases, our observing team members successfully distinguished between human and machine answers. Maybe it was a stroke of luck, but we had indeed equipped ourselves with every possible strategy to outsmart ChatGPT.

Now, let’s imagine a different scenario. What if we had asked less biased questions? Perhaps, in that case, ChatGPT would have passed the Turing test with flying colours. The implications of such an achievement are profound. It would blur the line between human and machine interactions, impacting fields such as customer service, journalism, and even interpersonal relationships. It will give rise to trust issues and ethical dilemmas, necessitating careful regulation and ethical considerations. Moreover, the widespread use of advanced language models will lead to the dissemination of misinformation and deepen societal divisions if not handled responsibly.

The application of the Turing test to language models opens up captivating discussions about the boundaries of machine intelligence and its potential impact on society. However, it is crucial to view the test as one evaluation metric among many, and a passing score should not be seen as an absolute measure of machine (non)intelligence.

As we navigate this technological frontier, we must approach the evaluation of LLMs with care, recognizing the complexities involved and placing ethical considerations at the forefront. By working toward responsible and ethical AI deployment, we can ensure that these powerful tools are developed and employed in ways that truly benefit society as a whole.

Branka Andjelkovic is co-founder and Programme Director of the Public Policy Research Center, a Belgrade-based think tank.

The opinions expressed are those of the author and do not necessarily reflect the views of BIRN.

‘Like Swiss Cheese’: North Macedonia’s Institutions Face Uphill Battle Plugging Online Defences

Posted on July 24, 2023August 2, 2023 by BIRD

From targeted DDoS attacks blocking access to key sites and data to the hijacking of entire websites and suspected theft of sensitive data, North Macedonia has experienced it all in the past few years.

The government and the Interior Ministry say they are hard at work strengthening defence mechanisms against such malevolent online players. The US and EU have jumped in to help as well, providing both technical and training assistance.

And, in late June, Interior Minister Oliver Spasovski said they had raised the salaries of employees in the ministry’s department of telecommunications and informatics and in the digital forensics section by 30 per cent.

“These people are really needed,” the minister said, admitting that the country as a whole must invest much more in boosting cyber security.

But while at central level the Interior, Defence and Information Society Ministries seem busy boosting security teams and shaping more capable teams of experts ready to offer competent response to threats, the more than 1,000 state or local government-run institutions, public enterprises and agencies, who are often the targets of such attacks, remain wide open.

“There, the situation is dire and harder to fix. For a long time, the issue of cyber security has been neglected in these institutions so their online presence and especially the issue of safeguarding it, have been an afterthought for the many heads and directors who often did not, and do not, understand the matter,” said Dejan Sokoloski, an IT expert and author of the IT.mk website.

As BIRN found out, some of these institutions lack any specialized IT security personnel and rely on just a few staffers to maintain their sites. Some have offloaded this work to private companies that often do not satisfy their needs.

“These institutions are often the first line of defence when it comes to preventing or intercepting cyber-attacks. If they had a secure and competently maintained web presences, we could say half of the job is done. But they don’t, so they are the weakest link – a ‘Swiss cheese’ of vulnerabilities and holes that need to be plugged,” Sokoloski added.

Photo by EPA/RITCHIE B. TONGO

Late realization of the threats

The Public Transportation Utility, JSP Skopje, is a public utility company under the City of Skopje that operates commuter bus services in the capital.

Among others, it provides online services to their commuters like buying tickets, and a GPS system tracks all the buses and informs users when the next bus will arrive at their station.

With just one successful attack, the transport system in the capital of more than half-a-million people could suffer greatly. However, the company told BIRN that while it has experts to maintain the system, it lacks specialized cyber security experts.

“We are constantly striving to upgrade our cyber security and the quality of our online services … and we hope that in the next city budget [for 2024] there will be funds to hire dedicated experts in IT security. So far, we’ve relied on help and instructions from the central authorities,” JSP told BIRN in a written response.

The National Information Agency, MIA, is in a similarly vulnerable position. This agency, which receives central government funds and was formed by a decision of parliament, was targeted by a DDoS attack in 2020 during the last parliamentary elections. Together with the Central Electoral Commission, its website was not functional for almost two days after voting day.

The agency still relies on a skeleton team of two general IT experts employed simply to maintain the website.

Photo by EPA-EFE/SASCHA STEINBACH

USB stick is all you need

Vladimir Stajovic, a cyber security expert who has been engaged in a private IT company from North Macedonia that offers its services to public enterprises and agencies, says such a qualified workforce that would answer needs does not exist yet in North Macedonia.

“The general population thinks all IT experts are the same and that they know everything, when in reality security experts are highly focused and skilled on this area alone – and are hard to find,” he said.

“We have many people employed in the IT sector, and that is our advantage if we want to invest in specializing some of them for security, but when it comes to existing security experts, they are mostly working abroad because the salaries there are much higher,” he explained.

Stajovic said a common misconception among clients is that they can quickly fix breaches and vulnerabilities after an attack has already happened.

“We’re not plumbers. We cannot fix a leaking faucet in five minutes in an apartment that has been neglected for decades and where the entire plumbing is rusty.

“The solution is much more regular maintainance of the entire system and updating and migrating the vulnerable files onto more secure and up-to-date platforms and servers. That needs a lot of programming, work, money and testing, and even then, nothing is 100-per-cent secure when it comes to cyber space,” he noted.

Stajovic says that, from his experience, many institutions in North Macedonia are so vulnerable that even a group of high school students could breach defences and wreak havoc in important organisations that employ hundreds of people.

Stressing the need to keep a constant guard and keep up with the latest threats, he mentioned the recent appearance of a USB stick available online for just over $100 US.

It sounds like something straight out of a spy movie.

“All it takes is for someone to physically enter an institution and put this stick in any USB port on any PC. The system falsely recognizes it as a normal peripheral, like a mouse or a keyboard, and then its malicious software, that may be programed for various activities like gathering data, deleting files or doing something else, starts working and can spread undetected,” he said.

North Macedonia’s Digital Society Ministry presented this year a plan for better and safer digitization of the administration. Photo by Information Society Ministry of North Macedonia

Not a hypothetical threat

North Macedonia is no stranger to cyber attacks.

To name just a few, in July 2020 a DDoS attack rendered the site of the State Electoral Commission useless for several days.

The attack delayed the announcement of the official results of tightly contested parliamentary elections, so the Commission had to improvise by releasing partial results through YouTube clips instead.

To make matters worse, the country’s most popular news aggregator, TIME.mk, experienced a similar attack at the same time.

Later that month hackers took down the sites of the Health and Education ministries.

In September 2021, a population headcount was marred by a slew of technical problems that forced many of the census takers to sit idle for days. Initially, authorities suspected a cyber attack but later said they had been misinterpreted. However, this only revealed the many weaknesses of all-too important systems.

In August 2022, the government’s site for public services, uslugi.gov.mk, was downed for almost two days.

Earlier, in February 2022, the Education Ministry reported another attack – but insisted that a video published on Twitter by a notorious group calling itself “Powerful Greek Army”, purportedly recorded by the ministry’s security cameras, was a fake.

Skopje. Photo by EPA-EFE/GEORGI LICOVSKI

Solutions must come ‘step by step’

North Macedonia has a total of almost 1,300 public institutions, data from the Information Society Ministry show. Most are in the area of education, healthcare, state administration, communal enterprises and culture.

Slightly more than half of these institutions are at a local municipal level while the rest come under the central authorities.

By time of publication, BIRN was not able to determine how many of them have permanently employed dedicated IT security stuff, or how many rely on private companies to do the work for them.

“We are at the forefront, so to speak, in this effort to boost cyber security across all of our state apparatus. We are aware of the acuteness of the problem but the solutions will come step by step,” said the Information Society Ministry.

It added that along with other government ministries they have already formed so-called quick response teams of IT security experts and that such teams are especially present within the Interior and Defence Ministries.

“Our particular part of the job is to also provide training and help to the many institutions you mentioned and that is underway,” the ministry informed.

“Trainings and communication for them are available, we are working on standardizing the platforms they are using in the online sphere.”

The Ministry also sees potential to speed up the process as many people employed in the country’s IT sector, if motivated correctly, could be trained in security.

So far, though, there is no projection about how much it would cost to train these new experts and motivate them to stay in the country for a better salary, or how long that could take.