Trump and COVID-19 Fuel North Macedonia’s Clickbait Boom

Elena used to dream that one day she would head her own marketing agency.

But then the COVID-19 pandemic slashed the company’s revenues and transformed her job into something completely different. Since May this year, she has been reassigned to translating stories from English and Serbian media into Macedonian, and from Serbian into English, adjusting the content to create short, sensationalist articles with headlines that will catch a reader’s eye imediately – clickbait.

“I used to dream of one day creating a campaign for [US fashion designer] Marc Jacobs, now I just translate articles from dawn until dusk,” said Elena. “My boss lady says it’s the same thing, it’s just being a content writer – but is it?”


COVID-19 conspiracies shared on a website named Torix.info that publishes in the Croatian language. The website is part of the interests Aleksandar Filipovski shared on his Facebook page along with other similar websites, such as the currently inactive, German-language Newcome.net and the Serbian language BalkanEkspres.com. Screenshot: Saska Cvetkovska

The articles that are created at the marketing agency where Elena works end up being published on various websites with the aim of generating revenue from Google Ads, as well as being posted to a range of Facebook groups to drive click-throughs. BIRN is not naming the company in order to protect the anonymity of Elena, which is not her real name.

Elena showed BIRN her corporate and private emails dating from May 21 to October 2.

“Just take a look at one day in the office. Total brainwashing bullshit,” she said as she showed hundreds of emails sent to the 18 employees who survived staff cutbacks in July and have now been reassigned to work on the clickbait content, which they call “the dirty laundry”.

Asked to explain why they call it that, Elena responded sharply: “As a professional I find there are no ethics in what we are doing. No professional challenge, nor any excitement. I just need the job desperately,” she said.

“As a feminist and bisexual, I do not feel comfortable creating clickbait posts for articles like ‘You have no idea what she did to her boyfriend when she found out he was gay. Now he is paying the price before God,’” she explained.

She said the agency’s staff were shocked that the company’s director was willing to get involved in clickbait publishing. They have never told been the identity of the client or clients who are paying for the stories they produce, and the exact relationship between the agency and the websites that publish the articles is unclear.

According to Elena, the director simply told them: “For now, we will have to adapt. This what makes money, I didn’t invent it, but there are people with huge businesses that work exclusively with Google ads. This is the reality now.”

Back in 2016, world media reported how more than 100 websites had been set up in North Macedonia to target US readers ahead of that year’s presidential elections, most of them pumping out bogus stories aimed as boosting Donald Trump’s candidacy. Amazement was expressed at how young Macedonians, thousands of kilometres away from the US, were making money out of fake news about the American elections.

Four years later, some clickbait sites based in North Macedonia are still pumping out pro-Trump stories. But now entrepreneurs and companies with no political agenda have got involved, seeing an opportunity to earn easy money by mass-producing sensationalist content about the US elections and COVID-19 that will generate revenue from Google Ads.

BIRN spoke to four marketing agencies in North Macedonia that are now involved in creating clickbait content for international clients; two of them also create articles for domestic websites. With the country’s advertising and marketing business hit hard by the pandemic, they see it as one of the only ways to stay in business.

US elections change the agenda

US President Donald J. Trump participates in a ‘Make America Great Again Victory Rally’ campaign event at the Richard B. Russell Airport in Rome, Georgia, USA, 2020. Photo: EPA-EFE/BRANDEN CAMP

Around 60 per cent of the content created by the agency where Elena works was clickbait material about COVID-19 – emotional stories about survivors, poignant statements from doctors in hospitals, what world leaders have said on social media, what celebrities do or don’t do to protect themselves from the coronavirus, plus conspiracy theories and articles about famous people who think that COVID-19 doesn’t exist. Other topics included politics, health and beauty.

The stories, mostly translated from Serbian or Croatian tabloids’ websites, were generally presented with misleading headlines written in capital letters: “This is how the client wants it, our boss just says,” Elena explained.

On September 6, an email from the director set out a new priority for the agency’s employees: the mass production of clickbait articles about Donald Trump.

“Guys, as you know the US elections are coming. We have follow the trends and increase advertisements on Google Ads. That is what everyone is reading now. Trump, Trump, Trump, just follow that and US domestic policy,” the email said.

On October 6, another email from the director on October 2: “Please follow Donald Trump’s Twitter, too. Especially now he has COVID-19. The client wants headlines adapted from the videos he shares. Try to get hold of tweets that are crazier, or the ones in which he mocks the liberals, i.e. his opponents,” it said.

Elena noted that the clients are not interested in having just any story on Trump, but prefer positive content. She and her co-workers were introduced to at least 20 Facebook groups with names like Trump for USA or Conservatives for Trump, which they were supposed to use as sources of content.

They were told they could use anything as source material for a clickbait article, even a meme. They were asked to deliver “at least 30 articles per day”, she said.

Elena said she saw at least five headlines she personally created were picked up by hundreds of other media outlets. She said she found the whole clickbait phenomenon disturbing.

“As a reader, I would not want the media and journalists to work like this,” she said. “As a marketing person, I never dreamed that we would do this. As a citizen, honestly, I find this a dangerous trend. This is becoming a big industry.”

Trump and the North Macedonian connection


The moto of TILT news is “conservatives uncensored”. Screenshot: Saska Cvetkovska

Among the suggestions that Elena and her colleagues were given for sources of content was a website named TiLT News, whose slogan is “Unfiltered Conservatism”. Her boss described it as a “great source, according to the client, aggregating the most important tweets and Facebook posts from US President Donald Trump”.

Some TiLT News headlines also took readers through to well-known US right-wing and pro-Trump sites like Breitbart News.

BIRN’s efforts to find out who is behind TiLT News led back to the notorious websites that operated out of the North Macedonian towns of Veles and Kumanovo during the 2016 US presidential elections, with the aim of affecting the outcome by targeting American readers with positive news about Trump and attacks on his opponent Hillary Clinton.

More than 100 websites with names like DonaldTrumpNews.co and USADailyPolitics.com were launched by a North Macedonian lawyer who was working with US conservative partners.

There is no data about the owner of TiLT News on the site due to protected anonymity, which can be bought for $15 a year from the Internet domain registrar and web hosting company GoDaddy. However, BIRN found that an email address that was used to register TiLT News, tamiterusa@hotmail.com, was also used to register some of the pro-Trump conservative clickbait websites in North Macedonia that were operating in 2016.

One of those involved was Aleksandar Filipovski, who in 2016 worked on producing pro-Trump articles on behalf of the US conservative lobby.

Links to Filipovski’s websites that were registered in 2015 and 2016 have since been removed from Facebook and Twitter. But his network of false Facebook accounts still exists, using PhotoShopped profile pictures that are hard to identify as modified fakes.

These fake accounts share TiLT News items to hundreds of US conservative groups’ Facebook pages, as well as to military veterans’ groups and other pro-Trump groups.

How the clickbait business works


In 2016, TiLT news published fake news claiming that former US President Barak Obama is an alien. At the time, the website was named the Tamiterusa blog. If you google TiLT news, you will only get results for Tamiterusa, most of which dates back to before the 2016 presidential elections. Screenshot: Saska Cvetkovska

To explain the clickbait business model, BIRN asked Aleksandar Velkovski, a 28-year-old bank official from Skopje who earns money on the side by running five different websites, three in English and two in Macedonian.

Velkovski said that after setting up their websites and paying the fee to keep their ownership anonymous, clickbait entrepreneurs need to acquire more than 30 fake Facebook profiles that they can use to promote their articles.

“Then [get the fake profiles to] join as many Facebook groups as possible because you’re not a real news brand, no one knows you and you just need the clicks so that Google Ads can work for you,” he said.


Silvi Trajanovska was an active profile in 2016. She has Macedonian friends, some of whom are fake profiles, but some are real. BIRN tracked her sharing and liking TiLT news, and became members in groups that share this and other conservative content but were not able to confirm whether this profile is real or not. Screenshot: Saska Cvetkovska

The fake profiles then post the clickbait articles in the Facebook groups. “From a group of 150,000 members, at least 30 per cent will click [on a clickbait link]. If the topic is currently ‘hot’, like the US elections or COVID, you can get around $100 to $300 out of one article from Google Ads,” he continued.

Velkovski doesn’t produce content himself, but orders it from various suppliers.

“I can pay a content provider for English news like $1,000 per month, and on top of that I have two more people from Skopje who I’m paying 400 euros each, and there is money left over for me as well. I’m not going to tell you exactly how much, but a bit more than double the costs.”


Silvi Trajanovska in one of the groups sharing TiLT news and other conservative news content. Screenshot: Saska Cvetkovska

Rosana Aleksovska, the director of F2N2, a fact-checking service that also investigates disinformation narratives, said that clickbait entrepreneurs are now not only promoting their sites using networks of fake profiles on Facebook and Twitter, but also now increasingly on Instagram and Telegram. “The bigger your social media platforms are, the bigger your earnings,” she said.

When it comes to disinformation campaigns, Aleksovska suggested that “most of this type of content is linked to conservative and extreme-right politics and opinions”. Some sites are ideologically-driven, some have murky connections to Russia. But other sites aren’t concerned about the politics of their content, she noted: “This is about money now, this has truly become a business.”

North Macedonia’s Media Ethics Council, an independent body, has been trying to address the issues of disinformation and political propaganda in media as well as pushing for transparency in media ownership. It runs the media transparency registry, where media ownership is listed, although disclosure is not compulsory under the law.

The council says it sometimes receives more than 100 complaints from the public each month.

“Most of the cases we receive are related to violations of Article 1 of the Code of Journalists, which refers to the publication of accurate and verified information, and in 39 per cent of reported cases this is the problem, while violations of Article 8 of the Code of Journalists, which refers to sensationalist information, were found in 35 per cent of the reported cases,” explained Katarina Sinadinovska, the president of the council.

‘Fake news’ and sensationalist stories are genuine worries for the public, Sinadinovska said: “You have a sea of unverified information, full of sensationalism, and we are not sure who makes the news anymore,” she pointed out.

Clickbait journalism as a career option


Illustration. Photo: Unsplash/Nick Morrison

Lila Karjlieva, a young Macedonian journalist, until recently worked for a website in the capital Skopje that pumps out clickbait articles. When she went for the interview, she was not expecting her first job in journalism to be the greatest in North Macedonia, but what she was told by her prospective employer surprised her.

“‘You’re young and there’s plenty of time for real journalism; this is content creation, a different kind of journalism’ – this is what Filip told me when I asked why we were working from home. You know, I was expecting a real newsroom,” Karjlieva recalled. “I had been following that website for about four years, and I thought real reporters worked there.”

The three owners of the site all have day jobs: one runs his own business selling hot dogs in the best-known mall in Skopje, another one owns a small construction company and the third one is a public servant, running social media for the director of Skopje’s state-owned water supply company.

They also run two other websites that aim to churn out as much content as possible, because the more articles they publish, the more the potential revenue from Google Ads.

“We were given sources, mostly Serbian tabloids like Kurir, Informer, Blic and others, and our job was to make the articles seem different than they were [on the newspaper websites] and put clickbait headlines on them,” Karjlievasaid. “We had a quota, like 50 articles in an eight-hour period, but it was so easy.”

In the current media environment in North Macedonia, ‘real’ jobs are almost impossible to find, and producing clickbait content is one of the few options for young journalists, she explained.

“If you are looking for a job in media, it is more likely for a young person like me to choose to work for a website like this one for six hours a day and a 450-to-500-euro fee. Working from home and just doing nothing but copy-pasting and adjusting,” she said.

“The alternative is to find jobs that are not really available in real media like TV stations or NGOs. I said to myself: ‘Why not?’ And these days I can say that many of my peers do not feel this is wrong, they want to be like my owners.”

She said she has seen how easy it can to make money from clickbait sites: “If I had been ambitious about this, I swear to you that in two years from now I could have been running 15 websites like this, employing five people and earning as much as any big-shot, politically-connected Balkan editor-in-chief,” she declared.

It is already hard to attract young people to work in the media in North Macedonia because it’s such a politically-dominated environment, and the rise of the clickbait industry could make the problem worse, experts believe.

Maja Jovanovska, a member of North Macedonia’s Association of Journalists who works on the issue of the lack of young reporters in the country’s media, said that there are more than 100 websites in the country operating on the clickbait model – purely led by Google Ads’ algorithms, with no editorial ethics or standards.

“People’s access to genuine information is being limited,” said Jovanovska. “This is how we influence people’s lives, by giving them poor-quality information.”

Conspiracy theories become profitable

Karatseva left the website two months ago, not long after the owners announced an editorial shift towards political and coronavirus-related news.

“They gave us a list of sources, mostly very questionable sources, from Russia and Serbia, and the US and Croatia as well,” she recalled.

“Domestic news was also included, we were told that we should do news not just about every comment that the minister of health made on live TV or on Twitter or Facebook or in the press, but also even from the comments made about him. That attracts readers, the management said.”

She showed BIRN some of the articles that the site has been publishing recently – some of them praising the authorities’ COVID-19 policies, others condemning them; some of them advocating the idea of protecting oneself from the virus, others pushing conspiracy theories about it.

Indeed, conspiracy theories have become profitable online content in the age of the coronavirus.

Vasko, Meglen, and Vera are all 21-year-old students from Skopje and their job is to translate conspiracy theories from YouTube or other video platforms. BIRN is not naming the company in order to protect their anonymity.

At the company where they work, the employees are divided into two teams: one team of makes transcripts of conspiracy videos from YouTube, while the second team picks up news ideas from the videos and writes short articles or social media posts promoting the conspiracy theory.

“The stories are [about the] ‘deep state’ – anti-liberal, anti-government no matter where, anti-NGO, anti-international institutions like the IMF, the UN, the EU, NATO and, most recently, mostly COVID-does-not-exist conspiracies,” Vasko explained.

He said he found the job four years ago through adverts on LinkedIn and Freelancer.com seeking content writers. Several of his friends, mostly students, also signed up.

“I can earn like $1,500 for like nothing, no brain involved. But I study philosophy and there is a pattern in what we translate. We do not know what the company does this for, but during the COVID-19 crisis I’ve noticed some of the headlines I personally created in some shitty English-language media,” he said.

The company is registered outside North Macedonia and creates clickbait content to order, mostly for right-wing libertarian clients.

“Sorry about this,” he said, “but we’re doing it for the money.”

Saska Cvetkovska is an investigative reporter and media freedom activist. She is a co-founder of Investigative Reporting Lab – Macedonia, an OCCRP member center that fights disinformation with investigative reporting that uses interdisciplinary approaches, including technology and academic research. She serves at the Board of Directors of the Organized Crime and Corruption Reporting project. She was a lead reporter on investigstive project Spooks and Spin — Information Wars in the Balkans, about how Macedonia became a haven for propaganda.  Saska has won more than ten domestic and international journalism awards. In 2018 she was elected by Macedonian journalists to represent them on the board of directors of the Association of Journalists of Macedonia, an organization that works to improve working conditions for reporters in the country.

This article has been produced as part of the Resonant Voices Initiative in the EU, funded by the European Union’s Internal Security Fund – Police. The content of this story is the sole responsibility of BIRN. The European Commission does not accept any responsibility for use that may be made of the information it contains.

Pandemic May Reshape North Macedonia Media Landscape for Good

In March this year, as COVID-19 shut down North Macedonia, Ivana Ramadanova was working from home on a story about textile workers being laid off when she got her own marching orders from the news portal Lokalno.mk.

Management told Ramadanova, 36, and three other journalists they would not be needed from the beginning of April. Ramadanova complained to the Labour Inspectorate, arguing she had been fired based on a termination agreement she never signed. But when the company was ordered to take her back, it did so on worse terms. Ramadanova found somewhere else to work.

“It’s a horrible feeling,” she told BIRN. “When someone needs you, you’re good, but at the very first sign of a crisis they get rid of you.”

Since the onset of the COVID-19 pandemic, advertising revenues in the media sector have nose-dived around the world, triggering a wave of job losses.

North Macedonia is no different, but the precarious financial state of many media outlets in the Balkan country even before the pandemic means some face a fight to survive. Coupled with new work practices to adhere to social-distancing regulations, the pandemic has the potential to reshape the sector like never before.

“We have a decline in advertising of about 70 per cent,” said Atanas Kirovski, director and editor of Telma TV and head of the Macedonian Media Association, MMA, which represents five television broadcasters with national frequencies.

“It is happening all over the world, and we are no exception,” he told BIRN. “Our business directly depends on the situation. If it takes two years, I do not believe that all media in the country will survive. If it ends earlier, they still have a chance.”

Aid package ‘helpful at the moment’

Two years is the timeframe the World Health Organisation has put on efforts to rein in the novel coronavirus, providing a vaccine proves safe and effective.

Few in North Macedonia believe the state has the resources to keep media outlets alive that long.

According to a survey conducted by the Independent Trade Union of Journalists, 73 per cent of respondents said they needed financial assistance, and 30 per cent said they knew someone in the sector who had lost a job in recent months due to the crisis.

Since March, the state has provided three million euros in aid to the media sector, in the form of direct injections and tax breaks. Of that figure, 1.7 million went to 116 broadcasters, including 500,000 euros to the public broadcaster.

For a period of three months, the state took on the burden of health and pension contributions for employees of media companies that had managed to avoid any layoffs.

Media outlets also benefitted from a blanket aid package for all companies in the country by which the government covered up to 14,500 denars [235 euros] of each employee’s monthly salary.

Kirovski said the measures had cut Telma TV’s financial burden by about 20,000 euros and that the company was able to make regular salary payments.

“The government measures are helpful at the moment,” he said.


Infographic: BIRN

Dangers of state support

That the likes of respected global media giants The Guardian and the BBC have announced job losses since the onset of the pandemic has sent shockwaves through the global media industry.

“When practically two symbols of quality journalism show that they cannot cope with the crisis, what remains for others?” asked Brankica Petkovic, head of the Centre for Media Policy at the Peace Institute in the Slovenian capital, Ljubljana.

While it is only normal in such circumstances that public and private media should turn to the state for help, Petkovic told BIRN, it is crucial that they guard their editorial independence.

This is particularly pertinent in North Macedonia, where the current Social Democrat-led government has yet to fully address the clientelism that characterised relations between the state and the media under former Prime Minister Nikola Gruevski between 2006 and 2016.

Mladen Chadikovski, head of the Association of Journalists of Macedonia, said the aid risked turning into a trap.

“When there is a state of emergency as it is now, whether it is officially declared or not, there are dangers of passing solutions that are problematic,” Chadikovski told BIRN. “We would not like to use this period to establish a media fund that would remain and create risks of influencing editorial policy.”

He said media would be better off receiving aid in the former of tax breaks rather than direct transfers from state coffers.

Aid can’t last long

Some media experts believe the recession triggered by the pandemic and the widespread closure of businesses may do what no government or regulator in North Macedonia has dared – cut the number of media outlets.

North Macedonia confronted the pandemic with an unreformed public broadcaster, 115 commercial broadcasting companies, 12 newspapers, hundreds of Internet portals and an advertising pie of about 15-20 million euros.

“The media scene is already in big trouble – many media outlets and a small advertising market,” said Chadikovski. “If the crisis continues, these problems will increase.”

Goran Mihajlovski, owner and editor of the portal Sakam da kazham (sdk.mk), said online journalism was particularly vulnerable. Registered as a non-governmental organisation, his portal also benefits from donor-funded projects.

“If we were dependent on advertisements, we would have not existed either,” he said.

Dejan Georgievski of the Media Development Center, which provides legal and advocacy support to media workers in North Macedonia, said the aid provided by the state was not a long-term solution.

“The aid cannot last more than a few months, half a year at most,” he said

Georgievski is one of only a few media experts in the country to say a reduction in the size of the media sector would not necessarily be a bad thing.

“Those who are lucky to survive will have more resources at their disposal that will help their sustainability and help them offer better content, better information, but also be less dependent on public money and free of any economic and other types of pressure,” he told BIRN.

Working practices changed


Illustration: Unsplash.com

The pandemic has not changed only the financial outlook for media outlets.

Social distancing measures have dramatically altered how journalists do their jobs.

“We have introduced work in shifts, so that if a colleague becomes infected and others have to go into isolation, the other shift can cover the work,” said Telma TV’s Kirovski. “But that meant that we always worked at 50 per cent capacity, while the other 50 per cent was on standby.”

Journalists at most Internet portals and some print media worked from home, encountering the same problems as those in other professions in balancing work and childcare. Smaller newsrooms struggled to adhere to government requirements that the parents of children under 10 years of age be exempted from work.

“I had to be a journalist, a babysitter and a mother at the same time, and the editor was not interested,” said one journalist, who spoke on condition of anonymity. “If I wasn’t online for 15 minutes he would immediately ask where I was.”

Movement restrictions and limited access to data and interviewees have hurt the quality of output, both in terms of content and technical quality.

“Of course it had an impact on the quality of work – the shifts are smaller, there are fewer journalists, editors, cameramen, editors available,” said Chadikovski.

Mihajlovski of Sakam da kazham said: “It’s not easy when you can’t go into the field, talk to people, but instead you have to work from a distance.”

Those who could not work from home or online paid a different price.

“We have to attend all the events, because of which we are constantly under stress, having even panic attacks,” said a journalist of a regional radio station who declined to be named.

Another, in Skopje, told BIRN: “I was talking to a mayor, who shook my hand to say goodbye. I returned the greeting so as not to be rude. A few days later, when he announced that he tested positive for the virus, I was in a terrible panic for the next two weeks.”

“Obviously one moment of carelessness is enough,” said Hristina Belovska, a reporter at TV 24 Television who tested positive during North Macedonia’s July parliamentary election.

“Our work is fieldwork and that cannot be changed. We were provided with protective equipment, we also had training on how to protect ourselves and recommendations not to put ourselves at risk. However, I ended up positive. I discovered it by accident and I do not know how it happened. It just shows how serious the situation with the virus is.”

In the survey conducted by the Independent Trade Union of Journalists, 22 per cent of respondents said they had not been provided with protective equipment.

Nothing will be the same

Ironically, given the financial strain on media, audiences have grown during the pandemic, with television broadcasters reaching twice or three times their usual number of viewers per day between January and June, compared to the same period of 2019 and 2018, according to surveys conducted by the Agency of Audiovisual Media Services.

For example, the percentage of respondents who said they had watched Kirovski’s Telma TV the day before, grew from 12 to 32.

“Undoubtedly, the fact that many people stayed at home and that something completely new was happening that affected everyone and that affected our daily lives, such as the spread of the coronavirus, contributed to a significant increase in media interest,” said Magdalena Davidovska Dovleva, head of the Agency’s Sector for Research and Long-Term Development.

It remains to be seen which of these changes will stick long-term, but all of BIRN’s interlocutors agreed the media landscape will be altered for good.

“The coronavirus has deepened the problems in the media sphere, but it may also help us find faster solutions,” said Petkovic of the Peace Institute in Ljubljana.

This project is financially supported by The Royal Norweigan Embassy in Belgrade. Opinions expressed in this publication do not necessarily represent those of The Royal Norweigan Embassy, the Balkan Trust for Democracy, the German Marshall Fund of the United States, or its partners. 

North Macedonia’s Ruling Party Won Twitter War in Election

Largely because the COVID-19 outbreak reduced classical campaigning and election rallies, the main political blocs at the July 15 early general elections invested serious attention in social media and in Twitter campaigns.

But what happened within the social network bubbles did not always reflects accurately real life, or the election results.

Despite being twice as active on Twitter, the ruling alliance led by the Social Democrats under Zoran Zaev, pulled off only a wafer-thin victory at the polls, winning 46 of the 120 seats in parliament, just two more than their right-wing rivals in VMRO DPMNE.

BIRN’s comparative analysis on the tweets of the party candidates and the use of their punchline hashtags, done with the help of SHARE foundation, reveals several characteristics.

When it came to their official hashtags, such as “We Can” and “We Care”, used by the Social Democrats, and “Choose Renewal” and “Rise Up Macedonia”, used by VMRO DPMNE, the former were clearly dominant, for example. Ruling alliance hashtags could be seen on more than 5,600 tweets. Those of the opposition were found in just over 2,100.

Yet their strategies were very similar, with party leaders and the electoral lists’ heads in the six electoral districts posting the initial electoral propaganda, and sympathizers disseminating it.

Only some party sympathizers used their personal profiles with their names clearly displayed. Most posts were retweeted by profiles using pseudonyms or just codenames. Thus, one assumption is that these were automatized profiles, or bots.

One difference between them was that the posting of tweets was more evenly spread in the ruling party bloc.

While Social Democratic leader Zaev led the process, much of the party’s communication also originated from other prominent figures, such as Foreign Minister Nikola Dimitrov, Vice Prime Minister Mila Carovska, Defence Minister Radmila Shekerinska, provisional PM Oliver Spasovski and others – most of them leading the lists of candidates in the six electoral districts.

In the opposition bloc, most of the traffic originated from the profile of the VMRO DPMNE leader, Hristijan Mickoski, or from the official party twitter profile. Compared to these two, the activity of the other opposition party officials was negligible.


Illustration depicting the twitter interactions between the two political blocs: BIRN

While most Twitter posts on Zaev’s profile referred to the alliance’s own campaign points and promises, some 10 per cent were reserved for negative campaigning against the opposition.

Among these negative posts, most suggested that if VMRO DPMNE came back to power, it would mean a “return of the regime” – referencing the authoritarian government of former VMRO DPMNE leader and former prime minister Nikola Gruevski.

Most of the tweets from the profile of opposition leader Mickoski also focused on election promises and on parts of the party’s manifesto. But about 13 per cent of tweets were devoted to attacking the other side.

The most common tweets attacking the Social Democrats referred to alleged “crimes” committed by Zaev, mostly drawing on connections to the high-profile “Extortion” trial in which the former head of the Special Prosecution, SJO, Katica Janeva – once strongly supported by Zaev – and others were found guilty of extortion.

Other posts accused Zaev of undermining the national interest by presiding over important friendship deals with neighbouring Bulgaria and the historic “name” agreement with Greece.

The analysis shows that nine of the ten most shared posts during the campaign were those of Social Democratic officials, with Zaev’ post sharing the official video commercial of their campaign, in which the party says it has achieved a lot and can do even more, being most shared.

The opposition leader posted the tenth most shared post as well. In it, he shared a video advertisement in which he implored young people to stay in the country and to “fight for Macedonia”.

Analyzing overall Twitter communications during the election campaign, Zaev’s name was mentioned most often. His profile was mentioned in 3,100 posts, while that of the opposition leader Mickoski was mentioned in 1,580.

Despite the bitter electoral war waged on Twitter by both blocs and their supporters, neither bloc got exactly what it sought.

Zaev did not win a comfortable majority for a new government to accomplish his promised changes.

Mickoski also failed to persuade enough voters that it was time he took over and started to “strengthen the spines” of the country’s supposedly humiliated citizens.

North Macedonia Editor Faces Charges of Revealing Official Secrets

Media unions and watchdogs in North Macedonia have said they want to look into why a news portal editor has been charged with revealing official secrets.

The owner and editor-in-chief of Ekonomski Lider news portal, Ljupcho Zlatev, is accused of publishing two articles in July in which he has revealed classified documents from the former Directorate for Security and Counterintelligence, UBK, which was recently been transformed into Agency for National Security, ANB, and which he obtained illegally. He faces up to five years in prison if found guilty.

The two texts, published on July 9 and July 12, refer to a former employee of the now-defunct UBK who did not pass the security checks needed to transfer into the newly formed ANB.

Allegedly, this was because his father had participated in street protests against the change of the country’s name, which parliament had approved in early 2019, as part of a historic agreement with Greece.

“In both texts, the accused made available to the public copies of UBK documents – acts from operational checks on a person – which are listed as classified info,” the prosecution in Skopje said on Thursday.

The ANB was formed in 2019 under a law supported by both the government and opposition to replace the notorious secret police, the UBK, which was at the centre of an illegal wiretapping scandal in 2015.

To strengthen oversight over its work, the ANB no longer operates as part of the Interior Ministry but as an independent government body. It also no longer has police powers or is in charge of the technical process of surveillance, which was given to a separate agency.

But, as most of its employees come from the old UBK, a selection or vetting process was introduced to ensure that old corrupt para-intelligence structures did not get through.

Zlatev, who was seen as part of the PR machinery of former PM Nikola Gruevski and often perceived as a propagandist rather than a journalist, defended his action on social networks, saying that he had acted in the public interest.

Over the past two years, seven complaints of unethical and unprofessional conduct have been filed against Zlatev to the Journalistic Council of Ethics, a self-regulation body.

“I published [the texts] because after one father attended the protests against the change of name [to the country], his son lost his security certificate and the chance to work in the ANB,” he wrote.

“This UBK construct is a classic blow to citizens’ political freedoms and big public interests, so that is why I published the documents that a whistle-blower gave me.

“If I got similar documents now, I would also publish them without thinking twice!!! I could repeat the act because freedom and democracy are more important to me than any legal provision,” Zlatev added.

The country’s oldest and biggest media union, the Association of Journalists of Macedonia, ZNM, said it would look into the case and demand answers from the prosecution.

“We don’t know all the details of the case and analysis needs to be done. But every time a case is opened by the prosecution in the domain of freedom of expression and the right to inform, it can be problematic,” ZNM head Mladen Cadikovski told 360 Degrees news portal on Thursday.

“The public interest can be stronger than the law if publication reveals the misuse of certain institutions. We are demanding a meeting with [chief] prosecutor [Ljubomir] Joveski on several topics, and this will be one of the issues that we wish to discuss,” Cadikovski added.

New Cyber Attacks on North Macedonia Spur Calls for Better Defences

Fresh cyber attacks in North Macedonia, this time targeting the health and education ministries, are spurring calls for more sophisticated cyber protection.

Last week’s attacks took down the websites of both ministries and were claimed by the hacker group ‘Anonopsmkd’, which previously took responsibility for a July 15 attack on the country’s most popular news aggregator TIME.mk.

The denial of service attack on TIME.mk, which involved more than 35 million addresses that generated thousands of clicks per seconds, coincided with a closely-fought parliamentary election in North Macedonia when the State Electoral Commission was also targeted.

In an interview last week, Anonopsmkd denied hitting the electoral commission, but it has warned that law enforcement structures in North Macedonia are its next target, spurring calls for greater protection of state bodies in the newest member of NATO.

“There should be a single protection system that would cover all government electronic services including agencies, ministries, local governments, and any legal entity or state body,” said Skopje-based cybersecurity consultant Mane Piperevski.

“This can be achieved by having a state-level Security Operation Centre with mixed ownership (51:49 in favour of the state),” Piperevski told BIRN. “The joint protection system would be under the leadership of the company that would be in charge of this Security Operation Centre.”

Hackers obstruct election result announcement

Piperevski said such a model had been implemented in a number of European Union countries.

“There is a quality staff within the government bodies that is ready to respond to such challenges,” he said. “The only problem, however, is with politics and priorities of the work in the institutions.”

Privacy and data protection expert Ljubica Pendaroska said the protection system should be multi-layered, “in order to make to make it as hard as possible for the hackers, and thus increase the protection of information and especially the personal data of citizens.”

“It is necessary for the institutions to have a developed and functional team and a procedure for rapid intervention and response in the case of an attack,” Pendaroska told BIRN.

An investigation conducted by the Ministry of Interior concluded that the electoral commission had been the target of a denial of service or DDoS attack which blocked publication of the preliminary results. The Commission website was out of action for several days.

“The investigation of this case continues in order to determine the IP addresses from where the attack was carried out, and for additional information to be collected to determine the perpetrator of this attack,” the ministry said.

National cybersecurity body has met only once

A spate of cyber attacks on state bodies in North Macedonia over the past few months has raised fears over the safety of its IT system, a concern for NATO too since the country joined the Western military alliance in March this year.

As BIRN reported in May, several cyberattacks in a short period of time exposed gaps in how North Macedonia’s authorities are dealing with cybersecurity issues.

In one security breach two months ago, a Greek hacker group calling itself ‘Powerful Greek Army’ leaked dozens of email addresses and passwords from staffers in North Macedonia’s ministries of finance and economy. Authorities are yet to determine how exactly the attack happened.

Last year, North Macedonia formed a National Council for Cyber Security, bringing together the ministers of interior, defence and information society. But it has so far met only once.

NATO member countries bear primary responsibility for their national cyber defences, but the alliance does provide expert support and has rapid reaction teams it can deploy in emergencies.

“NATO cyber experts can offer support and share information with Allies in real-time, including through our Malware Information Sharing Platform,” a NATO official told BIRN in an emailed response. “NATO has cyber rapid reaction teams on standby to assist Allies 24 hours a day, and our Cyberspace Operations Centre is operational.”

“NATO also invests in training, education and exercises which improve the skills of national cyber experts. Any attempts to interfere with democratic elections, including through hacking, are unacceptable, so we must remain vigilant.”

North Macedonia hackers target British pop stars
A hacker group from North Macedonia has claimed to have taken down the websites of British pop stars Dua Lipa and Rita Ora.

The attacks happened amid a row that erupted this month when Lipa, whose parents were born in majority-Albanian Kosovo, posted on social media a map of ‘Greater Albania’.

Ora, who was born in Kosovo but moved to Britain as a child, voiced her support for Lipa and called for Kosovo – which declared independence from Serbia in 2008 – to appear on Apple Maps.

AnonOpsMKD claimed responsibility for the attacks.

North Macedonia Probes Election Day Cyber Attacks

Authorities in North Macedonia have announced an investigation into election day’s cyber attack while experts are still puzzled about how the attack occurred on July 15, targeting the website of the state election commission, SEC, and the news aggregator website.

“It is not clear whether the [SEC] website was tested to withstand a large amount of connections for a short period of time, and whether it had the necessary DDoS protection,” cyber-security engineer Milan Popov told BIRN on Friday.

The Interior Ministry confirmed that it is looking into the matter. “The SEC reported the case and, immediately after the report, the Sector for Computer Crime and Digital Forensics took measures and activities to clear up the case,” ministry spokesman Toni Angelovski told BIRN.

Polling day on July 15 saw two of the highest profile cyber attacks the country has ever seen. In a single night, both the election commission’s website and the most popular news aggregator, TIME.mk, were brought down for several hours.

While TIME.mk quickly recovered, the SEC website is still having difficulties functioning. According to the SEC head, Oliver Derkovski, the attack probably came from abroad.

“We informed the Interior Ministry about this cybercrime. They were here today and I hope they will resolve it soon. It was an attack from abroad,” Derkovski said.

The IT company that runs the SEC election results page section, Duna Computers, said its own application functions flawlessly and the main issue came from the SEC website experiencing a sophisticated cyber attack.

The second cyber attack of the night, the denial of service, DDoS, attack that hit TIME.mk, involved more than 35 million addresses that generated thousands of clicks per second.

“There were brief interruptions but mostly the site withstood the attack. Unfortunately, we did not have the best protection, and this was our mistake, which we have corrected, so that it will not happen again,” the website’s founder, Igor Trajkovski, wrote on Twitter.

“I can say for sure that, for the second part of the attack, someone is connected to one of the sites that we index, because that is the only way through which they can find out our IP address,” Trajkovski added.

Unlike the SEC cyber attack, responsibility for this one was claimed by a hacker group that uses a logo similar to that of the famous hacktivist group Anonymous, and calls itself “Anonopsmkd”.

The group left a message in which it voiced displeasure with the election process in the country, and said it had targeted the TIME.mk website mostly because of its popularity. Regarding the group itself, information is scarce. However, in their message, they warned ominously that they are ready to strike again, and that they “neither forgive nor forget”.

North Macedonia Election Commission ‘Cyber-Attacked During Polls’

The website of North Macedonia’s State Electoral Commission, SEC, suffered an alleged denial-of-service, DDoS, attack for more than three hours during the parliamentary elections on Wednesday.

The attack delayed the SEC’s announcement of the official results of the tightly-contested vote on its website and it had to improvise by releasing partial results through YouTube clips instead.

SEC officials insisted that the alleged attack did not affect the data that they had been collecting throughout the day.

“From what I know so far, this was an attempted external attack. But until this is confirmed, I cannot speculate, we will know more about it tomorrow [Thursday]. The data wasn’t attacked and no damage was caused in the process,” SEC President Oliver Derkovski told a press conference.

At the same time as the SEC suffered the alleged attack, the country’s most popular news aggregator TIME.mk was also targeted by a heavy DDoS attack, which took the website down for a couple of hours. The site’s founder, Igor Trajkovski, said that Cloudflare, a US-based website security company, had to block millions of IP addresses involved in the attack.

“So far, Cloudflare has blocked three million IP addresses. And more new ones are appearing. We have never had such a DDOS attack before. Someone paid a lot of money to do this,” Trajkovski wrote on Twitter.

The attack was later claimed by a hacker group calling itself Anonymous Macedonia, which left a message on the website voicing displeasure with the election process, citing “empty promises from all political parties in this beautiful country”.

“We had yet another ‘democratic election process’, and as we can see, it is the same story repeating every three to four years,” the message said.

“It had to be your website because it has the highest number of visitors – no hard feelings,” It added.

With more than 90 per cent of the ballots counted, the ruling SDSM party was ahead of the opposition VMRO-DPMNE by some 10,000 votes.

North Macedonia: Facebook Pages Target Users with ‘Identical Content’

The Atlantic Council’s Digital Forensic Research Lab, DFRLab, which works to counter disinformation online, says its researchers have found dozens of Facebook pages linked to at least 10 Macedonian news outlets, demonstrating “several characteristics pointing to coordinated activity, including the near simultaneous publication of identical content”.

While some of these Facebook “assets” acknowledged their connection to the outlets whose content they were amplifying, others had no known connection.

“The assets also demonstrated signs of inauthenticity, as they were created as various interest pages, but ultimately promoted content from news sites to which they disclosed no connection,” DFRLab said.

It added this was clearly an efficient strategy, as the pages in every network had more followers than the official Facebook pages of the promoted media outlets.

A total of four separate networks or subsets of coordinated Facebook assets were amplifying content published by some of these websites: Republika Online, Kurir, Denesen, News24, Puls 24, Galama Club, among others. 

Only one of these is a tabloid. The others publish mostly political content: one of the outlets is openly pro-opposition. The others offer more balanced reporting on internal affairs. 

DFRLab research found coordination within networks of pages, but not across the four networks. There was also no sign that North Macedonian media outlets themselves managed the inauthentic networks.

The Facebook pages were created between 2009 and 2018 and were mostly managed from North Macedonia. Some were managed from the US.

According to DFRLab’s research, some of the Facebook pages seemed connected to Adinamic Media, which publishes news sites supporting the main opposition VMRO-DPMNE party. 

This media company is believed to have links with the Hungarian pro-government public TV network, Magyar Televizio, MTV.

Researchers said the presence and success of these networks had added to the political polarization in North Macedonia ahead of early parliamentary elections due this year. 

“The use of an inauthentic network on social media may enable political forces to mislead people and spread manipulated content to garner voter support, raising a concern on the integrity of the electoral process in the country,” DFRLab said.

VMRO-DPMNE, Putin and right-Wingers

Different pages amplified the same content at the same time from the same media outlets. Red boxes highlight posts from official Facebook pages of Vistina and Republika showing simultaneous posting by official and amplifier pages. Photo: Courtesy of DFRLab

According to the research, the first network consisted of seven Facebook pages that were amplifying articles published by Republika Online, Kurir, Denesen and Vistina

Vistina is a tabloid and doesn’t cover political topics. The remaining three mainly report on political issues and feature pro-VMRO-DPMNE views. All are owned by the same media holding, Adinamic Media, which is connected to Hungary’s MTV, the report said.

According to the Organized Crime and Corruption Reporting Project (OCCRP), a former senior executive at MTV, Agnes Adamik, established Adinamic Media in 2017. The company then purchased a majority of shares in three media companies in the country, mostly supporting VMRO-DPMNE.

According to some experts, these acquisitions helped Hungary’s Prime Minister, Viktor Orban, expand his and his country’s influence in the Balkans. They also supported his then ally in Macedonia, Nikola Gruevski, who obtained asylum in Hungary after fleeing a prison sentence in his home country in 2018.

The Facebook pages in this network posted almost identical articles and at the same frequency. The total number of followers of the seven pages was more than 690,000, while the official Facebook pages had less than 300,000 followers.

“This may indicate that since these outlets had not been successful in growing audiences for their official Facebook pages, they decided to create coordinated networks to amplify their content,” the researchers say.

The second network comprised 17 Facebook pages publishing content from three news outlets: Markukle, News24 and Signal. These also report political issues, but their content is not openly anti-government. 

Some publish supportive articles on Russian President Vladimir Putin, portraying him as an influential leader who upholds traditional values and helps friends in need. News24 sometimes amplified Russia Today and Sputnik videos.

As for the third network of pages, the DFRLab researchers found that the “amplifier pages … may be connected to Filip Petrovski, a right-wing presidential candidate in the 2019 North Macedonia presidential elections and a former member of VMRO-DPMNE party”.

Petrovski opposed the country’s change of name to North Macedonia and has called for the cancellation of the related Prespa agreement with Greece, signed in 2018. Petrovski also posts News24 articles on his own Facebook account.

Two pages in this network had names related to Petrovski, and their “about” sections contained details from his biography and political views.

The fourth network of Facebook assets amplified content published by two outlets, Net Medical Diet, which reports on health, and Galama. According to the research, the eight amplifier pages were managed from North Macedonia and from the US.

DFRLab also found five Facebook pages amplifying content from outlets owned by EM media, in which Adinamic Media has a majority of shares.

“Although the DFRLab was not able to identify coordination between them, there is a likelihood that EM Media was using these assets for content promotion,” the report said.

BIRD Community

Are you a professional journalist or a media worker looking for an easily searchable and comprehensive database and interested in safely (re)connecting with more than thousands of colleagues from Southeastern and Central Europe?

We created BIRD Community, a place where you can have it all!

Join Now