Bot attacks on social networks are a frequent occurrence in Montenegro, and are especially visible during important socio-political events, such as the election of the government.
Activities involving bots and abuse of media space are carried out unhindered due to the lack of systemic responses to this problem.
Thus, the Digital Forensic Center (DFC) comments on the frequent attacks by bot accounts in the Montenegrin digital space.
These are coordinated types of attacks on social networks and websites, in which a large number of fake profiles are used in order to spread propaganda, spread positive or negative narratives, or other malicious activities.
Such attacks should be distinguished from hacker bot attacks. There may or may not be people behind bot account attacks on social media. Those who are not - imitate people.
Hacker bot attacks (DDos) are computer-created and serve to steal data, prevent the system from functioning and overload the "traffic" on the website.
The DFC announced that, among other things, attacks by bot accounts on social networks led to citizens' equally negative perception of the influence of Russia and the European Union (EU) in Montenegro.
"If it is taken into account that the institutions of the system do not provide answers to these questions, and that there is no strategy to fight misinformation and foreign malignant influence, the space for influence operations and other forms of hybrid activity is getting bigger", they assessed for "Vijesti" .
They emphasized that avoiding stopping these types of attacks can cause a greater degree of erosion of democracy and democratic processes in the country, adding that the highest officials from the current and previous governments relativized and minimized the danger of harmful foreign influence.
MJU: Better protection with the new law
From the Ministry of Public Administration (MJU), which he manages Marash Dukaj "Vijesti" was told that on May 10, the Government adopted the proposal of the Law on Information Security, which, they say, will create mechanisms for additional improvement of the protection of cyber space against attacks and incidents.
They pointed out that several bot attacks were detected in the past period, i.e. the so-called "DDoS" attacks, which, they claim, were "effectively solved".
DDoS attacks are carried out by individual devices (bots) or a network of devices (botnet) that are infected with malware and used to "flood" websites.
"We are currently in the process of establishing a fully functional reserve Disaster Recovery location in Bijelo Polje, which will serve as an additional mechanism for defense and response to bot attacks," added the MJU.
They pointed out that the responsibility for the security of the digital space lies with the state administration, citizens, the economy and "all other entities in Montenegro".
"Ambassadoristan" and "Defense of Electoral Will"
After the parliamentary elections in June last year, the president of the country Jakov Milatovic awarded on August 10 to the leader of the Europe Now Movement (PES) Milojko Spajić the mandate to form the government.
Spajić completed that work on October 31, eight days before the expiration of the constitutional deadline, and the period of the process of formation of the new executive power was marked by "artificially" created narratives on social networks that Montenegro is "ambassadorian" and that "Western embassies do not allow Serbs to enter Government".
In the end, the government was formed with the minority support of pro-Serbian parties from the coalition For the Future of Montenegro (ZBCG), which, according to the coalition agreement, should become part of it by the end of the year.
"The comprehensiveness of the influence operations, which are channeled from the political top of Serbia, through the media, pro-Serbian and pro-Russian right-wing proxy groups, result in the imposed narratives polarizing and antagonizing Montenegrin society. The expediency of the operations is also reflected in the fact that disinformation narratives are used as a tool by third parties for the homogenization of a certain ethnic, religious or political group," the DFC announced.
On Viber, at the end of August last year, the group "Defense of the Electoral Will" was formed, in which protests were called for regarding the events related to the formation of the government, the phone numbers of certain politicians were exchanged, and then, as can be seen from the correspondence, messages were sent to them.
The main administrator of that group is Beranac Neđeljko Peković, a repeatedly convicted criminal, while some of the other administrators spread extremist content on their social media profiles, supported Russian aggression against Ukraine, and the Serbian Orthodox Church (SPC).
Peković rejected claims that the group was formed by order of any political party, the Metropolitanate of Montenegro and the Littoral or the NGO "Orthodox Brotherhood Stupovi", saying that they are trying to criminalize them in vain.
"We are not supported by the church or any political party, even politics is forbidden in the group. Behind this group stands only the dissatisfied, betrayed and deceived people who will not allow the repackaged DPS (Democratic Party of Socialists) and their satellites to oppress our families, to rob and devastate this country. There is no other reason or motive," he told "Vijesta" last summer.
The "peak" of the group's activities, which at one point had more than 20.000 members, are the so-called car rallies, which were organized in several Montenegrin municipalities on August 30 last year, the day when the three-decade rule of the DPS was replaced in 2020.
"'The threat of Serbs in Kosovo', 'Serbs are forbidden to enter the Government' or the latest narrative that the UN resolution on the genocide in Srebrenica marks the Serbs as a 'genocide nation' reflect the way in which narrative forms are used as a cohesive factor for certain ethnic and national groups during important social events", according to the DFC.
Krivokapić was attacked by three "families"
In October 2020, the then mandate holder for the composition of the Government Zdravko Krivokapic he was targeted by three "bot families" on the X social network (formerly Twitter) - "Andrić", "Ivanović" and "Popović".
DFC points out that a network of more than 80 bot accounts attacked Krivokapić because of his views on the formation of the so-called expert government, i.e. the non-inclusion of the then Democratic Front (DF) in the executive power.
DFC's analysis shows that every member of the "Popović family" was created on October 13, 2020, all the "Andrićs" a few days later, on October 17 and 18, and the "Ivanović" orders on October 25.
The orders were not active until Krivokapić's message that he remains of the position that all candidates for ministers must pass a competence check, and that this does not exclude the participation of politicians in the government if they meet the criteria with their resumes.
After that, the bot account @AndricDanijela4 shared Krivokapić's post criticizing his views, after which the bot network was activated, which attacked the then president.
All profile photos of members of the "bot family" were created with the help of artificial intelligence (AI), as evidenced by the fact that the position of the eyes in all photos is identical and forms a straight line. None of these accounts are active today, and all their posts have been deleted.
"SPC threatened, Serbs persecuted"
In May 2020, the DFC discovered more than 600 bot accounts on the Iks network, which are linked to the Serbian Progressive Party (SNS) and the President of Serbia Aleksandar Vučić.
As the DFC told "Vijesta", these orders coordinated the spread of the narrative about the threat to the Serbian Orthodox Church, as well as the persecution of Serbs in Montenegro.
In mid-May 2020, this network had more than 2.000 posts, of which 80 percent were "retweets" (sharing other people's messages), which, DFC explains, is one of the key features of such accounts, which aim to increase the reach existing content.
"The activation of bot accounts on social networks occurs before and during important socio-political events, with the aim of creating a false image. A large number of bot accounts with a clearly defined theme clearly indicates that the goal of these operations is to increase the visibility of existing content and spread narratives that are aligned with the policies of third parties," added the DFC.
The main narratives spread by the activity of this bot network are that "churches in Montenegro belong and will always belong to the SPC", that Montenegro is "Serbian Sparta", that the former head of state Milo Djukanovic the main culprit for bad relations with Serbia, as well as that Serbia and Vučić will do everything to protect Serbs and their national interests in Montenegro.
All the posts of these bot accounts also included the tag of Vucic's account on the Iks network (@avucic).
Actions during the enthronement
Enthronement of the Metropolitan of Montenegrin and Littoral Joanikia in Cetinje on September 5, 2021, was the reason for the coordinated actions of pro- and pro-Russian Facebook pages, the DFC points out.
At that time, a protest was organized in Cetinje by a group of citizens who opposed the enthronement, and a barricade made of car tires was placed on the Belvedere, which made it impossible to enter the capital.
Patriarch of the Serbian Orthodox Church Porphyry and Metropolitan Joanikije were transported by helicopters of the Aviation Helicopter Unit of the Ministry of Internal Affairs (MUP) to Cetinje, where there was a conflict between the police and citizens.
The DFC states that coordinated actions and inflammatory rhetoric on Facebook pages from Serbia were made "according to the matrix that was used during the local elections in Nikšić", held in March 2021, where, as they said, dozens of pages publish fake and sensationalist news almost at the same minute. .
Several coordinated actions were recorded during the day, and the total number of people who followed the analyzed pages exceeded 580.000.
In the period from September 1 to September 8, there were 11.244 posts on Facebook that generated 1.674.030 interactions. In the same period, there were 43.637 posts on Iks, while the topic of Cetinje appeared in 17.200 posts in the media.
"The media in Montenegro and Serbia spread misinformation about the alleged repression of the police against the Montenegrin and Serbian population in the country. The marketed narrative depended on the political leanings of the media. Pro-Montenegrin media wrote about repression against Montenegrins, while Serbian media wrote about repression against Serbs. These were classic examples of fake news that tended to raise tensions and radicalize citizens of both nationalities. The DFC, in cooperation with the Police Directorate, successfully denied such allegations", claim the DFC.
From that organization, they stated that several Montenegrin media published false news about bus convoys with citizens who headed from Belgrade to Podgorica to support the enthronement.
"Nevertheless, there was no convoy of buses on the Montenegrin borders that day, nor were there large crowds that would support such claims. Also, during the day, Serbian tabloids constantly spread misinformation and fake news, along with sensationalist reporting. One of those fake news is that 'young men are being prepared in T-shirts with Serbian symbols, who will cause chaos'. None of that happened in Cetinje", they add.
They push narratives through legal loopholes
Bearing in mind the limitation of the media market in terms of profit generation, the portals "IN4S", "Borba" and televisions with an ownership structure from Serbia market their content in order to spread the influence of third parties.
This is how the DFC interprets the influence of the pro-Serbian media in Montenegro, stating that they use legal and systemic deficiencies in the fight against disinformation and "unimpededly flood the public space with misleading content, emotional manipulation and disinformation."
DFC in the study on the influence of Serbia in Montenegro assesses that "IN4S" plays a key role in the promotion of pro-Russian and pro-Serbian narratives.
"The unregistered portal 'IN4S' has repeatedly exerted inappropriate influence on public opinion through hate speech, by targeting individuals from public and political life, as well as by spreading explicit pro-Russian war propaganda," replied "Vijesti".
They state that "IN4S", apart from Podgorica, has newsrooms in Belgrade, Novi Sad, Nikšić, North Mitrovica and Donbass.
The portal is not registered, which means that it is not subject to the legal regulations of Montenegro, and the name of the famous former Cuban boxer is stated in the imprint as the editor-in-chief - Felix Savon.
The "real" editor-in-chief is one of the founders of that portal Gojko Raicevic.
"He was also at the head of the NGO 'No to War - No to NATO' and advocated for the organization of a mandatory referendum on Montenegro's entry into NATO, while on the other hand he acted as a Russian propagandist," writes the DFC study.
In a State Department report outlining the pillars of the Russian disinformation campaign, "IN4S" was labeled as part of the "propaganda ecosystem of the Russian disinformation campaign."
Apart from Raičević, the founder of that portal is also the current rector of the University of Montenegro (UCG). Vladimir Bozovic.
Božović told the "News" in August of last year that for years, and especially since he is in his current position, he has had absolutely no participation in the work of "IN4S".
"Of course, I condemn any insult, outpouring of hatred towards individuals or nations. We all need a more measured and much more honest attitude towards what we nominally stand for the most - the value of mutual respect", said Božović at the time.
The role of "IN4S" was relativized by the prime minister Milojko Spajic, as well as its predecessors Dritan Abazovic and Krivokapić, by guesting in shows produced by that portal.
Along with "IN4S", the portal "Borba" is in line with the nationalist policy of creating a "Serbian world", as well as degrading and causing distrust in Montenegrin institutions, the DFC announced.
The editor-in-chief of the portal "Borba" was until recently the editor of TV "Prva". Drazen Zivkovic. He and Raičević were detained in 2020 on suspicion of publishing false information about the explosion in Villa "Gorica"...
In addition to those two portals, the media that DFC labeled as pro-Serbian are also "Srpska24", "Aloonline.me", "Srpska Radio Televizija", TV "Adria"...
"Parallel with the spread of narratives that glorify the policies of the regime in Belgrade, those portals and media are used to publish unverified information and manipulate facts," they added.
They establish CIRT even though it already exists
MJU told "Vijesti" that the new Law on Information Security envisages the establishment of two new structures - a cyber security agency and the Government CIRT, i.e. a computer attack response team.
As they pointed out, MJU, through CIRT, will be the central point for all cyber security issues in the field of public administration, while the agency will have the same function for all other subjects.
However, as written on the Government's website, CIRT has existed since 2012.
"CIRT (Computer Incident Response Team) is, in accordance with the Data Confidentiality Act and the Information Security Act, responsible for responding to computer security incidents in the cyber space of Montenegro. It was founded in 2012 as part of a joint project between the Government and the International Telecommunication Union (ITU). From its beginning until today, it has successfully solved or helped to solve a large number of computer incidents that had a national or international character," it says on the Government's website.
MJU did not explain to "Vijesti" what is the difference between the existing and the planned CIRT.
Creating a false impression
The activity of bot accounts on networks is only one segment of the so-called influence operation. The DFC states that bot accounts often participate in "astroturfing campaigns".
Such campaigns aim to create a false impression, positive or negative, by writing comments on networks and portals.
"We noticed such activity before the parliamentary elections in Serbia in 2023, when on the portals 'Borba' and 'IN4S' in the comments below the news about the support for the list 'Aleksandar Vučić-Srbije ne sme da stop', the coordinated activity of the bot profile gave support to the signatories of the support of that list ", according to DFC.
There are similar comments on the "Vijesti" portal. The user "Milenicaaa" left 16 comments on the text "Vučić: The behavior of Montenegro is the most disgusting, they will not pass a resolution on Jasenovac, because they are not allowed to".
"You can hate Vučić as much as you want, but he didn't sell his country for 30 silver coins"; "That's why Vučić will not send any note of protest because he knows who is in charge of you"; "It is important that our Vučić fought for us, everything else we know who conducts whom, and what Vučić is fighting against" - read some of the comments.
On the same text, user "AcaP" commented 14 times in 44 minutes. His comments were similar to the above.
"Vučić is right and said everything well"; "Vučić leads a responsible policy"; "Vučić said everything as it is"...
Russian presence sensitive
In 2016, the Russian Internet Research Agency founded the "Montenegro News Agency" portal, which aimed to discredit pro-Western political entities and NATO in front of the Montenegrin public.
The DFC points out that Russia directed "hybrid activities towards Montenegro, abusing the information space" that year.
"Pro-Russian and pro-Serbian media downloaded posts from this portal and shared them as relevant information. Even after Montenegro joined NATO (2017), influence operations in the media and public space did not disappear, but continued through more subtle forms, primarily through proxy media and portals", they pointed out.
They add that it is important to emphasize that pro-Serbian media play a significant role in spreading and strengthening pro-Russian propaganda in Montenegro.
"After the Russian aggression against Ukraine, pro-Serbian proxy media and portals took over content from the Russian state media and spread propaganda through the glorification of the Russian army and the demonization of the political West," states the DFC.
Bonus video:
