By Filip Stojanovski, fpr Global Voices
Activists of the ruling Serbian Progressive Party (SNS), nicknamed ‘SNS bots’, have been using a mobile application to post thousands of ‘up-votes’ and ‘down-votes’ on comments to articles of popular media websites Kurir and Espresso, to influence the perceptions of their readers, revealed a research by the Centre for Investigative Journalism of Serbia (CINS).
In an investigative story published on 4 September 2019, journalists Anđela Milivojević and Milica Šarić revealed that analysis of the source code of the mobile application called VotR2 showed that it enabled adding votes ‘for’ or ‘against’ readers’ comments, to make them either less or more visible to other readers.
SNS’s online strategy: bots and trolls
As part of the ruling party’s online strategy, members have been instructed to open fake user profiles to post positive comments about the SNS and its leader, the Serbian President Aleksandar Vučić, and to post negative comments and down-votes of critical articles and comments.
In 2014, a leaked PowerPoint presentation revealed that the party was seeking to establish information dominance in online debates by recruiting 500 members of 80 local party committees to troll critics and produce comments favorable to the government and the SNS.
CINS pointed out that an interview published on 9 August 2019 of a former member of SNS’s troll army with news portal Južne vesti showed that the party continued to use “the organized bot system with intent to create a false image of satisfaction with the current government.” The interviewee, who spoke to Južne vesti anonymously, indicated that civil servants and employees in state-owned companies are forced into joining the troll army, and refusal can result in loss of livelihood.
A follow up article quotes the administrator of Južne vesti website who found out that the comments on this interview received a total of over 22.500 votes, all coming from a single network related to an IP-address, registered at the SNS headquarters in Belgrade.
Discovery of the mobile app indicates that the party upgraded its online tools arsenal for wider reach with increased intensity.
Analysis of the app code shows direct connection to ruling party
The icon of mobile app VotR2 as preserved on the archive website APKMonk.
CINS consulted digital security expert Jurre van Bergen, who works with the Organized Crime and Corruption Reporting Project (OCCRP), to analyze the code of the VotR2 app, which was available on Google Play Store until January 2019. However, the code is still available on websites that archive apps, such as APKMonk, allowing experts to analyse it. Van Bergen concluded that “VotR2 has been specifically designed to manipulate the comments through the voting feature.”
The code analysis showed that after installing the app on their online phones, users would need to perform a password confirmation. Then the app continues working in the background while the smartphone remains active, posting pluses and minuses on the websites of Kurir and Espreso. The app restarts whenever the phone restarts, and continues receiving instructions on how to vote from the party, without any interference from the mobile phone’s owner. It would post votes every six seconds, working down a list of links to individual comments received remotely.
The analysis of the up/down-voting app’s code showed that it has been controlled from a server with a specific IP address “77.46.148.99,” that since March 2016 has been registered by the Serbian Progressive Party. Registration record shows the name of the party in Serbian (Srpska Napredna Stranka) and the address of their headquarters in Belgrade (Palmira Toljatija 5).
SNS has not replied to CINS’ request for comment.
Van Bergen and other experts consulted by CINS opined that the targeted websites receive these votes as if they are sent from the mobile apps of Kurir and Espreso.
Nemanja Nenadić from anti-corruption organisation Transparency Serbia told CINS that the manipulation of user comments aims to deceive readers by pretending to represent the voice of “the neutral compatriot:”
Are the media outlets part of the scam?
Experts consulted by CINS opined that this level of access of the SNS app to the websites of Kurir and Espresso can only be gained in three ways: (1) receiving access privileges directly from website owners, (2) hacking the official mobile apps published by the media outlets, or (3) low level of protection of websites enabling manipulations.
Tanja Maksić, the vice president of the Association of Online Media said it would be “completely unethical” and “unacceptable” for the media to provide direct access to the ruling party’s app.
Representatives of both media outlets contacted by CINS responded that they are not providing direct access to anyone, while one of them hinted that her technical team did not rule out the possibility of hacking against their website.
Digital security expert Van Bergen said that he did not find evidence of hacking. According to his statement for CINS, the controversial app is using a legitimate function from the website API enabling voting on the comments. “However they didn’t build adequate security measures to prevent manipulations with pluses or minuses on the comments,” he concluded.
Kurir and Espreso are now owned by one of biggest media companies in the Balkans, Adria Media Group. In January 2019 the Adria Media was bought by Igor Žeželj, owner of another portal called Mondo. Before the purchase, Mondo submitted an evaluation to the Commission for Protection of Competition [anti-monopoly regulatory body in Serbia] that estimated that the two websites together cover 16.4% of the market share in the online portal category in Serbia.
According to CINS, Kurir articles receive up to 10 times more comments than the articles on the website of their main competitor, Blic.
Experiences of other Serbian websites like Južne vesti, showed that news related to the current government receive most comments, pluses and minuses. “They are very sensitive to every news article critical of the government and such articles receive most reactions,” explained editor-in-chief Gordana Bjeletić. According to her, the number of up or down votes (pluses or minuses) did not increase the actual number of visits to their websites. In her opinion the party would not do it if there’s no effect “as their goal is to influence people, especially the undecided citizens who like to see what others think about particular issues.”
Transparency Serbia representative Nenadić added that if the media outlets enable such voting privileges for the political party, they would have to report it as “a specific kind of free service” which amounts to party donation.
Neither of the two affected popular media outlets published news articles or opinion pieces about CINS’ investigation.
By Filip Stojanovski, fpr Global Voices
