{"id":22690,"date":"2019-09-16T16:21:37","date_gmt":"2019-09-16T14:21:37","guid":{"rendered":"https:\/\/www.cins.rs\/?p=22690"},"modified":"2020-10-28T17:22:57","modified_gmt":"2020-10-28T15:22:57","slug":"serbian-progressive-party-bots-had-access-to-kurir-and-espreso-websites","status":"publish","type":"post","link":"https:\/\/www.cins.rs\/en\/serbian-progressive-party-bots-had-access-to-kurir-and-espreso-websites\/","title":{"rendered":"Serbian Progressive Party Bots Had Access to Kurir and Espreso Websites"},"content":{"rendered":"

Activists of the ruling party have had access to the Kurir<\/em> and Espreso<\/em> websites, where they could leave a large number of pluses of minuses on existing comments by readers, shows CINS\u2019 analysis of the code of the VotR2<\/em> app, which the party\u2019s \u201cInternet team\u201d has been using. In that way the activists, also known as bots, according to instructions received in advance, awarded positive or negative marks to the comments published by the two media, which in the case of the Ju\u017ene Vesti<\/em> website they used to deal with criticism aimed at the Serbian Progressive Party<\/em> and Serbian President Aleksandar Vu\u010di\u0107<\/strong>. Through that influence they create a false public image, CINS\u2019 interlocutors say.<\/p>

\u201cVotR2<\/em> is especially designed to manipulate comments through voting,\u201d says Jurre van Bergen<\/strong>, a digital security expert with the Organized Crime and Corruption Reporting Project<\/em> (OCCRP).<\/p>

This data was revealed by the VotR2<\/em> app\u2019s code, i.e. text, which was available for download at least until January 2019. The code shows that it was enough to install the app on one\u2019s cell phone and thus access these websites. Although the app no longer exists in the Google Play Store, it is available on at least one of the foreign websites that collect apps (APKMonk), while CINS reveals that accessing media websites in a similar way is still possible.<\/p>

VotR2<\/em> is easy to use.<\/p>

\n
\u201cVotR2 is especially designed to manipulate comments through voting.\u201d Jurre van Bergen <\/figcaption>\n <\/div>
<\/div><\/div><\/div>

Judging by the analyzed code, after they have downloaded and launched the app on their phone the user receives a code they need to verify through a program on their computer. The app then continues to operate without further orders from the user, i.e. \u201cin the background\u201d of the phone, where it performs the work it was designed for \u2013 gives pluses and minuses to existing comments on the Kurir<\/em> and Espreso<\/em> websites. Van Bergen, a digital security expert, analyzed the app using three different tools. He says that, apart from operating on its own, the app is programmed to relaunch every time an Android phone is turned on or restarted.<\/p>

Voting is done automatically every six seconds, with up to five votes per comment, after which the app moves on to the next comment. Votes are awarded according to a list of comments, with specific instructions as to whether a positive or a negative vote should be given.<\/p>

This is possible b ecause the app code contains links leading to the comments on the news posted on the two websites. The Kurir<\/em> and Espreso<\/em> websites probably perceive clicks on those links as voting via mobile apps of these media, according to Van Bergen and other experts CINS consulted. These links are still available today, albeit better protected than before.<\/p>

 <\/p>

How Do We Know the App Belongs to the Progressive Party<\/h2>

With the help of several experts, CINS analyzed the code and found data on an IP address under the number 77.46.148.99. An IP address is a unique number, similar to a phone number, used by computers to communicate with each other on the Internet. During operation, the app communicated with a server, i.e. with this IP address.<\/p>

A checkup of IP address ownership on any publicly available website (such as whois.domaintools.com) shows that its owner is the Serbian Progressive Party<\/em>. The party registered this IP address in March 2016 at the address of the party headquarters, Palmira Toljatija 5 in Belgrade\u2019s New Belgrade municipality. CINS reported earlier on how the Serbian Progressive Party<\/em> had acquired the office space through an unpermitted donation<\/a>.<\/p>

By the time this article was published, the Progressive Party<\/em> did not answer CINS\u2019 questions.<\/p>

\"\"<\/p>

IP address ownership<\/h6>

The aim of leaving comments under news and voting for them is to get access to potential voters through the vote of \u201ca neutral fellow citizen,\u201d says Nemanja Nenadi\u0107<\/strong> of Transparency Serbia<\/em>.<\/p>

\u201cThe aim is to create an impression of what the majority thinks, what a socially acceptable opinion is. I suppose that ultimately that has some effect on voters, because otherwise I do not think the ruling party, and probably some other parties to a lesser extent, according to their financial capacity, would be putting so much effort into it,\u201d adds Nenadi\u0107.<\/p>

Gordana Bjeleti\u0107<\/strong>, Editor-in-Chief of the Ju\u017ene Vesti<\/em> website, says that the bots are the most active on that website when the Serbian Progressive Party<\/em> of the president are mentioned: \u201cThe most reactions, pluses and minuses are given to the news that mention Aleksandar Vu\u010di\u0107.\u201d<\/p>

 <\/p>

Interest of a Media Outlet or of the Party<\/h2>

According to experts, for the app to access the Kurir<\/em> and Espreso<\/em> websites in this way, the media had to give access to the Serbian Progressive Party, or for someone to hack their mobile apps. The third option is insufficient protection.<\/p>

\n
\"None of the users of the Kurir and Espreso websites actually know they are in that way taking part in a staged public debate.\" Tanja Maksi\u0107 <\/figcaption>\n <\/div>
<\/div><\/div><\/div>

Tanja Maksi\u0107<\/strong>, Vice President of the Association of Online Media<\/em> (AOM), told CINS that if the media themselves had allowed access to the app, that was \u201ccompletely unethical\u201d and \u201cunacceptable.\u201d<\/p>

\u201cThat kind of business relationship is never transparent. None of the users of the Kurir<\/em> and Espreso<\/em> websites actually know they are in that way taking part in a staged public debate,\u201d said Maksi\u0107, adding that this created a false public image.<\/p>

Ana Markovi\u0107<\/strong>, Executive Director of Espreso<\/em> Group<\/em>, which includes the Espreso<\/em> website, denied that the Group had ever given the Espreso<\/em> code to anyone, and says that only readers have control over the pluses and minuses awarded to comments. In her first reply to CINS, Markovi\u0107 said that \u201cwe have not noticed that those data are being manipulated,\u201d but later, after consultation with the technical team, confirmed that the website had had problems in the past with some bots \u201cwho vote automatically by changing the IP address of the server,\u201d i.e. by changing its location.<\/p>

The technical team also mentioned the possibility of hacking:<\/p>

\u201cThe aforementioned public API link is relatively easy to get by \u2018sniffing\u2019 traffic through Wireshark or by decompiling the app and reverse engineering the API call, just like it is possible to reach it from any other app,\u201d reads the reply.<\/p>

However, Markovi\u0107 declined to say whether Espreso\u2019s<\/em> official position was that they had been hacked.<\/p>

CINS journalists received an identical answer from Sonja Laki\u0107<\/strong>, Deputy Editor of the Kurir<\/em> website, who also consulted the technical team and added that they had not given anyone their code.<\/p>

\u201cKurir<\/em> and Espreso<\/em> were not hacked. It is a legitimate function that was envisaged \u2013 an API that will vote for or against comments on their website. Nevertheless, they did not build adequate security measures which would prevent people from manipulating voting with pluses or minuses on comments,\u201d says Van Bergen.<\/p>

\"\"<\/p>

The part of the app code where you can find Kurir and Espreso websites<\/h6>

Kurir and Espreso are part of Adria Media Group<\/em>, one of the largest media groups in the Balkans. The Group was owned by businessman Aleksandar Rodi\u0107<\/strong> until January 2019, after which it was taken over by Igor \u017de\u017eelj<\/strong>, the head of well-known website Mondo<\/em>.<\/p>

There are many comments under news posted on the Kurir<\/em> website, sometimes up to 10 times more than on the rival Blic website. CINS\u2019 interlocutors say that, if the app creator so wishes, comments and rating them with pluses and minuses can increase traffic on websites.<\/p>

\u201cThey can create a system where every vote is not a visit, they can create a system where a vote is a visit. The goal is to manipulate the system,\u201d said Gordana Bjeleti\u0107 of Ju\u017ene Vesti<\/em>, which recently faced an \u201cassault\u201d by bots.<\/p>

On some media websites, the comments with the most pluses automatically rise to the top and are the first to be seen by readers.<\/p>

On the other hand, for parties this is a way to promote opinions that are positive for them. The experience of Ju\u017ene Vesti<\/em> shows that the biggest number of pluses and minuses go to the news that pertain to the incumbent authorities, from comments in their favor to criticism:<\/p>

\u201cThey are very sensitive to each piece of news, each topic where the authorities are criticized and they react the most to that,\u201d Bjeleti\u0107 explains. Although voting did not bring Ju\u017ene Vesti<\/em> more traffic, she believes the party would not have done it if it had no effect, adding that their objective is to influence people, especially those who are undecided and look at what others think.<\/p>

Nemanja Nenadi\u0107 says that it is important for the media to prevent further access to comments, if they were hacked, otherwise their behavior might be interpreted as support to a political option. On the other hand, if the media allowed the Serbian Progressive Party to vote in this way, that would be \u201ca special form of free service which would have to be reported as a free service, as a contribution to party funding.\u201d<\/p>

The case of Ju\u017ene Vesti<\/h2>

A testimony<\/a> by a former Serbian Progressive Party<\/em> bot, published by Ju\u017ene Vesti<\/em> in early August, revealed that the ruling party has an organized botting system the purpose of which is to create a false image of satisfaction with the current government. In the anonymous interview, the Progressive described how the party kept a record of Internet activities through its local offices, while the superiors are at the headquarters in Belgrade. Soon after the interview was posted, the website received more than 22,500 votes on the piece from the same IP address. The IP address is registered at the address of the Serbian Progressive Party<\/em> headquarters in Belgrade. <\/p><\/div><\/div>

 <\/p>

The text was created within the project \u201cNadzor javnih politika: prEUgovor prati reforme u poglavljima 23 i 24\u201d<\/a> supported by the European Union. The content of the text is sole responsibility of the author and does not necessarily reflect positions of the European Union.<\/em><\/h6>
From November 2018 to September 2019 the work of CINS is supported by Sweden, within the Belgrade Open School program \u201cCivil Society as a Force for a Change in the Serbia\u2019s EU Accession Process.\u201d<\/a><\/em><\/h6>
\"\"<\/h6>","protected":false},"excerpt":{"rendered":"

Serbian Progressive Party activists, also known as bots, have until recently been able to leave thousands of pluses and minuses on comments posted on the Kurir and Espreso websites through the VotR2 app, thus influencing the readers of these popular media. The app contains information from the two websites\u2019 code and has been operating independently of the bots\u2019 activities, shows research conducted by the Center for Investigative Journalism of Serbia (CINS). <\/p>\n","protected":false},"author":1341,"featured_media":22706,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1492,1574,1573],"tags":[1651,1653,1640,1650,1611],"class_list":["post-22690","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-investigative-stories","category-media","category-political-parties","tag-bots","tag-internet-bots","tag-media","tag-preugovor-en","tag-serbian-progressive-party","ciTrackContent"],"acf":[],"featured_image_url":"https:\/\/www.cins.rs\/wp-content\/uploads\/2019\/09\/IMG_0607-1.jpg","author_additional":[1124],"_links":{"self":[{"href":"https:\/\/www.cins.rs\/en\/wp-json\/wp\/v2\/posts\/22690","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cins.rs\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cins.rs\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cins.rs\/en\/wp-json\/wp\/v2\/users\/1341"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cins.rs\/en\/wp-json\/wp\/v2\/comments?post=22690"}],"version-history":[{"count":15,"href":"https:\/\/www.cins.rs\/en\/wp-json\/wp\/v2\/posts\/22690\/revisions"}],"predecessor-version":[{"id":22754,"href":"https:\/\/www.cins.rs\/en\/wp-json\/wp\/v2\/posts\/22690\/revisions\/22754"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cins.rs\/en\/wp-json\/wp\/v2\/media\/22706"}],"wp:attachment":[{"href":"https:\/\/www.cins.rs\/en\/wp-json\/wp\/v2\/media?parent=22690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cins.rs\/en\/wp-json\/wp\/v2\/categories?post=22690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cins.rs\/en\/wp-json\/wp\/v2\/tags?post=22690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

The Kurir<\/em> newspaper is distributed nationwide, while the websites of both media register a lot of traffic. Kurir.rs boasted that close to 2.8 million readers visited the website over the course of August 2018, whereas research conducted by the Balkan Investigative Reporting Network<\/em> (BIRN) showed that these two media had attracted 7.5% of the total audience in Serbia in 2018. Before purchasing the media outlet, Mondo handed<\/a> the Commission for Protection of Competition an estimate that the two websites accounted for about 16.4% of the website market.<\/p>