Serbian journalists expose a ruling party bot application used to manipulate readers’ comments on media websites · Global Voices
Up-voted comments on a Kurir.rs article about president praising graduating medical students. First comment claims “The state increasingly pays attention to youth” and the second “Serbia's goal is to keep its expert young people in the country by providing good jobs.”
Activists of the ruling Serbian Progressive Party (SNS), nicknamed ‘SNS bots’, have been using a mobile application to post thousands of ‘up-votes’ and ‘down-votes’ on comments to articles of popular media websites Kurir and Espresso, to influence the perceptions of their readers, revealed a research by the Centre for Investigative Journalism of Serbia (CINS).
In an investigative story published on 4 September 2019, journalists Anđela Milivojević and Milica Šarić revealed that analysis of the source code of the mobile application called VotR2 showed that it enabled adding votes ‘for’ or ‘against’ readers’ comments, to make them either less or more visible to other readers.
SNS's online strategy: bots and trolls
As part of the ruling party's online strategy, members have been instructed to open fake user profiles to post positive comments about the SNS and its leader, the Serbian President Aleksandar Vučić, and to post negative comments and down-votes of critical articles and comments.
In 2014, a leaked PowerPoint presentation revealed that the party was seeking to establish information dominance in online debates by recruiting 500 members of 80 local party committees to troll critics and produce comments favorable to the government and the SNS.
CINS pointed out that an interview published on 9 August 2019 of a former member of SNS's troll army with news portal Južne vesti showed that the party continued to use “the organized bot system with intent to create a false image of satisfaction with the current government.” The interviewee, who spoke to Južne vesti anonymously, indicated that civil servants and employees in state-owned companies are forced into joining the troll army, and refusal can result in loss of livelihood.
Posledice? Naravno da ih ima. Uglavnom su članovi internet tima zaposleni u javnom sektoru i možete da zamislite koja tu posledica može da bude. Prestanak radnog odnosa ili šta već – kaže ovaj bivši bot.
Consequences? Of course there are consequences. The members of the Internet team are mainly public sector employees, and you can imagine the consequence [of dissent]. 463
Ending of the working relationship and more, the former bot said.
A follow up article quotes the administrator of Južne vesti website who found out that the comments on this interview received a total of over 22.500 votes, all coming from a single network related to an IP-address, registered at the SNS headquarters in Belgrade.
Discovery of the mobile app indicates that the party upgraded its online tools arsenal for wider reach with increased intensity.
Analysis of the app code shows direct connection to ruling party
The icon of mobile app VotR2 as preserved on the archive website APKMonk.
CINS consulted digital security expert Jurre van Bergen, who works with the Organized Crime and Corruption Reporting Project (OCCRP), to analyze the code of the VotR2 app, which was available on Google Play Store until January 2019. However, the code is still available on websites that archive apps, such as APKMonk, allowing experts to analyse it. Van Bergen concluded that “VotR2 has been specifically designed to manipulate the comments through the voting feature.”
The code analysis showed that after installing the app on their online phones, users would need to perform a password confirmation. Then the app continues working in the background while the smartphone remains active, posting pluses and minuses on the websites of Kurir and Espreso. The app restarts whenever the phone restarts, and continues receiving instructions on how to vote from the party, without any interference from the mobile phone's owner. It would post votes every six seconds, working down a list of links to individual comments received remotely.
The analysis of the up/down-voting app’s code showed that it has been controlled from a server with a specific IP address “<IP_ADDRESS><PERSON> and <PERSON> revealed that analysis of the source code of the mobile application called VotR2 showed that it enabled adding votes ‘for’ or ‘against’ readers’ comments, to make them either less or more visible to other readers. 609