The limited recount of cyberattacking media freedom

The limited recount of cyberattacking media freedom

The limited recount of cyberattacking media freedom

We consider this piece to be a limited recount of the cyber-attack towards Citizens Channel, as the situation is still evolving, technical investigations are still due, as is a response from Meta.

The continuous cyber-attacks on Citizens Channel, a niche non-profit and independent media outlet in Albania, have raised concerns on the safeguard of media freedom in the country, and upholding of constitutional rights such as media freedom and freedom of speech, seriously impacting an already fragile democracy.

These attacks on Citizens Channel can be broken down into three major milestones: cyberattack on their website, Facebook censorship due to content reporting, and a targeted bot campaign on their Instagram page. attack

Since March 2024 the website of Citizens Channel, as the outlet reports, has been a target of attempted distributed denial-of-service (DDoS) attacks. Following the attempts of DDoS attacks, on April 04, was reported a successful in-path attack, where malicious scripts were injected in their server, redirecting their domain first to a porn site, and then to a website which automatically started downloading of malicious content. These continuous attacks on the website drove the outlet to expedite their transition to a new domain (, and migration of all content. The original domain ( and server space where it was hosted, was subject to in-path attacks for a week. Considering the low resources at the outlet’s availability, a proper investigation was not conducted.

Facebook censorship through content reported as spam

Since April 2, Citizen Channel’s content on Facebook has been removed due to systematic reporting as spam or in violation of Facebook’s rules. Examples of removed content are related to issues of public interest such as the construction of the National Theater, the granting of permits for the construction of skyscrapers by the Municipality of Tirana, the abuse of natural resources, and the resistance of the communities in Thirra (Mirdita) and Zall Gjocaj (Mat) against the destruction of nature, reports SafeJournalists Network.

Facebook has policies on what is considered spam if you contact people with unwanted content or requests. For example, sending bulk messages, sending requests to people you don’t know personally, or excessively posting links or images to other people’s timelines. In this case, we are dealing with malicious bots. Malicious bots on these platforms are automated or semi-automated entities used in nefarious ways while simulating human behavior. These bots can be programmed by malicious actors to target specific posts or accounts, leading to the removal of the content without the user’s consent.

As of April 10, more than 2000 posts have been removed from Citizens Channel’s Facebook account. The outlet has reached out and opened cases, through third party support, at Meta, Facebook’s parent company, requesting the restore of the removed content. They yet have to receive feedback from the platform.

Targeted bot campaign on Instagram

On the dawn of April 08, the team at Citizens Channel woke up to a surge in Instagram followers amounting 53,6K followers, compared to the organic 5000 followers. On April 09, another increase of inorganic followers happened, taking the number to 80,000. This drove the outlet to make their account private, as the only guard towards this campaign.

The increase in inorganic followers was a result of a targeted bot campaign. This targeted bot campaign relies on using automated software programs known as bots, which can generate thousands of fake accounts within minutes, complete with profile pictures and generic usernames. Social media bots mimic human behavior to appear similar to real human users and accounts can like, follow, re-share certain content on social networks, according to the orders they receive from their creators. This raises concerns about disinformation, perpetuating propaganda, digital manipulation, the circulation of fake news, suffocation of freedom of speech, digital harassment and hate speech, in turn affecting public opinon and debilitating democracy.

Furthermore, a targeted bot campaign on Instagram disrupts engagment metrics, has the potential of reporting content as spam, resulting in posts being removed from the platform, or the account being banned. In the face of this situation, and considering their experience on Facebook, Citizens Channel shares reasonable concern regarding the loss of their digital voice for issues of public interest. The case has been reported to Meta, Instagram’s parent company.

Moving forward

Cyberattacks against independent media outlets not only restrict the rights and activities of journalists, but also restrict the right to unbiased information of citizens, representing a threat to democratic principles and human rights. Considering the dominance of propaganda in the Albanian information scene unbiased, fact-based reporting is of outmost importance.

Expert investigation into the origins of the attacks is necessary, to fully paint the picture, although attribution is difficult.

In the case of independent media, or other actors of society that act in defense of the public interest, a stronger commitment and investments are needed in regard to cyber security. These investments often translate into high costs that exceed the solvency of public interest defenders.

We call on the international donors’ community to support these investments, especially in terms of tools and resources, and join local partners in providing continuous capacity building, so that cyber resilience of public interest defenders can be built.

We call on the cyber security diaspora to engage in supporting public interest defenders, especially in interacting with platforms, and in facilitating access to tools and resources.

Lastly, we call on the wider Albanian cyber security community to assist and offer support to endangered independent media to safeguard freedom of speech and independent reporting. We call on companies that offer cybersecurity solutions, to provide support through making them available to public interest defenders operating in Albania.