From “ghost users” to “cyborg bots”, a BIRN investigation shows how nationalists in North Macedonia, Greece and beyond are unleashing automated armies on social media to rally the masses.

As the sun dipped over the rooftops of the North Macedonia town of Bitola near the southern border with Greece, the man they call “Cheese” sipped a beer on the Sirok Sokak pedestrian strip. As sundowns go, this one seemed fitting. It was 12 August, the day North Macedonia outlawed the use of the Vergina Sun – a Greek national symbol – in books, on monuments and in public spaces. For Cheese, the ban on “appropriation” of the Classical Hellenic emblem with its distinctive pointy rays was the latest act of surrender in a bitter fight over Macedonian identity.

It was part of a historic deal with Greece to end a 30-year dispute over his country’s use of the name “Macedonia” – which Athens argued implied territorial ambitions over a northern Greek province of the same name and its ancient legacy of Alexander the Great. Under the deal signed in July 2018, the former Yugoslav republic had to change maps and textbooks, abandon all use of the Vergina Sun and – the ultimate betrayal, in Cheese’s view – rechristen itself “North Macedonia”. Sitting in an outdoor cafe as dusk descended, he vowed never to sully his lips with the new name. “I’m a patriot, and I just don’t want my country’s name to be changed,” he told BIRN.

Few people know Cheese’s true identity, though many are familiar with his nationalist views. He is, in fact, Goran Kostovski, a 38-year-old marketing company worker from the capital, Skopje. With almost 10,000 Twitter followers on three continents, Kostovski led a social media campaign in 2018 urging Macedonians to boycott a referendum on implementing the name-change deal, known as the Prespa agreement after the lake near which it was signed. While the Prespa deal promised to unblock Greek opposition to the country’s hopes of joining NATO and the EU, critics saw it as a compromise too far. They hoped a low turnout in the September 2018 referendum would invalidate the result. “It made no sense to tell the world to vote no in the referendum because we feared the government would distort the results,” Kostovski said. “We had to boycott the referendum first.”

Prompting street protests at home and drumming up diaspora dollars abroad, the “#boycott” campaign was a runaway success. While 95 per cent of those who voted in the referendum were in favour of the name-change deal, turnout was only 37 per cent – well short of the 50 per cent minimum threshold. Though parliament later ratified the Prespa agreement anyway, experts say the victory for voter suppression was due in part to a new type of information warfare increasingly seen in nationalist circles. Known as “computation propaganda”, it is what the Oxford Internet Institute at Oxford University calls “the interaction of algorithms, automation and politics”.

Few have mastered the art better than Kostovski, though he is cagey about the methods he uses. “You can say we’re bots, but that doesn’t mean it’s true,” he said, referring to the new foot soldiers of the online propaganda war: bogus Twitter accounts programmed to behave like humans. “We’ve blurred your thinking so you don’t know where our campaign is coming from, and you don’t know where to look first.” While much has been said of Balkan troll farms and fake news factories, less is known about the impact of computational propaganda on the workings of democracy in the region.

A BIRN investigation into nationalist networks on both sides of the name dispute lifts the lid on the online tricks employed to amplify political messages and distort public opinion. It is a journey into an underworld of computer code and conspiracy theories, where “ghost users” and “Twitterbots” meet far-right extremism in a digital hall of mirrors. As much fake buzz as fake news, the activity is designed to create the false impression of a giant online conversation so opinion-makers such as journalists and activists sit up and take notice. In this way, experts say a small group of geeks with laptops can exert an influence way out of whack with their actual numbers, with worrying implications for democratic discourse.

Disinformation “spin cycle”

At the government headquarters in Skopje, the country’s new official name – Republic of North Macedonia – greets visitors as they approach the Ionic columns of the building, renovated five years ago to look like the White House in Washington, DC. It is a stone’s throw from the city’s main square, where a statue of Alexander the Great on a stallion looms over a Classical-style fountain – the result of a taxpayer-funded makeover of Skopje to give it a more antiquarian feel. Many saw the revamp announced in 2010 as an architectural thumbing of the nose at Greece by the government of then Prime Minister Nikola Gruevski after Athens vetoed his country’s accession to NATO in 2008.

Inside government headquarters, Demijan Hadzi-Angelovski, a 28-year-old social media expert at the information ministry, recalled how 10 or so influential Twitter accounts sought to dominate the news agenda in the run-up to the Prespa referendum. Every day, three times a day, a different user would send one or two provocative tweets, which would then be liked and retweeted by an army of automated accounts, he said. The idea was to “trend” on Twitter and get picked up by big news aggregators like Time.mk. “Their goal was to have the news sites view and reproduce these tweets, to make the information more credible,” he said. “They then re-posted the news in a washing machine news cycle.”

According to Information Minister Damjan Manchevski, who oversaw the government’s pro-Prespa referendum campaign, much of the recycled content was fake news designed to discredit the agreement. “More than 10 per cent of articles in that period were pure misinformation,” Manchevski told BIRN in an interview. “The bots on Twitter were the main source of fake news.”

One story falsely stated that people living near the country’s largest army base in the central Krivolak region would be poisoned by depleted uranium brought in for military training if the government ratified the Prespa deal and then joined NATO. An investigation by the Organised Crime and Corruption Reporting Project and the Investigative Reporting Lab Macedonia (IRL) traced the story to Zlatko Kovac, a 50-year-old US-Macedonian who works as a Washington columnist for Russian news agency Sputnik. Kovac did not reply to BIRN’s request for comment. “Kovac collaborates with a number of websites in [North] Macedonia that are part of the propaganda mechanism against the Prespa Agreement,” said Saska Cvetkovska, the chain-smoking editor-in-chief of IRL. “The story was started by Kovac on Facebook, the news was immediately posted on Twitter, dozens of bots reproduced it and then several conservative online media … posted it as a regular news item.”

As a result, Defence Minister Radmila Šekerinska spent a week frantically reassuring people it was not true, Cvetkovska said. In the days before the referendum, other scare stories wormed their way into mainstream news. Media reported that people could be prosecuted for disagreeing with Prespa, that the need to print new money would cause massive inflation and that Greece would get a blank cheque to do whatever it wanted. None of this happened by accident.

“Cyborg bots”

In the runup to the referendum, the Transatlantic Commission on Election Integrity, an initiative of the Danish-based Alliance of Democracies Foundation, noticed a spike in bot activity on its social media monitoring tools. “There is clearly a concerted effort to thwart the democratic rights of Macedonians and delegitimise the referendum vote,” it said in a statement. Two weeks before the referendum, the Digital Forensic Research Lab (DFRLab) of the US-based Atlantic Council think tank, which monitors digital propaganda, published research showing that far-right Twitter accounts were boosting the boycott campaign.

Over a period of nine days, researchers analysed all tweets linked to the hashtags “#Бојкотирам” and “#bojkotiram” (#boycott) – around 23,800 of them. They found that more than 80 per cent were in fact retweets, a 4:1 ratio of retweets to original content that suggested rampant automation. “There was well-coordinated, non-authentic activity that destroyed any normal Twitter talk,” DFRLab researcher Kanishk Karan told BIRN. “Instead of discussing these accounts, they spammed others and bombarded them with thousands of mentions and retweets.” The DFRLab identified the nine most active Twitter accounts that helped the campaign go viral – and Kostovski’s “Cheese” account was among them.

According to Kostovski, the campaign had three main ringleaders: himself, a blogger friend named Igor Pipovski (whose Twitter handle “@m0rban” honours populist Hungarian Prime Minister Viktor Orbán) and Zarko Hristovski, a Macedonian web developer who lives in Norway and built the campaign’s website. “#Бојкотирам belongs to the Macedonian people,” Pipovski tweeted to BIRN when asked about his role in the campaign. “Nobody should take the credit.” BIRN was unable to contact Hristovski but Kostovski expounded on the worldview that he said motivated them all. “We live in the middle of a digital war,” he told BIRN. “We nationalists and patriots on the one side, and internationalists, communists and former communists and social democrats on the other.”

His Cheese account – which is followed by one in three Twitter users in North Macedonia, according to analysis using the Statcounter online monitoring tool – makes no bones about its purpose. A pinned tweet at the top of his Twitter stream says: “A place where you will find plenty of banners, gifs, memes and other propaganda material that will be useful for a successful social campaign. Network against the fatal referendum to change our identity.”

In many ways, Kostovski has as much in common with alt-right white supremacists in the United States as with Macedonian nationalists. His Twitter posts bristle with far-right symbols and conspiracy theories. His Twitter profile picture was formerly a cartoon image of Pepe the Frog, a favourite alt-right emblem. These days, his header has a big “Q”, a reference to the popular far-right “QAnon” conspiracy theory of a “deep state” plot against US President Donald Trump. In a rare public appearance, Kostovski addressed a rally in Skopje two days before the referendum wearing a “Q” hat and a “Make America Great Again” T-shirt.

“We all fight the deep state and globalisation,” Kostovski told BIRN. “We have the same enemies and similar ideologies.” He listed the populists who inspire him: Trump, Orbán, French far-right opposition leader Marine Le Pen and British Brexit Party founder Nigel Farage. Many of his Twitter posts also feature former Trump strategist Steve Bannon. “We were excited about Trump’s election campaign and we tried to copy its methods and symbols,” Kostovski said. “We wanted people especially to believe that Steve Bannon was involved in the [#boycott] campaign.” In one tweet in August 2018, he suggested that the “illegal and treasonous” government of Prime Minister Zoran Zaev was in hock to US billionaire philanthropist George Soros – a familiar figure of hate among far-right groups. “Boycott the illegal #Referendum for the Nazi #agreement,” he added.

Kostovski insisted that he and his fellow keyboard crusaders were in no way out of the ordinary. “In our group, we are all just normal people, with regular jobs and families, and most of us want to remain anonymous on social media.” But BIRN’s investigation shows there is more to Kostovski’s anonymity than meets the eye. Using a crawler application called Twitterbots, a tool created by Athens-based software engineer Dimitris Papaevangelou to assess the likelihood of bot activity, BIRN analysed Cheese’s Twitter output and found he averages almost 110 “actions” per day.

Computer scientists say any number of actions – tweets, retweets, likes and other interactions – over 70 suggests bots are on the loose. While Kostovski said he only used automation in the early days of the #boycott campaign, BIRN’s analysis confirmed that his Cheese persona is what is known in the computational propaganda business as a “cyborg bot” – half person, half machine. These hybrids combine algorithmic automation with human intervention to get past Twitter’s anti-bot defences, since automation is strictly no-go on the social media platform.

Ben Nimmo, a digital propaganda specialist at the Atlantic Council, has described the use of such bots as “a game of numbers”. “If you create a sufficient number of false accounts and automate them, then there is a chance that they appear on the list of trending subjects,” he told this reporter in an interview for a recent investigation by the Athens-based Mediterranean Institute for Investigative Reporting (MIIR). “Social media is therefore the place where, with the proper tactics and five persons, you can generate the impression that five million people are talking about something.”

Scrutiny of Cheese’s network using Sparktoro analytical software revealed that more than 38 per cent of his followers were classified as “fake” – likely to be bots or other tools of computational propaganda. Asked what it was doing to counter such activity, Twitter referred BIRN to its recently updated policy against what it calls “platform manipulation”, which includes spam, “malicious automation” and the use of fake accounts. The company noted that in May 2018, it identified and challenged more than 9.9 million potentially “spammy” or automated accounts. In September, however, it reported “a nearly 50 per cent drop in challenges issued to suspected spam accounts compared to the previous reporting period”.

Diaspora dollars

According to Kostovski, nationalist politicians were quick to jump on the #boycott bandwagon in opposing the Prespa deal. Among them was Filip Petrovski, a former lawmaker with the right-wing opposition VMRO DPMNE party who was involved in “Macedonia Boycotts”, a coalition of almost 30 small right-wing parties, political factions and civic associations. Kostovski said the two met in the summer of 2018 to discuss working together. Contacted by BIRN, Petrovski confirmed that he was actively involved in the boycott campaign. As the main opposition party, VMRO DPMNE’s official position towards the referendum was that people should vote with their conscience, though critics say the nationalist wing of the party was firmly against the Prespa deal.

“We have strong evidence that the centres of these online attacks are linked to the VMRO opposition, but they were not the strongest,” Information Minister Manchevski told BIRN. Rather, he said the most strident opposition to Prespa came from Macedonians living abroad. He cited the example of a Toronto-based businessman named Bill Nikolov, president of Macedonian Human Rights Movement International in Canada. “The most extreme of the diaspora, like him, are second-generation immigrants who have come to the country only a few times for vacations,” Manchevski said. Kostovski said Nikolov funded an anti-Prespa billboard campaign in Skopje after getting fired up online. “Many rich diaspora people with connections saw what we were doing on social media and multiplied our influence,” he said. “Bill Nikolov was one of them.”

Asked to comment, Nikolov told BIRN in a Tweet: “No Macedonian politician (from any political party) has the right to negotiate or change our name, identity and history. They attack and lie about those who defend our basic human rights but won’t defend themselves against those who admit to wanting to erase our identity.”

Kostovski told BIRN the #boycott movement received several thousand euros from Todor Petrov, leader of the World Macedonian Congress, a Skopje-based non-governmental organisation that boasts diaspora members in the United States, Canada, Australia, Italy and Germany. In 1991, Petrov had advocated putting the Vergina Sun on the new country’s flag. His World Macedonian Congress is widely seen as an ultranationalist movement. “The World Macedonian Congress has connections with many Macedonians around the world and it is true that they helped campaign for last year’s referendum boycott,” Petrov to BIRN.

Meanwhile, Kostovski said other politicians “tried to ride the wave we created. And they all demanded – and got – a lot of money from the Macedonian diaspora.” One such beneficiary was Janko Bacev, president of the pro-Russian United Macedonia party, he said — though BIRN was unable to confirm the claim. Asked to comment, Bacev told BIRN: “I won’t comment on provocateurs working for the puppet government in Macedonia.” Bacev was seen at a violent anti-Prespa protest in front of parliament in June 2018 that police quelled with teargas and stun grenades.

“We want our name back”

BIRN’s investigation showed that Greek nationalists on the other side of the border also used computational propaganda to whip up a backlash against the Prespa deal. Again, diaspora activists played a role in turning online propaganda into action on the street, with anti-Prespa anger fuelling the biggest protests in Athens and Thessaloniki since Greece’s debt crisis. “This is a geographical area where large populations were forced in the 20th Century to migrate for economic and political reasons, first to the US, Canada and then to Australia,” said Tasos Kostopoulos, a historian and investigative journalist at the Efimerida ton Sintakton daily paper in Athens. “It is precisely these people, especially the second and third generation, who are involved in a raging fight online, exchanging insults on Twitter with hundreds of trolls and bots.”

Like Cheese, one of the loudest Greek voices in the digital cacophony is a human-machine hybrid, according to BIRN’s investigation. “I AM A GREEK MACEDONIAN!” says the Twitter profile of “Pallas Athena” under an image of the Vergina Sun. “We 3.5 million Greek Macedonians are tired of being robbed of our IDENTITY, HISTORY, NAME AND SYMBOLS! We want our name Macedonia back!”

The sheer number of tweets from Pallas Athena’s account – around 478,000 in five years – is a clear indication of automation, though plenty of the content is clearly human-generated too. According to analysis by TweetBotOrNot, a software application that uses machine learning to classify Twitter accounts as bots or human, there is an almost 70 per cent chance that Pallas Athena is a cyborg bot.

Using advanced metrics and monitoring tools, BIRN extracted and analysed a week’s worth of output from the account – more than 2,500 tweets and retweets. The number-crunching revealed that Pallas Athena’s online actions – human or otherwise – potentially reached no fewer than 9.7 million other Twitter users in seven days. Geolocation analysis showed these users were in 106 spots across the globe including Athens, Toronto, Caracas, Miami and Melbourne. Experts say such numbers show the power of computational propaganda to create an ever-expanding echo chamber from a single account.

Contacted by BIRN, the owner of the Pallas Athena account messaged: “Dear, I am not a bot. ”She identified herself as a Macedonian woman living permanently in Sweden who took to Twitter in 2014 after she “saw the people from Skopje claiming that they have suffered genocide from the Greeks”. “Unthinkable,” she wrote. “I come from Alexander the Great’s [ancient city of] Pella and always my grandmother, Helen, used to talk to me about the crimes of Bulgarians and Turks in the area.

“I started looking into old newspaper records and understood that they [people living in what is now North Macedonians] were committing the real crimes. So I started actively working on Twitter with the Macedonian issue.” In April 2018, she locked horns with Cheese in a public Twitter spat.

“Good night, fellow Greek,” Cheese taunted her. “Good night from a Macedonian from Macedonia.” Pallas Athena replied: “I AM A GREEK MACEDONIAN FROM EDESSA PELLA IN REAL ANCIENT GREEK MACEDONIA, THE AREA WHERE ALEXANDER THE GREAT WAS BORN! Your country has never been part of Ancient Greek Macedonia.” After more exchanges like that, the two cyborg bots blocked each other on Twitter and got on with other business.

For Nikos Smyrnaios, a professor of political economy and the sociology of media and the internet at the University of Toulouse, blaming such animus on technology is only part of the story. “It was not the technology that shaped this deep polarisation in the two countries but the very societies that for decades kept creating the conditions for this computational nationalist propaganda to grow and take root,” he said.

First published on 18 December 2019 on Balkaninsight.com.

This text is protected by copyright: © Kostas Zafeiropoulos, edited by Timothy Large. If you are interested in republication, please contact the editorial team.
Copyright information on pictures, graphics and videos are noted directly at the illustrations. Cover picture: Macedonian nationalists call for a boycott of a referendum on a historic name-change deal with Greece in 2018. Photo: © Robert Atanasovski / AFP / picturedesk.com

This article was produced as part of the Balkan Fellowship for Journalistic Excellence, supported by the ERSTE Foundation in cooperation with the Balkan Investigative Reporting Network.