When he visited the grave of the Jašari family in early January, the president of the Republican Party (registered as a party of the national minority), Nikola Sandulović, was detained by members of the Security Information Agency. News of his arrest broke out on the X social network, formerly Twitter. Through an organized campaign, using dangerous narratives, a network of accounts that includes Kosovo's political leaders, obscure analysts and lobbyists from the West, as well as fake accounts, tried to present Sandulović as the leader of the Serbian opposition, and accuse Serbia of working to raise tensions with Kosovo.
By using hate speech directed against Serbia, propaganda and misinformation, this network creates fertile ground for destabilizing already strained relations in the region. The goal of this research is to show how the X network is used to frame false narratives with the ultimate goal of discrediting Serbia in the international community. Posts are published exclusively in English and are targeted at a Western audience.
Researching disinformation and misinformation on social networks requires the identification of several basic parameters. It is important to map key actors, their narratives, to determine whether propaganda is carried out in an organized manner through campaigns, but also to determine the connection between accounts in the network.
FALSE LEADER
On the X network, Nikola Sandulović tries to present himself as the "only true leader" of the Serbian opposition. He was a welcome guest in Pristina, which is confirmed by the fact that he met with Albin Kurti on several occasions. However, in the Serbian political reality, his party is registered as a party of the Hungarian national minority and has never had representatives in the National Assembly.
Sandulović is a controversial person in many respects. He claims that he was an adviser to Zoran Đinđić, when in fact he was only a member of his security for a very short time. In the White Book, published in 2001, he was linked to organized crime, the media wrote.
In the midst of the corona virus pandemic, he was one of the "internet experts" claiming on his Facebook profile that states receive 3.000 euros for every patient they mislead as sick. He also talked about toxic dust from airplanes, the alleged harmfulness of the 5G network, the deep state, and similar topics. He did not remain a conspiracy theorist for long, but instead transformed himself into an agitator for Serbia's entry into NATO and the European Union, and on behalf of his party he signed an agreement on the mutual recognition of Serbia and Kosovo.
Why is Sandulović even important to this story?
Although not a key actor in the entire process that is the subject of this research, it is a starting point for mapping and understanding the network. Also, it is itself often the "narrative" that unites the network of accounts.
MESH
Research shows that the IX network consists of four key account categories. The first group includes accounts belonging to real people in Serbia, such as Sandulović, his lawyer Cedomir Stojković (@FIGHT_4_RIGHT_S), as well as the @DissidentAnswer account, which belongs to Boban Bogdanović. The last is an alleged political dissident with a controversial past who became known to the public after he gave an interview to KRIK claiming that he knew who was behind the murder of Oliver Ivanovic. It turned out that the information was not correct, which Bogdanović himself later admitted and changed the story. Representatives of the Serbian authorities on a couple of occasions brought Bogdanović into contact with official Pristina.
The task of these accounts is to present themselves as relevant actors in Serbia, and to support accounts from Kosovo in order to give weight to their propaganda narratives. Although probably no one in Serbia believes that the aforementioned trio has any political weight, we should not forget that the targets of the campaign are people in the West who are not thoroughly informed about the events in Serbia.
The second category consists of the real accounts of various supposed experts from the international community. Most important for this research is Gunter Fehlinger (@GunterFehlinger), an Austrian economist who actively lobbies for Kosovo by spreading false narratives about Serbia. His account, which follows almost 60 thousand profiles, occupies one of the most important places in the network.
The third category includes accounts of real people, but from Kosovo, some of whom use hate speech and spread misinformation. One of the most active is the account @admirim, behind which stands a certain Admirim Luboteni, an expert in marketing and communications; it is ironic that it was he who once held trainings to combat disinformation. I also admire accounts like @arianakra, @thisisKaltri, @AgimAlickaj, or @GallopeniMergim belong to the so-called X influencers. They are followed by several thousand people, while @admirim has more than 30 thousand followers.
Finally, the last category includes hundreds of "fake" accounts that glorify the great Albania and are activated in an organized manner to promote certain topics by publishing, liking, commenting or forwarding the posts of accounts from the first three categories. Some of these accounts were recognized by the X network itself as breeding grounds for hate speech, so they were blocked.
The network usually works as follows. When one of the Pristina officials publishes a post on X, the post very quickly receives a large number of interactions. X-influencers, fake accounts, but also people from Serbia then en masse start to repost and comment using mostly similar narratives, and in that way raise the visibility of the posts.
When it comes to accounts belonging to analysts and lobbyists from abroad, they also interact with X influencers and fake accounts, and there is no significant difference in the narratives. For example, Nikola Sandulović's account mainly interacts with the accounts @GunterFehlinger and @admirim.
NARRATIVES AND CAMPAIGNS
The activities of the network were observed in this research from the beginning of January 2024 to the end of May. In that period of time, in addition to practically daily announcements, several events were identified during which the activity of the network increased significantly. The first event was the already mentioned arrest of Nikola Sandulović. In addition, the network intensified after the cancellation of the dinar in Kosovo, the incident in Banjska, the incursion of Kosovo special forces in the north, the holding of the All-Serbian Assembly in Belgrade, as well as the European Football Championship.
The events that trigger the network, that is, after which one can see increased activities in the form of organized propaganda campaigns, do not necessarily have to be of a political nature. Already in the first days of the European Championship, the network began to spread aggressive narratives towards Serbia, usually using vulgar and offensive terms, but also accusing Serbia of using football and the championship as a platform for "calling for war against Albanians".
One of the narratives that is often used is the labeling of Serbs as a "genocidal nation", and the equating of Serbia with Russia, and President Aleksandar Vučić with Russian President Vladimir Putin. These events, when the activities of the network intensify, point to the fact that it is an organized campaign that tries to shape the attitude of public opinion, in this case in the West.
The entire network uses similar narratives. However, while bots and trolls are mostly engaged in reposting, other accounts are trying to start some discussion online.
Dominant narratives during the network's research period include highlighting Serbian war crimes in Kosovo, constant provocations, criticism of both the Serbian government and opposition, historical revisionism, use of the Srebrenica Genocide Resolution to characterize Serbs as a genocidal people, promotion of Albanian war crimes from the Kosovo war , denying the KLA's crimes, but also attacking Albanian members of civil society in Kosovo who are not supporters of Kurti's Self-Determination.
Also, by constantly equating Serbia with Russia, Vučić with Putin, and Kosovo with Ukraine, the network tries to impose the discourse that Kosovo is threatened by an armed intervention from Serbia.
In March of this year, the Kossev portal published an article explaining how the organized campaign against Đorđe Bojović, Viola von Kramon's parliamentary adviser, was conducted. The warrants on IX accused him en masse of denying and relativizing Serbian crimes from the war in Kosovo. The original video in which Bojović speaks was edited, while a part was taken out of context and published on X. The video reached more than 55 thousand people. In this case, the ultimate target was Viola von Cramon.
The disputed video was posted by the account @Dardha93, quite active in the network. The identity of the person behind the account is not known, but the very fact that it is followed by almost 10 thousand people indicates that it is not a troll or a bot, but one of the X influencers who is hiding his identity. An advanced internet search yielded some results that could not be fully verified, so his name will not be listed. It is most likely a member of the Kosovar emigration in the United States of America.
Accounts from the second category (alleged experts from the West) also follow the given agenda, mainly writing about Serbian war crimes and calling on the international community to take measures against Serbia. In addition to lobbying, their tasks are to raise the visibility of propaganda announcements abroad.
SOPHISTICATED TROLLS
At the beginning of the research, the question arose whether the "fake" accounts are malicious bots or trolls. The key difference is who is behind them. Bot accounts are managed with the help of an automated script, and as a rule, they are of lower capacity, while there is a person behind the trolls. One person can and generally manages multiple troll accounts.
Since social network X changed its policy on free API tokens in the middle of last year, most bot and troll detection tools have stopped working. Therefore, detection today is much more difficult and generally has to be done manually.
However, research has shown that these are most likely trolls. They are, however, still different from classic Internet trolls, who are mostly recognized by their aggressive tone, use caps-lock, frequent grammatical errors, open threats towards dissenters and constant repetition of the same phrases. The troll accounts that are the subject of this research are much more complex. They also follow an agenda, just like basic trolls, but they do it in a much more sophisticated and advanced way.
Troll accounts within this network look alike. They start from the point of view of Greater Albanian nationalism and use identical narratives. They try to present Albanians as a superior race, especially to their Serbian neighbors, whom they usually label as "savages" and "archenemies" of civilization. They use profile and cover photos in which they glorify Albanian national heroes, but also follow each other. Also, they massively follow the account of lobbyist Gunter Fehlinger, but he also follows a significant part of them. It's not often you see a verified account with a lot of followers – like Gunter's – being directly linked to obscure accounts.
One more thing connects all accounts within the network – unreserved support for Aljbin Kurti and his Self-Determination. An investigative journalist from Kosovo was the first to publicly accuse Kurti of having an army of trolls behind him.
......
TROLL CASTLE
For the purposes of this research, a script was developed that cross-referenced data about accounts from the network on Ix. The results are presented through a visualization made in Gephi software. The visualization shows the interaction between accounts that have been mapped by research as part of a network that spreads disinformation and propaganda narratives. Due to the strict policies of X, the visualization covers only part of the order.
The red dots represent the most active accounts belonging to one of the first three categories. The closer accounts are to the core of the map, the more connected they are to the rest of the network. The red and black lines connecting the orders show their connection.
The grouping of accounts and the way the network is formed suggests that it is a troll trap. This term indicates the existence of an "internet army" that organizes campaigns on social networks. Troll castles are not a new phenomenon, nor were they invented by Kurti's regime, but the way in which this one was organized in Kosovo indicates that propaganda activities were approached very seriously. Propaganda activities are also carried out on other networks, such as Facebook, where people in Kosovo and emigration are targeted, but postings in English and X make it possible to directly target Western public opinion.
The red dot closest to the center is the account @thisiskaltri. The position of this account indicates that it is extremely connected to the network. Consequently, the more red dots are connected to other accounts, the more likely they are to be inside a troll castle themselves.
The approach to propaganda warfare used by Self-Determination has only two goals - creating a negative image of Serbia and raising tensions. The latter, after all, has already been largely achieved.
This text was created with support Metamorphosis Foundation from Skopje.
The views expressed in the text are solely the views of the author and do not represent the views of the Metamorphosis Foundation.
