Across Southeast Europe, cases of criminal prosecutions, coordinated disinformation campaigns, and online harassment of individuals and civic groups are becoming increasingly widespread.
Over the past two months, digital attacks in the region have mainly targeted environmental activists, anti-corruption institutions and independent media, according to BIRN monitoring in the Western Balkans, Turkey and Hungary. These actors have not been targeted at random, but because they disrupt existing control systems.
These are not isolated incidents or mere technical failures, but reflect deeper trajectories of democratic decline in contexts where institutions weaken, executive power dominates public discourse, and civic resistance increasingly relies on digital tools to mobilize, investigate, and expose violations.
Citizen actors are currently facing powerful interests with far greater resources and political influence, capable of using an arsenal of digital repression against them. They are not sufficiently equipped – legally, technically or financially – to withstand the pressure.
Environmental activists become targets
Across the region, environmental activism, often intertwined with reporting on corruption related to land use and “strategic investments,” has prompted some of the most aggressive digital reactions, according to BIRN monitoring.
Activists from two northern Albanian areas of natural beauty, Zall Gjocaj and Lufaj, who oppose hydropower projects that threaten local rivers, denounced the creation of a fake Facebook profile targeting community members. The account spread false narratives about their work, undermining years of resistance. The online attacks followed a court ruling in January that dismissed a criminal defamation and insult lawsuit brought against the activists by Seka Hydropower — the developer of the contested projects.
The environmental organization PPNEA (Protection and Preservation of Natural Environment in Albania) also reported cyberattacks on its website. PPNEA is one of the leading voices in the country denouncing environmentally harmful “strategic investments” and misuse of protected areas, including opposition to the Vlora International Airport project. It recently called for the suspension of a $1.4 billion luxury project in Sazan, the brainchild of the US president’s son-in-law and daughter, Jared Kushner and Ivanka Trump.
In Serbia, recent investigations revealed that the Security Information Agency (BIA) had secretly installed the NoviSpy spyware on the phones of at least four farmers and environmental activists protesting against Rio Tinto's multi-billion dollar lithium mine project in 2024. According to Amnesty International, NoviSpy can extract sensitive personal data and remotely activate the phone's microphone or camera without the user's knowledge.
One of the activists, Zlatko Kokanovic from the association Ne damo Jadar (“We Don’t Give Up Jadar”), reported suspicions of phone tapping after pro-government media published excerpts of his private conversations, suggesting a link between state surveillance and digital smear campaigns.
In Montenegro, residents of the southwestern village of Botun who opposed a wastewater project faced online hate campaigns after voting against it.
Community-based environmental movements in Southeastern Europe have emerged in recent years as among the most vibrant expressions of civic mobilization, demonstrating the essential role of local communities in defending the public interest in the face of growing political and corporate pressure. Meaningful spaces for civic engagement — both online and offline — are shrinking due to digital attacks on these groups, reducing opportunities for public consultation and accountability.
Attacks on judges and anti-corruption institutions
Albanian Prime Minister Edi Rama and Deputy Prime Minister Belinda Balluku (left), who is under criminal investigation for violating equality in public tenders. Photo: LSA.
Another consistent trend is the targeting of oversight institutions, including prosecutors, judges, and anti-corruption structures.
In Serbia, pro-government media launched a disinformation campaign against the chief organized crime prosecutor Zagorka Dolovac after she filed charges against ruling party figures. AI-generated content falsely portrayed her as fleeing the country, undermining her credibility.
In Albania, Prime Minister Edi Rama publicly attacked the judiciary over a Constitutional Court decision upholding the suspension of Deputy Prime Minister Belinda Balluku (currently under criminal investigation), as well as over legislation on judges’ salaries. The National Association of Judges condemned these statements as inappropriate pressure that threatens the independence of the judiciary and the rule of law.
Meanwhile, the Special Structure Against Corruption and Organized Crime (SPAK) closed its investigation into a cyberattack against it last year, identifying three former senior prison officials as responsible for leaking data from high-level corruption investigations.
In Hungary, pro-government media outlet Origo falsely accused the head of the Integrity Authority, Ferenc Pal Biro, of misusing public funds to renovate a private home. A court later ordered the publication of a rebuttal.
Efforts to strengthen the rule of law, fight corruption, and protect the independence of the judiciary in Southeast Europe continue, but are constantly undermined by political attacks, both online and offline.
The institutionalization of censorship and the criminalization of speech
Turkey continues to represent the most advanced model of legally integrated digital repression in the region. BIRN has documented several cases in recent months that clearly illustrate this pattern. Journalists and organizations reporting on corruption and human rights appear to be the main targets.
The Association for Freedom of Expression, a civil society organization that monitors online freedoms in Turkey, reported that content about digital censorship had been removed from its website by court order.
Investigative journalist Furkan Karabay was sentenced to over four years in prison for reporting and posting online about the arrest of a mayor. Journalists Hasan Koksoy and Halil Kurklu of the YouTube channel Kendine Muhabir were arrested for reporting on corruption allegations against local authorities. Journalist and writer Enver Aysever was arrested for political comments critical of right-wing narratives online.
The courts also blocked access to the female-run Kurdish agency JINNEWS and the pro-Kurdish platform Mezopotamya News Agency, known for their human rights reporting. With the same vague justification of “national security and public order,” authorities also blocked several accounts on X covering developments in Syria — mostly journalists, parliamentarians, civil society organizations, and leftist groups.
A particularly troubling precedent came when the Constitutional Court ruled in December that use of the encrypted app Signal could be considered evidence of criminal or terrorist activity. By equating secure communication with criminality, the decision puts all users — citizens, journalists, activists, and whistleblowers — at risk.
This is not an isolated case. In a previous case against Turkey, the European Court of Human Rights ruled that criminal convictions based solely on the use of the ByLock app violate the European Convention on Human Rights. In its new prosecution of Signal users, the country appears to be ignoring that ruling.
As democratic control has waned and emergency-style governance has become normalized, courts are functioning less as guarantors and more as enforcement tools.
Platform manipulation and the “engineering of silence”
Digital repression in the region is not limited to state or local actors. It is also enabled by the opaque operations of large online platforms.
Në Serbi, mediat e pavarura Danas, N1, Nova.rs dhe KTV Zrenjanin morën email kërcënues të koordinuar që “paralajmëronin” se llogaritë e tyre në rrjete sociale do të mbylleshin nëse vazhdonin kritikat ndaj presidentit. Kërcënimet u pasuan menjëherë nga sulme të koordinuara me botë që përmbytën llogaritë në Instagram me dhjetëra mijëra ndjekës të rremë, përfshirë median online Radar.
Meta reagoi duke fshirë përfundimisht llogarinë e Radar dhe duke pezulluar përkohësisht të tjera, përfshirë Nova.rs dhe VOICE, duke pretenduar shkelje të “standardeve të komunitetit”. Email të rremë më pas morën përgjegjësinë, duke lidhur qartë mbylljet me kritikat ndaj presidentit.
Kjo përfaqëson një formë “censure me ndërmjetës”, ku manipulimi artificial shkakton zbatim real nga platformat, duke heshtur zërat kritikë pa veprim të drejtpërdrejtë shtetëror.
Edhe llogaria në Instagram e Balkan Insight e BIRN-it u pezullua së fundmi pa shpjegim, përtej një reference të përgjithshme për shkelje të supozuara të standardeve.
Në mungesë të rregullimit në rajon, platformat mund të censurojnë në mënyrë arbitrare përmbajtje legjitime pa shpjegime transparente ose mekanizma efektivë ankese, duke i lënë gazetarët dhe aktorët qytetarë shumë të cenueshëm ndaj heshtjes së qëllimshme apo aksidentale. Në këtë mënyrë, në vend që të jenë ndërmjetës neutralë, platformat shpesh bëhen bashkëfajtore në “inxhinierinë e heshtjes”.
Megjithatë, “inxhinieria e heshtjes” nuk mbështetet vetëm te manipulimi i platformave. Rastet e regjistruara nga BIRN muajt e fundit tregojnë se aktorët qytetarë dhe gazetarët shpesh bëhen objektiv i sulmeve teknike dhe kërcënimeve të sigurisë.
Në fund të vitit 2025, think tank-u serb Qendra e Beogradit për Politika të Sigurisë pësoi mbi 10,000 sulme kibernetike, si dhe fushata phishing dhe imitimi digjital gjatë një konference të madhe sigurie, të lidhura me grupin hacker Forest Blizzard, të kontrolluar nga inteligjenca ushtarake ruse.
Në janar, një faqe e rreme në Facebook që imitonte lëvizjen Studentët në Bllokadë në Serbi u shfaq, duke krijuar rreziqe mashtrimi dhe dezinformimi që mund të minonin fushatat qytetare. Pjesëmarrës të shumtë në protestat studentore kundër qeverisë në Serbi janë përballur me sulme digjitale dhe survejim për më shumë se një vit.
Në dhjetor, media Radar dhe karikaturisti serb Dusan Petricic morën kërcënime me vdekje online që i referoheshin sulmeve ndaj Charlie Hebdo në Francë në vitin 2015. Në Shqipëri, gazetari Osman Stafa mori kërcënime anonime pas raportimit për kushtet në Spitalin Onkologjik në Tiranë. Në janar, gazetarja investigative malazeze Jelena Jovanovic u përball me ngacmime mizogjene për raportimet e saj, dhe autori u ndalua.
Ekspozimi i dështimeve sistemike përmes angazhimit qytetar dhe raportimit në interes publik po shkakton frikësim dhe represion, në vend të llogaridhënies.
Pjesëmarrës në Samitin Botëror të Mbrojtësve të të Drejtave të Njeriut 2018 në Paris. Foto: Protectdefenders.eu
Repression doesn't always come in tanks or official shutdowns. The "plan" from Southeast Europe shows that it can be imposed gradually – through hacked accounts, criminal charges masquerading as justice, algorithmic deletions, covert spyware installations, and mass reputation-destroying efforts.
What unites these cases in the region? The targets: environmental activists, civil society, independent media, and anti-corruption institutions – in short, anyone who challenges the concentration of power in fewer hands.
Why digital repression? Because it offers what overt repression cannot: deniability, speed, and scale. It allows states and their associated actors to silence dissent without officially banning protests, formally closing down media outlets, or imprisoning everyone involved, although Turkey seems to prefer the “all-inclusive” package.
The question is no longer whether civic actors can withstand this pressure alone. They cannot. The real question is whether we are willing to treat widespread digital repression for what it is – a direct and coordinated attack on democracy and not as technical glitches, isolated incidents or an inevitable effect of online life.
Without strong and active support for those targeted, silence becomes the safest option, and spaces for civic engagement and accountability continue to shrink – silently, algorithmically, one (digital) voice less at a time./Birn
