The Russian GRU and Prigožin's Agency tried to undermine Montenegro

Today, its three websites and social media accounts have been shut down, but the company has provided Facebook experts with data sets that point to the agency's modus operandi, which included a network of fake profiles that shared its sarcasm.

While the experts of the American Stanford University point out that the Russian military intelligence service GRU is behind the "news agency", the Montenegrin Digital Forensic Center (DFC) has established the involvement of the Internet Research Agency (IRA) of Yevgeny Prigozhin.

What both the American and Montenegrin sides agree on is that the idea started from the same address, Moscow, and with the same goal - undermining Montenegro, but also that their activities did not produce the expected results.

By the way, Prigozhin is the head of the Wagner mercenary army, which is participating in the Russian aggression against Ukraine.

After launching a one-day rebellion against Moscow on June 24, he fell out of favor with Russian President Vladimir Putin and currently has asylum in Belarus.

 

The head of the Border Control Department of the Ministry of Internal Affairs, Velibor Vučinić, told RSE that Prigožin "has not been recorded in the electronic records of crossing the state border" of Montenegro since 2018.

 

RSE requested information for the period from 2016, the same year when the portal was opened, but Vučinić said that they do not have data for that period, because according to the Law on Border Control, records are kept for five years.

 

The Russian embassy did not respond to questions about suspicions of meddling ahead of the 2016 parliamentary elections, through this "news agency".

 

Experts from Stanford dealt with the "agency" from Montenegro

The connection of the "Montenegrin news agency" with the Russian GRU is mentioned in a study prepared in 2019 by representatives of the Stanford University Internet Observatory.

 

The study points out that the "agency" was aimed at "creating untrue stories and conspiracy theories in order to cast doubt on the regularity of the parliamentary elections in 2016, undermining then Prime Minister Milo Đukanović."

According to the authors of the study, Rene DiResta and Shelby Grossman, the goal was to reduce the chances of Montenegrin joining NATO.

However, eight months later, in June 2017, Montenegro will become a member.

They analyzed information from social networks, which was provided to the US Senate Intelligence Committee by Facebook. Facebook attributed the provided information to the activities of the GRU.

DiReste and Grossman note, however, that GRU operations "overlap with several other Russian entities, including Yevgeny Prigozhin's IRA Agency."

Analyzing the data, they found that GRU operations "generally follow an established tactic, known as information laundering, in which a story is planted or fabricated and then legitimized through a chain of repetition or citation" on other channels.

The 'electoral fraud' in Montenegro also reached the Russian TASS

This is exactly how the story about the European Commission's suspicions of electoral fraud in 2016 in Montenegro reached the Russian state news agency TASS.

The evening before the parliamentary elections, the TASS agency, referring to the "Montenegro news agency CGNA" and its sources, reported that the European Commission was concerned that they could be stolen.

Radio Free Europe then warned that it was a portal intended for election purposes, on which texts were published that did not correspond to the Montenegrin language, and that TASS did not withdraw the news despite a denial from Brussels.

Even today, after less than seven years, you can find this news from the "Montenegro News Agency" from 2016 on TASS.

 

The political context of these events

And a few days before the October 2016 elections, some Serbian portals also carried the story of the "Montenegro News Agency" about the dubious affairs of the then Prime Minister Milo Đuković - "How to steal millions in Montenegro and stay in power".

This story can still be found today on two portals from Serbia.

In response to these elections, the cyber attacks of the Russian services were also intensified. Behind the attack, as they claim in the DFC, are the services of the GRU, "that is, their ATP28 group Advanced Persistent Threat 28, known as Fancy Bear".

 

The Democratic Party of socialist Milo Đukanović secured another four-year mandate in those elections, which remained in the shadow of the coup attempt.

In mid-April 2017, the Special State Prosecutor's Office will indict 14 people, including two Russian citizens, allegedly agents of the Russian GRU - Vladimir Popov and Eduard Šišmakov - for attempted coup d'état.

After the Court of Appeal overturned the conviction in February 2021, the entire case was returned to the Podgorica High Court for a retrial. The process is ongoing.

 

Sources indicated a connection with Pirgožin's Agency

And DFC researcher Milan Jovanović for RSE assesses that the GRU and the IRA jointly worked to undermine Montenegro that year.

"Based on publicly available information about the activities of the GRU and our sources, who are familiar with the activities of Prigožin's IRA, the DFC concluded that the 'CGNA' was created by the joint capacities and activities of those two entities," Jovanović explained how they determined the connection.

He added that there had been examples of "synergy of action" between the GRU and the IRA before, highlighting the example of the 2016 presidential election in the United States.

 

'Jelena' and 'Milko' spread the content on the networks

The representatives of the Stanford Internet Observatory also found similarities between the profiles that Facebook attributes to the GRU. In their biographies, it is often stated that they are independent journalists or that they have graduated from political science faculties, they only talk about one topic and have only one photo.

 

These similarities correspond to "Jelena Rakočević" and "Milko Pejović", who shared content from the CGNA pages on social networks and forums.

"Jelena" introduces herself as a freelance journalist who earned her master's degree in international relations at the University of Montenegro in 2013.

It was established that her profile photo was stolen from the account of a real person from the Russian social network Vkontakte, and the number she left was actually the contact of the representative office of the car company "Mercedes" in Montenegro.

"Milko" claimed that he studied at the Faculty of Political Sciences. He published articles and posts with linguistic errors that were against Montenegro's membership in NATO.

 

It turns out that his picture was also stolen from Vkontakte, and the Stanford study states that Facebook removed his profile.

Agency: 1,530 posts, few reactions

Data that Facebook forwarded to the US Senate show that in less than seven months of activity, CGNA had 1,530 posts on that social network, with a small number of reactions.

Jovanović from DFC says that Facebook's data "indicates that the action did not have a big impact" on social networks.

"Nevertheless, we believe that the interactions and virality of the posts were not the goals, but the marketing of anti-Western and anti-NATO content from the supposedly Montenegrin media, which the Russian media could later refer to," he said, citing as an example the alleged news about concerns of the European Commission.

In their study, Stanford University representatives also assess that the distribution of CGNA content "seems limited".

Montenegro, as well as the international community, often highlight the problem of Russia's malignant influence in the region.