Bots, Portals and Propaganda: How Macedonia Is Being “Brainwashed” from Bulgaria

While casually scrolling through social media, many Macedonian citizens have no idea who might be behind the portals that bait them for clicks. Thousands of users are shown provocative headlines, bombastic statements, short videos or photos with a strong emotional charge about the Macedonian-Bulgarian political dispute. Some of the posts stoke intolerance between Macedonians and Albanians, while others glorify Bulgaria’s military power.

They share statements suggesting that Macedonians and Bulgarians are the same people, or posts captioned “Bulgarians in the Constitution”. Some accuse the Macedonian authorities of following directives from the Kremlin, or claim that 300,000 citizens paid to become Bulgarians.

The provocative posts attract hundreds of reactions, shares and comments in which social media users insult each other and exchange harsh and vulgar words.

Some of this content is produced by a dozen portals which the National Security Agency confirmed in March this year are an organised network that, through propaganda activities, incites hatred, intolerance and violence between Macedonian and Bulgarian citizens in both countries.

Behind the network’s activities is a Bulgarian citizen who has been carrying them out via social media for a long time, according to the ANB “from the position of a non-state proxy actor serving the hybrid undermining of Macedonia’s strategic European integration processes and endangering European security”.

He was assisted by a Macedonian citizen, a 30-year-old from Skopje, against whom criminal charges were filed for “spreading racist and xenophobic material through a computer system”.

The Agency acted together with the Public Prosecutor’s Office and the Bureau for Public Security “based on previously obtained information indicating subversive propaganda activities by domestic and foreign non-state actors, and after seizing propaganda materials aimed at provoking ethnic and national intolerance, discord and hatred among citizens”.

The same individuals also shared content inciting national and ethnic discrimination on the Facebook page “Historical Facts about Macedonia”.

The ANB says that, together with other competent authorities, it will continue to take action to detect and prevent acts that discredit and offend the feelings of citizens and endanger national and regional security.

The foreign citizen behind the instigation and financing of the subversive propaganda activities has been banned from entering the country.

The Bureau for Public Security told IKS that no similar cases have been recorded in Macedonia so far.

The Intelligence Agency said it is unable to respond to requests for more details about the case, explaining that it is not authorised to comment on or publicly share intelligence information.

“In accordance with its legal competences, the Agency collects intelligence on threats and risks from abroad in order to protect national security, and informs the President of the State, the Prime Minister, the Speaker of Parliament and other state administration bodies, depending on the issue concerned,” the Agency said.

The Public Prosecutor’s Office is still gathering evidence in the case, after which a prosecutorial decision will be made. However, the evidence gathering concerns only the Macedonian citizens involved – in this case the 30-year-old from Skopje who was found to have assisted the Bulgarian citizen.

Who, and whose interests, stand behind the bot network?

In March, Macedonian media reported that Viktor Stoyanov, a Bulgarian citizen and president of the “Macedonia” Foundation, is the person named in the complaint for spreading racist and xenophobic material through a computer system. Stoyanov is publicly known for his denialist and offensive statements about the Macedonian people and state.

The home page of the “Macedonia” Foundation, which he heads, states that its goal is for “Bulgarian and Macedonian society to become one society in two states, to build bridges in all spheres of life – economic, cultural, social and societal”.

The ANB stated that the activities were carried out “from the position of a non-state proxy actor” – meaning that the actor did not carry them out for his own state, but for someone else.

Stoyanov’s narratives match those of the Bulgarian parliamentary party Vazrazhdane (Revival), led by Kostadin Kostadinov. Their dominant themes are the alleged non-existence of the Macedonian people – the so-called artificial identity of Macedonians – and historical revisionism.

The party has signed a cooperation agreement with United Russia, the ruling Russian party and the main political pillar of President Vladimir Putin. Last year, Vazrazhdane supporters led the protests against the introduction of the euro in Bulgaria.

Sources in the Macedonian security services say that Stoyanov, although close to the party, is not a member of Vazrazhdane, and that his activities are directed against Macedonia in the service of Russian hybrid policy.

In the country, Stoyanov owns an entire media network – portals, Facebook pages, profiles on X. There is even a popular podcast whose guests include current and former politicians, professors, analysts and journalists. All the equipment used to produce the podcast was purchased and financed by Stoyanov, security sources say.

In one of his social media posts, Stoyanov explains that the Foundation has created “at least ten Bulgarian media outlets and one television studio” in Macedonia, and asks for financial help so that, as he puts it, “the Bulgarians of the Republic of North Macedonia can open more than 50 media outlets and many television studios to exert strong influence”.

According to security sources, one of the Macedonian citizens involved in running these portals is an activist in an association of Macedonians with Bulgarian self-identification, and was also a Vazrazhdane candidate in the last elections in Bulgaria.

The reason Macedonian citizens get involved in running these portals is most often financial.

One of the outlets is considered the main, central one, and the same narratives are spread from it through clone portals. This is essentially how a bot network works. Through coordinated activity on social media and with the help of algorithms, they create false legitimacy and impose artificial topics and views on the public. Tactics, techniques and procedures of foreign information manipulation and interference can be recognised in this coordinated operation. Their aim is to increase hatred between the citizens of the two countries and to bring that narrative to the widest possible audience, while on the ground materials are printed that could provoke protests and physical incidents.

Russia’s hybrid activity is dynamic and takes various forms, security sector sources say. While anti-EU narratives were used in the period before NATO membership, the current focus is on reopening frozen conflicts – that is, the dispute with Bulgaria is being used as a tool for propaganda activities. Through the negative campaign, the goal is to sow doubt in state institutions, Euroscepticism, negative reactions and a hostile atmosphere.

Foreign interference – hard to prove

Propaganda activities aim to devalue the state, provoke inter-ethnic or inter-religious unrest, or make the population lethargic, explains Zlate Dimovski, a professor at the Faculty of Security in Skopje, part of St. Kliment Ohridski University in Bitola. This, he adds, plays into the hands of extremist structures that do not want the country to progress. According to him, such activities took place over a long period before the war in Ukraine.

“All of that weakened the capacity of citizens, their morale and their beliefs, leading them to believe that the state was not powerful enough to deal with everything Russia was putting out, and it ultimately culminated in war. In our case I don’t mean the same thing, but here there will be continued – I would call them attacks – hybrid activity that works together with other elements. Everything that falls under hybrid warfare is a broad concept covering many activities that we may not necessarily classify as a security threat or risk, but we can assume that this tension will continue,” says Dimovski.

Metodi Hadji-Janev, a professor of international law at the Military Academy in Skopje, part of Goce Delchev University in Shtip, says it is very difficult to prove who is behind cases of foreign information manipulation and interference, because similar methods are used not only by opponents of Euro-Atlantic integration, but also by actors from the business sector and other fields.

“Whether the Bulgarian state or proxy individuals are behind this is for the investigation to prove and establish. However, in a time of mass digitalisation and the convergence of two worlds – the digital and the physical – the assumptions and regulations designed to work in the physical world, where you have established methods of verifying and confirming identity and so on, cannot be applied so easily in the digital world. Even if a state actor is behind such methods, it is very difficult to prove,” the professor says.

However, Hadji-Janev believes citizens themselves can recognise when they are reading a text published by the bot network.

“You will notice that some words are coined using the Bulgarian alphabet. All of that is language that should be a ‘red flag’, a signal that something about the information is not entirely clean – although, for the sake of democracy and democratic principles, we should leave it to every citizen’s right to choose whether that information is for them, whether they can form a view on it and how they will react to it. Why is the reaction important? Because they need to understand that the information has been placed to provoke an impulse, since that is later used in the geopolitical struggle that Bulgaria imposes, using it from a position of strength as an argument that we are intolerant towards our neighbours,” says Professor Hadji-Janev.

Making “foreign information manipulation and interference” a criminal offence

Foreign information manipulation and interference has not yet been formalised as a criminal offence in the Macedonian justice system. The hybrid activities of non-state proxy actors disrupted in early March are being prosecuted as “spreading racist and xenophobic material through a computer system”.

The question of regulating and possibly sanctioning foreign influence and information manipulation is sensitive because of the fine line beyond which it can encroach on the right to freedom of speech.

The Government of North Macedonia told IKS that it is continuously working to improve and formalise the response to foreign information manipulation and interference. The aim, they add, is not to ignore the situation but to act institutionally, with a comprehensive approach, because no single institution can respond to these challenges on its own. So far, they add, there is no single model that is best suited for application, and for that purpose they will carry out a comprehensive analysis to find the best solution.

Professor Dimovski explains that in such cases of foreign interference, people most often call for legal restrictions and limits on certain activities, without realising that propaganda activities are not easy to recognise.

“The fact is that the judiciary, that is, the courts, work with evidence. We will not be able to provide evidence for all of this. It is a fact that instruments exist, at the international level, but we must understand that everything that spreads here goes through our media – many media outlets created precisely for that purpose in our country,” the professor says.

Professor Hadji-Janev says regulation depends on two factors: the willingness to sacrifice democracy, that is, the inviolability of the right to speech and freedom of expression, up to the point where they would endanger national security. The other question, he adds, is how national security will be defined – whether, besides the army and police, it will also cover the other instruments of political power: information, the digital world, the economy and diplomacy.

“If you redefine it that way, you could adopt a legal solution. What the results will be remains to be seen, because so far it has been shown that you automatically generate fodder for those who instigate information manipulation. For that you would need a flawless system that knows how to govern well, that is utterly honest, that has the maximum capacity for strategic communication with the public when information is conveyed, and that simply has enough political virtue to admit any mistake, corruption or anomaly,” says Hadji-Janev.

He adds that the “fog” is also created by the fact that some of these activities come from European Union countries, not only from countries with authoritarian regimes.

In conditions where it is not possible to recognise foreign influence, Professor Dimovski says citizens’ capacity to recognise attacks – on identity, the state and progress – as well as threats to personal security, which in his view is part of collective security, will have to be strengthened.

“Unfortunately, security culture is built from an early age. We can take many countries as examples, and Israel is a classic example of how children learn security culture from an early age – not in the sense of how to survive an attack, but how to take in information as a whole, how to check it, what to do next, what the procedure is,” says Dimovski.

He adds that citizens should rely on official information from institutions, and that security culture is a process that needs to be built over the long term.

This content was produced by the Institute of Communication Studies.

Journalist: Maja Blazhevska Evrosimoska

Camera: Nake Batev

Editing: Risto Dushkovski

This article was translated from Macedonian using artificial intelligence (AI). The original Macedonian version is available here.