Cyber Incident Victim: Citizens Channel
Date:
Apr 2024
Location:
Albania
Summary
A coordinated cyber attack targeted an independent Albanian media outlet, involving both the mass removal of its Facebook content labeled as spam and a suspected DDoS attack disrupting its website. The incidents resulted in the near-total elimination of the organization's social media presence and forced migration to a new web platform. The non-profit outlet, known for reporting on public interest issues like human rights and government accountability, faced significant operational disruption, with concerns raised about deliberate efforts to silence critical journalism. Sector analysts highlighted the disproportionate impact on niche media and called for investigations into organized attacks while criticizing social media platforms' role in censoring legitimate content. The incident reflects broader challenges to press freedom and access to independent information.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On April 1, 2024, Albanian online media outlet Citizens Channel experienced a coordinated multi-platform disruption beginning with the removal of its content from Facebook. The first ten posts were removed on Tuesday evening, March 26, flagged as "spam content" by the platform. This escalated the following day with hundreds of additional posts removed, deleting 80-90% of the organization's Facebook content. Director Lorin Kadiu reported that the removed content included investigative articles about construction companies occupying public spaces. Concurrently, Citizens Channel's website suffered a cyber attack characterized by unusual traffic patterns consistent with a Distributed Denial-of-Service (DDoS) attack. Kadiu described both the content removals and website disruption as appearing "coordinated," noting the timing suggested a deliberate effort to silence their reporting.
The attacks significantly degraded Citizens Channel's operational capacity, forcing migration to a new website on April 4. SafeJournalists network confirmed the outlet's profile, work, and security were compromised, emphasizing the disproportionate impact on niche media reliant on carefully cultivated audiences. Blerjana Bino of Safe Journalists Albania noted the removals erased years of audience-building efforts in hours, narrowing space for critical journalism amid increased propaganda from bot networks. Citizens Channel, a donor-funded outlet focused on human rights, public finance, and environmental issues, faced professional reputational damage from being misclassified as spam despite rigorous fact-checking practices. Response actions included technical migration to the new platform and plans to investigate the attack's origins. SafeJournalists called for solidarity and technical support, while digital rights advocate Megi Reci demanded investigations into organized attacks and criticized Meta's censorship mechanisms for enabling human rights violations. The incident occurred amid Albania's stagnation in media freedom rankings, with Reporters Without Borders documenting government attacks on critical journalists and restricted information access.