On Thursday, Kyrgyzstan’s parliament approved in a third and final reading, without debate, a bill requiring nonprofits that receive foreign funding and engage in what it defines as political activities to register as “foreign representatives,” according to news reports.
Japarov, who recently defended the law in a letter to U.S. Secretary of State Antony Blinken, has a month to return the bill or sign it into law.
The bill, an amended version of a draft law previously criticized by CPJ, does not directly target news outlets but would apply to media rights organizations and nonprofits that run several of Kyrgyzstan’s prominent independent news websites, according to CPJ’s review.
A new provision requires organizations designated as “foreign representatives” to label their publications as being produced by a foreign representative. Other clauses grant authorities sweeping powers of oversight over the activities of “foreign representatives” and allow them to suspend or shutter nonprofits for alleged violations of the law.
“The ‘foreign agents’ bill passed by Kyrgyzstan’s parliament copies many of the worst aspects of Russia’s foreign agent legislation. It is clearly focused on stigmatizing nonprofits working in news media and threatens to hamstring the work of press freedom organizations,” said Gulnoza Said, CPJ’s Europe and Central Asia program coordinator, in New York. “Kyrgyz President Sadyr Japarov must show that his stated commitment to free speech is more than empty words by vetoing the bill and withdrawing his support for any form of foreign agent law.”
Submitted to parliament in May, the bill has elicited extensive international criticism, including from the United Nations High Commissioner for Human Rights, U.N. special rapporteurs, the Organization for Security and Cooperation in Europe, and Blinken.
The latest version of the bill, amended by parliament in February ahead of the second reading, removes a controversial clause stipulating prison terms of up to 10 years for vaguely defined offenses, according to CPJ’s review and an analysis by the Washington, D.C.-based International Center for Not-for-Profit Law (ICNL).
Under the bill, externally funded nonprofits must apply to a public register of “foreign representatives” if they participate in activities defined by the law as “political”—including “disseminating … opinions on decisions taken by state organs,” issuing public appeals to state organs and officials, and “shaping socio-political views and convictions, including by conducting surveys of public opinion.”
The law would require nonprofits to carry out a costly independent audit report each year, according to the ICNL. It would also grant authorities the right to request their internal documents, to send government representatives to participate in nonprofits’ internal activities, and to check—by as-yet-unspecified means—whether their activities and expenditures correspond to the aims listed in their articles of incorporation, it said. The U.N. special rapporteurs said these clauses “may amount to almost unrestricted administrative control over these associations.”
Authorities would have the power to suspend the activities of nonprofits for up to six months and freeze their bank accounts if they fail to declare themselves as foreign representatives or to label their publications after receiving a warning. Nonprofits that fail to rectify such omissions after suspension can be liquidated by the courts.
In his letter to Blinken, Japarov said Kyrgyzstan needed to ensure financial transparency of media outlets and NGOs. However, Aibek Askarbekov, an independent human rights lawyer, told CPJ that authorities already had full access to financial data of nonprofits, which are required to publish information about sources of income and expenditures online. The bill instead aims at “exerting tight control” over nonprofits, he said.
Parliamentary approval of the bill comes amid an unprecedented crackdown on independent reporting in a country previously seen as a regional haven for the free press. In January, Kyrgyz authorities arrested 11 journalists linked to the investigative outlet Temirov Live and raided the privately owned news agency 24.kg. In February, authorities shuttered the prominent news website Kloop.
CPJ’s emails to Kyrgyzstan’s parliament, lawmaker Nadira Narmatova, who introduced the bill to parliament, and the Office of the President requesting comment on the bill did not receive any replies.
]]>“Alongside Kyrgyzstan’s ongoing media crackdown, jailing of journalists, and Russian-inspired ‘foreign agents’ bill, the vague and repressive mass media bill could have been the nail in the coffin for Kyrgyzstan as a regional beacon for the free press. It is only right that it be retracted,” Gulnoza Said, CPJ’s Europe and Central Asia program coordinator, in New York, said on Wednesday. “Kyrgyz authorities must now engage in meaningful consultation with the media and press freedom advocates to ensure that any new version of the bill allays journalists’ fears that it would be used to silence critical voices.”
Japarov’s spokesperson Askat Alagozov said in a statement that the president ordered the bill withdrawn following a meeting with media representatives and that the draft would be revised, without providing further details.
The bill was proposed in May and entered parliament in December. Journalists and rights advocates feared that provisions requiring registration of internet news websites and expanding authorities’ powers to suspend and shutter press organizations by court order would make it easier for authorities to stifle critical media.
The United Nations Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression and the Organization for Security and Cooperation in Europe criticized the draft bill and called on the Kyrgyz authorities to repeal it.
]]>On Tuesday, the Pervomaisky District Court in the capital, Bishkek, extended by two months the pre-trial detention of Temirov Live director Makhabat Tajibek kyzy and the outlet’s current and former staff members Aike Beishekeyeva, Azamat Ishenbekov, Saipidin Sultanaliev, Aktilek Kaparov, Tynystan Asypbekov, Joodar Buzumov, and Maksat Tajibek uulu, according to news reports.
The court also ordered Temirov Live journalist Sapar Akunbekov and camera operator Akyl Orozbekov released into house arrest and freed the outlet’s former project manager Jumabek Turdaliev under a travel ban.
All 11 continue to face charges of inciting mass unrest, which carries a jail sentence of up to eight years under Article 278, Part 3, of Kyrgyzstan’s criminal code.
“The mass detention of journalists linked to investigative outlet Temirov Live is emblematic of Kyrgyzstan’s intensifying press freedom crisis,” said Gulnoza Said, CPJ’s Europe and Central Asia program coordinator, in New York. “By extending their incarceration, the country’s authorities are signalling their intention to continue this repressive course.”
In a series of raids on January 16, police searched Temirov Live’s office and the 11 journalists’ homes and arrested the journalists over unspecified videos by Temirov Live and sister project Ait Ait Dese. Court documents reviewed by CPJ accused Tajibek kyzy of “discrediting” state organs in those videos, “which could lead to various forms of mass unrest.”
A local partner of global investigative network Organized Crime and Corruption Reporting Project (OCCRP), Temirov Live is known for its anti-corruption investigations into senior government officials and has more than 265,000 subscribers on its YouTube channels. Authorities deported the outlet’s Kyrgyzstan-born founder Bolot Temirov in 2022 and banned him from entering the country for five years in connection to his reporting.
In recent months, Kyrgyz authorities have launched an unprecedented crackdown on independent reporting in a country previously seen as a regional haven for the free press. On January 15, security services raided privately owned news website 24.kg and opened a criminal case for “propaganda of war.” In February, a court shuttered Kloop, another OCCRP partner.
In April 2023, a court ordered the closure of Radio Azattyk, the local service of U.S. Congress-funded Radio Free Europe/Radio Liberty (RFE/RL), but reversed the decision in July after the outlet deleted a report that authorities had demanded be removed.
]]>“After last month’s mass arrest of journalists linked to anti-corruption outlet Temirov Live, the forced closure of Kloop—one of the most respected media outlets not just in Kyrgyzstan but in the whole of Central Asia—signals Kyrgyz authorities’ intent to wipe out an investigative reporting hub that has previously set the country apart from its authoritarian neighbors,” Gulnoza Said, CPJ’s Europe and Central Asia program coordinator, said in New York on Monday. “Authorities in Kyrgyzstan should allow Kloop to remain open, reverse their escalating campaign against the press, and allow independent media to work freely.”
On February 9, Oktyabrsky District Court in the capital, Bishkek, granted an application by the city’s prosecutor to shutter Kloop Media on the grounds that the organization’s charter does not cover journalistic activity, according to news reports.
Prosecutors also cited expert assessments commissioned by the court and Kyrgyzstan’s state security services alleging that Kloop’s reporting contained “harsh criticism” of the authorities and that its “purely negative” coverage was demoralizing the public and causing “psychological disorders,” “sexual anomalies,” drug addiction, and “suicidal disposition” among the population.
Kloop’s chief editor, Anna Kapushenko, told CPJ that the outlet rejected the claims and planned to continue operating pending appeal.
Kloop, a partner of the Organized Crime and Corruption Reporting Project global investigative network, frequently publishes investigative and fact-checking articles critical of Kyrgyz authorities.
On August 22, prosecutors applied to the courts to shutter the outlet on the same day that Kloop published an investigation alleging relatives of senior officials including President Sadyr Japarov were involved in the construction of a soccer academy in Kyrgyzstan franchised by the Spanish soccer club Barcelona.
In September, authorities initiated a block on the outlet’s website days before the publication of another investigation into the president’s family.
In recent months, Kyrgyz authorities have launched an unprecedented crackdown on independent reporting in a country previously seen as a regional haven for the free press.
In January, police arrested 11 current and former staff of the investigative outlet Temirov Live, after deporting its Kyrgyzstan-born founder Bolot Temirov, and security services raided and brought a criminal case against privately owned news agency 24.kg.
Last year, authorities blocked Radio Azattyk, the local service of U.S. Congress-funded Radio Free Europe/Radio Liberty (RFE/RL) for eight months, and ordered it to shutter, until the outlet removed a report about border clashes from its websites.
]]>“By confirming the arrests of 11 journalists—an unprecedented assault on press freedom in modern Kyrgyz history—authorities in Kyrgyzstan are choosing to shatter the country’s long-held reputation as a haven for free speech in Central Asia,” said Gulnoza Said, CPJ’s Europe and Central Asia program coordinator, in New York. “Authorities should immediately release all 11 detained current and former journalists of Temirov Live, withdraw the trumped-up charges against them, and end their crackdown on independent reporting.”
In several hearings between February 1 and February 6, the Bishkek City Court rejected the appeals of current Temirov Live staff Makhabat Tajibek kyzy, Aike Beishekeyeva, Akyl Orozbekov, Sapar Akunbekov, and Azamat Ishenbekov, and the outlet’s former staff Aktilek Kaparov, Tynystan Asypbekov, Joodar Buzumov, Saipidin Sultanaliev, Maksat Tajibek uulu, and Jumabek Turdaliev of their January 16 arrests and pretrial detention, according to reports and Bolot Temirov, the outlet’s founder, who spoke to CPJ by messaging app from exile.
In a series of raids on January 16, police searched Temirov Live’s office and the 11 journalists’ homes and arrested the journalists on charges of calling for mass unrest in unspecified publications by Temirov Live and sister project Ait Ait Dese. If convicted, the journalists face between five and eight years in prison under Article 278 Part 3 of Kyrgyzstan’s criminal code.
Temirov Live is known for its anti-corruption investigations into senior government officials and has more than 265,000 subscribers on its YouTube channels. Authorities deported Kyrgyzstan-born Temirov in November 2022 and banned him from entering the country for five years in connection to his reporting.
In recent months, Kyrgyz authorities have launched an unprecedented attack on independent media. On January 15, security services raided privately owned news website 24.kg and opened a criminal case for “propaganda of war.” Authorities are currently seeking to shutter Kloop, a local partner of global investigative network Organized Crime and Corruption Reporting Project (OCCRP), and last year blocked Radio Azattyk, the local service of U.S. Congress-funded Radio Free Europe/Radio Liberty (RFE/RL), and ordered it closed, reversing their decision several months later after the outlet deleted a report that authorities had demanded be removed.
]]>On Monday, officers from Kyrgyzstan’s State Committee for National Security (SCNS) in the capital, Bishkek, searched 24.kg’s office, confiscated its equipment, and detained the outlet’s general director Asel Otorbaeva and chief editors Makhinur Niyazova and Anton Lymar, according to news reports.
The SCNS said a criminal investigation has been opened into 24.kg for “propaganda of war,” without providing more details, those reports stated. SCNS officers sealed 24.kg’s office and questioned Otorbaeva, Niyazova, and Lymar at SCNS headquarters as witnesses in that case for about 45 minutes each before releasing them, the outlet’s lawyer Nurbek Sydykov told CPJ by telephone.
Separately, on Tuesday, police in Bishkek raided the office of Temirov Live, confiscated its equipment, and arrested and searched the homes of 11 current and former staff of the outlet, the outlet’s founder, Bolot Temirov, told CPJ by telephone.
Local media quoted Kyrgyzstan’s Ministry of Internal Affairs as saying that a criminal investigation had been opened into unspecified publications by Temirov Live and sister project Ait Ait Dese for “calls to protest actions and mass unrest.” Police placed all 11 under arrest for 48 hours on those charges, pending a court ruling on further custody measures, according to reports and Temirov.
Press freedom has sharply deteriorated in Kyrgyzstan over the past two years amid a series of legal attacks on independent media. In 2022, authorities raided Temirov Live’s office and deported Kyrgyzstan-born Temirov. Authorities also ordered Radio Azattyk, the local service of U.S. Congress-funded Radio Free Europe/Radio Liberty (RFE/RL), blocked. The following April, a court ordered the closure of Radio Azattyk, though several months later an appeals court reversed the decision after the outlet deleted a report that authorities had demanded removed. Meanwhile, Kyrgyz authorities are currently seeking to shutter Kloop, a local partner of global investigative network Organized Crime and Corruption Reporting Project (OCCRP).
“Having already cracked down on RFE/RL and Kloop, Kyrgyz authorities are now renewing their assault on key independent media by turning their sights on respected news website 24.kg and once again targeting award-winning anti-corruption journalist Bolot Temirov’s outlet, Temirov Live. Reports that authorities confiscated all the outlets’ equipment on such highly dubious grounds, gaining access to confidential sources, are deeply concerning,” said Gulnoza Said, CPJ’s Europe and Central Asia program coordinator, in New York. “Kyrgyz authorities should drop all investigations into 24.kg and Temirov Live, release all detained current and former members of Temirov Live, and end their repression of the independent press.”
Propaganda of war is punishable by a fine or up to five years in prison, according to Article 407 of Kyrgyzstan’s criminal code. Calling for mass unrest is punishable by between five and eight years in prison under Article 278, Part 3, of the code.
SCNS officers began searching 24.kg’s editorial office at around 11 a.m. on January 15, not allowing the outlet’s lawyers to enter the premises until one and a half hours later, Sydykov told CPJ. Officers took all the outlet’s computer equipment before sealing the office shut, Sydykov said.
As SCNS officers led her from 24.kg’s editorial office, Niyazova told reporters that the investigation was related to one of 24.kg’s reports about Russia’s war in Ukraine. Niyazova confirmed to CPJ via messaging app that the investigation was related to one of the outlet’s publications, but said she was unable to say which one, as investigators made her and her colleagues sign nondisclosure agreements.
Niyazova added that the interrogated 24.kg staff “categorically disagree” with an SCNS assessment classifying the report as propaganda of war, saying she believes the investigation is retaliation for 24.kg’s “independent position.”
24.kg is one of Kyrgyzstan’s oldest online news outlets and one of the country’s leading sources for news, according to media reports. In September 2023, Russian authorities blocked the outlet over its reporting on Russia’s invasion of Ukraine.
Starting at around 6 a.m. on January 16, police in Bishkek and the nearby city of Tokmok searched the homes of Temirov Live and Ait Ait Dese director Makhabat Tajibek kyzy, Temirov Live reporter Aike Beishekeyeva, camera operator Akyl Orozbekov, Ait Ait Dese journalist Sapar Akunbekov, and Azamat Ishenbekov, a folk singer who collaborates with Ait Ait Dese. They also searched the homes of six former Temirov Live staff: Aktilek Kaparov, Tynystan Asypbekov, Joodar Buzumov, Saipidin Sultanaliev, Maksat Tajibek uulu, and Jumabek Turdaliev. Authorities took them all to Ministry of Internal Affairs headquarters in Bishkek or to police headquarters in Tokmok, according to Temirov.
Officers then took Tajibek kyzy to Temirov Live’s office, where they conducted a search, confiscated all of the outlet’s computer equipment, and sealed the office, according to news reports and Temirov.
Temirov told CPJ that it was unclear which of the outlet’s material police allegations relate to, but that none of its publications contained calls to mass unrest. The charges may be retaliation for a series of investigations into the wealth of Kyrgyzstan’s Minister ofInternal Affairs, Ulan Niyazbekov, published by Temirov Live in recent weeks, or a September 2023 investigation into links between President Sadyr Japarov’s son and major construction projects in Kyrgyzstan, conducted with Kloop and OCCRP. But it could also be related to older material, since investigators arrested former staff who had not worked for Temirov Live for over a year, Temirov said.
In December, CPJ and partners submitted a letter to United Nations special rapporteurs regarding Temirov’s arbitrary deportation.
CPJ emailed the State Committee for National Security and the Ministry of Internal Affairs of Kyrgyzstan for comment but did not immediately receive any replies.
]]>In January 2022, Kyrgyz police raided Temirov’s outlet, Temirov Live, two days after it published an investigation alleging corruption by family members of the head of Kyrgyzstan’s state security services. Police arrested Temirov on drug charges after appearing to plant drugs on him in that raid, and later added charges that Kyrgyzstan-born Temirov forged documents to obtain a Kyrgyz passport. A court acquitted Temirov on the drug charges and found him guilty of using forged documents but did not apply a punishment as the statute of limitations had expired. In spite of this, authorities later deported the journalist as additional punishment for the forged documents charge.
Read the letter, which alleges that Kyrgyzstan violated international law with Temirov’s deportation, in full below.
On Wednesday, Kyrgyzstan’s parliament passed in a first reading a bill requiring nonprofits that receive foreign funding to register as “foreign representatives,” according to news reports.
Semetey Amanbekov, a member of local advocacy group Kyrgyzstan Media Platform, told CPJ by telephone that the main aim of the legislation is to stigmatize nonprofits as “untrustworthy foreign agents,” saying authorities could use it to target media rights organizations as well as nonprofits that run several of Kyrgyzstan’s prominent independent news websites.
The bill would require organizations to provide regular, detailed reports on their activities, including an audit of funds received from foreign sources and the use of those funds, the composition of their management, and the number of employees and their salaries. In addition, they would have to publish a report on their activities in the media every six months.
Local human rights group Bir Duino said the requirements were “excessively burdensome” and provided “a path to the destruction of civil society organizations,” and the U.S.-based news organization Eurasianet warned that the costs involved could prove “unsustainable” for smaller non-governmental organizations (NGO).
“Amid Kyrgyz authorities’ ongoing campaign to silence leading independent media, plans to copy Russia’s foreign agent legislation threaten to seriously hamper the work of press freedom groups and further restrict the country’s beleaguered free press,” said Gulnoza Said, CPJ’s Europe and Central Asia program coordinator, in New York. “Kyrgyzstan’s parliament must show that it still respects its international obligations to safeguard human rights and freedom of expression by rejecting any attempts to stigmatize nonprofits as foreign agents and criminalize their work.”
In addition, the bill introduces a fine or up to 5 years in prison for creating an NGO that “incites citizens to refuse to perform civil duties or to commit other illegal acts,” and a fine or up to 10 years in prison for “active participation” in or “propaganda” of such NGOs. In an October 13 statement calling on Kyrgyzstan’s parliament to reject the law, a spokesperson for the United Nations High Commissioner for Human Rights called this offense “ill-defined, broad and open to subjective interpretation” and said it could be used for “selective prosecution of legitimate human rights advocacy.”
Under the proposed law, state authorities would also have the right to request NGOs’ internal documents and to send government representatives to participate in NGOs’ internal activities, according to an analysis by the Washington, D.C.-headquartered International Center for Not-For-Profit Law.
On October 6, three United Nations special rapporteurs urged Kyrgyzstan to withdraw the bill as some provisions were contrary to the rights to freedom of association and freedom of expression, the right to non-discrimination, and the right to privacy. It said that proposals to give authorities the right to conduct unscheduled inspections could constitute “a tool of potential intimidation, surveillance, and harassment by authorities, which could be used against organizations that voice criticism or dissent.”
A similar “foreign agents” bill was submitted to parliament a decade ago but was rejected in its third reading in 2016 after facing opposition from civil society. In November 2022, a new version was presented, with the term foreign agent replaced with “foreign representative.” In May 2023, 33 lawmakers introduced the latest draft to parliament for discussion.
The bill defines nonprofits as “performing the function of a foreign representative” if they receive funding from foreign sources and participate in political activities, which it defines as “the organization and conduct of “political actions” aimed at influencing government policy or the “formation of public opinion”—a definition that the U.N. criticized as “overly vague”.
Organizations that fail to declare themselves as foreign representatives could have their activities and banking operations suspended for six months.
CPJ’s emails to Kyrgyzstan’s parliament and lawmaker Nadira Narmatova, who introduced the bill to parliament, did not receive any replies.
This year, authorities blocked and applied to shutter major independent outlets Kloop and Radio Azattyk, the local service of U.S. Congress-funded broadcaster Radio Free Europe/Radio Liberty, and in 2022 prominent Kyrgyzstan-born investigative journalist Bolot Temirov was deported in retaliation for his work.
In September, Kazakhstan published a register of organizations and individuals, including journalists and media outlets, receiving foreign funding without explicitly labeling them foreign agents.
In March, Georgia’s government withdrew a bill that would have labeled media outlets as foreign agents after public protests.
]]>“Following their recent application to shutter the outlet and now their threat to block its website, Kyrgyz authorities’ appetite for retaliation against Kloop for its uncompromising anti-corruption reporting appears to know no bounds,” said Gulnoza Said, CPJ’s Europe and Central Asia program coordinator, in New York. “Authorities in Kyrgyzstan must cease all efforts to silence Kloop and repeal the false information law, which has once again proven its only purpose is to shield officials from criticism.”
On Thursday, September 7, Kloop received a letter from Kyrgyzstan’s Ministry of Culture, Information, Sport and Youth Policy warning that if the outlet didn’t remove a September 1 article within 48 hours its website would be blocked under the country’s false information law. The letter did not specify which information was false and followed a complaint against the outlet by the State Committee for National Security.
The article cited a jailed opposition politician’s allegations of ill-treatment—which he had posted on his personal Facebook page and was widely reported by Kyrgyz media—and included a rebuttal of the politician’s claims by the country’s penitentiary service.
Kloop does not intend to remove the report, the outlet’s co-founder Bektour Iskender told CPJ by phone, and the outlet has filed a complaint with the ministry. Iskender said Kloop has been expecting such a step from authorities and set up a mirror website in February.
On August 22, authorities applied to shutter Kloop after the outlet published an investigation alleging the involvement of relatives of Kyrgyzstan’s president and the head of the State Committee for National Security in the construction of a Barcelona soccer academy in Kyrgyzstan.
Kyrgyz authorities previously blocked Radio Azattyk, the local service of U.S. Congress-funded broadcaster Radio Free Europe/Radio Liberty, for nine months from October 2022, and restored their access following the removal of a report from the outlet’s websites.
]]>“It was a very traumatic week. Sleepless. Very stressful. We could not publish our statement, the first statement of Mohamed’s detention,” SJS secretary general Abdalle Ahmed Mumin told CPJ in an interview from the U.K., where he fled earlier this year after he was repeatedly arrested by Somali authorities. “Imagine someone attacking your team, detaining one of your team, and you’re not able to communicate to the international world because your website has been taken down.”
SJS found some relief when it connected with Qurium, a Sweden-based nonprofit that began hosting SJS’s website. But a week after the initial attack, another DDoS flood hit the website. This time, Qurium was able to protect SJS from going offline. Qurium’s analysis of these additional attacks also found that a U.S. company, RayoByte, had provided the tools used in the attack.
Sprious, which owns RayoByte, told Qurium in an email, which CPJ reviewed, that it had “removed the abusive user” from its network and added the SJS site to its “blacklist” to prevent it from being targeted further.
SJS isn’t the only news outlet that has suffered a DDoS attack using RayoByte’s services. News outlets from at least five other countries — Kosovo, Nigeria, Kyrgyzstan, the Philippines, and Turkmenistan — have faced similar attacks over the last two years, according to Qurium’s analysis. These incidents provide a rare look at the mechanics of online censorship efforts and how private corporations can profit from them.
Sprious declined CPJ’s requests for an interview and did not directly answer a list of written questions. But in emailed statements to CPJ, Sprious said it was “deeply concerned” about reports that its services were “allegedly” used in DDoS attacks. “We firmly stand against any form of online harassment or harm, including cyber-attacks, especially when it concerns entities that play a crucial role in promoting press freedom and the safety of journalists,” it said.
Headquartered in Lincoln, Nebraska, RayoByte, formerly known as Blazing SEO, is one of many companies that sells clients access to Internet Protocol (IP) addresses, unique numbers assigned to internet-connected devices, for “scraping,” a method for extracting large amounts of data from websites. RayoByte’s website lists a range of prices for access to IP addresses based on variables including type and speed.
One way to conduct scraping is through repeated requests to visit a site with different IP addresses. Journalists and researchers use scraping as a research technique, but when IP requests are directed quickly and en masse toward a specific site in order to overwhelm it and knock it offline, this constitutes a DDoS attack.
CPJ has documented DDoS attacks against outlets conducting critical journalism around the world. These cyberattacks also often take place alongside other threats to journalists’ safety and press freedom.
Qurium’s analysis shows that it blocked nearly 20,000 IP addresses from hitting the SJS website with millions of requests on August 18 and 19. The largest portion of the traffic (nearly 50%) came via RayoByte and its hosting partners, the analysis said. The second half of the traffic came through several other online channels, including virtual private networks (VPNs).
“We were very effective at mitigating the attack because within a few hours we realized we had seen this type of traffic before,” Qurium’s technical director Tord Lundström told CPJ. “We have met this [attacking] infrastructure in the past…this infrastructure is no joke.”
Similar DDoS attacks began almost immediately after Kosovo-based news site Nacionale began publishing in March 2022, covering local politics and social issues, co-founder Visar Arifaj told CPJ in a recent phone interview. “Our website would be down quite often. Because we were still fresh in the news market, it really had an impact for us to reach our audiences,” Arifaj said. “For us to be down a couple of hours during the day was a huge blow.”
Qurium began hosting and defending Nacionale in September 2022, and in March and April 2023 Qurium notified Sprious that attackers had been using its services against the outlet.
In emails from March, Qurium informed Sprious of attacks lasting “several hours non-stop.” One of the attacks “sourced” millions of web requests from IP addresses “publicly advertised by Rayobyte/BlazingSEO,” Qurium said. Sprious responded that it had “blacklisted” access to Nacionale’s website and it had barred the “user” responsible – which Sprious did not name — from accessing its services, but in April Qurium again tracked a DDoS attack against Nacionale involving RayoByte. In response to Qurium’s email about the April attack, Sprious said it had “discovered an issue” with its “security controls,” and had addressed it “to prevent further traffic.”
However, RayoByte-sourced internet traffic to Nacionale’s website did not stop and featured in DDoS attacks against the outlet in July and August, Lundström told CPJ. While Kosovo police arrested and prosecuted one man in connection with the cyberattacks and Qurium has successfully prevented the continued attacks from taking Nacionale offline, Lundström told CPJ that incoming traffic shows attackers continuing to harness IPs from a combination of proxy services, VPNs, and other sources.
Alongside the cyberattacks, Nacionale’s staff have been subjected to “constant” online harassment for their work and were recently physically attacked on the job, though those attackers have been arrested, Arifaj told CPJ. “This constant pressure, even when it doesn’t get to the journalists physically and in a direct manner, you can see that it does a lot for their burnout,” he added. “It does take a toll, mentally, on everyone.”
Since 2022, Qurium has additionally tracked DDoS attacks with IPs sourced from RayoByte against four other outlets: Peoples Gazette from Nigeria, Kloop from Kyrgyzstan, Bulatlat from the Philippines, and Turkmen.news, which reports on Turkmenistan from exile. The attacks on three of the four outlets, excluding Kloop, also involved traffic via VPNs.
In its statements to CPJ, Sprious said it investigates reports of DDoS attacks using its services and takes “appropriate actions with the end user that we believe is responsible” and “steps to mitigate the reported issues, including, but not limited to, blacklisting associated domains and working diligently to remove abusive users.” The statements did not respond directly to CPJ’s requests for details of the customers responsible for these attacks and how the company responded in each case.
Lundström told CPJ that Sprious has yet to respond to Qurium’s emails concerning the attacks on Peoples Gazette, Kloop, Bulatlat, and Turkmen.news, as well as the additional attacks on Nacionale in July and August.
Proxies and VPNs have valid and important uses for ensuring internet users, including journalists, can maintain privacy online. Rights organizations, including CPJ, recommend the use of VPNs to defend against surveillance; individuals can use it to avoid state-backed online censorship, and companies use them to safeguard proprietary information. But Lundström described the use of proxy and VPN services to conduct DDoS attacks as a “weaponization” of these tools. “You’re hiding in a tool [made] for another purpose,” he said of the attackers. “I think it’s a strategic decision.”
“DDoS attacks are illegal under a section of the [U.S.] Computer Fraud and Abuse Act,” Gabe Rottman, director of the Technology and Press Freedom Project at the U.S.-based Reporters Committee for Freedom of the Press, which provides legal support to journalists, told CPJ. But he said that it is not necessarily illegal for proxy or VPN companies to provide services that are then used in DDoS attacks.
That doesn’t mean service providers can’t take actions. “You can have technology providers doing appropriate things to protect their users and others at the same time as they build their service in a way that protects privacy,” Rottman said. “If … you become aware of bad actors doing bad things, notify the authorities, stop them from using your service, mitigate the damage.”
Attacks on the SJS website have continued, Lundström told CPJ, though none of the IPs have come via RayoByte since Qurium and CPJ contacted Sprious for comment. Nevertheless, Lundström wants RayoByte’s leadership to do more to address the fact that attackers have repeatedly come to the company’s services to target media sites. “[RayoByte’s] making all the money,” he said. “And we have to do all this extra work and build new infrastructure to deal with all this shit.”
As for SJS, Abdalle remains worried about his colleague, who is still behind bars. But he says he’s confident that the press freedom group’s website will remain accessible. He still doesn’t know the identity of the person or people who launched the cyberattack, but he imagines what they might be thinking: “Now they are witnessing, they are coming into a new reality that even after the attack SJS is still resilient. SJS is still active. SJS is still available and is able to work and operate effectively both online and physically inside Somalia.”
Editor’s note: The first name and title of Qurium’s technical director Tord Lundström was added in the 11th paragraph.