SNS bots and who organises them

Category: Elections, media and institutions

Period: from 2014

Since 2014, investigative media, hackers and the platforms themselves have described an organised network of accounts, coordinated through a party “internet team”, that praises the Serbian Progressive Party and Aleksandar Vučić on social media and news portals and attacks their critics. In 2020 Twitter shut down 8,558 such accounts, and Meta attributed the network to the SNS internet team. According to BIRN and the weekly Vreme, some users logged in from public institutions' networks during working hours, which means that part of the botting was paid for from the budget. According to available sources, prosecutors and the Anti-Corruption Agency have taken no action against the network.

The internet team and its platforms

The network's activity was coordinated through the party “internet team” of the SNS and a series of programs and platforms: “Valter” (2014), “Fortress”, “Castle” (castle.rs, 2017–2020), VotR2, an app for upvotes and downvotes, and, from 2023, the progress.rs platform.

In 2019 Južne vesti and CINS linked votes on comments to IP addresses registered to the SNS headquarters.

Accounts shut down on Twitter and Facebook

In April 2020 Twitter shut down 8,558 accounts “that were working to promote the ruling party in Serbia and its leader”. In February 2023 Meta attributed a network on Facebook and Instagram to employees of the SNS internet team and to civil servants across Serbia.

Botting at the budget's expense

According to BIRN (2020) and to an analysis of the leaked progress.rs platform database published by the weekly Vreme in October 2026, some users logged in to the platforms from public institutions' networks during working hours, which means that part of the bot activity was paid for out of the state budget. According to Vreme, from 2022 to 2024, 1,241 progress.rs users logged in from the networks of 231 public institutions, with 94 percent of logins between 7h and 16h. Vreme notes that a login from an institution's network does not prove that every user is employed there.

Jovana Brajović, a member of the SNS employed at a company that works for EPS, said publicly in 2023 that she had worked as a bot for eight years under threat of dismissal.

SNS responses

The SNS responses ranged from silence and refusal to confirm to open acceptance: in 2020 Vučić said he had no idea what it was about, and in 2023 he posted “Yes, I am an SNS bot”; MP Vujadinović told the National Assembly “we will keep doing it”.

Prosecutors and the search of a student's flat

According to available sources, prosecutors and the Anti-Corruption Agency have taken no action against the network.

In October 2026 the Higher Public Prosecutor's Office in Belgrade said that a student's flat had been searched on a court order on suspicion of unauthorised access to a computer. This followed a post by lawyer Ivan Ninić saying the student was suspected of creating the website ocisti.net with a database of bots.

Claims of a bot centre in the VBA

In November 2026, former Military Union president Novica Antić claimed on N1 that the director of the Military Security Agency, Đuro Jovanić, organises the wiretapping of journalists and activists and has set up a bot centre that operates from a military facility and monitors social media.

The Ministry of Defence said the VBA has no bot centre and has not wiretapped any of them, calling the claims “slander and malicious falsehoods”.

Participants

Serbian Progressive Party: According to Meta, BIRN and CINS, its internet team and civil servants ran networks of inauthentic accounts, partly during working hours (responsible)
Aleksandar Vučić: Said in 2020 he had no idea what it was about, and in 2023 posted "Yes, I am an SNS bot" (commented on the case)
Miloš Vučević: Said he could not confirm the list and that this is not done in an organised way (commented on the case)
Vladimir Đukanović: Said he had not heard of the portal and that, if the finding was accurate, he would congratulate the internet team (commented on the case)
Slaviša Mićanović: Dismissed claims of a secret internet team and pointed to the Internet Council set up in 2012 (commented on the case)
Milimir Vujadinović: Told the Assembly he was on the list of bots and would keep doing it (commented on the case)
Nebojša Bakarec: Launched the "Yes, I am an SNS bot" counter-campaign on Twitter (commented on the case)
Bratislav Gašić: Posted a photo of himself in a T-shirt reading "I am a bot" in July 2023 (commented on the case)
Agency for the Prevention of Corruption (until 2020 the Anti-Corruption Agency): Did not comment on the "Castle" case and, according to Nenadić, did not react even after the accounts were shut down (oversight and the public)
Twitter (now X): Shut down 8,558 accounts which, it said, promoted the ruling party and its leader (oversight and the public)
Stanford Internet Observatory: Its analysis of the suspended accounts concluded that the link to the SNS had not been precisely established, but that the network was aligned with Vučić's efforts (oversight and the public)
Meta (Facebook, Instagram): It removed a network of accounts and attributed it to the SNS internet team and civil servants (oversight and the public)
BIRN: According to its investigation, hundreds of people logged in to "Castle" during working hours, and the IP address in the code belongs to the SNS headquarters (oversight and the public)
CINS (Centre for Investigative Journalism of Serbia): According to its investigation, SNS activists used the VotR2 application to vote on comments from the IP address of the party headquarters (oversight and the public)
Južne vesti: According to their findings, more than 22,500 votes on comments came from a single IP address at the SNS headquarters (oversight and the public)
Bureau for Social Research (BIRODI): Together with Civic Turnaround, it called on the SNS to disband its bot factory and demanded an anti-bot law (oversight and the public)
Balkan Free Media Initiative (BFMI): Together with Clemson University, it found 332 accounts and almost 40,000 messages over 12 days of the campaign (oversight and the public)
CRTA (Centre for Research, Transparency and Accountability): Observer mission's account suspended after bot attack (January 2026) (harmed)
Higher Public Prosecutor's Office in Belgrade, Special Department for High-Tech Crime: It said a student's flat had been searched on a court order on suspicion of unauthorised computer access, and that he had not been arrested (investigation and courts)
Ivan Ninić: He posted that police, on the prosecutor's orders, were arresting a student suspected of creating a website with a database of SNS bots (oversight and the public)
Ministry of Defence of the Republic of Serbia: It dismissed as slander Novica Antić's claims that the Military Security Agency has a bot centre and wiretaps journalists and activists (commented on the case)

Victims and others harmed

Jovana Brajović