CPJ urges Kazakh authorities to investigate cyberattacks on media

Cyberattacks by unidentified perpetrators have targeted at least nine independent media outlets and multiple journalists in Kazakhstan since November 2023, according to data shared with CPJ by local press freedom group Adil Soz, which issued a statement on the attacks January 19, 2024, and several of the journalists, who spoke to CPJ.

The attacks, which have targeted well-known independent media including news agency KazTAG, and popular social media-based outlets like AIRAN and Obozhayu, included distributed denial-of-service (DDoS) attacks and blocking of outlets’ social media accounts through orchestrated mass complaints, causing media to lose access to their audiences and incurring heavy financial costs, those journalists told CPJ.

The latest wave follows a previous series of cyberattacks and physical attacks on independent journalists in Kazakhstan in late 2022 and early 2023. In March, authorities arrested and later convicted five people in connection with those incidents, including one who admitted to ordering the attacks. Despite those convictions, Karla Jamankulova, head of Adil Soz, told CPJ that cyberattacks against the independent press have continued throughout 2023 and intensified since November.

“Kazakhstan’s continuing epidemic of cyberattacks on the press poses a threat not just to the individual outlets targeted but has become a systemic threat to the country’s media and demands a concomitant response,” said Gulnoza Said, CPJ’s Europe and Central Asia program coordinator, in New York. “Authorities in Kazakhstan must conduct a swift and thorough investigation into these attacks and hold all those responsible to account.”

According to data from Adil Soz, the organization recorded 56 incidents of cyberattacks on media outlets and journalists in 2023, up from 37 in 2022. Of those cyberattacks, 36 were against the websites and social media pages of media outlets, and 20 of them targeted the social media accounts of individual journalists.

Since November, DDoS attacks have targeted the websites of at least four independent media – KazTAG, independent news outlet Nege.kz, and business news outlets Kursiv.Media and inbusiness.kz, causing them to be inaccessible for short periods or load slowly, according to reports and Adil Soz. 

A January 5 statement by KazTAG said that the outlet closed access to its website from outside of Kazakhstan to fight the DDoS attacks, but the attacks later resumed from IP addresses located in the building of majority state-owned telecommunications company Kazakhtelecom. Kazakhtelecom denied involvement.

Over the same period, social media accounts or websites of at least four independent media – Kursiv.Media, and social media-based outlets AIRAN, ProTenge, Shishkin_like, and Obozhayu – were blocked by orchestrated mass complaints or by fake accounts posting banned content that triggered social media companies’ automated blocking systems, according to Adil Soz and several of the outlets, who told CPJ that it can take a long time, or prove impossible, to restore the blocked accounts. Kursiv.Media chief editor Mira Khalina told CPJ the outlet ’s Instagram accounts were blocked for over six weeks and that replacement accounts set up by the outlet remain blocked. Dmitry Shishkin, founder of Shishkin_like, told CPJ the outlet was unable to restore an Instagram account wrongly blocked in April 2023.

Askhat Niyazov, founder of Obozhayu, which covers the work of local authorities, told CPJ that in addition to blocking the outlet’s Telegram channel by flooding it with banned violent and pornographic content, perpetrators hacked or blocked the Instagram and WhatsApp accounts of Niyazov, two of the outlet’s journalists, and Niyazov’s parents and wife. Around 4,000 fake accounts left the comment “R.I.P.” under one of the outlet’s YouTube videos.

Mikhail Kozachkov, author of the popular Telegram channel Kozachkov offside, told CPJ that the channel has removed around 750,000 fake accounts posting banned or offensive content since October 2023. In November, dozens of fake Telegram accounts under Kozachkov’s name spread calls for interethnic violence, which is subject to heavy penalties under Kazakh law.

Jamankulova of Adil Soz told CPJ the ongoing attacks are having a “huge impact” on the functioning of independent Kazakh media, which often struggle financially and are forced to divert significant resources to deal with the cyberattacks. Khalina told CPJ that the attacks have cost Kursiv.Media over 19 million tenge (US$42,300) in redirected resources, lost advertising revenue, and other costs.

In January, six of the outlets filed a police complaint over the attacks but are still waiting for police to respond, Khalina said. She described the attacks as an attempt to “disable” independent journalism.

Maricheva of ProTenge told CPJ that while it remains unclear who might be behind the attacks, which usually cost tens of thousands of dollars, they require resources typically available only to wealthy business interests and those with access to state resources.

In November, a closed-doors court in the southern city of Almaty convicted Arkady Klebanov, the son of a former member of the Kazakh elite, of ordering attacks on journalists in late 2022 and early 2023, but declared him insane and ordered him to undergo psychiatric treatment. Several of the journalists targeted by those attacks have expressed skepticism that Klebanov was the real instigator of those attacks.

CPJ emailed the Ministry of Internal Affairs of Kazakhstan for comment but did not receive any reply.