CRTA in the Crosshairs

A case study of media reporting on Serbian election observer CRTA

Monitoring period: 1 September–4 October 2026

This case study is part of the ongoing media monitoring that the SHARE Foundation is carrying out during the 2026 election campaign in Serbia, covering 25 national online media outlets and the most popular social media. Between 1 September and 4 October 2026, the monitoring recorded a sharp rise in negative coverage and a smear campaign targeting the Center for Research, Transparency and Accountability – CRTA – an organisation that has built a reputation over the past decade as a credible independent election observer in Serbia. During the period analysed, a total of 130 articles mentioned CRTA in a markedly negative context, mostly in tabloid media.

Most of the coverage in the corpus focuses on disputing the organisation’s identity, while none of the claims made in the published articles offers a reasoned challenge to CRTA’s methodology. In the middle of an election cycle, most media outlets are systematically challenging the legitimacy of the civil society organisation with the greatest authority in election observation in Serbia. Media close to the ruling structures play a central role in this process.

Of the 25 outlets monitored, 12 have published articles in which CRTA is the target of a smear campaign. Some of them generate content challenging CRTA’s legitimacy, while others pick it up, keep it on the agenda and further intensify the established narrative. The absence of arguments and facts to support the claims made in these articles suggests that their purpose is to undermine public trust in an organisation that consistently sheds light on irregularities in the electoral process and the misuse of public resources.

Although continuous, the attacks on CRTA are growing in intensity as the election approaches. While there were days at the start of the monitoring period with no articles referring to CRTA in a negative tone, such articles were published almost daily during the final eight days, from 27 September to 4 October.

The highest number of articles was published on 27 September, the day after CRTA declined Aleksandar Vučić’s invitation to take part in a debate on RTS, followed by Sunday 4 October, when an audio recording was released in which a lawyer from CRTA’s legal team, Vladimir Tupanjac, can allegedly be heard advising people that, ‘if they really have to’ attack the police, they should do it smartly and ‘put their hoods up’. The media attacks on CRTA come from four main sources: the top of the executive, party operatives, pseudo-independent bodies and anonymous social media accounts.

The attacking narrative can be grouped into six types of discrediting claims: that CRTA is a political party in disguise; that a member of CRTA’s legal team joined the Republic Electoral Commission (RIK) in its expanded election-period composition, on behalf of the Student List; that CRTA is funded from abroad; that CRTA’s research is rigged; that it is preparing to contest the election; and that it is implicated in violence.

The techniques the media used to discredit CRTA include, among others, status reclassification – insisting that the organisation is not an independent election observer but an electoral participant – and false attribution of affiliation, linking speakers at a student press conference to CRTA even though they are not its members. Others were using details from CRTA members’ biographies to damage the organisation’s credibility; ‘chain’ association with other organisations or individuals without evidence of any such link; and pre-emptive delegitimisation, pre-emptively presenting findings that CRTA might publish on election day under the guise of breaking news.

The target of the attacks was most often the organisation as a whole, but also named individuals within it, such as Vukosava Crnjanski, Raša Nedeljkov and Pavle Dimitrijević, as well as the lawyer Vladimir Tupanjac.

During the monitoring period, the attacks on CRTA passed through three stages: challenging its impartiality, reclassifying its status and financial delegitimisation. The next three phases are currently under way: personalisation, pre-emptive challenging of findings and criminalisation. The final three phases that may follow are institutional action, attacks on election-night findings and a legislative outcome – in effect, making the organisation’s work impossible.

Building a negative image of CRTA

Most of the negative articles about CRTA (101 of 130) were published on six portals in the corpus: Kurir, Informer, Novosti, B92, Alo and Politika.

Kurir and Informer published the most articles, 19 each. While Informer is where news targeting CRTA is produced – and its articles are the longest of all the outlets analysed – Kurir is where the attacks are picked up and amplified. Novosti also republished a large number of articles (18), but this portal also produces news attacking CRTA and is the first to publish it. B92 likewise republishes articles from other outlets (17), but its coverage is notably free of a sensationalist tone.

Ten or more articles were also recorded on Alo (15), which produces news attacking CRTA and publishes it first, and on Politika (13) and Pink (10), which republish rather than create news about CRTA.

As the election nears, the attacks intensify

The intensity of media attacks on CRTA increases as election day approaches: from 27 September to 4 October, there was hardly a day without articles targeting CRTA.

The highest number of articles in a single day was recorded on 27 September (26 articles), the day after CRTA declined an invitation to take part in a TV debate on the national public broadcaster, Radio Television of Serbia (RTS) with Aleksandar Vučić and Ilija Srdanović, who heads the Student List and had also turned down the invitation.

‘Brutal cowardice of the fake elite!’ and ‘PANIC AMONG THE BLOCKADERS – THEY DON’T DARE EVEN IF THREE AGAINST ONE’, the media wrote that day.

Two days later, on 29 September, nine articles targeting CRTA were published, prompted by Aleksandar Vučić’s appearance on Informer TV, where he said that CRTA was ‘no objective observer’ but an ‘active participant in a colour revolution’.

The last day of monitoring, 4 October, had the second-highest number of articles (22) in the observed period. That day, the media published a recording, allegedly of CRTA’s lawyer, in which he advises students that, if they attack the police, they should do it ‘smartly’, that is, wear hoods. The media are using the case to call for his arrest and for the organisation to be banned.

The first wave of attacks on CRTA was recorded on 2 and 3 September, when a total of 11 articles mentioned the organisation in a negative context. At the time, the media were republishing a post from the @BiseriDrugeSrbije social media account about the participants in a press conference on the discovery of spyware, organised by representatives of the student movement.

The account posted that it was finally known ‘who the “plenum” is’. Among the speakers listed in the post was Ana Toskić Cvetinović, who was presented as an ‘NGO star, a member of CRTA, but also of many other NGOs, liberal, pro-antifa organisations’. Ana Toskić Cvetinović is the executive director of Partners Serbia and is not employed by CRTA.

In this wave, CRTA was also targeted in articles recounting a TV Nova S report on Aleksandar Vučić’s letter to pensioners, in which a CRTA representative was one of the interviewees.

The next wave of attacks was recorded on 6 and 8 September, when 20 markedly negative articles about the organisation were published. The context was the reaction of the Speaker of the National Assembly, Ana Brnabić, to statements made in the media by CRTA representatives, and the organisation’s report on the campaign the ruling party launched before the election was called.

In those days, the media reported that Vukša Dragović had ‘exposed CRTA’, publishing biographical details of the organisation’s representatives and information about its funding.

Two more waves of attacks were recorded in mid-September. On the 13th and 14th, five articles were published about the ‘alleged victims’ of the sound cannon at the protest on 15 March, mentioning CRTA as one of the organisations that had signed a letter to state authorities. On Wednesday 16 September, seven articles were published claiming that CRTA was the ‘Student List’s representative on the Republic Electoral Commission’.

Aleksandar Vučić: CRTA’s most frequent attacker in the media

Sources of media attacks on CRTA, whether referred to in headlines or leads, were identified among senior executive officials, party operatives, pseudo-independent bodies and anonymous social media accounts.

Aleksandar Vučić – former President of Serbia and head of the ‘Aleksandar Vučić – United Serbia’ electoral list – was identified as the source of the attack in half of all the articles in the corpus. There were 66 such articles, and Vučić made his harshest statements at the end of September.

‘Everyone knows that CRTA is no objective observer, that they are under the thumb of Western intelligence services. They are active participants in a colour revolution, in training, participants in the made-up sound cannon,’ Vučić said on 29 September, as reported in the media.

Vučić had also mentioned CRTA the day before, on 28 September, claiming that on election day CRTA would announce ‘at 4 or 5pm’ that there had been many irregularities. The media reported this statement too.

The second most frequent source of attacks, in a total of 24 articles, was Ana Brnabić, Speaker of the National Assembly and acting President of Serbia following Vučić’s resignation.

After the head of CRTA’s legal team, Pavle Dimitrijević, said that ‘every record is being broken in this election campaign when it comes to erasing the line between party and state’, Brnabić posted on social media that this confirmed CRTA was not just a civil society organisation but an ‘active political participant’.

The media reported her response with comments such as ‘Brnabić had to draw CRTA a picture’.

On 8 September, the media also reported Ana Brnabić’s reaction after CRTA asked the Anti-Corruption Agency to gather evidence on the costs of a Serbian Progressive Party (SNS) rally in Užice. CRTA argued that voting for the ‘United Serbia’ list had been promoted at the rally, even though the election had not yet been called.

‘Brnabić teaches CRTA a lesson’ and ‘Brnabić hits back hard at CRTA’, the media wrote, reporting the Speaker’s claims that CRTA ‘makes things up and talks nonsense’ so that, after the election, ‘they can justify their fake research’.

Another frequent source for media attacks on CRTA was Vukša Dragović, leader of the organisation ‘Serbian Sovereignists’, who regularly posts content on his social media accounts targeting media outlets and civil society organisations.

Unlike most sources, Dragović produces content rather than commenting on it. Videos he posted on social media during the monitoring period prompted 14 articles on the Informer, Kurir, Novosti, Alo and Politika portals. On 8 September, Dragović posted that CRTA was ‘a political party using the Student List to stand in the election in its place’, which the media then reported.

Another prominent media source during the period was Mario Spasić, representative of the ‘Council for Monitoring, Human Rights and the Fight against Corruption – Transparency’, whose statements were reported in five articles.

Spasić’s organisation, identified in independent analyses as a so-called GONGO (government-organised non-governmental organisation), presents itself as an impartial actor while challenging the credibility of civil society organisations, including CRTA. This was the case on 19 September, when the media reported the organisation’s claim that CRTA, BIRODI and New Serbian Political Thought were not credible sources of research because they were ‘on a foreign payroll’.

SNS officials Vladimir Đukanović and Milenko Jovanov appear as sources of media attacks on CRTA in a total of seven articles, prompted by CRTA’s refusal to take part in the pre-election TV debate. ‘You are absolutely participants in the electoral process, and blatantly partisan,’ Đukanović said, as reported by the media on 27 September.

In two articles, the source of the attack was caretaker Interior Minister Ivica Dačić, who condemned lawyer Vladimir Tupanjac’s ‘instructions’ (to activists’ attacks on the police, as alleged by the media) and called on the judicial authorities to act urgently. This was the first time in the monitoring period that the minister responsible joined the attack with a call for judicial action.

Anonymous and pseudonymous actors also served as sources of the media attacks, such as the @BiseriDrugeSrbije account on X and a Kompas columnist writing under the pseudonym Vuk Svetovid.

Six recurring claims

Six key claims recur across the analysed articles that mention CRTA in a negative context, appearing in various combinations in all the outlets monitored. None of them offers a reasoned challenge to the methodology CRTA uses to monitor and analyse electoral processes; instead, they all aim to undermine the organisation’s identity, motives and legitimacy.

One of these discrediting claims is that CRTA is a political party in disguise. On 8 September, for instance, the media reported claims by Vukša Dragović that CRTA is ‘using’ the Student List to take part in the election in its place. 

Attacks on CRTA by the Speaker of the National Assembly, Ana Brnabić, most often concerned the organisation’s status.

‘PREPARING A NEW ALIBI FOR ELECTION DEFEAT! Ana Brnabić responds to CRTA’s Dimitrijević: You are an active political participant in these elections’, reads one of the headlines analysed.

The second recurring claim in the media is that a member of CRTA’s legal team sits on the extended RIK, nominated by the Student List. This is the only claim in the entire corpus with a verifiable factual core. 

‘So, there are no students, there is no Student List, there is only an NGO hydra,’ reads part of a social media post by Vukša Dragović, which the media went on to republish.

The media also spread the claim that CRTA is funded from abroad, in order to discredit the organisation and as supposed proof that CRTA’s goal is ‘to bring Serbia down’.

On 8 September, Informer claimed that CRTA’s budget exceeds 300 million a year, listing the foreign donors that had funded CRTA’s projects. From this, Informer concluded that CRTA’s intention and goal were ‘to bring Serbia down and install a puppet government’. This is a technique in which a supposed fact is used to prove an unprovable claim.

To dispute CRTA’s current projections of the election results, the media published or republished claims that CRTA’s research is rigged, citing, among other things, sociologist Ivan Živkov’s comment that in 2023 CRTA had projected that the ‘Serbia Against Violence’ coalition would win 51 per cent of the vote in Belgrade, which did not happen.

Another claim repeated by the media and their sources is that on election day CRTA will withdraw its observation mission, declare the election invalid and ‘bring people out onto the streets’ – in other words, that it is preparing to contest the election. Informer’s editor-in-chief, Dragan J. Vučićević, described this on 29 September as the ‘blockaders’ plan B’, while on 28 September Aleksandar Vučić even named the time it would happen – ‘at 4 or 5pm’ – which the media reported.

The sixth claim, repeated across several outlets, is that CRTA is behind the violence, or turns a blind eye to it. The claim appeared as early as 4 September in a column published on B92, which said that instructors from CRTA were advising blockaders that, if they attacked the police, it was best to be masked. The column offered no evidence for this. A month later, the media published an audio recording that confirms the sentence from the column almost word for word, claiming that the voice on it belongs to Vladimir Tupanjac, a lawyer on CRTA’s legal team. It remains unclear how the media obtained the recording and whether it is authentic.

Discrediting techniques and tactics

None of the 130 articles in the corpus challenges any specific methodological procedure that CRTA uses in its core work of observing electoral procedures. Instead, they challenge the organisation’s real identity and motives.

Among the techniques identified, status reclassification stands out: persistently insisting that CRTA is not an independent observer of the electoral process but a participant in it, and that it is not a civil society organisation but a political one.

In this way, CRTA is delegitimised and portrayed as an actor that, as an alleged active participant in the electoral contest, cannot provide independent analysis of the election results, the campaign or the electoral atmosphere.

In early September, Students in Blockade called a press conference to announce that the devices of some students and opposition politicians had been infected with advanced spyware. One of the speakers was Ana Toskić Cvetinović, executive director of Partners Serbia. The media wrongly identified her as a ‘member’ of CRTA and then used this to argue that CRTA is not objective and independent in political life but has taken sides – namely, that it is close to the student movement. This is the technique of false attribution of affiliation.

The media also discredited CRTA through its representatives, using biographical attacks: they went after the organisation by publicising details from the biographies of people in its management. 

Another technique observed was chain association, in which each link is used as proof of the next, while none is actually proven. The media thus claimed that CRTA had links to the Slavko Ćuruvija Foundation, Dinko Gruhonjić and Veran Matić, and then used this as proof that CRTA was part of a ‘colour revolution’.

A large part of the corpus consists of articles based on text or video content from social media, sometimes from unknown or anonymous actors. In such cases, the media act as distributors, treating social media posts as valid evidence for certain claims while at the same time legitimising them. 

A common technique the media used to discredit CRTA was pre-emptive delegitimisation – an attack on research findings the organisation had not yet produced. The media did this by presenting assumptions, framed as facts or revelations, about what CRTA would do, publish or announce on election day.

In the final part of the monitoring period, from 4 October, the media targeting of CRTA moved into a phase of institutional targeting, with calls for criminal prosecution. That day, an audio recording was published containing alleged instructions for attacks on the police, which was used to back up a claim published a month earlier on B92 (the technique of making claims without evidence). The media reported Vukša Dragović’s demand that the organisation be banned as a criminal one, while the Council for Monitoring called for the urgent arrest of CRTA representatives for allegedly planning an organised terrorist act. Informer’s editor-in-chief, Dragan J. Vučićević, said there was also a continuation of the recording in which ‘blockaders are taught how to make Molotov cocktails’, but offered no evidence for this.

The monitoring also recorded that on 1 October the media opened a front against Istinomer, a portal founded by CRTA and Meta’s fact-checking partner in Serbia. Informer asked pointedly: ‘Who gave a private organisation the right to decide what the citizens of Serbia may see on social media?’, warning that Istinomer’s ratings could reduce Informer’s visibility and claiming that part of the moderation for the region is ‘coordinated from Zagreb’. This is also the only article in the corpus that frames the attack on CRTA in terms of national security.

How the attacks spread through the media

The pattern of media attacks on CRTA is consistent. It usually starts with a social media post (on X) or a statement by an official, which five to seven portals then pick up within a few dozen seconds, with almost identical text.

The diagram shows the twelve waves in the corpus. Minute zero is the moment of the first publication in each wave, and each dot is an outlet, placed by its delay in minutes. A filled circle marks the outlet that published first.

In ten of the twelve waves, Alo and Novosti were the first to publish an article attacking CRTA. These portals are the entry point for attacks into the media space.

Informer appears as the first outlet to publish an attacking article twice: on 29 September, when Vučić was a guest on the outlet’s TV channel, and on 4 October, with the recording of the lawyer from CRTA’s legal team, claiming it had obtained the recording through its own channels. In both cases, Informer created the news it published.

Further down the chain are outlets that republish news rather than produce it. These are typically Politika and B92, which republish content from other outlets with less sensationalism than the original and with careful attribution of statements, giving the text the appearance of legitimate political debate. The exception was 4 October, when B92 was the first to publish the call for lawyer Tupanjac’s arrest.

A significant finding from the analysis of the waves in the corpus is that the 4 October wave was the fastest and the longest. The first seven portals published the story within 21 minutes, between 08:16 and 08:37. This was followed by a pause of around three hours, and then a second burst of eight portals between 13:09 and 14:01. A single event thus filled the media space for the whole day, in two bursts – something not seen in the September waves.

An individual wave typically ends within fifty minutes to two hours, which leaves too little time for editorial checks and newsroom preparation. This finding suggests coordinated publication of pre-prepared content.

The only recorded case that departs from this pattern is the wave of articles about the ‘false’ number of people injured at the protest on 15 March. The wave began on the evening of 13 September with an article in Kurir, while Novosti, Informer and B92 published only the next morning.

Most frequent targets

The media most often discredited CRTA as an organisation as a whole, but the attacks were also aimed at five named individuals linked to it.

The most frequently mentioned was Vladimir Tupanjac, a lawyer on CRTA’s legal team, in 13 articles, all published on 4 October. The attacks on him are the harshest, and he is also the only person whose arrest is demanded in the corpus.

CRTA’s director, Vukosava Crnjanski, was mentioned in 12 articles. Most of these named her as one of the people invited to the pre-election TV debate, alongside the heads of the SNS and Student List electoral lists. An attacking tone was present in articles that repeated biographical details about her made public by Vukša Dragović.

The head of CRTA’s legal team, Pavle Dimitrijević, was mentioned in five articles attacking CRTA, published on 6 and 8 September. In them, the media reported Ana Brnabić’s reaction to his statement that the line between party and state had been erased.

CRTA’s programme director, Raša Nedeljkov, was named in three articles, in which the media reported Vukša Dragović’s claims that Nedeljkov was ‘hiding his past’.

Ana Toskić Cvetinović, wrongly presented as a member of CRTA, was mentioned in three articles.

For most of the monitoring period, the attacks targeted CRTA as an organisation and its leadership – the director and the programme director. A member of the expert team was named for the first time on 4 October – not as someone holding an allegedly biased view, but as the alleged perpetrator of a criminal offence.

None of the 22 articles published that day carried CRTA’s response to the accusations. The only instance of anything resembling a reaction from the organisation appeared in an article that mentioned CRTA’s response within a statement by Ana Brnabić, in which she claimed that CRTA had backed lawyer Tupanjac and urged citizens not to listen to the organisation’s assessments.

Levels of attack

Based on similar international experience, the stages of a media campaign against a civil society organisation can be identified as: (1) challenging impartiality, (2) status reclassification, (3) financial delegitimisation, (4) personalisation, (5) pre-emptive discrediting of findings, (6) criminalisation, (7) institutional action, (8) attacking election-night findings and (9) legislative endgame.

According to the findings of the media monitoring in this period, three stages have been completed. The campaign to challenge CRTA’s impartiality as an organisation and election observer was waged in early September, including through false claims that a member of CRTA had spoken at a student movement press conference. In the first half of September, the outlets monitored began reclassifying the organisation’s status, publishing articles claiming that CRTA was not an independent observer but a participant in the electoral process. Financial delegitimisation refers to media claims about CRTA’s foreign donors, which are used as proof that CRTA wants to ‘bring Serbia down’.

The personalisation stage is currently under way, with individuals from the organisation singled out by name for attack. In early October, this stage spread beyond the organisation’s leadership for the first time, with a member of the expert team becoming a target. Pre-emptive discrediting of findings is also under way, through predictions of what CRTA will do on election day, presented as the exposure of a secret plan. The criminalisation stage began on 4 October, with calls for the organisation to be banned and its members arrested.

Beyond the media campaign itself, three further stages are likely to follow: institutional action – moves by prosecutors, inspectors or financial auditors – for which the media created a pretext on 4 October; attacking the election-night findings, which can be expected on 25 October and has been heralded in the media since 8 September; and, finally, a legislative endgame, which comparable cases around the world show tends to come after elections.

Annex: list of articles in the corpus

Note on the use of AI tools: This report was prepared with assistance from an AI chatbot for data processing and language editing. The authors and editors retain full responsibility for the report’s research, analysis, findings, and conclusions.