BANNER: An activist in front of law enforcement officers during a 2019 protest against domestic violence and violence against women in Baku, Azerbaijan. (Source: Reuters/Aziz Karimov)

A cross-platform campaign targeted detained Azerbaijani activist Bakhtiyar Hajiyev and several female Azerbaijani pro-democracy activists in an attempt to undermine their reputations. The kompromat campaign appeared on Telegram, Facebook, TikTok, and multiple websites.  

In Azerbaijan, kompromat has historically been used against journalists, activists, and opposition figures as a means of discrediting them. Usually, women are targeted with kompromat campaigns, which can sometimes put their life at risk. The term is Russian KGB slang referring to “compromising material” that can be used to damage the reputation of “enemies” by disseminating fabricated or real information, typically intimate in nature, that is often gathered by illicit means.

On February 24, 2023, Azerbaijani authorities extended the detention of political activist and former parliamentary candidate Bakhtiyar Hajiyev by two months, the same day his text messages and other intimate materials leaked on Telegram. Azerbaijani authorities arrested Hajiyev in December 2022 under allegations of hooliganism and contempt of court, but he claimed that he was arrested by order of the Minister of Internal Affairs. Hajiyev is a well-known political activist in Azerbaijan who co-founded the Positive Change Youth Movement (“Müsbət Dəyişiklik Gənclər Hərəkatı”), with a primary focus on encouraging citizens to actively participate in democratic processes and raising awareness about civil rights. The movement originated from Hajiyev’s parliamentary election campaign, but later halted its activities due to changes in legislation. On December 15, 2022, Hajiyev went on a hunger strike to demand his release. He ended the strike on December 28 following persistent pleas from the public and family members, but resumed it on January 9, 2023, after the appellate court denied his release. On February 28, his lawyer reported that Hajiyev ended his hunger strike in response to public demand. The US Department of State called on the Azerbaijani government to release him, as did former US Secretary of State Hillary Clinton and USAID administrator Samantha Power.

On June 6, authorities searched the homes of Hajiyev and his relatives, reportedly seizing his computer, documents, SD cards, and card readers. Hajiyev’s brother reported that Hajiyev’s 2011 photo with Hilary Clinton was also seized. On June 16, authorities announced additional charges against Hajiyev, including illegal entrepreneurship, smuggling, and the use of forged documents. Hajiyev said through his lawyers that he disagreed with the charges and believes he is being persecuted for his public activities. On June 22, the court extended his detention to July 28, 2023.

The kompromat campaign against Hajiyev also targeted several women, including activists and journalists, who had exchanged images, messages, or videos with Hajiyev. The leaked materials included nude images of several women, non-intimate selfies posing with Hajiyev, conversations between them, and screenshots alleging that Hajiyev sent nude images of the women to his male friends in a Facebook group. Hajiyev claimed that some of the material was fabricated and manipulated, and that other material appeared to be ten years old.

The dissemination of the materials appeared to be a cross-platform campaign initiated on Telegram, later amplified by Facebook accounts and pages, then pushed by newly created TikTok accounts and pro-government news websites. The DFRLab also found 1,211 Facebook pages trying to influence the online discussion of Hajiyev, some of which had posted pro-government comments in the past.

Those undertaking the kompromat campaign also published the names of some of the women targeted by the leaked images. Recently, women’s rights activist Gulnara Mehdiyeva, who was targeted by a similar kompromat campaign in the past, stated that perpetrators of this recent campaign published a leaked message that included the home address of one of the women.

As a result of the kompromat campaign, the political opposition condemned the government and alleged it was behind the campaign; they also criticized Hajiyev for allegedly possessing the compromising content. In response, the Ministry of Internal Affairs denied viewing or transferring Hajiyev’s personal material. According to Hajiyev’s lawyer, Hajiyev believes that the perpetrators used Pegasus spyware to obtain the kompromat materials; the Organized Crime and Corruption Reporting Project previously identified Hajiyev as a victim of the spyware.

The perpetrators of the kompromat campaign used Telegram as the initial distribution point for leaking material and harassing the women who communicated with Hajiyev. Telegram has been used similarly in the past; in 2022 the BBC found Telegram groups and channels sharing thousands of secretly filmed, stolen, or leaked nude images of women in at least twenty countries. The platform is a popular tool for disseminating kompromat, as it lacks a robust moderation policy. Telegram also allows users to create public channels anonymously; these channels can have an unlimited number of participants, often disabling any ability to hold perpetrators accountable.

The DFRLab found ten Telegram channels seemingly created for the explicit purpose of publishing the private materials of Hajiyev and several women. At the time of writing, six of those channels had been deleted. These channels published, among other things, private messages and intimate videos and photos, some including the women’s names. One channel created a poll listing the full names of women associated with Hajiyev and asked subscribers to vote on which material to release next. The DFRLab is not naming or sharing links to the channels to protect the privacy of the women involved in this campaign.

After posting the compromising material on Telegram, the perpetrators subsequently amplified the material on Facebook. The DFRLab identified two tactics on the platform: amplifying leaked material by linking to the originating Telegram channel via Facebook groups and pages, and employing Facebook pages to post derogatory comments in order to damage their reputations. The DFRLab found sixty posts on thirty-one Facebook groups by seven accounts and one Facebook page promoting three Telegram channels, including two now-deactivated channels. These posts contained one of five identical messages regarding Hajiyev and the female associates, while incorporating or pushing some element of the leaked materials. The Facebook accounts also promoted the oldest of the Telegram channels on the same Facebook groups in December 2022.

Some of the identified Facebook accounts did not publicly post as part of the kompromat campaign but did comment on related posts in order to invite users to join one of the Telegram channels responsible for leaking the materials. There was at least one account that used a stock image as its profile picture and changed its last name on Facebook during the course of our investigation from “Asim Lələyev” to “Asim Lazıyev.”

Some popular Azerbaijani Facebook pages shared the kompromat campaign images taken from Telegram, including the pages ANSQapanma (“ANSClosure”) (98,981 followers) and Sətiraltı (“Subtext”) (30,863 followers). The DFRlab discovered a post on ANSQapanma sharing a manipulated image of Azerbaijani women’s rights activist Narmin Shahmarzade. The original photo, as posted to Shahmarzade’s Facebook account, showed her holding a sign at the March 8 protest with the slogan “Seçkidə – Qisasda – Siyasi Alət deyil!” (“In elections, revenge isn’t a political tool!”) The sign featured a drawing of a bra and women’s underwear, intended to convey the message that women should not be exploited as political tools. The manipulated version changed the text on the sign to read, “Dilin ağrıyır dilinə qurban, belin ağrıyır belinə qurban” (“I could die for you if you have any pain in your tongue and your back”), intended to be an offensive phrase involving sexual practices.

The perpetrators of the kompromat campaign appear to have created two Facebook pages, named Bextiyarin qizlari (“The girls of Bakhtiyar”) and Bəxtiyarın İfşası (“The Exposure of Bakhtiyar”), to promote and gain subscribers on the Telegram channels. These pages were created in early 2023 on February 25 and February 28, respectively. At the time of observation, both pages had only one or two posts, featuring a link to one of the kompromat-pushing Telegram channels. Both have been removed from the platform.

Some Azerbaijani Facebook accounts, not connected to the kompromat campaign, posted a screenshot showing a sponsored post by one of the Facebook pages. The DFRLab could not verify the sponsored ad as it was not available in Meta’s ad library.

The DFRLab used Meta-owned social media analysis tool CrowdTangle to find the most commented-on posts, using Azerbaijani keywords about Hajiyev in the period from February 24 to March 16, 2023. The three most commented-on posts appeared on the pages 7GÜN XƏBƏR (27,799 followers), Patrul.az (38,956 followers), and Duckstagram (47,050 followers), all of which were related to a video featuring the activist and former political prisoner Ilkin Rustamzade talking about Hajiyev. Most comments on the posts came from Facebook pages that used Azerbaijani names and surnames and had profile pictures of seemingly real people; this may have been an attempt to avoid detection by camouflaging pages as user accounts. The three posts had a significant number of comments from pages masquerading as accounts: 881 of 921 comments, 336 of 749 comments, and 670 of 906 comments, respectively. In total, 1,211 Facebook pages commented 1,886 times on the three most popular posts. Some of these Facebook pages commented on more than one of the posts. Their comments were similar but not identical in wording.

The DFRLab analyzed the Facebook pages posing as user accounts. According to DFRLab reverse-image searches conducted with Google and Yandex, many of the Facebook pages used stock or stolen images as their profile pictures. For example, one of the pages that commented on all three of the most commented-on posts regarding Hajiyev displayed a number of suspicious characteristics. Created on September 30, 2022 under the category of “Book Series,” the page “Mila Melik” used a profile image of Sevil Atakishiyeva, a university student who took her own life in 2021. Her suicide was widely reported after her messages with another activist revealed that her family threatened to kill her prior to her death.

In other cases, some pages used stolen profiles photos of the same person. For example, two different pages used different images of a nail artist based in Israel. The pages were created on July 7, 2021 and August 13, 2022, and registered under the page categories “Food & Beverage” and “Arts & Entertainment,” respectively. Two other Facebook pages stole their profile photos from a seemingly real person’s VKontakte profile.

The DFRLab analyzed the creation dates of 606 Facebook pages out of a total of 1,211 pages that were identified, using publicly accessible Facebook transparency data. The 606 pages were all created between 2018 and 2023, including ninety-nine created in September 2022.

Further, the older pages were used between 2020 and 2022 to comment on Facebook posts from media outlets like BBC Azerbaijan, Meydan TV, and Hamam Times in which the outlets reported on questionable actions by the Azerbaijani government. These posts also received troll comments from other account-like Facebook pages with similar characteristics. 

Trolls can benefit from deploying Facebook pages rather than user accounts as it can be more difficult to track comments from pages. This enables these pages to post incendiary comments or biased opinions – in this particular instance, pro-government opinions. There are some indicators when a page or account engages in troll behavior, such as a prevalence of typographical and grammatical errors, or a high similarity in the language used in the comments. In 2021, the Guardian reported on account-like Facebook pages that were involved in trolling operation in Azerbaijan.

The DFRLab also found six TikTok accounts promoting the Telegram channels. All the accounts included a link to a Telegram channel in their description. The accounts bore similar names and used some of the leaked images as profile pictures. The most popular channel had 320 followers and 3,570 likes on TikTok.

The DFRLab also found several Azerbaijani websites that used similar arguments to accuse Hajiyev of inappropriate sexual behavior and claim that the government opposition supports this behavior. The websites relayed the leaked material and exaggerated or fabricated claims built around that material. These articles contained accusations against Hajiyev and his supporters and dismissed the invasion of his privacy in order to frame the narrative around the allegations.

The websites’ content is often sensationalized, biased, or lacks context. For example, Demokrat.az published a report that targeted activists involved in the “8 Marş” protest (marş is the Azerbaijani word for the act of marching), which took place on March 8, 2023, the manipulated photo of Narmin Shahmarzade was shared in this report. These websites also published leaked images of Shahmarzade that were disseminated after her Facebook account was reportedly hacked.

In Azerbaijan, which the international human rights organization Freedom House determined to be “not free,” pro-democracy activists are subject to online and offline harassment, as seen in this case study. The online harassment is particularly dangerous, as failure to take action against it sends a signal to other activists to either remain silent or face similar consequences. Cross-platform campaigns can reach larger audiences and facilitate the easy spread of negative sentiment toward pro-democracy activists.

“Cross-platform kompromat campaign targets detained activist Bakhtiyar Hajiyev and several female Azerbaijani activists,” Digital Forensic Research Lab (DFRLab), July 11, 2023, https://dfrlab.org/2023/07/11/cross-platform-kompromat-campaign-targets-detained-activist-bakhtiyar-hajiyev-and-several-female-azerbaijani-activists.