When Bosnia and Herzegovina held general elections last month, it used biometric voter identification and ballot scanners — a reform widely praised for producing fast and accurate results. That’s a real achievement. But the region’s digital foundations remain fragile, and the region’s adversaries know it.
The Balkan chessboard remains checkered, torn between attraction to the European Union and to Russia, with China maneuvering for leverage. Bosnian nationalists, including separatist, pro-Russian Serbs, won the recent vote. But Serbs gave a pro-European student-led movement a clear majority in another October election, while Montenegro and Albania closed chapters in their EU accession talks.
The cheapest way to shift the balance of power is to undermine trust in the ballot. For the region, cybersecurity is not a technical issue. It is a strategic one. Washington is waking up to the risk — but needs to increase its focus on digital dangers. The EU is already pressing for action but must also increase its scrutiny.
Across the region, national cyber-response teams remain small and underfunded, public systems are outdated, and responsibility is fragmented. Large volumes of sensitive data, from tax and health records to the new biometric voter data in Bosnia, are held in databases that are rarely audited.
Telecommunications and surveillance networks rely on Chinese equipment. Belgrade’s Chinese-supplied “safe city” facial-recognition system represents the best-known example. Kremlin-funded media and anonymous networks are ready to amplify disinformation, which artificial intelligence now makes cheap to produce in local languages.
China’s Huawei remains the dominant supplier to Bosnia’s two largest mobile operators, BH Telecom and Republika Srpska’s M:Tel. The security risks of that choice have never been seriously considered. Western money paid for much of that infrastructure. Bosnia’s biometric voting carries its citizens’ calls, data, and biometric records — and it is only as trustworthy as the equipment and the vendors deployed.
For a hostile power, this represents an attractive environment. It does not need to defeat Balkan institutions, only to find the least-protected one. Access gained can be used to collect data on officials, NATO personnel, and diaspora communities; to map energy grids and transport hubs; and to prepare disruption that can be switched on in a crisis.
Consider Albania. Earlier this year, HomeLand Justice, a hacker group that the Albanian government links to Iran, broke into the national parliament, deleted data, and published lawmakers’ emails on Telegram. Investigators believe the attackers had administrative access well before they revealed themselves; passwords had reportedly not been changed for years, and intrusion alarms did not sound. It was the group’s third major attack on Albanian institutions since 2022.
There are other notable attacks. Ransomware paralyzed Montenegro’s government networks in 2022. Bosnia lacks a fully functioning state-level cyber emergency response team. A 2022 ransomware attack crippled the country’s Parliamentary Assembly, taking its servers, website, and email offline. Thousands of employees in state institutions were locked out of their networks for more than two weeks. No public report on the incident or its lessons was ever released. The pattern persists. In early 2024, hackers breached the Bosnian Republika Srpska’s health information system and its tax administration.
Washington has started to worry. Representatives Ritchie Torres and Joe Wilson have introduced H.R. 10748, the Balkans Security Cooperation Act, which asks the Pentagon to report on every Western Balkan country’s security cooperation with Russia, China, the US, and NATO, including arms deals, exercises, agreements, and intelligence ties. It also asks for an assessment of the Russian-Serbian Humanitarian Center in Niš, which has signed a new development plan with Serbia’s interior ministry for 2025-2027 and whose request for diplomatic status for its staff the US and EU have resisted since 2014.
The bill counts tanks, missiles, and agreements. It does not count code, vendors, or data. That gap matters, because the most likely next attack on a Balkan state will not arrive by air.
As the bill moves forward, Congress should add a cyber and data annex covering four questions: Which hostile cyber operations have targeted each country since 2012, and by whom? Which foreign vendors supply critical telecommunications, energy, surveillance, and election systems, and under what legal obligations to their home governments? How well are sensitive government and citizen data protected, including biometric data? Where would US, NATO, and EU assistance close gaps fastest? Iran, whose operations in Albania are well-documented, should be included alongside Russia and China.
Europe should not wait for Washington. The EU already demands cybersecurity and data protection standards as part of the accession process, and Montenegro and Albania are moving quickly through the chapters. Brussels and NATO should make cyber-resilience a visible, funded priority across the region: shared incident response, regular audits of critical databases, support for election security, and clear rules on high-risk vendors in critical networks.
The new political moment creates an opening. Serbia’s incoming government has promised transparency and the rule of law while keeping military neutrality. Cyber cooperation is one area where it can work closely with EU and NATO partners without changing that stance. Bosnia’s successful use of election technology shows what is possible, and also creates a new duty to protect biometric data.
Western Balkan citizens want accountable institutions. Protecting that legitimacy means protecting their networks.
Dr. Emir Kremić is a cybersecurity strategist and AI & data governance expert. He is the former head of the Federal Institute of Statistics of the Federation of Bosnia and Herzegovina and Co-Founder of Auroris AI.
Bandwidth is CEPA’s online journal dedicated to advancing transatlantic cooperation on tech policy. All opinions expressed on Bandwidth are those of the author alone and may not represent those of the institutions they represent or the Center for European Policy Analysis. CEPA maintains a strict intellectual independence policy across all its projects and publications.
Steel and Silicon: Allied Innovation for the Next Century
2026 CEPA Tech & Security Conference
