Ctrl+Alt+Defend
How Kosovo is getting ahead of increasing cyber threats
In an ever-evolving landscape of cybersecurity, Kosovo stands at a crossroads, facing both the promise of digital progress and the specter of cyber threats.
The surge in the quantity and variety of cyberattacks across Eastern Europe in recent years emphasizes the necessity of bolstering cybersecurity measures and enhancing the resiliency of critical infrastructure.
With an increasingly interconnected society, as evidenced by nearly 100% mobile phone penetration, Kosovo has found itself a target for cybercriminals seeking to exploit vulnerabilities at the individual, governmental, and private sector levels.
National security, public safety, and economic stability are often jeopardized by cyberthreats on critical sectors such as energy, telecommunications, water, and transportation.
For example, the September 2022 cyberattacks on Kosovo Telecom and government services interrupted access to landline and mobile internet and to government websites. After reporting no stored data had been compromised, the government announced that it drafted a cybersecurity law and would propose establishing a Kosovo cybersecurity agency.
The European Union Agency for Cybersecurity identified multiple trends fueling these attacks: geopolitical tensions, increased capabilities for disinformation and propaganda, technology vulnerabilities, and novel threats that exploit weaknesses in computer systems or networks.
To build a secure digital future in Kosovo and other countries across Eastern Europe, USAID’s Critical Infrastructure Digitalization and Resilience program brings relevant stakeholders together around a common goal — developing cybersecurity resilience in critical infrastructure.
The regional program — operating in seven countries in the Western Balkans, Black Sea region, and South Caucasus — works with partner governments and organizations to develop cybersecurity workforces, facilitate data sharing, build cyber resilience, and develop cyber governance through working groups that inform decision making.
In Moldova, USAID’s assistance and training supported the government to thwart all cyberattacks during the 2023 local government elections, following a massive cyberattack on their systems in the previous year.
The Critical Infrastructure Cybersecurity Working Groups are collaborative forums to incubate ideas and foster knowledge-sharing among representatives from government agencies, ministries, the private sector, and academia.
In addition to the working group in Kosovo, USAID facilitates similar working groups in Georgia, Moldova, North Macedonia and, soon, Albania.
The approach has been especially fruitful in Kosovo, where the working group’s recommendations led to the enactment of the Cybersecurity Law and then the establishment this year of the country’s first cybersecurity agency — the National Authority for Cybersecurity.
For Lule Ahmedi, Board Member of The Regulatory Authority of Electronic and Postal Communications and a Kosovo working group member, the group’s importance goes beyond coordinating policy awareness.
“The working group ensures that Kosovo is proactive and prepared to confront the ever-evolving landscape of cyber threats,” she said.
The Kosovo working group empowers participants to stay one step ahead of cyber threats through tabletop exercises, workshops, expert-led discussions, and information-sharing platforms.
With support from USAID, the working group has drafted cybersecurity bylaws and outlined workforce needs of the newly created National Authority for Cybersecurity. Additionally, the working group has also helped clarify the criteria needed to designate organizations as “national critical infrastructure.”
“The most important factor in our successful collaboration has been the establishment of trust between public and private sector entities and a true cybersecurity community.”
— Working group member Artan Dreshaj, the Director of the Department for Cybersecurity and Systems Administration within Kosovo’s Ministry of Internal Affairs.
However, the journey is far from over.
“We are a small country with limited expertise,” Dreshaj said. “By sharing and collaborating, we can amplify our expertise…We can create better legislation and come to effective decision making.”
Looking to the future, the working group will build on past successes and adapt to emerging challenges. From enhancing incident response capabilities to promoting cybersecurity awareness among the general public, there is no shortage of work ahead.
“Together, we will stand stronger,” Ahmedi said. “Let us continue to chart a course towards a safer, more resilient Kosovo.”
Next, USAID’s Critical Infrastructure Digitalization and Resilience program plans to increase support across the region to critical infrastructure operators in the energy, telecom, and financial sectors, among others, as well as to government institutions responsible for cyber support and oversight.
To advance cyber workforce development, USAID will deepen our ongoing assistance in gender-sensitive and updated cyber curricula, training of trainers in university and vocational settings, and women’s employment in cybersecurity — all to address market needs identified by our research.
These activities are intentionally built to last beyond the life of the program, including assistance and partnerships to create the policies, frameworks, and coordination bodies required for long-term success in building resilient critical infrastructure in Eastern Europe.
The Critical Infrastructure Digitalization and Resilience (CIDR) program, implemented by DAI, was selected as a winner of USAID’s 2023 Digital Development Awards.
