Cybercrimes as a Potential Threat to National Security: The Case of Kosovo

Abstract

The focus of the chapter is cybercrime and the danger it poses to the national security of Kosovo. In order to present the situation of this problem in Kosovo, the author concentrates on cyberattack cases in which the national security of Kosovo has concentrates on cyberattack cases in which the national security of Kosovo has been threatened during the last few years. Kosovo’s national security is being attacked by various forms of cybercrime, which are mostly carried out by cybercriminal groups from countries that oppose Kosovo’s independence, such as Serbia, Russia, Bosnia, and Herzegovina. The author analyzes the volume and dynamics of cybercrime offenses committed in Kosovo over the last 8 years. Analytical studies are conducted on legislative measures. Among such measures is the cyber security legislation, which in Kosovo is sufficient and meets the needs of its citizens, as it is in accordance with aquis communiter, legal standards, and other legal acts of the EU. The various state mechanisms that Kosovo has established during the past decade, which are solely dedicated to preventing and combating cybercrimes in this small European state, have also been addressed. The new types of cybercrimes pose a significant challenge for Kosovo, which is constantly evolving, affecting various computer systems and social values, including national security.

1. Introduction

In Kosovo, the increase in the use of computers and Internet networks in recent decades has directly affected the improvement of the quality of life of its citizens and enabled the realization of various economic benefits, especially through rapid relative growth rates of cyber-producing sectors [1].

According to the European Union Statistical Office (Eurostat), from 2017 until 2023, the percentage of families with access to the Internet in Kosovo has continuously increased. Now, only 1.4% of families are without Internet access [2]. The percentage of families in Kosovo, 98.6 that have access to the Internet is greater than the average in the European Union, which is 92.4. Last year, the main Internet users were people between 16 and 34 years [2]. Over the years, those over 65 have had the lowest Internet usage in the country [2].

These developments, particularly the fact that the vast majority of services in Kosovo are performed online through digital networks, have made Kosovo an extremely vulnerable country to cyberattacks. Cyberattacks against such digital services have an impact on the privacy of the citizens of Kosovo, as well as on the economy, state security, and societal peace in general.

The Kosovar Center for Security Studies (KCSS) suggests that cybersecurity attacks in Kosovo are directed toward the state computer network system, user accounts, the financial system, websites, and the private sector [1]. Due to Kosovo’s unstable relationship with Serbia and lack of normalization, cyberattacks through disinformation campaigns can result in interethnic incidents and violence and endanger national security. Given the risks that cyberattacks create for the economy and state security, Kosovo has taken various measures and actions, as well as established certain mechanisms to prevent and combat cybercrimes.

In the framework of these measures, among the most important are the legislative ones, which regulate the protection of numerous areas that are vulnerable to cybercrimes, carried out in a network that has as its objective or as a way of carrying out the crime, the misuse of computer systems and computer data. The areas that are protected from cybercrime can belong to private businesses, state institutions, industries, economies, national security, or personal actions of ordinary citizens (e.g., child pornography). Then, it regulates and protects electronic communication between different subjects, whether natural or legal persons, with a focus on protecting the rights of individuals to personal data and, in particular, the right to privacy. So, it has created the conditions for the country’s institutions to invest in building security capacities in the field of computer technology. Therefore, the focus of this chapter is on cybercrimes in Kosovo, as well as its measures and mechanisms to combat them.

2. Cyberattacks against national security in Kosovo

Cybercrime, as a relatively new phenomenon, is defined in criminal legal doctrine as a crime where computers are used as tools to commit an offense, and the primary targets are computers and computer systems [3].

There are generally two main types of cybercrime: (a) cybercrime that in one way or another is related to “traditional” forms of crime, which have evolved by transferring to the cyber sphere, such as financial offenses, then criminal offenses that affect the safety of children and young people, including terrorism, and (b) the so-called high-tech crime, which is the advanced form of cybercrime, targets computer hardware and software as its main targets of sophisticated attacks [4].

Cybercrime experts emphasize that the motive for committing cyberattacks determines the different types of cyberattacks, which can be classified as cybercrimes motivated by revenge, curiosity, financial gain, espionage, jeopardizing national security, and terrorism [1]. In Kosovo, while cyberattacks with a nature of financial gain and curiosity have been carried out by local criminals, the majority of the attacks on national security have been perpetrated by hackers from countries that oppose Kosovo’s independence. In certain periods, Kosovo has had a tendency to receive attacks from the Serbian state, China, Russia, and other countries within this political bloc. Fortunately, these efforts have not caused any significant damage or consequences for the state institutions of Kosovo. An attack of this nature was registered at the beginning of December 2018, targeting the electronic communication network of the Ministry of Foreign Affairs (MFA) of Kosovo, which resulted in the complete blocking of Kosovo’s embassies in the capitals of the different states in official emails. According to Kosovar investigators, the cyberattack lasted for over 24 hours. It was carried out by Serbia, Bosnia and Herzegovina, and North Macedonia. While the representatives of the Ministry of Foreign Affairs of Kosovo (MFAK), stated that “we do not know if they are sponsored by the official Belgrade regarding those who ordered the attack, but we are aware that they are coming from there, and this poses a major threat to Kosovo” [5]. In addition to the MFAK, attacks of this kind have targeted the Ministry of Internal Affairs of Kosovo (MIAK) in 2018 [1]. Cyberattacks against Kosovo institutions occurred in 2021 and 2022 as well. The government’s decision on car plate reciprocity on September 20, 2021, is a clear illustration of how foreign malignant influences can have a negative effect on the national security of Kosovo.

Following this decision on car plates, propaganda, disinformation, and fake news from Serbia were spread in the northern municipalities of Kosovo aimed at escalating the situation on the ground, in majority-Serbian communities, stoking fears that the Kosovo Security Forces would enter these majority-Serbian areas [1]. However, in close coordination with international allies, the Kosovo government successfully coordinated all national security mechanisms, preventing the situation from escalating on the ground. This government decision was followed by the highest amount of disinformation and misinformation in the digital space throughout the year, as reported by an organization that monitors online portals [6]. The aforementioned type of cybercrime used against Kosovo’s national security is known as “computer disinformation,” which, according to the “US Department represents one of the most important and widespread weapons of the Kremlin” [6]. According to a local study, “Kosovo is vulnerable to misinformation and malicious external influences, especially in the media sphere” [6]. One of the reasons for Kosovo’s high vulnerability to this type of cybercrime is that over 40% of Kosovo citizens do not verify the information they receive online at all, while only 16% of them check the source of the information [7].

To such cyberattacks, Kosovo’s prime minister Albin Kurti reacted himself. He pointed out in September 2023 that Russia and its allies are frequently using disinformation and other malicious behavior in the cyber field as a mechanism, for interfering in the process of dialog and normalizing relations between Kosovo and Serbia [8].

At the beginning of 2022, cyberattacks again targeted the computer systems of the Ministry of Internal Affairs of Kosovo [9]. These attacks were an additional reason for Kosovo’s National Cyber Security Council (NCSC) to conduct a comprehensive analysis of the state of cybersecurity and the degree of risk of state institutions, concluding that because they operate in the same cyberspace as other parts of the world, it is expected that they face the same risks [9].

The NCSC claims that Russian hackers from the “KILLNET” group are constantly targeting state institutions. The Ministry of Internal Affairs of Kosovo (MIAK) has been targeted by cyberattacks even in April 2022, as confirmed by its officials through a statement; it was emphasized that “we have had ‘Phishing’ cyberattacks, but not we have had any cyberattacks that have compromised the infrastructure and we have not suffered any damage from those attacks, although ‘Phishing’ attacks are frequent” [10]. The “Phishing” type of cyberattack is a form of “social engineering” that aims to steal credentials. With “Phishing” attacks, the victim is tricked into providing their credentials through emails so that the email is professionally modified and sent to officials working in a particular state institution [11]. These emails look very innocent as if they were sent by a friend, a government official, a public institution, a bank, etc. So, reliable institutions [1]. The victims assume they are on a legitimate site, but in reality, they are on a fraudulent site [12]. Usually, in these emails, there are one or more links or some documents that look safe and in which the victim registers, for example, by giving their email and password [1]; unfortunately, in such cases, the victim gave the email and password to fraudsters/hackers, who aimed to steal credentials, which then would be used for their criminal purposes [12].

The Ministry of Internal Affairs has confirmed that during April 2023, the websites of the three most important institutions of Kosovo, including the Presidency, the Prime Minister’s Office and the Prosecutor’s Office of Kosovo, were the target of a cyberattack. The type of cyberattack used was Distributed Denial of Service (DDoS). The DDoS attacks affect the availability of web services for an undefined period of time, causing fraudulent requests to flood the company’s servers, denying requests from legitimate users and generating economic losses due to rendered services that are unavailable [13]. As a result of this cyberattack, the websites of the Prime Minister’s Office, the Presidency, and the State Prosecutor’s Office have been out of order from time to time during the attack [14]. An online group called “Anonymous Albania” has taken on the responsibility for these attacks, while the attacks were conducted as a demonstration against the lack of respect for workers’ rights and the inadequate response to the 11-year-old girl’s rape in Kosovo [1].

In recent years, cybercrime has also appeared in Kosovo as a threat to institutions with bomb explosions, as were the cases with the International Airport of Pristina (several times in June 2022, February 2023, April 2023, etc.), then the University of Prishtina (July 2022), “Xhevdet Doda” Gymnasium in Prishtina (May 2022), the “Gate” discotheque in Prishtina (November 28, 2023), etc., upon receiving emails, the Kosovo Police went to the locations where there were supposed to be bomb attacks, but thankfully they were false alarms.

In addition to the aforementioned cyberattacks, Kosovo has also been afflicted with cybercrimes, which are foreseen as the criminal offense of Unauthorized access to computer systems (UACS) Article 327 of the Criminal Code of Kosovo (CCK) and Infringing privacy in correspondence and computer databases (IPCCD) Article 199 of CCK).

Under Article 327 of the CCK, it is determined that a person commits the criminal offense of Unauthorized access to computer systems if the person does so without authorization and with the intent to obtain an unlawful material benefit for themselves or another person or to cause damage to another person, alters, publishes, deletes, suppresses or destroys computer data or programs or in any other way intrudes into another’s computer system [15].

According to the provisions of Article 199 of the CCK, the criminal offense of infringing privacy in correspondence and computer databases is committed by the person who, without authorization, intervenes in the computer database of another person, respectively, the person who without authorization opens the person’s consignment (shipment) or electronic communication other, or in any other way uses that data or violates the confidentiality of such materials or without authorization retains, hides, destroys or delivers to another person such paper or electronic communication [16].

Based on the statistics of the Kosovo Judicial Council (KJC) [17], a total of 111 cybercrime criminal offenses were registered in Kosovo between January 2017 and October 2023 (see Table 1).

Criminal offenses	2017	2018	2019	2020	2021	2022	2023	In total	Percentage
UACS	11	17	11	10	09	20	06	84	75.5%
IPCCD	04	03	04	05	03	06	02	27	24.5%
	15	20	15	15	12	26	08	111
	13.5%	18%	13.5%	13.5%	10.8%	23.4%	7.2%		100%

Table 1.

The volume and dynamics of cybercrime offenses registered in Kosovo courts (according to the KJC) between January 2017 and October 2023.

Table 1 shows that between January 2017 and October 2023 (almost 8 years), of the 111 criminal acts of cybercrime committed in Kosovo, 84 or 75.5% were of the type “unauthorized access to computer systems,” while 27 or 24.4% criminal offense were “infringement of confidentiality of correspondence and computer databases.”

Looking at the dynamics of such criminal offenses committed during the eight-year period, it can be concluded that, almost in each year of the study period, approximately 15 such offenses (or about 13%) were committed, with the exception of the year 2018 when 20 such crimes were committed (or 18%) and in 2022 the largest number, with a total of 26 (or 23.4%).

In addition to the data on the volume and dynamics of cybercrimes, for the purposes of this paper, some data (not for all criminal cases) related to the gender of the perpetrators and the types of criminal sanctions imposed on them have been provided. Thus, from the total of 111 criminal offenses registered, the data on the gender of 48 of their perpetrators has been provided, of which it can be seen that 39 or 81.25% of them were male, while 9 or 18.75% perpetrators were female. This fact shows that Kosovo women are more likely to participate in cybercrimes (with 18.75%) than in the commission of crimes in general, with 4% in 2013 (573 female perpetrators and 14.473 male perpetrators); with 4% in 2014 (743 female perpetrators and 16.747 male perpetrators), respectively, with 5% in 2015 (769 female perpetrators and 15.755 male perpetrators) [18].

As for the type of criminal sanctions imposed on cybercrime perpetrators in Kosovo, data has been provided for 19 perpetrators, which are presented in Table 2.

Type of punishment	Conditional sentence	Punishment with a fine	Imprisonment sentence and fine	Imprisonment sentence	In total
Criminal files	08	06	03	02	19
Percentage	42%	31%	15%	10.5%	100%

Table 2.

The types of criminal sanctions imposed by the courts of Kosovo for cybercrime perpetrators (for 19 cases, data has been provided) between January 2017 and October 2023.

From Table 2, it can be seen that out of 19 perpetrators of cybercrimes, 8 or 42% of them were sentenced to a conditional sentence, then 6 or 31% of them were sentenced to a fine, while only 5 or 25% of them were punished with imprisonment. Given that 73% of cybercrime perpetrators were sentenced to a conditional sentence and a fine, punishments that mainly affect the material values of the perpetrator, it can be concluded that the courts in Kosovo are lenient in their approach to punishing the perpetrators of these crimes. However, only a quarter of perpetrators are sentenced to imprisonment, which is regarded as one of the most severe punishments in contemporary criminal legislation through which the perpetrator is deprived of one of the most precious personal values, which is freedom.

3. Kosovo’s risks and challenges in combating cybercrimes

Kosovo, as a country that came out of the war two and a half decades ago, has not developed its industry. This fact has made this area (industry) not a target of cybercrimes, so in a way, it has protected it from this type of crime. As an integral and active member of the international community, Kosovo is in the process of digitizing all its services, activities, business spheres, and every aspect of the life of its citizens. In accelerating this process, the COVID-19 pandemic has served as an important catalyst (the isolation of Kosovo citizens began in March 2020 and has continued throughout 2021), during which period many institutions and businesses in Kosovo switched from the physical system of services to the digital system, circumstances that have increased the interest of hackers and the risk of cyberattacks.

In addition to the digitalization of industrial, commercial, and economic services, it is currently developing the digitalization of state institutions, which process data for nearly 1.7 million citizens responsible for protecting and providing security of their customers’ numerous data. Such developments have made (will make) state, administrative, business, commercial, industrial, and other services accessible to every citizen in the world; simply, anyone from any corner of the world can have access to Kosovo’s digital platforms, not only to assess the quality of these services but also to identify their weaknesses and take advantage of the opportunity to hack or attack them. So simply these services have become and day by day are becoming even more vulnerable to cyberattacks.

The Kosovar authorities and society as a whole are cognizant of the increasing risks from cybercrimes, so they are constantly taking various actions, measures, plans, and strategies to prevent and successfully fight against cybercrimes. Such efforts by the Kosovar authorities are encountering difficulties and challenges of various natures, which can generally be divided into two groups.

The challenges faced by Kosovo’s state institutions in building cyber security capacities, such as the lack of human resources for this type of profile as well as the unsatisfactory stimulation for information technology professionals during the time of exceptional competition with the private sector is a problem that belongs to the first group [19].

This challenge is of global nature therefore Brett Callow, a Canadian analyst at the cybersecurity group Emsisoft, rightly says that cybersecurity experts are in short supply. They go where the money is, so they usually not in government institutions; this fact creates the impression that “local governments seem to have the weakest systems” [20].

Another challenge is that the justice system in Kosovo, particularly the courts, are not professionally prepared to properly handle cybercrime cases, because for Kosovo judges and prosecutors, this field remains largely unknown [1]. Therefore, it is rightly emphasized in a report to the Commission of the European Parliament that Kosovo needs to address the issue of the insufficient availability of cybercrime training for newly appointed judges, prosecutors, and those who handle electronic evidence [1].

The decentralization of computer systems in Kosovo’s institutions is another challenge, which means that they do not have control or supervision over each other’s data, so they do not have such policies in the cyber sector, which determines whether data is to be transferred from one system to another or from one institution to another; specifically, the state applications of the Tax Agency of Kosovo, do not exchange information with the Central Bank of Kosovo. This lack of coordination can affect the security aspect of the computer systems of such institutions [21].

Another challenge of this group is the lack of harmonization between different laws, strategies, and other acts in this field. Kosovo has many laws, such as the law on national security, the strategy for national defense and security, the law on telecommunications, and the law on critical infrastructure, which have poor coordination and harmonization among themselves. While cyber security requires harmonization of all laws to respond appropriately to cyberattacks.

There are challenges in the second group that are related to the characteristics or types of cyberattacks. One of the main characteristics of cybercrime is the dynamic evolution of its types. There is no doubt that cybercrime in this direction (plane) is more dynamic than all other forms of contemporary criminality. The evolution of cybercrimes is primarily related to the rise of new technologies, such as artificial intelligence, which has enabled attackers to become more sophisticated in their methods. It is crucial for businesses to stay current with the latest threats, as cybercriminals constantly evolve their tactics. Cybercriminals make use of fileless attacks, which leave no marks on the system, and supply chain attacks, in which they target third-party vendors to gain access to a network [22].

Building the capacity to successfully combat existing types of cybercrimes as well as new types that might emerge against national security, poses another challenge for Kosovo. It is well-known that human society is currently facing more than 50 types of cyberattacks [23]. Given the dynamics of the appearance of such crimes over the past 15 years, during which it is evident that a new type has appeared every 2 years, it is expected that in the coming years, new types of cybercrime will emerge, with which the Kosovar authorities will have to contend.

According to NordLayer, the number of Advanced Persistent Threats (APTs) increased significantly between 2009 and 2012, which are sophisticated attacks designed to steal data from a specific target [24]. Finally, during 2022–2024, another new form of cybercrime emerged, which is manifested by “the creation of realistic videos or audio recordings that can be used to spread misinformation or conduct social engineering attacks.” These videos are created by deep fake technology. On the other hand, synthetic identity fraud involves creating fake identities using both real and fake information [24].

What will be the new types of cybercrime that will endanger Kosovo’s national security from 2024 onwards? This represents a challenge for this country.

4. Cybercrime in Kosovo’s legislation

The Republic of Kosovo is dealing with challenges, risks, and problems related to cybercrime, so it has approved laws and other legal provisions to tackle and successfully combat this phenomenon. There is no doubt that one of the most important laws that defines and sanctions criminal offenses related to cybercrime is the Criminal Code of Kosovo (CCK), which, besides the two criminal offenses of Infringing privacy in correspondence and computer databases (Article 199) and Unauthorized access to computer systems, Article 327 (highlighted above in this paper), as offenses of this nature has also foreseen Avoiding technological measures (Article 291), Identity theft and access equipment (Article 336), etc.

The CCK also contains other criminal offenses that can either be committed in the form of cybercrimes or their commission (methods or means) depending on the use of an Internet network or a computer, such as the criminal offense of Inciting discord and impatience (Article 141), and the criminal offense of causing general danger (Article 356).

In addition to the provisions of the CCK, Kosovo also regulates cybercrime through other laws, including (1) Law on Prevention and Fight of Cyber Crime (July 2010), (2) Law on Electronic Communications (2012), and (3) Law on Cyber Security (February 2023).

4.1 Law on Prevention and Fight of the Cyber Crime 2010

Law on Prevention and Fight of Cyber Crime is the first law of this nature that Kosovo has ever approved. The law defines a preventive package against cybercrime, which includes the development of cyber policies, awareness campaigns, the development of minimum practices and standards for cybersecurity by authorities and competent public institutions in the field of cyber services, etc. [25].

Determining the scope of the law is done through the definition of basic expressions used to describe this phenomenon, such as “cyber crime,” “computer system,” “computer program,” and “interception.” Upon examination of the definition of cybercrime, it becomes evident that three basic requirements must be fulfilled for its existence. First, the act of committing, which may be considered “criminal activity in the form of misuse,” then the defense facilities of the criminal offense are “networks or computer systems,” and finally, the object of the attack is “computer data.”

Given the sensitivity of computer systems, as well as the information transferred through them, including personal data, it is required by law to ensure that human rights are observed and personal information is safeguarded [25], during the development of different procedures.

The law also defines a certain number of criminal offenses of a cyber nature, highlighting their nature and the actions taken to commit them, their aggravated forms, and the criminal sanctions that can be imposed on their perpetrators. To prevent cybercrimes under this law, initial consideration is given to the confidentiality, integrity, and availability of computer system data (Article 9).

Computer data encompasses any form of facts, information, or ideas that are appropriate for processing in a computer system, including a program capable of enabling a computer system to perform a specific function [26]. Under the law, a person who illegally accesses computer systems and accesses such data commits a criminal offense for which he/she can be sentenced to up to 3 years in prison. In addition to illegal access to computer systems, this law also defines a criminal offense as the unauthorized interception and transfer of computer data or its limitation. Modifying, paying back, destroying, or limiting computer data can be classified as criminal offenses for unauthorized transfer.

The law considers as the criminal offense also the obstruction of the functioning of computer systems, then causing loss of property through computer systems, child pornography through computer systems, and other computer-related criminal acts (Article 14) [25] that can be carried out in the form of information entry, amendment or deletion without authorization of computer data, etc.

In addition, the law has regulated the procedure for investigating and criminally prosecuting cybercrime perpetrators, and specific measures have been established to preserve and safeguard the data that was attacked by these crimes.

Cybercrime can cause damage worth billions of dollars within a year [27]. It is an “elusive phenomenon,” and as a result, combating it is not simple, primarily because it develops in a virtual way, which means that there is no material evidence behind it [27]. As a specific procedural measure, the law defines “the storage of computer data” that may be ordered by the prosecutor during investigations, while during the “judicial procedure by the judge” [25]. Then, the measure of “seizure of objects and devices containing computer data” [25], as well as the measure of “copying and storing data that may serve as evidence” [25].

In cases where investigators cannot succeed through standard methods to obtain useful evidence regarding the identification of the perpetrator or clarification of the criminal offense, then the provisions of this law allow them to use “interception or recording of communication carried out by computer system equipment as investigative measures” [25].

Given that cybercrimes (including those committed in and from Kosovo) are often of an international nature (the largest number of servers that contain data on cybercrime perpetrators are still in the United States) [28], the law provides considerable space for Kosovo’s international cooperation in this area. Kosovo’s international cooperation in combating cybercrime under this law can be of various forms and consists of ranging from “international assistance, exchange of information to specialized training and other activities” [25].

Kosovo’s government is prepared for secure international cooperation and has established a permanent contact point, which has numerous competences in this regard, including “rapid data storage and confiscation of equipment containing computer data” [25].

4.2 Law on Electronic Communications, 2012

This law regulates electronic communication in Kosovo [29]. Electronic communication is the activity of transferring ideas, knowledge, information, data or messages through digital means, including but not limited to communications via “fixed line, mobile phone, facsimile, Internet, cable, or satellite” [30].

Under this law, the development of electronic communications in Kosovo is defined by technological neutrality and the EU regulatory framework [29]. The law “promotes competition and guarantees proper and appropriate services” [29] for all operators who offer electronic communication services across all of Kosovo’s territory. It is known that the European Convention on Human Rights guarantees and protects the right to respect for private and family life, as well as its correspondence [31]. Whereas the European Court of Human Rights, when interpreting the word “correspondence” has taken into account technological advances in the field of communication, therefore for the purposes of Article 8, the word “correspondence,” it considers electronic communication in addition to old forms of communication [32]. Despite Kosovo is not a member of the Council of Europe, as a state, it has shown its readiness to respect the European Convention, determining with the provisions of this law that it “ensures an equal level of protection of the right to privacy and personal data of persons” [29].

The Kosovar legislator has taken into account the specifics of this contemporary form of communication, therefore, with the provisions of this law, it has defined some of the main principles for the regulation of this social activity. At the same time, competent bodies in this field have been arranged, with a focus on electronic communications that are developed for the purpose of national defense, national security, maintaining the state border, railway traffic safety, civil aviation, and the energy system.

Due to the significance of such communication for Kosovo’s national security, this law stipulates that “the work of these institutions will be coordinated by the competent state institution” [29].

Public communications networks that consist of servers, firewalls, computers, routers, switches, printers, and more, often for the purpose of stealing, modifying, or removing access to valuable data, whether it be temporarily or permanently, are targeted by cybercrimes. As a result, with the provisions of Article 26, the law provides legal protection to public communications networks from all forms of cybercrimes [29].

In addition to the obligations for the state, the law also foresees obligations for entrepreneurs providing public communications networks, from whom it is required to undertake appropriate technical and organizational measures for the security of their networks and services. All these measures are designed to prevent and minimize attacks on electronic communication in Kosovo.

4.3 Law on Cyber Security, 2023

The need for Kosovo to have a legal framework for effective protection from cyberattacks was highlighted in the European Commission Report 2022 [33]. In the report during the assessment of the cyber security situation, it is noted that Kosovo has developed basic cyber security capabilities on the one hand, but on the other hand, it lacks a comprehensive legal framework, operational mechanisms, and technical and human capacities to operate effectively in the area of crimes and other illegal activities in cyberspace [34].

In order to harmonize its cybersecurity legislation, Kosovo has adopted this law, which partially transposes the EU Directive and the Council of Europe directive [35], then replaces the Council Framework Decision [36] as well as the European Parliament Directive [37] and the Council directive [38] on security measures for networks and information systems [39].

The law regulates important issues related to cybersecurity in Kosovo, such as defining the principles of cybersecurity and establishing institutions responsible for developing, implementing, and promoting cybersecurity policies [33].

The law stipulates the responsibilities for operators of essential services and the digital service provider’s system, which impose permanent organizational requirements and physical and information technology security measures in order to prevent and combat cyber incidents as well [40].

In addition to these measures, the law requires operators to prepare a system risk assessment, then describe the measures for resolving a cyber incident, ensure the monitoring of the system to detect actions or software compromising its security, etc. [41].

Another obligation of the operator of essential services is to report a cyber incident to the Cyber ​​Security Agency (CSA) “immediately, but not later than 24 hours after becoming aware of a cyber incident” [41].

The establishment of the Cyber Security Agency (CSA) and other relevant mechanisms for the implementation of cyber security measures in Kosovo is one of the most significant parts of this law. In addition to the CSA, this law also operationalizes the National Computer Emergency Response Team (CERT), then the State Council for Cyber Security (SCCS), the national sector-Computer Security Incident Response Team (CSIRTs), the State Training Center for Cyber ​​Security, etc. [41].

Kosovo’s legal framework is one of the most advanced in the region, furthermore, as per the EU Commission’s Report on Kosovo in 2021, Kosovo’s cybercrime law is generally in accordance with the EU acquis [42].

After reviewing the legislation on cyber security, it can be concluded that with the approval of the Law on Cyber Security (2023), Kosovo has somehow completed its legislation in the field of cyber security. More specifically, the Law on Prevention and Fight of Cybercrime (2010), has established the legal basis for preventing and combating cybercrime and sanctioning violations, adhering to human rights and protecting personal data [25]. In this law, cybercrime is defined as a criminal activity committed on a network that aims to misuse computer systems and computer data [43]. The Law on Electronic Communications (2012) provides legal guidelines for the use of electronic communication, as well as safeguarding personal data and the right to privacy in this area [44]. The Law on Cyber Security (2023) has a direct impact on strengthening cybersecurity in Kosovo, as the fulcrum of it was the Directives of the European Parliament and the Council of Europe of 2016 on security measures for network and information systems. This law governs the establishment of the National Cyber Security Authority and the operationalization of CERT within this structure. The provisions of this law enabled the strengthening of CERT’s capacities, which were limited until this law was adopted.

In addition to its positive aspects, this legislation has its own weaknesses or shortcomings. Its weaknesses are considered as lack of harmonization between the provisions of these laws, despite the fact that all laws must be harmonized to have an adequate response to such attacks. The other shortcoming of this legislation is the spread of cybercriminal offenses and other legal violations through various laws.

As a good opportunity to avoid the non-harmonization of laws protecting cyber security and the spread of criminal offenses, there is the codification of legislation on cyber security.

Despite the above-stressed shortcomings and weaknesses, Kosovo has sufficient legislation to combat cybercrimes that is comparable to both the countries in the region and developed countries in Western Europe, including those of the EU.

5. Kosovo’s main mechanisms for preventing and combating cybercrime

Kosovo, in order to protect itself and counter successfully the threats of cybercrime, besides raising funds and approving state strategies for cybersecurity (2023–2027), appropriate state mechanisms have also been established to combat cybercrimes, such as

1. The Cyber Security Agency (CSA);

2. State Council for Cyber ​​Security (NCSC);

3. National Cyber Security Unit (KOS-CERT);

4. Kosovo Police Department for Cyber ​​Security and Systems Administration;

5. State Cyber Security Training Center.

5.1 The Cyber Security Agency (CSA)

The Cyber Security Agency (CSA), established by Law on Cyber Security (2023), is the main institutional mechanism that is responsible for proposing and implementing cybersecurity measures and ensuring cybersecurity throughout the country [1]. The CSA along with the State Council for Cyber ​​Security (NCSC) acts as a regulatory body and creator of all state controls on cybercrimes. The agency was officially established by the government and serves as a central body for establishing, managing, auditing, and defending against malicious attempts [1]. This agency contributes to the increase of national capacities in the field of cyber security, so it has the duty to monitor, inspect, and coordinate the activities of the institutions responsible for cyber security, as well as to take measures in the event of not implementing the obligations stipulated by law for operators of essential services and digital service providers.

The CSA is also responsible for responding to threats and incidents in the cyberspace of the Republic of Kosovo and recording them in the cyber threats register, furthermore to create an electronic platform for information exchange, which platform can be used by all operators of essential services and digital service providers in Kosovo. The agency cooperates with the authorities of foreign countries and international organizations regarding aspects under the responsibility of the CSA and serves as the single point of contact. The CSA coordinates its activities with security and defense institutions and cooperates with national sectorial cyber security incident response teams, designated information security officials, and international authorities [41]. The CSA has established a communication platform for citizens and businesses that is available 24/7 for reporting cyber incidents.

5.2 State Council for Cyber ​​Security (NCSC)

The NCSC is an advisory independent body of the Government of Kosovo and the business community, which takes strategic measures to increase the level of cyber security in the Republic of Kosovo. The NCSC is responsible for enhancing coordination and cooperation between various public institutions that have competence in cyber security matters, as well as between the public and private sectors. The advisory body is composed of high-level representatives from government institutions, law enforcement agencies, public and private organizations, and the scientific community. It will also facilitate the decision-making process by analyzing, studying, and proposing initiatives at national and international levels [41]. The NCSC achieves its mission by providing strategic advice on cybersecurity to the Government of Kosovo and the business community (through the government), observing the latest technological trends and developments and, when needed, taking measures to reduce cyber security risks, to increase economic opportunities, and initiating and accelerating relevant initiatives that significantly contribute to increasing the level of cyber security in Kosovo; systematically monitoring and coordinating the implementation of the National Cyber Security Strategy, taking into account all current and future challenges in the field of cyber security, suggestion of precise measures to improve the implementation of the National Cyber Security Strategy and Action Plan, etc. [41]. The NCSC is headed by the Minister of Ministry of Internal Affairs or his delegate, who is ex officio the National Coordinator for Cyber Security.

Otherwise, the regular annual meetings of the NCSC are known to the Kosovo public, in which the members are informed and discuss the level of cyber security in Kosovo, then the implementation of the State Strategy for Cyber Security is evaluated during the period between the two NCSC meetings; also the measures and activities that have been taken and those that will be undertaken to increase cyber security in all public institutions are discussed. But when the need calls for it, and especially when the institutions of Kosovo are attacked by cybercrimes, then the NCSC also holds extraordinary meetings, as was the case with the cyberattacks in March 2021, when discussing the type of cybercrime (DDoS), the consequences caused, and the measures taken, also notified the dependent institutions and the persons responsible for the steps they need to take [45].

5.3 National Cyber Security Unit (KOS-CERT)

The National CERT (Computer Emergency Response Team) is the team of the Republic of Kosovo that responds to computer emergencies at the national level [41]. Besides this team, the Kosovo legislation allows for the establishment of teams in specific sectors of critical infrastructure. These are the teams responsible for responding to computer security or cyber security incidents that affect an operator of essential services (CSIRTs of operator essential services- OES) and the teams responding to computer security or cybersecurity incidents affecting digital service providers (CSIRTs of digital signal processors- DSPs) that also operate in Kosovo.

The Regulatory Authority of Electronic and Postal Communications (ARKEP) is the national body responsible for the regulation of electronic communications activities, as outlined in the Law of Kosovo on Electronic Communications (2012). Article 10 mandates and obligates the authority to “perform the functions of the Computer Center for Emergency Response to manage risks in public electronic communications systems” [44]. The authority incorporated and functionalized the KOS-CERT in July 2016 as a technical and functional unit. The National KOS-CERT is authorized to handle all types of computer security incidents that occur or threaten to occur in the Kosovo community environment. KOS-CERT is dedicated to keeping the community informed about potential risks and will inform them before they occur if possible.

Otherwise, KOS-CERT is one of the first units of this type from the region that was accredited in July 2017 by the “Trusted Introducer/TF-CSIRT,” which was created by the European community of CERTs (Computer Emergency Response Teams) in 2000 to address common needs and establish a service infrastructure that provides vital support to all cybersecurity teams.

The functionalization of KOS-CERT in July 2016 has had a direct impact on the establishment of the CSIRTs. Thus, in Kosovo, during the period 2016–2020, more than 50 CSIRTs have been functionalized and have started operating [43].

Despite KOS-CERT’s creation of an online platform that allows Kosovo citizens to report cyber incidents against both private and public legal entities and citizens, in the absence of awareness of its existence, victims of cybercrime do not use it. However, such cases are reported to the Kosovo Police, which further transmits them to its Investigations Department and Cybercrime Investigation Section [43].

5.4 Kosovo Police Department for Cyber ​​Security and Systems Administration

Given the high risk of cybercrimes, the Ministry of Internal Affairs of Kosovo has established the Cyber ​​Security Department. One of its main duties is to prepare, supervise, and implement cybersecurity policies at the national level. In addition to tasks of a strategic nature, the department is also responsible for the practical level of combating cybercrimes because it coordinates cyber security activities related to various cyber incidents. Regardless, they are committed to public or private institutions. Within the Kosovo Police, the investigation of cybercrime is handled by the cybercrime investigation sector, which is part of and operates within the Directorate for the Investigation of Organized Crime.

The cybercrime investigation sector deals with citizens’ denunciations related to cybercrimes, taking investigative actions, such as crime scene investigation, interrogation of suspects, victim interviews, and various computer expertise in order to detect and fix traces and evidence of cybercrimes.

5.5 State Cyber Security Training Center

The State Cyber Security Training Center operates within the Ministry of Defense of Kosovo in order to provide training for all institutions of the Republic of Kosovo in the field of cyber security. The Center has its own organizational structures, which, in cooperation with CSA, determines the procedure and format of specialized programs for training and certification of personnel engaged in the field of cyber security in accordance with their competencies [41].

To fulfill its obligations, The Center collaborates with numerous international projects and mechanisms. Particularly, during the preparation and finalization of the training curriculum for its beneficiaries in September 2023, the activities of this Center were supported by the program of the British Embassy in Prishtina and implemented by the Geneva Centre for Security Sector Governance (DCAF).

Given that the individual actions of the above-mentioned mechanisms may be accompanied by omissions and inefficiencies in the fight against cybercrime, as per the Law on Cyber Security (2023), it has been determined that state mechanisms for preventing cyberattacks and cyber protection in the Republic of Kosovo must coordinate and cooperate between them during full filling of their duties and responsibilities.

Kosovo has completed its state mechanisms for combating cybercrime with the establishment of the State Agency for Cyber Security. The State Agency for Cyber Security and the NCSC acts as a regulatory body and creator of all state controls. The updated legislation of Kosovo with which these mechanisms are established is being reviewed by the NIS European Directives, as an attempt to remove redundancies and make it as relevant as possible [46]. These mechanisms, which are relatively new and lack experience, are experiencing difficulties of different natures, which are affecting their low-efficiency rate. Among the difficulties of these mechanisms are considered:

• Institutions are experiencing a significant shortage of cybersecurity experts in the country.

• Victims of cybercrime are not using the Kos-CERT online platform for cyber incident reporting because they are unaware of its existence.

• The lack of clarification of clear mandates and competencies with legal provisions of these mechanisms.

• Lack of transparency and accountability culture among essential state service operators is expressed through non-publication of reports on cybersecurity incidents.

• Insufficient cooperation of these mechanisms (e.g., KOS-CERT) with academic institutions is due to limited professional capacities, etc.

Therefore, Kosovo’s state institutions have a priority task to take various measures to improve the functioning of cyber security protection mechanisms.

6. Conclusions

The rise in computer users and Internet services has led to an increase in cybercrimes worldwide, including in Kosovo.

During the last few years, Kosovo has been attacked with both ordinary forms of cybercrime and forms that have threatened the national security of this country. Cybercrime has hindered and threatened the operation of some of the highest state institutions, beginning with the Presidency, the Prime Minister’s Office, the Ministry of Foreign Affairs of Kosovo (MFAK), the Ministry of Internal Affairs of Kosovo (MIAK), the Prosecutor’s Office of Kosovo, etc.

Kosovo’s national security has also been endangered by propaganda, disinformation, and fake news spread by opponents of Kosovo’s independence, such as Serbia, Bosnia and Herzegovina, Russia, and other countries in this political bloc. The purpose of this cyber propaganda is to manipulate the citizens of Kosovo and escalate the situation on the ground, causing a conflict between the majority Albanians and the minority Serbs in Kosovo.

Cybercrime in Kosovo has included information about threats to Kosovo institutions, such as bomb explosions.

The most frequent types of cybercrime threatening Kosovo’s national security include Distributed Denial of Service (DDoS) and “Phishing” as a form of “social engineering” that aims to steal credentials.

The digitization of state institutions in Kosovo, which process data for almost 1.7 million citizens, poses a risk and possibility of increasing cyber threats and cybercrimes in Kosovo.

The Republic of Kosovo faces numerous challenges in combating cybercrime, starting from the lack of human resources in the state institutions to build cyber security capacities, then the courts are not professionally prepared to properly handle cybercrime cases, the decentralization of computer systems in Kosovo’s institutions, lack of harmonization between different laws, strategies and other acts in this field. Another challenge for Kosovo is building capacities to combat existing cybercrimes (more than 50 types) and adapt to new types that may appear and endanger its security.

Kosovo’s legislation on cyber security, in addition to being harmonized with aquis communiter, provides legal security for Kosovo citizens because, among others, it protects the confidentiality, integrity, and availability of computer system data; contains a significant number of criminal offenses from the sphere of cybercrimes and determines the criminal sanctions for their perpetrators; considers and regulates the issue of respect for human rights.

Kosovo’s legislation on cyber security also deals with the international cooperation of Kosovo’s institutions with mechanisms similar to those in other countries in preventing and fighting cybercrime as well as regulating other issues in the field of cybersecurity.

Kosovo has set up the necessary mechanisms and institutions to combat cybercrime, including The Cyber Security Agency, the State Council for Cyber ​​Security, the National Cyber Security Unit, the Kosovo Police Department for Cyber Security and Systems Administration, and the State Cyber Security Training Centre.

In order to enhance the effectiveness of these mechanisms and successfully overcome the challenges related to cybersecurity, state institutions, and Kosovo society in general should take certain measures related to:

• Providing cybersecurity training programs for both government employees and private sector workers.

• Making regular cybersecurity training mandatory for all essential state services.

• Raising awareness among staff members of these mechanisms and citizens of Kosovo about cybersecurity threats.

• Granting assistance to academic institutions and private companies in the development of new tools and technologies to tackle emerging cyber threats.

• Collaboration between government agencies, private companies, and academic institutions can be encouraged by a state to exchange information and expertise on cybersecurity threats, best practices, etc.