Is the Western Balkans a cyber danger zone? The honest answer is: parts of it, provably, yes — and the strongest evidence is not speculation but a string of actual breaches. When Bosnia and Herzegovina ran general elections last month with biometric voter identification and ballot scanners, the reform won praise for fast, accurate results. According to the Center for European Policy Analysis, the region's digital foundations remain fragile, and its adversaries know it.
A second opinion on that argument is worth having, because CEPA is right on the record and partly overreach on the framing. The breaches are documented. The claim that China and Russia are maneuvering for leverage across a region "torn between attraction to the European Union and to Russia" is interpretation — reasonable interpretation, but interpretation. Where the fee actually sits, to borrow a payments habit, matters: the vulnerability is real and local, and the geopolitical storyline sits on top of it rather than underneath.
This piece examines what the record supports, what it does not, and what a measured response would look like. Readers tracking how Washington turns concern into legislation can see the machinery in how a bill really becomes law, because CEPA's key recommendation is an amendment to a bill now moving through Congress. For related coverage, see How a Bill Becomes a Law: How a Bill Really Becomes Law, Step by Step.
What does the evidence actually show?
The attacks are real, named, and repeated. According to CEPA, HomeLand Justice — a hacker group the Albanian government links to Iran — broke into Albania's national parliament earlier this year, deleted data, and published lawmakers' emails on Telegram. Investigators believe the attackers held administrative access long before revealing themselves; passwords had reportedly not been changed for years, and intrusion alarms did not sound. CEPA counts it as the group's third major attack on Albanian institutions since 2022.
The pattern extends beyond Albania. Ransomware paralyzed Montenegro's government networks in 2022. In Bosnia, a 2022 ransomware attack crippled the Parliamentary Assembly, taking its servers, website, and email offline, with thousands of employees in state institutions locked out for more than two weeks. No public report on that incident or its lessons was ever released. In early 2024, hackers breached the Bosnian Republika Srpska's health information system and its tax administration. Bosnia, CEPA notes, lacks a fully functioning state-level cyber emergency response team.
That is a solid evidentiary base for one conclusion: the region's defenses are weak, and attackers have already exploited them. It supports a second, weaker conclusion: hostile actors find the region attractive. It does not, on its own, prove a coordinated Chinese-Russian campaign — a distinction CEPA's own headline blurs. We covered a connected angle in Field: Eugene Bardach Taught Policy Analysis to Admit Its Own Doubt.
Where does the vulnerability actually sit?
CEPA's infrastructure detail is the most useful part of the analysis, and it reads like an audit finding rather than a war warning. National cyber-response teams across the region are small and underfunded. Public systems are outdated. Responsibility is fragmented. Large volumes of sensitive data — tax records, health records, and Bosnia's new biometric voter data — sit in databases that are rarely audited.
Then there is the vendor question. Huawei remains the dominant supplier to Bosnia's two largest mobile operators, BH Telecom and Republika Srpska's M:Tel, and CEPA states flatly that the security risks of that choice have never been seriously considered. Belgrade's Chinese-supplied "safe city" facial-recognition system is the best-known example of surveillance built on Chinese equipment. Western money, the article notes, paid for much of that infrastructure — a detail that should discomfort the donors as much as the recipients.
Bosnia's biometric voting system, in this reading, is only as trustworthy as the equipment and vendors behind it. That is a fair engineering point. It is also where the argument needs care: dependence on a vendor is a risk factor, not a demonstrated breach. The documented attacks CEPA cites were ransomware and an Iranian-linked intrusion, not evidence that Chinese-supplied telecom gear was exploited.
Does the congressional bill close the gap?
Here CEPA's skepticism is its strongest material. Representatives Ritchie Torres and Joe Wilson have introduced H.R. 10748, the Balkans Security Cooperation Act. It asks the Pentagon to report on every Western Balkan country's security cooperation with Russia, China, the US, and NATO — arms deals, exercises, agreements, intelligence ties. It also asks for an assessment of the Russian-Serbian Humanitarian Center in Niš, which signed a 2025-2027 development plan with Serbia's interior ministry and whose request for diplomatic status the US and EU have resisted since 2014.
CEPA's verdict: the bill counts tanks, missiles, and agreements. It does not count code, vendors, or data. As a critique of legislative scope, that is hard to argue with — a security-cooperation report built around conventional military ties will not surface a telecom supply chain. The proposed fix is a cyber and data annex asking four questions: which hostile cyber operations have targeted each country since 2012 and by whom; which foreign vendors supply critical telecommunications, energy, surveillance, and election systems and under what legal obligations to their home governments; how well sensitive government and citizen data, including biometric data, are protected; and where US, NATO, and EU assistance would close gaps fastest. CEPA also wants Iran included alongside Russia and China, given its documented operations in Albania.
The counterargument deserves its say. A Pentagon reporting requirement is a low-cost first step, and asking a bill to do everything is a way of ensuring it does less. But CEPA's point survives the steelman: a report that omits the attack surface where every documented incident actually occurred is answering last year's question.
What is the trade-off for Europe and the region?
CEPA argues Europe should not wait for Washington, and the accession process gives it leverage: the EU already demands cybersecurity and data protection standards as part of membership talks, and Montenegro and Albania are moving quickly through the chapters. The recommended package — shared incident response, regular audits of critical databases, election-security support, clear rules on high-risk vendors — is conventional but concrete.
The trade-off is political. Serbia's incoming government has promised transparency and the rule of law while keeping military neutrality, and CEPA argues cyber cooperation is one area where it can work with EU and NATO partners without changing that stance. That is plausible, but it asks Belgrade to scrutinize the very vendor relationships CEPA flags as riskiest. Brussels would be pressing a neutral state to treat its infrastructure supplier as a security question. That is not impossible; it is just harder than a communiqué suggests.
The measured view, then: the danger is documented, the response should be proportionate. The cheapest way to shift the balance of power in the region, as CEPA puts it, is to undermine trust in the ballot — and Bosnia's successful use of election technology shows what is possible while creating a new duty to protect biometric data. For readers following how election integrity becomes a policy fight, the stakes are easier to see through the lens of elections coverage than through threat headlines.
What should Washington and Brussels do next?
The next development is procedural: H.R. 10748 moving through Congress, with or without the cyber and data annex CEPA proposes. The evidence points to a narrow conclusion. The breaches happened. The defenses are thin. The bill as written looks past both. Whether Congress adds the annex, and whether the EU funds audits rather than issuing statements, will show whether the warning was a strategy or a headline. The record so far justifies the concern — and, on the evidence supplied, not much more than that.
