The increase in acts of sabotage, cyberattacks, and covert activities, suspected of being linked to Russia, has raised security concerns in Europe. These developments show that today’s threats extend beyond conventional military confrontations.
Kosovo is also exposed to such risks due to unresolved disputes with Serbia, tensions in the north, and the vulnerability of critical infrastructure. Kosovo Police’s SOCTA 2025 mentions propaganda, manipulation of public opinion, attacks in cyberspace, covert operations, and the exploitation of informal groups to fuel destabilization.
Të lidhura
None found
Security expert Drizan Shala, in a statement to “Bota sot,” considers the possibility of hybrid operations being used to destabilize Kosovo as real. According to him, this should be seen as a strategic threat to national security.
Shala notes that the risk is not limited to any single incident. The concern, according to him, is tied to the possible coordination of disinformation, provocations on the ground, cyberattacks, and the exploitation of interethnic tensions. He lists five areas where the country is most vulnerable and warns that the lack of institutional coordination could open the door to external interference.
Although Kosovo has built important institutional foundations for addressing risks, the expert emphasizes that shortcomings remain in cyber intelligence, specialized personnel, and the security of critical infrastructure.
Asked about the possibility of hybrid warfare being used against Kosovo, Shala said that it is real and requires strategic attention. However, he clarified that this does not necessarily mean a direct military conflict is being prepared. The goal could be to weaken the functioning of the state, shake citizens’ trust in institutions, and create insecurity through various means, without crossing into armed conflict.
He added that the risk should be examined in light of the unresolved relations with Serbia and Russia’s broader geopolitical interests in the Western Balkans. Shala described Kosovo Police’s SOCTA 2025 as a significant document, as it mentions propaganda, influence over public opinion, cyberattacks, covert activities, and the use of informal groups as components of hybrid threats.
According to him, from an intelligence perspective, the main risk lies in the possibility that multiple actions develop in parallel, from disinformation campaigns and provocations on the ground to cyberattacks and the incitement of interethnic divisions. He also stressed that the similarity of messages or interests does not by itself prove that Russia has operational control; for such a conclusion, concrete intelligence evidence is needed.
Shala identified five areas that, in his assessment, require special attention.
The first is northern Kosovo. The fragile security environment, illegal structures, criminal networks, and the possibility of exploiting interethnic tensions could create ground for destabilization. According to the expert, this area could be used for controlled provocations, inciting incidents, and testing the response of institutions and the international factor.
The second area is critical infrastructure. Electricity, telecommunications, banking systems, water supply, and public institutions could be targeted. A coordinated attack on them could bring technical consequences, but also political, economic, and social ones.
As a third point, Shala mentions cyberspace. State institutions, public administration systems, and digital infrastructure could be the target of attacks, espionage, and external interference.
The fourth risk is tied to the information space. Disinformation could be used to deepen polarization, lower trust in security institutions, and create the impression that the state is unable to handle crises.
The institutional dimension is the fifth area. Any shortcoming in cooperation among security institutions, defense policies, intelligence, and the civilian sector could be exploited by external actors. Shala underscored that, in a hybrid war, the greatest weakness is not necessarily the lack of military capabilities, but the lack of coordination and a unified state response.
Regarding the prevention of cyberattacks, sabotage, and disinformation campaigns, the expert assessed that Kosovo has built an important institutional foundation, but does not yet have all the necessary tools to confront every type of hybrid threat.
He distinguished between responding after an incident and the ability to detect, prevent, and neutralize an operation before it causes consequences. The National Cyber Security Strategy 2023–2027 and the development of the Cyber Security Agency are important steps, but implementation, specialized human resources, technology, intelligence sharing, and the protection of critical infrastructure remain challenges.
Shala singled out three priorities: building cyber intelligence and early warning capabilities; creating a joint mechanism for detecting and countering disinformation and foreign influence; and continuously exercising institutional readiness through hybrid crisis simulations, where cyberattacks, sabotage, and on-the-ground incidents are intertwined.
He argued that Kosovo should move away from a primarily reactive approach and build a national security model based on prevention, intelligence, and institutional resilience.
On the role of NATO and international partners, Shala said that cooperation with allies is crucial, but it needs to be better organized and focused on new threats. NATO, through KFOR and cooperation mechanisms with Kosovo institutions, helps maintain security and regional stability. However, he emphasized that hybrid threats require broader cooperation, especially in intelligence, cyber security, and the protection of critical infrastructure.
