During the past two years, Kosovo has been a target of cyber attacks and bomb threats aimed at destabilizing the country and creating panic among the population.
Since the beginning of Russia's aggression against Ukraine, bomb alerts have become common in other countries in the region as well. Although it is still unknown whether the perpetrators of these false bomb threats have connections to the states from which the messages were sent, the methods and institutions targeted by the threats were similar across all countries. The main targets were primarily schools and airports. Threats came from both non-state actors and state actors, making cybersecurity an increasingly critical issue for national security.
In Kosovo, the majority of attacks occurred during the spring of 2022, targeting some of the most frequented public places, such as public schools, the University of Prishtina, and Prishtina International Airport. These threats occurred during a challenging period for the country, at a time when tensions in the north were high, contributing to the escalation of panic.
The Kosovo Police (KP) reports to Sbunker that in 2022, a total of 48 cases of bomb threats through computer systems were identified in Kosovo, while only 9 were reported in the following year. Despite the high number of threats, relevant institutions have not disclosed whether they have identified the perpetrators, and it is unknown whether they operate within or outside the country.
Nevertheless, these threats continue to pose a significant risk to the country, and Kosovo's institutions remain inadequately protected. In these circumstances, it is crucial to establish a better cyber infrastructure to prevent such attacks in the future.
Threats against schools and the airport
The first serious threat that caused panic among the population and garnered media attention was the threat against "Xhevdet Doda" high school in Prishtina in May 2022. The attackers sent this message to the school's official email: "Bombing Xhevdet Doda School." “Bombing Xhevdet Doda School”.
The school staff immediately alerted the case, and within a few minutes, the school premises were surrounded by tapes and members of the Kosovo Police (KP) and specialists in explosive device elimination. The school director, Azem Jaha, recounted the situation to Sbunker in which they were tested for the first time:
as a “"After the police arrived, we informed them about the threat we had received," said Jaha. Furthermore, he added, "We told the students to leave the school calmly, without panic. Within a few minutes, the premises were emptied."
After the evacuation of the students, the school spaces were inspected by bomb disposal police units, including the unit of trained dogs for identifying suspicious objects. However, the police unit did not manage to identify any bombs, assessing the situation as a false alarm.
XHEVDET DODA GYMNASIUM, Pristina.
According to Jaha:"The police left no place unchecked. But fortunately, nothing was found. As a result, several instructional hours were lost that day." The entire control procedure, resulting in a false alarm, lasted about three hours.
However, the bomb threat at "Xhevdet Doda" school is not an isolated case.
Azem Jaha, Gymnasium “Xhevdet Doda”
Initially, in January 2022, a false bomb alarm was raised at the Bus Station in Prishtina. After police investigations, all that was found was a bag, but no bomb inside it.
Another threat occurred in May against the public University "Hasan Prishtina." Two months later, this university was threatened again. However, the KP's bomb disposal units found no bombs in either case.
Bomb threats were issued at specific intervals, not only during periods of internal political developments but also during Kosovo-Serbia tensions.
Threats continued in June, coinciding with the organization of two protests in Prishtina. There were threats in various regions, including the northern municipalities predominantly populated by Serbs.
This situation challenged the capacities of the KP, which faced difficulties conducting detailed checks at different locations simultaneously. Nevertheless, in the end, all alarms proved to be false.Despite this, the situation was deemed concerning because the targets were educational institutions at all levels. On this occasion, government officials urgedpeople not to create concerns and panic but did not provide any information about the source of the threats.
The Saga of Prishtina-Munich and Prishtina-Rome Flights
The International Airport of Prishtina was not spared from bomb threats. The airport was alerted twice in June 2022.
Initially, suspicions arose that an explosive device was on the Rome-Prishtina flight. The bomb threat bomb threat was made while the plane was in flight, causing significant concern among passengers. After the plane landed at Prishtina International Airport, passengers were evacuated by the Kosovo Police, which also conducted checks inside the luggage but found nothing.
Prishtina International Airport “Adem Jashari”
On June 16, 2022, another bomb threat occurred. Passengers on the Prishtina-Munich flight reported that the threat was of a high level. As a result, the plane was forced to divert to Skopje, awaiting instructions based on the situation at Prishtina Airport, and no one was allowed to disembark from the aircraft. The Kosovo Police, after verification and conducting checks at "Adem Jashari" International Airport, where the placement of explosive devices was reported, confirmed that these pieces of information were false.
Bomb threats at Prishtina Airport created extraordinary problems for the authorities. In addition to the security aspect, the threats led to numerous delays, complicating the airport's operations.
Valentina Gara, Prishtina International Airport “Adem Jashari”
as a “"Every false alarm has caused flight delays," said to Sbunker, Valentina Gara, the spokesperson for Prishtina Airport. According to her, in the cases of bomb threats, which endured in 2023 as well, the airport has an emergency plan that activates all relevant security authorities, including the Kosovo Police, the Kosovo Security Force (FSK), and KFOR.
During the intensified bomb threats, the annual "Mirëdita Dobërdan" festival was held in Belgrade, aiming to promote cooperation through culture and art. However, the opening ceremony was interrupted due to a bomb alarm at the Center for Cultural Decontamination (CZKD). For about half an hour, the area was inspected by the bomb disposal unit, which later confirmed that the alarm was false. The bomb threat notification had come from the same email address from which another bomb threat was issued after the opening of the exhibition "All Our Tears." This one also turned out to be a false alarm.
Attacks from unidentified computers and various IP addresses
Throughout 2022, the governmental systems of Kosovo have faced Distributed Denial of Service (DDoS) cyber-attacks, causing intermittent disruptions in the internet service within institutions and temporary lack of access to some government services. The websites of the Prime Minister's Office, several ministries, the Kosovo Police, the e-Kosova Platform, and some media outlets have been a target of cyber attacks.
One of the major telecom providers, Telekom Kosovo, also faced cyber attacks. Its officials stated that the attack was carried out by 30,000 unidentified computers with different IP addresses.
Considering the scale of the attack, cybersecurity experts urged the government to urgently block all IPs from Iran, Russia, China, and North Korea.
Cyber attacks in Kosovo occurred at the same time as when Iran was confirmed to have deeply penetrated the data of the Albanian government.
According to a Microsoft analysis,the cyber attacks against Albania were politically motivated, and behind them were actors linked to the Iranian government. After the attack, Albania ended diplomatic relations with Iran, expelling the diplomatic staff from the Embassy in Tirana.
Institutions in Kosovo on informational darkness
Despite the high number of cyber attacks and threats, relevant Kosovar authorities, including the Ministry of Internal Affairs, the Prosecutor's Office, and the Judiciary, have not been able to identify the source of the attacks and have not disclosed any information regarding investigations or potential charges.
Representatives of civil society organizations dealing with security issues state that threats usually arise during political or social tensions, aiming to instill fear, polarize society, and fuel ethnic divisions.
Throughout 2022, the governmental systems of Kosovo have faced Distributed Denial of Service (DDoS)
"Political developments in Kosovo and relations with Serbia can influence the security situation. Extra caution should be exerted with public statements, especially during moments that may cause tensions," stated Leureta Lumi (QKSS).
According to Lumi, alarms can be perceived as attempts to increase a sense of insecurity, but she does not rule out the possibility that such situations may influence political decision-making.
"At the same time, we have the international factor, which, in critical moments, may depend on the situations created, tensions in the country, to make important decisions for Kosovo," thotë ajo.
Leureta Lumi, QKSS
Lumi adds that threats aim to unsettle the public and disrupt regular activities, even attempting to induce panic and insecurity in society.
"But, this doesn't mean that these threats are not part of a broader geopolitical strategy," she says.
Schools have been the most affected by bomb threats because parents and the community are very sensitive to any kind of threat that may affect the safety of children, adds Lumi.
as a “This makes the school an easy target for those who want to cause disturbances or attract attention,"she expresses.
At a time when the education system in Kosovo is considered weak, especially after the pandemic, according to Lumi, these threats have only deepened this situation due to the loss of instructional hours.
Expanding knowledge to deal with false threats
Cyber attacks have highlighted the need to develop the necessary infrastructure to deal with such threats. This is because the use of information and communication technology has rapidly expanded since the year 2000.
According to statistics, internet usage in Kosovo is at 90.4 percent.
However, the relevant institutions do not seem to have taken any significant steps in this direction.
Nevertheless, this has not stopped Kosovar students from expanding their knowledge to deal with false threats.
Internet usage in Kosovo is at 90.4 percent
The director of "Xhevdet Doda" school in Prishtina, Azem Jaha, has stated that after the received threat, students are now organizing self-awareness lectures on cyber attacks..
Even at the Kosovo Center for Security Studies (QKSS), they say that improving reaction protocols in cases of bomb threats is crucial.
as a “"This includes training school staff and other institutions, improving communication between authorities and the public, as well as investing in technology for the identification and prevention of such threats. This will help reduce the impact of false threats and increase public safety," emphasized Leureta Lumi.
The need to enhance capacities
The informations that Sbunker requested have not been made available by the Kosovo Police and other investigating institutions. Government documents confirm that the increasing cyber attacks in recent years constitute a serious problem.
The borderless nature of cybercrime has contributed to the widespread dissemination of criminal activities involving computers and information systems. Last year, the government approved the National Cybersecurity Strategy 2023-2027, outlining the steps taken to establish a legal infrastructure aimed at preventing and combating all forms of cybercrime. Six strategic objectives are outlined to address this issue, including the establishment of legal and institutional cybersecurity capacities at the national level, promoting cybersecurity awareness programs, supporting the development of the private sector in cybersecurity, building sustainable national and international cooperation, and advancing investigative and military capabilities in cybersecurity.
Although the Cybercrime Investigation Unit within the Kosovo Police possesses the necessary technical capacities and training to investigate computer crimes, an effective law enforcement response remains a challenge. Focusing on the detection, tracking, and criminal prosecution of cybercriminals is crucial. Institutions must commit to building trust among citizens that all types of crime are handled responsibly and effectively.
So far, there have been no cases of penetration and serious damage to systems with state data, but this risk remains real.
Various criminal activities have exposed the vulnerabilities of computer networks in Kosovo. According to dataso far have been user accounts, banking systems, and websites. The government needs to improve the conditions for the police to perform their duties in line with technological developments and crime trends. Considering developments in this field, the government should implement a methodology for gathering cybercrime statistics, and the possibility of publishing annual data on cyber attacks should be considered. This would ensure an increase in the knowledge of investigative personnel and citizens in the field of information technology and cybersecurity.
This would ensure an increase in the knowledge of investigative personnel and citizens in the field of information technology and cybersecurity.
The region is also not immune
Since March 2022, there have been threats in Serbia, Montenegro, and Bosnia and Herzegovina.
Serbia has linked the threats to the situation in Ukraine, where state officials there said they are being targeted to exert pressure due to the non-imposition of sanctions against Russia. The Serbian police reported that eight threats originated from Poland, four from Gambia, two from Iran and Nigeria, and one each from Ukraine, Slovenia, and Russia.
Serbia also arrested three minors suspected of ordering over 80 bomb threats in schools in Serbia and Bosnia and Herzegovina.
*This article is published as part of the Western Balkans Regional Initiative against disinformation. Western Balkans Anti-Disinformation Hub: exposing malign influences through watchdog journalism.
