anniversary<\/a>\u201c in North Macedonia. Last year in July, our country was a victim of a sophisticated cyberattack that affected a very important public process. Just as a reminder for those who forgot (and honestly \u2013 who remembers cyber-attacks except their victims) the website of the National Election Commission crashed on election night and was out of function for several days, significantly disrupting the election process. It took days for the website to be recovered and the official results to be published online. That very same night, the biggest news aggregator in the country, the TIME.mk portal, was attacked from more than 35 million web addresses worldwide, by a hacker group called \u2018Anonopsmkd\u2019, who took responsibility for both attacks. As far as I know \u2013 the groups or persons behind the DDoS attacks that disabled the most important website in the country at that moment and most visible news portal, are still not identified.<\/p>\n\n\n\nInspired by the abovementioned \u201canniversary\u201d \u2013 I wonder how safe our region is when it comes to cybercrime?<\/p>\n\n\n\n
Although the Balkans (with a focus on WB6 countries) are still on the periphery of global cyber warfare \u2013 it doesn\u2019t mean they are safe. However, deep and serious digital reforms are underway all around us. This short overview of the bad and good guys can help us understand the situation a bit better.<\/p>\n\n\n\n
The Bad Guys<\/strong><\/p>\n\n\n\nIn the early months of the Covid-19 outbreak, Slovenia, Serbia, Croatia, and North Macedonia have been victims of a phishing campaign with fake emails supposedly coming from government health authorities, aiming to mislead the reader to register for free protective gear. The registration link in the emails contained malware that would damage the victims \u2018computers and networks.<\/p>\n\n\n\n
Cities are legitimate hackers\u2019 targets. The background of such attacks often remains unclear \u2013 but it is always somewhere between politics and \u201cclassic\u201d blackmail. For example, Novi Sad, one of the largest cities in Serbia, was a victim of a ransomware attack where the attackers asked for 400.000 EUR from local authorities to re-establish access to the public data system.<\/p>\n\n\n\n
In May 2020, a Greek hacker group called \u2018Powerful Greek Army\u2019 hacked dozens of e-mail addresses and passwords of employees in the Ministry of Finance and Economy in North Macedonia and the Municipality of the eastern town of Strumica.<\/p>\n\n\n\n
In 2019, in neighboring Bulgaria, more than five million people had their data stolen in a breach of the national tax agency. Romania on the other hand was \u201clucky\u201d because should have the massive ransomware attack on hospitals across the country in 2019 happened during the COVID-19 pandemic, the consequences for the health system in the country could have been beyond repair.<\/p>\n\n\n\n
Montenegro is on the attackers\u2019 map as well. Official sources report more than 7600 identified \u201cnon-targeted\u201d malware threats and several high-profile cyber-attacks as well. The lack of cybersecurity experts is not the case just in Montenegro but in other countries of the region.<\/p>\n\n\n\n
Cybersecurity is a super dynamic field where the situation changes on a daily level. In that complex game, countries are usually on both sides at the same time occasionally being the source of cybercrime and a firewall against it. That situation is evident almost everywhere \u2013 both globally and regionally.<\/p>\n\n\n\n
Albania, despite being a country with a mature cybersecurity status in terms of procedures, acts, resources, institutional readiness, and preparedness, has nevertheless been one of the top five sources of cyber-attacks in Europe in fall 2020. On the other hand \u2013 Albania has made four extensive cyber police actions in 2020 targeting children pornography, personal data theft, etc. As a country with 63.25% of the population with Internet access \u2013 Albania takes cybersecurity seriously.<\/p>\n\n\n\n
Content farms from Macedonia that, together with farms from the Philippines were involved in spreading of Covid-19 disinformation and conspiracy theories and thus banned from Facebook \u2013 is just one of the many examples.<\/p>\n\n\n\n
Finally, I will note the cyber-attacks on two popular internet portals in Bosnia and Herzegovina \u2013 Buka and Journal, which were sharply condemned by OSCE just to make this picture complete.<\/p>\n\n\n\n
The Good Guys<\/strong><\/p>\n\n\n\nThis is, however, just one side of the coin. The other side is a network of organizations and institutions involved in regional security, that together with legislative acts, bylaws, digital strategies, digital agendas, action plans, and other documents and procedures, make a complex regional cybersecurity system.<\/p>\n\n\n\n
That system, although not visible at a glance, is an effective firewall against cybercrime in the region. The simplest way to understand the complex situation is to read and compare national reports on Cyber Capacity Maturity Model (CMM) that are regularly published on the Global Cyber Security Center.<\/p>\n\n\n\n
A thorough evaluation of these reports would require a much longer text than this one, but, briefly, the regional comparison reveals the cyber maturity status of WB countries.<\/p>\n\n\n\n
We can see that technology, opposite to popular belief, is just one aspect of the story. Efficient cybersecurity requires standards, policies, education, strategies, and above all \u2013 education. At the end of the day, the most effective defense against cybercrime is a firewall of people \u2013 and that is, in my opinion, the most valuable resource one country can have when it comes to cybersecurity.<\/p>\n\n\n\n
The figure above, based on available national reports, shows that there is a large space for improvements in the entire region. It is important to understand that cyberspace cannot be sealed within national geographic borders and that the spillover effect <\/em>is something we must always count on. Regional cybersecurity requires a high level of cooperation and confidence, together with concrete synchronization of actions and procedures between WB6 countries. So, in a nutshell \u2013 we must cooperate because if we don\u2019t, we will all become victims sooner or later.<\/p>\n\n\n\nThe EU cybersecurity strategy published in December 2020 expressly stated that \u201cEU cyber capacity building should continue to focus on the Western Balkans and in the EU\u2019s neighborhood […] The EU efforts should support the development of legislation and policies of partner countries in line with relevant EU cyber diplomacy policies and standards\u201d<\/em>. It means that the entire WB region on its way to the EU \u2013 must take cybersecurity very seriously.<\/p>\n\n\n\nMoreover, the recent EU economic and investment plan for Western Balkans \u2013 an umbrella document for the entire EU-supported economic development in the region, outlines the investment frame in the regional cybersecurity infrastructures. EU calls the WB countries to focus on reform priorities, including \u201ccybersecurity capacity and the fight against cybercrime, especially by implementing the EU toolbox regarding cybersecurity risks to 5G networks\u201d<\/p>\n\n\n\n
Therefore, cybersecurity slowly but irreversibly becomes one of the important topics in the EU accession dialogues. It exceeds the frames of personal, corporate, and even national cybersecurity and becomes an umbrella for overall regional security and compliance with EU standards and efforts.<\/p>\n\n\n\n
The abovementioned example of Slovenian CERT (Computer Emergency Response Team) that cooperated with Serbian and Croatian colleagues to stop phishing disinformation campaigns during the outbreak of the Covid-19 pandemic is a good example of regional best practice. One of the most obvious consequences of the COVD-19 crisis is that it has accelerated digital transformation dramatically \u2013 and, together with it, a level of regional coordination as well.<\/p>\n\n\n\n
Finally, we should not forget that cybersecurity is a matter of all of us. The examples given here do not mean that cybersecurity is a task for some mysterious secret agents and national infrastructures to deal with. James Bond will not resolve your online identity theft or corporate data system breach. We must all act responsibly and be educated and ready to identify the cyber-attack, report it promptly and react accordingly.<\/p>\n\n\n\n