日内瓦安全部门治理中心-西巴尔干地区的网络安全能力建设和捐助者协调（英文）-2021.5-17正式版

GenevaCentre

forSecuritySector

Governance

CybersecurityCapacityBuildingandDonorCoordinationintheWesternBalkans

FabioBarbero,EUISS

NilsBerglund,EUISS

1

AboutDCAF

DCAF–GenevaCentreforSecuritySectorGovernanceisdedicatedtoimprovingthese-curityofstatesandtheirpeoplewithinaframeworkofdemocraticgovernance,theruleoflaw,respectforhumanrights,andgenderequality.Sinceitsfoundingin2000,DCAFhascontributedtomakingpeaceanddevelopmentmoresustainablebyassistingpartnerstates,andinternationalactorssupportingthesestates,toimprovethegovernanceoftheirsecuritysectorthroughinclusiveandparticipatoryreforms.Itcreatesinnovativeknowledgeprod-ucts,promotesnormsandgoodpractices,provideslegalandpolicyadviceandsupportscapacity-buildingofbothstateandnon-statesecuritysectorstakeholders.

DCAF’sFoundationCounciliscomprisedofrepresentativesofabout60memberstatesandtheCantonofGeneva.Activeinover80countries,DCAFisinternationallyrecognizedasoneoftheworld’sleadingcentresofexcellenceforsecuritysectorgovernance(SSG)andsecuritysectorreform(SSR).DCAFisguidedbytheprinciplesofneutrality,impartiality,lo-calownership,inclusiveparticipation,andgenderequality.Formoreinformationvisitwww.dcaf.chandfollowusonTwitter@DCAF_Geneva.

DCAF-GenevaCentreforSecuritySectorGovernance

MaisondelaPaixCheminEugène-Rigot2E

CH-1202Geneva,Switzerland

Tel:+41227309400

info@dcaf.ch

www.dcaf.ch

Twitter@DCAF_Geneva

2 CybersecurityCapacityBuildingandDonorCoordinationintheWesternBalkans

Contents

EXECUTIVESUMMARY 3

INTRODUCTION 3

PARALLELCAPACITYUNIVERSESINTHEWESTERNBALKANS 6

THEEUROPEANUNION 6

THEUNITEDKINGDOM 8

THEUNITEDSTATES 9

THEOSCE 10

THEWORLDBANK 10

THEUNITEDNATIONS 11

ENHANCINGCOORDINATIONTHROUGHCAPACITYBUILDINGPRACTICES 12

LOOKINGAHEAD 14

3

EXECUTIVESUMMARY

ContinuedinterestandinvestmentincybersecuritycapacitybuildingintheregionclearlyindicatesthattheWesternBalkansremainsastrategicallyimportantregionforanumberofinternationalactors.Systematic,coordination-by-designmethodologiesandbestpracticesamongdonorsthatutilisewhole-of-societyandmulti-stakeholderapproachescanimprovethelegitimacy,ownershipandsustainabilityofoutcomesinthecontextofpersistentchal-lengestohumancapacity,politicalwill,andresourcescarcity.Furthermore,tobetterdefinetherolesofdifferentcapacitybuildingactors,helpidentifyopportunitiesforstrategicpart-nerships,andclarifydonor-recipientrelationships,donorsshouldseektostrengthenthelinksbetweenpolicyobjectivesandstrategiesforcapacitybuildinginterventions.Astheinterwoventhreatsandopportunitiesofcybersecurityanddigitaldevelopmentgrowmorecomplex,andgeopoliticaltensionsrise,bothdonorsandrecipientsshouldlooktowardsamoreholisticunderstandingofcapacitybuildingintheWesternBalkansthatalsoenablesmeaningfulinternationalengagementonthepeaceandsecurityofcyberspace.

INTRODUCTION

Cyberspaceisatheatrewherestatescooperateandcompeteovertheirinterestsandval-uesacrossalldomains:security,diplomacy,criminaljusticeanddevelopment.Digitaltrans-formation–withubiquitousaccesstotheinternetatitscore–hasbecomeoneofthekeydriversforeconomicgrowthandsocietalchanges.Itisnotsurprising,therefore,thatcyber-securityandresiliencehavebecomeanimportanttargetfordomesticreformsandanas-pectforstrengtheninginternationalcooperation.However,notallstateshavetheresourcesandexpertiserequiredtopursuethoseobjectivesinastructuredandsustainablemanner.

AstheCybersecurityCapacityMaturityModel(CMM)ReviewReportsfortheWesternBal-kanscountriesshow1,cybermaturityintheregionrangesfromstart-uptoformativelevels,scoringdifferentlydependingoncountriesandacrossdimensions(Fig.1).Despiteremark-ableexceptions,severalstatesstilllackofficialcybersecuritydocumentsdetailinghowtoestablishcoordinationbetweenkeycybersecuritygovernmentalandnon-governmentalac-torsorlackanoverarchingnationalcybersecuritystrategy.Severalemergencyresponseteamsexistintheregion,howeverthedegreeofgovernment-ledcoordinationatthena-tionallevelvariesfromcountrytocountry,togetherwithCERT’saffiliationtointernationalconsortiumssuchasFIRST2.Relevantdifferenceexistswithregardstotheexistenceofformalcategorisationofcriticalinfrastructureandrelatedlegislation.Nationalcybercrimelegislationexistsinmostcountriesintheregion,butchallengesintheeffectiveprosecutionofcybercriminalsandinthealignmentoflawswithregionallegalinstrumentssuchastheCouncilofEurope’sConventiononCybercrimeremain.Differentlevelsofawarenessex-istaroundtheprotectionofpersonalinformationandthesecurityofpersonaldata,withagrowing–butstillinsufficient–cybersecuritycultureamongcitizens,whichvariesgreatlydependingoninternetpenetration,theuptakeofe-commerceande-governmentinthena-tionaleconomy,andtheavailabilityofcybersecurityeducationinnationalcurricula.

1

2

CMMreviewshavebeenconductedforallWBcountries.AllexceptMontenegropublishedtheirCMMreviews,whichareaccessiblehere:https://gcscc.ox.ac.uk/cmm-reviews

ThegraphicbelowwascompiledbytheauthorsbasedonpubliclyavailableCMMreviews:EachoftheCMMstagesofcybermaturity,i.e.start-up,formative,established,strategic,anddynamicwasassignedascorefrom1(start-up)to5(dynamic).Ascoreforeachdimensionwascalculatedbasedontheaveragescoreofeachfactorwithinsaiddimension.

Attimeofwriting,onlySerbiaandMontenegroaremembersofForumofIncidentResponseandSecurityTeams(FIRST)./members/map

4 CybersecurityCapacityBuildingandDonorCoordinationintheWesternBalkans

Theneedtoclosethegapbetweenthosemostandleastadvancedaswellastocontinueadvancingthegloballevelsof‘cyberreadiness’againstthebackgroundofevolvingcyberthreatsanddigitalrisksiswhathasattractedeverybody’sattentiontotheexistingmecha-nismssuchastechnicalcooperationandcapacitybuilding/development.

Cybercapacitybuilding(CCB)canbebroadlydefinedasthedevelopmentandreinforce-mentofprocesses,competences,resourcesandagreementsaimedatstrengtheningna-tionalcapabilities,atdevelopingcollectivecapabilitiesandatfacilitatinginternationalco-operationandpartnershipsinordertorespondeffectivelytothecyber-relatedchallengesofthedigitalage.TheseCCBactivitiescancontributetopreventingcyber-relatedrisks,toprotectingcitizens,infrastructuresandprocesses,tothepursuitofcriminalactsincyber-spaceandtotheresponsetomaliciouscyberevents.3

Amidanevolvingthreatlandscapeandanupsurgeininvestment,theWesternBalkanshaveseenaproliferationincyberCCBactivitiescarriedoutbybothnationalandinterna-tionalactors.Despitetheexistinggaps,progressintheunderstandingoftheimportanceofbuildingadequatecapacitieshasincreasedintheregion,allowingWesternBalkansnationstobecomeplayersandpartnersasopposedtomererecipients.

Giventheincreasingnumberofstakeholdersinvolvedinthefieldglobally,the2018‘CouncilConclusionsonEUExternalCyberCapacityBuildingGuidelines’4recognisedthatsuchaproliferation,“createsopportunitiesforsynergiesandburden-sharingbutalsoposeschal-lengesintermsofcoordinationandcoherence.”Assuch,itcalledupontheEUanditsMemberStates“tocontinuouslyengagewithkeyinternationalandregionalpartnersand

3

4

PawlakP.(2018)(ed.),“OperationalGuidancefortheEU’sInternationalCooperationonCyberCapacityBuilding”.Availableat:https://www.iss.europa.eu/content/operational-guidance-eu%E2%80%99s-interna-tional-cooperation-cyber-capacity-building.SeealsotheDelhiCommuniquéonaGFCEGlobalAgendaforCyberCapacityBuilding(2017)at:/wp-content/uploads/2020/04/DelhiCommunique.pdfCounciloftheEuropeanUnion(2018),EUExternalCyberCapacityBuildingGuidelines,CouncilConclu-sions(26June2018).Availableat:https://data.consilium.europa.eu/doc/document/ST-10496-2018-INIT/en/pdf

5

organisationsaswellaswithcivilsociety,academiaandtheprivatesectorinthisfieldwiththeaimofavoidingduplicationofeffortgiventhelimitedresources.”

TheCOVID-19pandemichasbroughtnewchallengestoCCBactivitiesintheregion.Aspolicymakersfacethehealthcrisesanditssocialandeconomicimpacts,morecompetingprioritieslimitthefinancial,humanandtimecapacitiesthatcanbedevotedtocybercapac-itybuilding.Fordonorsandimplementors,shiftingpoliticalprioritiesmaymaketherecep-tionofCCBactivitiesmorechallenging,whilethebroadeningofthesurfaceattackduetoCOVID-19-comprisingforexamplehospitalsandthehealthsupplychain-bringsforwardnewareasforcapacitybuilding.Ontheotherhand,thepandemicmakescoordinationevenmoreimportantasitallowsformoreefficientallocationofresources.Yet,intheabsenceofvenuesforphysicalmeetingsandvenuesfornetworking,coordinationbetweendonorsandimplementorshasbeendisruptedtoagreatextent.

Inthiscontext,ourdiscussionpaperexploreshowcybercapacitybuildingactorsandini-tiativesintheWesternBalkanscouldbebettercoordinated,whileconsideringthebarrierstoreachingcybermaturityintheregion.Firstly,weofferanon-exhaustiveoverviewofproj-ects,donors,andimplementorsactiveintheWesternBalkans,basedondeskresearchandaseriesofinterviewswithrelevantstakeholders.Secondly,thepaperwillexplorebestpracticesoncoordinationthroughtheframeworkoftheOperationalGuidancefortheEU’sInternationalCooperationonCyberCapacityBuilding5.Lastly,basedontheabove,someconclusionsandbroadrecommendationsareproposed,withaneyetofutureCCBinvest-ment.

PARALLELCAPACITYUNIVERSESINTHEWESTERNBALKANS

Cybercapacitybuildingisinexorablylinkedtoongoinginternationaldebatesaboutthepeaceandstabilityofcyberspace.6Asaprocessfocusedonhumanresourcesdevelop-ment,organisationalarrangementsandlegalandinstitutionalframeworks,CCBactivitiescangenerallybeunderstoodaspromotinganimplicitorexplicitsetofpoliticalandsocialar-rangementsthatreflectthevaluesandprioritiesofagivendonor.Whilesuchprojectsbuildcapacitybystrengtheninginfrastructureandskills,theyfunctionasdiplomaticmechanismsforaligningpositionsoncyber-relatedissues.7Ratherthanpurelytechnocraticendeavoursforsocioeconomicdevelopment,then,capacitybuildinginitiativesimplementedbyinter-nationalactorsarealsoaformofpoliticalinstrument,orientedaroundtheadvancementofforeignpolicyinterests.Assuch,differentactorsengageintheWesternBalkanswithpar-ticularstrategicprioritiesandpolicyobjectives,thattendtoshapethenatureoftheircybercapacitybuildinginterventions.

THEEUROPEANUNION

TheEUcybersecuritystrategypublishedinDecember2020expresslystatedthat“EUcybercapacitybuildingshouldcontinuetofocusontheWesternBalkansandintheEU’sneigh-bourhood[...]TheEUeffortsshouldsupportthedevelopmentoflegislationandpoliciesofpartnercountriesinlinewithrelevantEUcyberdiplomacypoliciesandstandards8”.Thedoc-

5

6

7

8

PawlakP.(2018)(ed.),“OperationalGuidancefortheEU’sInternationalCooperationonCyberCapacityBuilding”.Availableat:https://www.iss.europa.eu/content/operational-guidance-eu%E2%80%99s-interna-tional-cooperation-cyber-capacity-building

SeeforexampleA/RES/74/173intheUnitedNationsGeneralAssembly,adoptedinDecember2019.Pawlak,P.(2016).CapacityBuildinginCyberspaceasanInstrumentofForeignPolicy.GlobalPolicy,7(1),83–92.Availableat:/10.1111/1758-5899.12298

EuropeanCommission(2020),“JointCommunicationtotheEuropeanParliamentandtheCouncil:The

EU’sCybersecurityStrategyfortheDigitalDecade”.Availablehere:https://ec.europa.eu/digital-sin-

6 CybersecurityCapacityBuildingandDonorCoordinationintheWesternBalkans

umentcallsupontheEUtodevelopatrainingprogrammededicatedtoEUstaffinchargeoftheimplementationoftheunion’sdigitalandcyberexternalcapacitybuildingefforts.Aclearnexusisalsodrawnbetweenmaliciouscyberactivitiesandtheintegrityandsecurityofdemocraticsystemsandsocieties.9Moreover,theEU’seconomicandinvestmentplanfortheWesternBalkansfromOctober202010stressedthattheEUshouldsupportcyberse-curitycapacitieswithparticularregardtoinfrastructureandthedigitaltransition,“developedbasedonaneedsassessmenttobeconductedin2021.”11Asaself-describedenablerofthattransition,theEUcalledfortheWesternBalkanstofocusonreformpriorities,including“cybersecuritycapacityandthefightagainstcybercrime,especiallybyimplementingtheEUtoolboxregardingcybersecurityrisksto5Gnetworks.”

WiththeCouncilofEurope,theEuropeanUnionhasbeenfundingjointregionalprojectsoncooperationagainstcybercrimeundertheInstrumentofPre-Accession(IPA).TheCy-ber@IPAprogramme12(2010-2013)wasutilisedtofurtheralignlegislationtotheBudapestConvention,supportthesetupandspecialisationofhigh-techcrimeunitsinpoliceandprosecutionservices,andfosteraregionalnetworkofcooperation.FromJanuary2016,the48-monthprojectiPROCEEDS13–fundedundertheIPAIIMulti-countryActionProgramme2014–focusedonstrengtheningthecapacityofauthoritiestosearch,seizeandconfiscatecybercrimeproceedsandpreventmoneylaunderingontheInternetinAlbania,BosniaandHerzegovina,Montenegro,NorthMacedonia,Serbia,TurkeyandKosovo*.FromJanuary2020,aseconditerationoftheprojectwaslaunched,targetingAlbania,BosniaandHer-zegovina,Montenegro,Serbia,NorthMacedonia,TurkeyandKosovo*foranadditional42months.Basedonthepreviouscapacitybuildingefforts,iPROCEEDS2focusesonthealignmentofpersonaldataprotectionwithEUandCoE’sstandards,oninteragencyandpublic-privatecooperationininvestigations,publicreportingsystemsononlinefraudandothercybercrimeoffences,judicialtrainingandinternationalcooperationandinformationsharingforinvestigationofcybercrimeandonlinecrimeproceeds.14Amongthedetailedactionsforeseenbytheprogramme,onecanfindworkshopsandtrainingcoursesoncyber-crimeandelectronicevidenceforjudgesandprosecutors,casesimulationexercisesandmocktrials,firstrespondertrainingcourses,tabletopexercisesandsimulationswithserviceproviders,etc.Theprojectalsoreferstothedevelopmentofguidelinesandtemplatesforinternationalcooperation,tothesupportofpartnershipbuilding,ofthepreparationofben-eficiaryreportsoncybercrimeandcybersecuritytrendsandcriminaljusticestatisticsandthesupportinsetting-uponlinereportingplatformsforcybercrimeinNorthMacedoniaandKosovo*.Notably,thisprojectdovetailswithotherCouncilofEuropecybercrimeinitiatives

9

10

11

12

13

14

gle-market/en/news/eus-cybersecurity-strategy-digital-decade

Seealsothe“EuropeanDemocracyActionPlan”.Availableat:https://ec.europa.eu/commission/presscorn-er/detail/en/ip_20_2250

EuropeanCommission(2020),CommunicationfromtheCommissiontotheEuropeanParliament,theCouncil,theEuropeanEconomicandSocialCommitteeandtheCommitteeoftheRegions:AnEconomicandInvestmentPlanfortheWesternBalkans”.p.12.Availableat:https://ec.europa.eu/neighbourhood-en-largement/sites/near/files/communication_on_wb_economic_and_investment_plan_october_2020_en.pdf

CyberCrime@IPAProjectPage.Availableat:/en/web/cybercrime/cybercrime-ipaiPROCEEDS–TargetingcrimeproceedsontheinternetinSouthEasternEuropeandTurkeywebsite.Availableat:/en/web/cybercrime/iproceeds

ThisdesignationiswithoutprejudicetopositionsonstatusandisinlinewithUNSCR1244(1999)andtheICJOpinionontheKosovodeclarationofindependence.

iPROCEEDS-2ProjectSummary,v.6December2019.Availableat:/0000-ipro-ceeds2-summary-v2/16809942df

7

intheregion,includingtheEndOnlineChildSexualExploitationandAbuse(EndOCSEA)projectfundedbytheEVACfund15.

Anotherintervention,the“EnhancingCybersecurity,ProtectingInformationandCommu-nicationnetworks”(ENSYSEC)project,wascarriedoutfrom2014to2016undertheIn-strumentcontributingtoStabilityandPeacemanagedbytheDirectorateGeneralforInter-nationalCooperationandDevelopment(DGDEVCO)oftheEuropeanCommission.Theproject,implementedbyExpertiseFrançaise16inpartnershipwithCivipol,aimedtoincreasethesecurityandresilienceofICTnetworksinthebeneficiarycountriesby“buildingandtraininglocalcapacitiestoadequatelyprevent,respondtoandprosecutecyberattacksand/oraccidentalfailures”.17Inparticular,itsupportedNorthMacedonia,MoldovaandKosovo*tobuildcapacitiesfornationalCERTs,toprovideadviceonpolicy,financialandlegalimpli-cationsofnationalcybersecuritystrategiesandtoenhancepublic-privatepartnershipsandcooperationinternationally.

InJanuary2020,theEUannounced,withinitsInstrumentforPre-AccessionAssistance(IPAII),an8-million-eurointerventioninsupportofcybersecuritycapacitybuildinginthere-gion,startingin2021.TheEUsupporttocybersecuritycapacitybuildingintheWesternBal-kansinterventionaimedto“buildupfunctioningandaccountableinstitutionsintheWesternBalkanstostrengthentheregion’scyberresilienceinordertorespondeffectivelytochal-lengesandriskssuchascyberattacks.”18Despitethemagnitudeoftheintervention,whichwassupposedtotargetallthesixWesternBalkanseconomiesforsixyears,inAugust2020theprocurementprocedurewascancelled“duetoare-assessmentoftheimplementationmodalityandscopeoftheproject”.WhileitisatpresentunclearifandwhentheseorotherEUfundswillbeavailablefortheregion,severalEUdocumentsgesturetothestrategicimportancethattheWesternBalkansshouldhavefortheEUwhenitcomestoCCB.

CertainEUmember-statesarealsoengagedinbi-lateralcapacitybuildingprojects,notably,theNetherlandsfundedprojectonSupportinggoodgovernanceandpublic-privatepartner-shipincybersecurityinSerbia,implementedbyDCAFfromSeptember2019toSeptem-ber2020.Theprojectsupportedthepublic-privatepartnershipinitiative‘PetnicaGroup’,agroupofrepresentativesfrominstitutions,regulators,oversightbodies,regulators,theprivatesectorandacademia.Theprojectaimedtoformalisethegroup’sobjectivesandop-erationsthroughmeetings,workshopsandexercises,thereforeultimatelygivingastructuretopublic-privatepartnershipinSerbia.

THEUNITEDKINGDOM

Accordingtothe2016-2021Cybersecuritystrategy,theUK’sinternationalengagementisintendedto“exertourinfluencebyinvestinginpartnershipsthatshapetheglobalevolutionofcyberspaceinamannerthatadvancesourwidereconomicandsecurityinterests.”19IntheWesternBalkansinparticular,thestrategyoftheForeign,andCommonwealth&Devel-

15

16

17

18

19

EndOCSEAprojectpage.Availableat:/en/web/cybercrime/endocsea-europe‘L’AssistanceauDéveloppementdesÉchangesenTechnologiesÉconomiquesetFinancières’(ADETEF)aidedtheimplementationbutwaslaterintegratedintoExpertiseFrance.ENCYSECprojectwebsite.Availableat:http://www.encysec.eu/web/

“EUsupporttocybersecuritycapacitybuildingintheWesternBalkans”programmeinformationat:https://webgate.ec.europa.eu/europeaid/online-services/index.cfm?ADSSChck=1580863587704&do=publi.detPUB&orderby=upd&page=1&orderbyad=Desc&searchtype=QS&aoref=140655&nbPubliList=50&user-language=en

NationalCyberSecurityStrategy2016to2021.Availableat:.uk/government/publications/national-cyber-security-strategy-2016-to-2021

8 CybersecurityCapacityBuildingandDonorCoordinationintheWesternBalkans

opmentOffice(FCDO)afterBrexitisfocusedprimarilyonsecuritycooperationandtacklingcorruptionandorganisedcrime.20

TheCybersecurityGovernanceintheWesternBalkansproject,startedinJuly2018andimplementedbyDCAF,involvestodifferentextentsallWesternBalkanscountriesandisex-pectedtorununtilMarch2021.Theproject,aimedtosupporteighteennationalgovernancereformsprocessesandactors,comprisesthreemainpillars:i)supportingcybersecuritygovernancepolicy-makingdialogueinBosniaandHerzegovina,Montenegro,NorthMace-doniaandSerbia;ii)buildingcapacityofnationalandgovernmentalCERTsinMontenegroandSerbia21;iii)enhancingregionalandinternationalCERTcooperationacrossthesixbeneficiarycountries.

TheFCDOalsosponsorstheCheveningCyberSecurityFellowships,deliveredbyCranfieldUniversityandallowingmid-careerprofessionalsfromtheWesternBalkanstoattenda10-weekprogramfocusingoncybersecuritypolicyanditsimplicationsfornationalsecurity,commercialopportunity,crimeprevention,andtherighttoprivacy,aswellasontrustbuild-ingandsharingofbestpractices.

THEUNITEDSTATES

TheUSNationalDefenceStrategy(NDS)hascalledforstrengtheningalliancesandattract-ingnewpartnersinthecontextofstrategiccompetitionwithChinaandRussia.Assuch,engagementsintheregionarecentredaroundadefence-forwardstrategythatemphasisesthestrengtheningofNATOalliancesandcyberdefence.22Inthecontextofcybersecurity,thishastranslatedprimarilythroughtechnicalexpertiseandhardware,butalsohumancapacity.AstheUSBureauofGlobalPublicAffairsmentions,followingtheirNATOacces-sionin2017,U.S.cyberexpertsworkedalongsidegovernmentofficialsfromMontenegroin2018and2019tocountermaliciouscyberattacksoncriticalnetworksandplatforms.AsoneoftheprimaryimplementorsofcybercapacitybuildingfortheU.S.DepartmentofState,CarnegieMellonUniversity’sSoftwareEngineeringInstitute(SEI)hasalsosupportedna-tionalCERTsintheregion,aswellastabletopexercises.Backin2011forexample,theirproject“AlbanianCyber-SecurityProgram”,aimedto“buildtheGovernmentofAlbania’scapacitytopreventandrespondtocyber-securityincidents,”andranaseriesofworkshopsandtrainingsthatsupportedtheestablishmentoftheAlbanianCyberIncidentResponseAgency(ALCIRT).Notably,SEIsupportandcooperationhasalsoextendedbeyondNATOmembers,includingtotheNationalCERToftheRepublicofSerbia(SRB-CERT).23Anoth-erimplementoroperatingaspartoftheUSDepartmentofStateCyberCapacityBuildingprogramistheGeorgeC.MarshallEuropeanCenterforSecurityStudies,whichhasimple-mentedtrainingcourses,andinteralia,runstheProgramonCyberSecurityStudies(PCSS)wherenationalofficials,includingthosefromtheWesternBalkans,havebeensponsored.24

20

21

22

23

24

Hoxhaj,A.(2019).“TheUK’sPolicyontheWesternBalkansPost-Brexit”.GlobeCentrePolicyBrief#6,UniversityofWarwickhttps://warwick.ac.uk/fac/soc/law/research/centres/globe/policybriefs/web_pb6_a_hoxhaj_by_research_retold_-_19_nov_2019.pdf

FromMarchtoAugust2017,theUKGoodGovernanceFundandDCAFsupported–throughtheMUPCERTproject–thecyberemergencyresponseteamoftheSerbianMinistryofInterior,whichactedatthetimeastheSerbianCERToflastresort.

NationalDefenseStrategy(NDS).Availableat:/Portals/1/Documents/pubs/2018-National-Defense-Strategy-Summary.pdf

SRB-CERTProceedings(2019)RegionalCybersecurityConference,05-06June2019,Ohrid.Availableat:https://mkd-cirt.mk/wp-content/uploads/2019/04/2019Ohrid_6.1.-Jelica-Vujadinovic-SRB-CERT-Nacional-ni-CERT-Ohrid-2019-v1.pdf

ProgramonCyberSecurityStudies(PCSS)Courses.Availableat:/en/aca-demics/college-courses/program-cyber-security-studies-pcss

9

THEOSCE

ThemandatefortheOrganisationforSecurityCo-operationinEuropespansacross‘polit-ico-military’,environmental,economic,andhumanaspects.Throughanumberofinstitu-tionsandstructures,theiractivitiesencourageparticipatingstatestocommitto“fullrespectforhumanrightsandfundamentalfreedoms;toabidebytheruleoflaw;topromoteprinci-plesofdemocracy.”25Asamember-stateorganisationofwhichallWesternBalkanstatesareapart,theircapacitybuildinginitiativesintheregionareinternallyfocused,coordinatedthroughthenationalOSCEmissionoffices.TheOSCEhasintervenedintheregionprimarilyinrelationtosupportingnationalcybersecuritygovernancereformsandconfidence-buildingmeasures.FromOctober2017toDecember2020,theOSCEwasinvolvedinsupportingtheimplementationofConfidence-BuildingMeasuresthroughaninitiativefundedbyGer-manyandtheUnitedStates.Accordingtotheproject’sentryintheCybilportal26,theprojectworkedwithWesternBalkansstates(exceptKosovo*)“toidentifyandprioritizenationalim-plementationchallenges”,aswellas“creatingnationalCBMimplementationroadmapsandacustomizedcapacitybuildingassistanceplanincooperationwithinternationalpartners.”27Pendingadditionalfunding,theOSCEalsohopestocarryoutanationaltable-topexerciseon“PreventingandCounteringtheUseoftheInternetforTerroristPurposes”intheregion28.WithregardstoSerbia,thelocalOSCEMissionsupportedthenationalpublic-privatedia-logue,facilitatingthecreationandmaintenanceofthePetnicaGroup29.InBosniaandHer-zegovina,thelocalOSCEMissionsupportstheworkondevelopingnationalcybersecuritystrategicframeworks.

THEWORLDBANK

TheWorldbankhashistoricallysupportedtheWesternBalkancountriesoneconomictran-sition,earlyreforms,aswellaspost-conflictreconstructioninBosniaandHerzegovina,andKosovo*.Today,theWorldBankGroup’sWesternBalkansprogramiscentredaroundeconomictransformationopportunitiesinconjunctionwiththeirsupportofEuropeanUnionAscension.30Between2016and2019,theWorldBank,withthefundingoftheKorea-WorldBankGroupPartnership(KWPF),hasundertakenaGlobalCybersecurityCapacityPro-gram.Aspartoftheprogramme,theGlobalCyberSecurityCapacityCentre(GCSCC)oftheOxfordUniversityconductedaseriesofCybersecurityMaturityModelforNations(CMM)assessmentsofAlbania,BosniaandHerzegovinaandNort