Sokol Zeneli September 2025 Disinformation and Hybrid Threats Assessing Kosovo’s Regulatory Framework Against Disinformation and Hybrid Threats

Imprint Publisher Friedrich-Ebert-Stiftung e.V. Godesberger Allee 149 53175 Bonn info@fes.de Responsibility for content and editing Katharina Hofmann Contact Rudina Nallbani rudina.nallbani@fes.de Design/Layout Trembelat Front page design Trembelat Printing and production Studio Forma The views expressed in this publication are not necessarily those of the Friedrich-Ebert-Stiftung e.V.(FES). Commercial use of the media published by the FES is not permitted without the written consent of the FES. FES publications may not be used for election campaign purposes. This policy brief was developed as part of the project“Assessing the Resilience of Kosovar Society to Ecological and Institutional Shocks”. A comprehensive scoring database, which underpins the analysis presented herein, is available upon request. Please send your requests to info@re-actlab.org. September 2025 © Friedrich-Ebert-Stiftung e.V. Further publications of the Friedrich-Ebert-Stiftung can be found here: ↗ www.fes.de/publikationen

Sokol Zeneli September 2025 Disinformation and Hybrid Threats Accessing Kosova’s Regulatory Framework Against Disinformation and Hybrid Threats Labour shortages due to automation 3

Contents Introduction 6 Methodology 7 Background info and context 10 Regulatory Framework 13 Discussing the Findings 28 Conclusions and Recommendations 30 References 32 4 Friedrich-Ebert-Stiftung e.V.

Key Recommendations Acknowledgement This policy brief was developed as part of the project“ Assessing the Resilience of Kosovar Society to Ecological and Institutional Shocks”. A comprehensive scoring database, which underpins the analysis presented herein, is available upon request. Please send your requests to info@re-actlab.org. The following key recommendations are proposed to build a more resilient regulatory and societal framework: → Modernise Media Regulation to Cover the Online Sphere - The government should substantially reform the Law on the Independent Media Commission(IMC) to grant it a clear and expanded mandate to oversee online media, including news portals and digital platforms, ensuring it is equipped with adequate resources and independence. → Increase Transparency and Accountability for Online Platforms - Adopt or amend legislation in accordance with the EU’s Digital Ser vices Act(DSA), especially its requirements on transparency for online political advertising, requiring clear labelling of state-sponsored content, politically sponsored and driven content, etc. → Integrate Counter-Disinformation into National Security - Revise the Kosovo Security Strategy to explicitly define and integrate actions against disinformation and hybrid threats as a core priority, ensuring clear roles for cross-agency collaboration and strategic alignment with the National Cybersecurity Strategy. → Launch a National Media and Information Literacy Strategy - Develop and implement a comprehensive, long-term national strategy to build societal resilience by integrating media and information literacy into the formal education system and strong public awareness programmes for all citizens. La D b i o si u n r fo sh rm or a t t a i g o e n s a d n u d e H to yb a r u id to T m h a re ti a o t n s 3 5

Introduction In an era defined by complex geopolitical competition, the stability and democratic development of small countries like Kosovo face unprecedented challenges. Kosovo’s institutions operate within a complex geopolitical landscape which is marked by contested statehood, historic ethnic tensions in the region and strategic competition among regional and global powers such as Russia, China, Türkyie, Gulf States(United Arab Emirates, Saudi Arabia, Qatar and Kuwait), alongside the European Union(EU) and United States(US). This environment creates a fertile ground for external influence and instability, making Kosovo institutions and society susceptible to destabilising shocks, most notably disinformation and hybrid threats. These shocks are not abstract risks but persistent, tangible challenges impacting Kosovo’s security, social cohesion and democratic development. The core issue we aim to address is the acute vulnerability of Kosovo’s institutional and societal structures to disinformation and hybrid threats. While the sources and manifestations of disinformation campaigns- from state-sponsored narratives aimed at delegitimising Kosovo’s statehood to the internal dynamics of a media landscape grappled with clickbait and unverified information- are increasingly documented, a critical gap remains in systematically evaluating the resilience of the existing regulatory framework to withstand and counterattack these shocks. Hybrid threats, in their deliberate blend of clever and overt measures, including cyber operations, political coercion and the manipulation of cultural and religious narratives, demand a holistic and adaptive response mechanism that the current regulatory framework in Kosovo does not adequately provide. The persistence of ethnic divisions, coupled with socio-economic vulnerabilities and instances of foreign interference exploiting these seams, underscored the urgency of this assessment. The policy brief aims to critically assess Kosovo’s regulatory preparedness, specifically its capacity for resilience against the distinct yet intertwined challenges of disinformation and hybrid threats. The central aim is to move beyond cataloguing threats to rigorously analysing the existing legal, policy and institutional architecture’s ability to anticipate, absorb, adapt to and recover from such shocks. The subsequent section will explain the methodology applied in this research. The next sections will delve into a detailed mapping of Kosovo’s regulatory framework concerning these shocks, followed by an in-depth application of the 4Rs framework to selected policies. The findings of this assessment will be discussed, highlighting systemic vulnerabilities and areas of concern. Finally, the brief will conclude by offering a set of targeted recommendations designed to enhance Kosovo’s institutional and societal resilience, aiming to foster a more robust, adaptive and rights-respecting approach to countering disinformation and hybrid threats in line with European best practices. 6 Friedrich-Ebert-Stiftung e.V. “These shocks are not abstract risks but persistent, tangible challenges impacting Kosovo’s security, social cohesion and democratic development.”

M M e e t t h h o o d d o o l l o o g g y y T T h h e e p p o o l l ic ic y y b b r r ie ie f f is is p p a a r r t t o o f f a a l l a a r r g g e e r r r r e e s s e e a a r r c c h h c c o o n n d d u u c c t t e e d d o o n n in in s s t t it it u u t t io io n n a a l l s s h h o o c c k k s s t t h h a a t t K K o o s s o o v v o o f f a a c c e e s s . . T T h h e e r r e e s s e e a a r r c c h h e e m m p p l l o o y y s s a a s s y y s s t t e e m m a a t t ic ic p p o o l l ic ic y y a a n n a a ly ly s s is is framework d f e ra s m ign ew ed or t k o d a e s s s i e g s n s e t d he to re a s s i s li e e s n s c t e h o e f r K es o i s li o e v n o c ’ e s e o x f i K st o in so g v r o e ’ g s u e l x a i t s o ti r n y g fr r a e m gu e l w at o o r r k y ( f p r o a l m ic e ie w s o , r la k w (p s, o b li y ci l e a s w , s l , a s w t s ra , t b e y g la ie w s, s, g s o t v r e a r t n e m gie e s n , t g a o l v d e o r c n u m m e e n n t t a s l , d e o tc c ) u a m g e a n in ts s , t e s t e c v ) eral s a h g o a c i k n s s . t T s h e e ve r r e a s l e s a h rc o h ck p s r . o T c h e e ss re fo s l e l a o r w c e h d p a ro s c t e r s u s ct f u o r l e lo d w p e r d oc a e s s t s ru co ct n u s r i e st d in p g ro o c f e t s h s ree m co a n in si p st h in a g se o s f :( t i h ) r i e d e en m ti a fy in in p g h t a h s e es n : a ( t i) u i r d e e o n f ti t f h y e in s g h t o h c e k, n ( a ii t ) u a re ss o e f ss t i h n e g s t h h o e c c k u , r ( r ii e ) nt p a o s l s ic e y ss r i e n s g p t o h n e se c s ur t r h e r n o t u p g o h li a cy sc r o es ri p n o g n s s y e s s te th m ro , u an gh d( a ii s i) c d o e ri v n e g lo s p y i s n t g em re , c a o n m d m (i e ii n ) dat d io e n v s el b o a p s in ed g o re n co th m e m fi e n n d d in a g ti s on an s d ba b s e e s d t p o r n ac th ti e ce f s in . dings and best practices. T T h h e e c c l l a a s s s s if if ic ic a a t t io io n n o o f f t t h h e e n n a a t t u u r r e e o o f f t t h h e e s s h h o o c c k k s s is is b b a a s s e e d d o o n n t t h h e e f f r r a a m m e e w w o o r r k k develo d p e e v d el b o y pe th d e b O y E th C e D O in EC 2 D 01 i 4 n , 2 a 0 s 1 e 4 x , p a la s i e n x e p d la in in t e h d e i t n a t b h le e b ta e b lo le w b : elow: T T a a b b le le 1 1 . . C C la la s s s s if if ic ic a a t t io io n n o o f f s s h h o o c c k k s s 1 1 Type of shock Characteristics Covariate Shocks ( Widespread, Systemic and Infrequent) Large-scale events that affect a large portion of the population at once. They are not frequent, but their impact is widespread and systematic. Seasonal Shocks ( Recurring, Predictable and Localised) Long-Term Stressors ( Gradual, Cumulative and Systemic Erosion of Resilience) Periodic shocks that occur at regular intervals, often linked to seasonal changes or climate patterns. Usually predictable, but inadequate preparedness can exacerbate their impact. Unlike shocks, long-term stressors develop slowly over time and weaken societal systems. These are often structural, environmental, economic or social shocks requiring policy responses. Examples Violent Conflict and political crises, pandemic and health crises, large-scale natural disasters, cybersecurity and hybrid threats. Annual floods and droughts, heatwaves and cold snaps, seasonal food insecurities, recurring health risks. Environmental degradation, demographic shifts, economic stagnation and inequality, weak institutions and governance. To evaluate the effectiveness of the regulatory framework in countering various s T h o oc e k v s a , lu w a e te bu th il e d e u f p fe o c n ti t v h e e ne 4 s R s s o o f f t R he s r i e li g e u n l c a e to f r a y m fr e a w m o e r w k. o T rk his n f c r o a u m n e t w er o in rk g assesse v s a p ri ol u ic s ie s s ho a c g k a s i , n w st e fo b ur ild ke u y p d o i n m t e h n e si 4 o R n s of R re e s s i i l l i i e e n n c c e e : framework. This framework assesses policies against four key dimensions of resilience: 1 Classified based on the OECD(2014)“Guidelines for Resilience Systems Analysis: How to Analyse Risks and Build a Roadmap to Resilience”. OECD Publishing. Labour shortages due to automation 7 Disinformation and Hybrid Threats 5

T T a a b b l l e e 2 2 . . T T h h e e 4 4 R R s s o o f f R R e e s s i i l l i i e e n n c c e e F F r r a a m m e e w w o o r r k k Table 2. The 4Rs of Resilience Framework Ta F b ra le m 2 e . w T o h r e k 4Rs of R C e a s t il e ie g n o c ry e Framework Framework Framework Category CRaotbeugsotrnyess Robustness Robustness 4Rs of Resil4ieRnsceof Resil4Rs of Resilience ience Redundancy Redundancy Redundancy Resourcefulness Resourcefulness Resourcefulness Rapidity Rapidity Rapidity Definition Definition D Th ef e in s i t t r i e o n n gth, or the ability of elements, systems and other units of analysis Ttohewsitthresntagnthd,aorgitvheenalbeivleitlyooffsetrlesmseonrtsd,esmysatnedmws iathnoduottshuefrfeurninitgs dofegarnaadlays-is The strength, or the ability of elements, systems and other units of analysis toiown iothr slotasnsdofafguinvcetniolnev. el of stress or demand without suffering degradato withstand a given level of stress or demand without suffering degradation or loss of function. tTiohne oarvaloilsasboilfitfyuonfctailotner.native resources in the recovery process of a system. The availability of alternative resources in the recovery process of a system. The availability of alternative resources in the recovery process of a system. The capacity to identify problems, establish priorities, and mobilise Trehseoucarcpeascwityheton icdoenndtitfiyonpsroebxliesmt tsh, aetsttahbreliasthenprtiorditisersu,patnsdomoebeileisme ent, The capacity to identify problems, establish priorities, and mobilise rseyssoteumrce, sorwohtehnercuonidtitoifonasnaelxyisits.that threaten to disrupt some element, resources when conditions exist that threaten to disrupt some element, system, or other unit of analysis. sTyhsetecmap, oarciotythteor muneiettopfraionraitliyessisa.nd achieve goals in a timely manner in Tohrdeecratpoaccoitnytatoinmloesestespraionrditaievsoaidndfuatuchreiedviesrguopatilosnin a timely manner in The capacity to meet priorities and achieve goals in a timely manner in order to contain losses and avoid future disruption order to contain losses and avoid future disruption Each source identified as part of the regulatory framework addressing the E E a a c c h h s s o o u u r r c c e e i i d d e e n n t t i i f f i i e e d d a a s s p p a a r r t t o o f f t t h h e e r r e e g g u u l l a a t t o o r r y y f f r r a a m m e e w w o o r r k k a a d d d d r r e e s s s s i i n n g g t t h h e e Es s h h ao o chc c k k ss s oi i us s rce e ev v a a idl l u u ea a nt t te e ifd d iea a dg g a a si i n n ps s t t art t th h oe e f4 4 tR R hs s e f f rr r ea a gm m ue e law w to o r r yk k fu u rs s ai i mn n g g ewa a os s rt t kr r u u ac c dt t u u dr r e e d d sss s inc c go o r r ti i n n hg g e syssstehhmoocc,kkasssiissexeepvvlaaalliuunaaettdeeddbeaalggoaawiinn: sstt tthhee 44RRss ffrraammeewwoorrkk uussiinngg aa ssttrruuccttuurreedd ssccoorriinngg ssyyss-t s e y m st , e a m s , e a x s p e la x i p n l e a d in b e e d lo b w el : ow: tem, as explained below: Table 3. Scoring system based on the 4Rs Framework T T a a b b l l e e 3 3 . . S S c c o o r r i i n n g g s s y y s s t t e e m m b b a a s s e e d d o o n n t t h h e e 4 4 R R s s F F r r a a m m e e w w o o r r k k Ta S b c l o e r 3 in . g Scoring system based on the 4Rs Framework Scoring Scoring Robustness 0: No robustness—policy does not address stability in the face of shocks. Robustness Robustness Redundancy 01: NWoearokbourstsnyemsbs—olpicomliceyadsuoeressnwoitthadlidttrelessenstfaobrcileimtyeintt.he face of shocks. 0: No robustness—policy does not address stability in the face of shocks. 12: 1: WMeoadkeroartesymmebcohlaicnimsmeasseuxreisst,wbiutht Weak or symbolic measures with tlhitetlye little aeernneffooinrrccoeemmnseeisnnttte..ntly applied. 23: MStorodnegra,tweemll-eecnhfaonrcisemd smeexcishta, nbiusmt tsheynsaurreiningcsotnasbiisltiteyn.tly applied. 2: Moderate mechanisms exist, but they are inconsistently applied. 3: Strong, well-enforced mechanisms ensuring stability. 30:: SNtorornegd,uwndelal-necnyf—orfcaeildurme eocfhtahneismmasinensysustreinmg lsetaadbsilittoy.collapse. Redundancy Redundancy Resourcefulness 01: NMoinriemdaulnodrainncfyo—rmfaailuarleteorfnathtievemsatihnastyasrteemunlreealidasblteo. collapse. 0: No redundancy—failure of the main system leads to collapse. 12: MSoinmime areldournindfaonrcmy,abl ualttegranpastievxeistthinatcoavreruangreeloiar belfef.iciency. 1: Minimal or informal alternatives that are unreliable. 23: SWoemlle-inretedgurnadteadncrye,dbuuntdgaanpcys exnissutriensccoovnetriangueityoruenfdfiecriesntrceys.s. 2: Some redundancy, but gaps exist in coverage or efficiency. 3: Well-integrated redundancy ensures continuity under stress. 30:: WNoelrl-eisnoteugrcreaftueldneresds—unredaacntcivyeernastuhreerstchoanntipnruoiatyctuivnedaerppstrroeascsh. . Resourcefulness Resourcefulness Rapidity 01: NLiomrietesoduardceafputlanbeislist—y r-eraecstpivoensraetmheercthhaannispmrosaacrteivwe eaapkprooraacdh.hoc. 0: No resourcefulness—reactive rather than proactive approach. 12: LMimoditeerdataedaabpitlaitbyiltiotymorebsilpisoensresmouerccheas,nbisumt sgapres wreemakaionr. ad hoc. 1: Limited adaptability- response mechanisms are weak or ad hoc. 23: MHiogdhelyraftleexaibilleitayntdo wmeolbl-icliosoerdreinsoautercderse,sbpuotngsaepms erecmhaaninis.ms. 2: Moderate ability to mobilise resources, but gaps remain. 3: Highly flexible and well-coordinated response mechanisms. 30:: HNioghralypifdlerxeisbpleonasnedmweecllh-caonoisrmdins—atdeedlareysepdoonrseabmseenctharenaiscmtiosn. s. Rapidity Rapidity 01: NSloowrapainddrebsupreoanusecrmateicchreasnpiosmnsse—wdietlhaymeadjor ianbesfefinctiernecaicetsi.ons. 0: No rapid response mechanisms—delayed or absent reactions. 12: SMloowdearantdebsupreeeadu,cbrauticsoremsepobnostetlewnitehckms aejxoirsti.nefficiencies. 1: Slow and bureaucratic response with major inefficiencies. 23: 2: MMHioogddheelyrraaetteeffisscppieeneetdd,,,fbbauustt-tssrooammckeerbbeoospttttolleennnseeccekknssseeuxxriissnttg.. swift action. 3: Highly efficient, fast-track response ensuring swift action. 3: Highly efficient, fast-track response ensuring swift action. The total policy resilience score(0-12) is then normalised into a percentage, TTenhhaeebttloointtaagll cppooomlliiccpyyarraeetssiiivlliieeenneccveealssuccaootrrieeon((00a--c11r22o))siisssdttihhffeeennrennnootrrmmpoaallliciissieedds aiinnnttdoo saaecppteeorrrccsee.nnttaagg ee,, e g n e a , b en lin a g bl c in o g m c p o a m ra p t a iv r e at e iv v e al e u v a a t l i u o a n t a io c n ro a s c s ro d s if s fe d r i e ff n e t re p n o t lic p i o e l s ic a ie n s d a s n e d ct s o e r c s t . ors. enabling comparative evaluation across different policies and sectors. Resilience score= SUM(Total score/12) x 100 Resilience score= SUM(Total score/12) x 100 Resilience score= SUM(Total score/12) x 100 8 6 66 Friedrich-Ebert-Stiftung e.V. Friedrich-Ebert-Stiftung e.V. Friedrich-Ebert-Stiftung e.V. Friedrich-Ebert-Stiftung e.V.

Table 4. Scoring interpretation Table 4. Scoring interpretation Scoring Interpretation 0-25% (0-3 points) 26-50% (4-6 points) 51-75% (7-9 points) 76-100% (10-12 points) Very Low Resilience Low Resilience Moderate Resilience High Resilience The policy makes the society highly vulnerable to shocks, offering little protection or response capability. Some resilience measures exist, but they are either weak, inconsistent, or incomplete. The policy provides a reasonable level of preparedness and response, but some critical gaps remain. The policy is well-designed, with strong mechanisms ensuring stability, adaptability, and quick response. For more detailed research methodology, please refer to the Policy Analysis A Fr n a a m ly e s w is o F rk ra d m e e v w el o o r p k e de f v o e r lo th p i e s d re fo se r a t r h c i h s . r Y e o se u a c rc a h n . f Y in o d u i c t a i n f t i h n i d s l it in i k n . this link. Labour shortages due to automation 9 Disinformation and Hybrid Threats 7

Background info and context Disinformation and hybrid threats are covariate shocks which vary in terms of frequency and have a systemic negative impact on society and political developments surrounding them. Disinformation refers to the systematic and intentional creation and propagation of false, biased, or manipulative information, created to deceive target audiences and achieve certain objectives. 2 This disinformation is disseminated through online portals, social media, and coordinated campaigns which aim to exploit existing societal fault lines. 3 Hybrid threats on the other hand refer to the broader utilisation of disinformation as a tool together with other hostile actions- political pressure, economic coercion, cyber operations, cultural and religious manipulations, etc - by state or non-state actors to destabilise Kosovo, exploit its vulnerabilities, and achieve strategic objectives without resorting to conflict. 4 The two are deeply intertwined; disinformation often prepares “Kosovo’s susceptibility to these shocks is not a reother hybrid tactics, leading to a general the ground for, or amplifies the effects of cent development but rathconfusion, distrust and polarisation that makes institutions and society more er a consequence of its vulnerable to manipulation and coercion. post-conflict realities and not a recent development but rather a Kosovo’s susceptibility to these shocks is its position as a geopoliticonsequence of its post-conflict realities and its position as a geopolitical pressure cal pressure point.” point. The legacy of the conflicts, its contested statehood and ethnic divisions provide vulnerabilities that external and internal actors continue to exploit consistently. For instance, the conflict with Serbia has historically allowed ethnic nationalism to thrive on both sides, often dominating public discourse and political agendas. Similarly, foreign interference has always been present, with various actors pursuing different- but often overlapping-agendas which impact the stability and democratic consolidation of the country. 5 Serbia, often supported by Russia, has engaged in long-running disinformation campaigns aimed at delegitimising Kosovo’s independence, portraying it as unstable or dangerous(particularly for Serbs), and sabotaging its integration into international structures. 6 The majority of this disinformation 10 Friedrich-Ebert-Stiftung e.V.

enters Kosovo through Serbian-language media outlets, some directly funded by Belgrade or linked to Russian state media like Sputnik’s branch in Serbia. 7 These narratives are then further disseminated within Kosovo, mainly in areas with a Kosovo Serb majority, but often also get picked up by Albanian language online media chasing clicks. 8 For instance, in 2018 alone, no less than 700 false news stories were published by Serbian media reporting an‘imminent war’ between Kosovo and Serbia. 9 A similar dynamic was also largely present during the 2022 Serbian elections. 10 Other actors also influence events in Kosovo. Türkyie, for example, has created ties with Kosovo through its significant economic investments, cultural and religious diplomacy through its Agency for Cooperation and Coordination(TIKA)- including funding mosques, educational opportunities- media platforms like TRT Balkan 11 , and defence cooperation. 12 However, Türkyie’s influence has manifested in concerning ways, such as the 2018 covert rendition of alleged Gülen supporters, which exposed vulnerabilities and parallel structures within Kosovo’s security apparatus susceptible to foreign pressures. 13 The influence of Türkyie continues to be strong even nowadays, such as in the case of the double cancellation of the performance“The Six Against Turkey” in Kosovo. The performance depicts the developments leading to the deportation of six Turkish teachers in 2018. The authors of the performance argued that the cancellation came due to the influence of the Turkish Embassy in Kosovo. 14 The cancellation was first justified due to technical issues, while later it was announced that the performance was cancelled as‘it is against the values of the Turkish community’ and‘against Türkyie and its president’. 15 Gulf States(especially Saudi Arabia) also have a significant influence over Kosovo. This influence has been largely linked to the spread of conservative Wahhabi interpretation of Islam, and in some cases, provided pathways for radicalisation and recruitment by extremist groups exploiting socio-economic marginalisation in areas neglected by the state. 16 China, on the other hand, although with a lower presence in Kosovo, continues to influence the region through infrastructure investments under its Belt and Road Initiative 17 and provision of technology, like the surveillance systems that Kosovo uses, raising concerns about potential dependencies and the promotion of alternative governance models. 18 For instance, Kosovo has installed approximately 3,500 surveillance cameras with facial recognition capabilities produced by Chinese companies like Dahua and Hikvision. 19 The latter is a blacklisted company by the US. These pressures and influences are further exacerbated by the internal factors in the country. Kosovo’s media landscape, especially the online sector, suffers from systemic weakness. A lack of effective regulation, non-transparent ownership structures often linked to political or business interests, and intense competition contribute to the spread of disinformation. 20 Attempts to introduce regulation for online media have historically faced resistance or failed to materialise 21 , and overall institutional capacity to counter disinformation campaigns and hybrid threats remains weak, lacking sufficient awareness, resources and coordinated strategies. Labour shortages due to automation 11

The consequences of these shocks are profound, impacting not only the institutional stability but also posing direct harm to citizens and society. One of the most harmful impacts remains the degradation of trust- be it between citizens and the state, among ethnic communities, or trust in the media- fueled by narratives of corruption, bias and the ongoing amplification of ethnic grievances. Additionally, by exploiting the socio-economic vulnerabilities of Kosovar society, disinformation and hybrid threats are used to create pathways to radicalisation. As it was shown, neglect, poverty, unemployment, and poor access to education in marginalised communities created an opening for extremist religious groups, funded by foreign actors, to spread radical ideologies, leading to tragic outcomes like citizens joining foreign conflicts. The constant spread of narratives about potential conflict, ethnic threats, state failure, or external aggression leads to an increased sense of anxiety and instability among citizens and potentially contributes to‘brain drain’. Disinformation campaigns in Kosovo almost exclusively create panic or alarm, especially targeting minority communities, to achieve political goals or undermine confidence in Kosovo’s future. 22 Similarly, these shocks directly impact the institutional integrity and functionality. Malign campaigns undermine governance effectiveness and the rule of law, often exploiting or exacerbating existing weaknesses like perceived corruption, political favouritism or inefficiency. This erodes institutional legitimacy both domestically and internationally. The risks posed by disinformation and hybrid threats to Kosovo’s institutions and society are not likely to diminish and could even intensify without proper mitigation efforts. The ongoing geopolitical tensions on Kosovo’s status and regional power dynamics ensure it will remain a target for external actors seeking to exert influence, maintain instability, or disrupt Kosovo’s Euro-Atlantic path. Furthermore, the methods employed in hybrid threats are constantly evolving, leveraging technological advancements to increase the speed, scale and sophistication of disinformation campaigns and cyber operations. The institutional capacity of Kosovo to counter these evolving threats remains a significant concern, with gaps in the legal frameworks, technical capabilities, human resources, and a lack of strategic coordination. 12 Friedrich-Ebert-Stiftung e.V.

Regulatory Framework The regulatory framework- comprising laws, regulations, strategies, and other policies- is crucial for Kosovo in addressing and resolving these shocks. Beyond that, the regulatory framework needs to ensure its resilience in order to help institutions and society to withstand the shocks. At the current state, although a relevant regulatory framework is in place, it is marked by significant gaps, outdated legislation and fragmented responsibilities. The Constitution of the Republic of Kosovo is the bedrock for this regulatory framework. It guarantees fundamental rights relevant to the information space. More particularly, Articles 40 and 42 explicitly protect the freedom of expression and media freedom and pluralism, ensuring the right to disseminate and receive information while prohibiting censorship. 23 The constitution, through this, sets the stage for an open information environment, which, anyway, requires supporting legislation and regulation to function properly in the face of different shocks, including disinformation and hybrid threats. In this regard, there are several laws that address aspects related to information integrity and accountability. More particularly, the Law Against Defamation and Insults sets standards for compensating individuals whose reputation is harmed, aiming to balance reputational protection with freedom of expression. 24 Other laws include those Protecting Journalistic Sources 25 , Whistleblowers 26 , ensuring Access to Public Documents 27 , and safeguarding Personal Data. 28 While these laws are important, they primarily address specific harms or procedural rights rather than the systemic challenge of coordinated disinformation campaigns or hybrid threats. In general, Kosovo lacks specific laws regulating crucial aspects of the modern media environment, such as media financing and ownership, particularly those for online entities 29 , therefore leaving significant space for hidden influence unexplored and unregulated. The primary regulatory body for media is the Independent Media Commission(IMC), which is established under Article 141 of the Constitution. Its mandate includes regulating broadcasting frequencies, licensing public and private audio and audiovisual broadcasters, and implementing broadcasting policies. 30 However, this law is widely considered outdated and not fit for the digital age. 31 Most worrying in this regard is the fact that IMC’s authority does not extend to online media(news portals, social media platforms, etc), which play a crucial role in spreading disinformation. This regulatory framework is significant. For instance, the IMC has the authority to demand the removal of channels from broadcasting Labour shortages due to automation 13

operators, as it did following the Russian invasion of Ukraine when it ordered the removal of Russia Today, Russia 24 and Planeta RTR to prevent propaganda. 32 However, as such authority does not extend to online media, they are left with the risk of potentially amplifying such disinformation and propaganda without restriction. Additionally, considering that the board members of IMC are appointed by the National Assembly 33 , concerns over its independence remain. The work of online media falls under the purview of the Press Council of Kosovo(PCK), which is a self-regulatory body founded by and for the media sector. The PCK is guided by its Press Code of Kosovo, and handles various complaints regarding ethical breaches by print and online media. 34 The biggest shortcoming of the PCK remains its inability to enforce decisions; the institution cannot issue fines or revoke licenses, limiting its effectiveness in efforts to counter disinformation and hybrid threats spread by online media. The efforts of government and public institutions to strengthen the regulatory framework to fight discrimination were largely opposed by media bodies like the PCK and the Association of Journalists of Kosovo (AGK), fearing the potential infringements on free speech. 35 Past attempts by the government in this direction include the Draft Media Law in 2018, and the proposal to regulate the issue of‘fake news’ through Kosovo’s Criminal Code by considering it as hate speech. 36 With regards to cybersecurity- as a critical component of countering hybrid threats- Kosovo adopted the Law on Cybersecurity in 2023. 37 The legislation led to the establishment of the Cybersecurity Agency(CSA), which is tasked with overseeing the cyber defence of Kosovo and providing relevant training through its Cybersecurity Training Centre. 38 Although the law is adopted, experts and international reports indicate that Kosovo continues to lack a comprehensive cybersecurity framework, sufficient operational mechanisms, technical capabilities and human resources to effectively address cyber threats, including those linked to disinformation campaigns. 39 14 Friedrich-Ebert-Stiftung e.V.

On a strategic level, Kosovo lacks a dedicated national plan to combat disinformation and promote media and digital literacy. Although the Digital Agenda for Kosovo 2030 outlines goals for digital development, it does not propose or plan any measures or objectives related to countering disinformation, enhancing citizens’ critical information consumption skills or their abilities to identify disinformation. The absence of a strategic vision and dedicated educational initiative leaves a significant gap in building societal resilience against manipulation. While the regulatory framework is sufficient to provide fundamental rights, it largely suffers from outdated laws for traditional media, low regulation for online media, limited enforcement capacity among self-regulating bodies, weak cybersecurity structures and a lack of strategic focus on countering these shocks. The fragmentation and incomplete framework open the space for external and internal actors to exploit these vulnerabilities. Labour shortages due to automation 15

Applying the policy analytical framework Applying the policy analytical framework Building upon the mapping of Kosovo’s relevant regulatory framework, this section will provide a more in-depth analysis by applying the 4Rs of r B e u s ild ie i nc g e u f p ra o m n e th w e o m rk a 40 p ( p ro in b g us o t f n K e o ss s , o r v e o d ’s un re d l a e n va cy n , t r r e e s g o u u l r a c t e o f r u y ln fr e a s m s a ew nd ork, this r s a e p c i t d io it n y) w , t il o l p ev ro a v lu id a e te a r m ele o v re an in t l d a e w p s t , h re a g n u a l l a y t s i i o s n b s y , p a o p l p ic ly ie in s g an th d e s 4 tr R a s te o g f ie r s esilience r f e ra le m va ew nt o t r o k 4 c 0 o ( u ro n b t u er s i t n n g es a s n , d re a d d u d n r d e a ss n i c n y g , r d e i so in u f r o c r e m fu a l t n io e n ss a a n n d d h r y a b p r i i d d it t y h ), re t a o t e s. valuate W rel e ev d a o n s t o la in ws o , r r d e e g r u t l o at u io n n d s e , rs p t o a l n ic d ie h s o a w nd ea s c tr h at c e o g m ie p s o r n e e le n v t a o n f t t t h o e c r o e u g n u t l e a r t i o n r g y and adf d r r a e m ss e in w g or d k is c i o n n fo t rm ibu a te io s n o a r n fa d il h s y t b o ri c d o t n h t re ib a u ts te . W to e K d o o so so vo i ’ n s o ca rd p e a r c t it o y u t n o derstand how w ea it c h h st c a o n m d p a o n n d en re t s o p f o t n h d e e re ff g e u c l t a iv to el r y y t f o ra t m hes w e o s r h k o c c o k n s t . ributes or fails to contribute to Kosovo’s capacity to withstand and respond effectively to these shocks. A total of 11 sources were assessed as part of this policy brief. The s A o t u o r t c a e l s o w f e 1 r 1 e so el u e r c c t e e s d w b e a r s e e a d s o se n s t s h e e d ir a a s p p p a l r ic t a o t f io t n hi i s n p t o h l e ic e y v b e r n ie t f o . f T d h i e si s n o fo u rces were m se a le ti c o t n ed a b n a d s h e y d b o ri n d t t h h e r i e r a a ts p , p a li n c d at t io h n ey in in t c h lu e d e e v d en p t o o li f ci d e i s s , in la fo w r s m , b at y i l o a n w a s, nd hybrid a th d r m ea in ts is , t a ra n t d iv t e he in y s i t n ru cl c u ti d o e n d s, p a o n li d ci n es a , ti l o a n w a s l , s b t y r l a a t w eg s i , e a s d . m Th in e i s s e tr w at e iv re e a in n s a t l r y u s c e t d ions, and a n s at p io re n s a e l n s t t e r d at b e e g l i o e w s. : These were analysed as presented below: Law No. 02/L-65- Civil Law Against Defamation and Insult Rapidity Robustness 3 2 1 0 Redundancy Resourcefulness Figure 1: 4Rs Framework Assessment of Law No. 02/L-65 Civil Law Against Defamation and Ina su n l d t. I ( n S s o u u l r t c . e: (S O o w u n rce cr : e O a w tio n n c ) reation) This is an important law that provides relevant avenues to address reputational r h e a p r u m ta , t w io h n ic a h l h can rm s , e w rv h e ic to h a ca d n dr s e e s r s v i e ss t u o e a s d r d e r l e a s te s d is t s o ue d s is r i e n l f a o t r e m d a t t o io d n i , si h n o fo w r e ver, the m law atio ts n e , l h f o d w em ev o e n r, s th ra e te la s w ve it ry se l l o f w de r m es o il n ie s n tr c a e te a s ga ve in r s y t l s o y w st r e e m si i l c ie d n i c s e in a f g o a rm in a s tion and s h y y s b t r e i m d i t c hr d e i a si t n s, fo a r s m se a s t s io e n d an t d on h l yb 1 ri 7 d % t . hreats, assessed at only 17%. The robustness of this law is weak(score 1). Although the law does not covc e o r v is e s r u i e ssu r es la r t e e l d at t e o d h t y o b h ri y d b t r h id re t a h t r s e , a i t t s d , o it e d s o o e f s fe o r f a fe l r e a ga le l g b a a l s b is a f s o is r f d o e r aling with dealing with reputational damage(which could come as a result of disinformation). However, it lacks specific measures for disinformation or 16 40 For mo F re r in e f d or r m ic a h ti o E n b r e g rt a r S di t n i g ft t u h n e g me e t . h V o . dology, please refer to the methodology section.

reputational damage(which could come as a result of disinformation). However, i s t ta la t c e k -s s p s o p n e s c o if r i e c d m in e f a lu su en re c s e. fo It r s d r i e s d in u f n o d rm an a c t y io i n s o n r o s n t a e t x e is -s te p n o t ns (s o c r o e r d e i 0 n ) f , lu a e s n t c h e e . I l t a s w r r e e d li u es nd e a n n ti c r y ely is o n n on ci v e i x l i c s o te u n r t ts ( , s t c h o e re re 0 fo ), re a , s it th o e ff l e a r w s n re o li a e l s te e r n n t a ir t e iv ly e o m n e c c i h v a il n c is o m ur s ts o , r t f h a e ll r b e a fo ck re s , y it st o e f m fe s rs to no fla a g lte o r r n m at i i t v i e ga m te ec in h f a o n rm ism at s io o n r t f h a r ll e b a a t c s k b s e y y s o t n e d m l s it t ig o a f t l i a o g n. or m Re it s i o g u a r t c e e i f n u f l o n r e m ss at is io a n ls t o hr l e im at i s te b d ey (s o c n o d re li 1 ti ) g ; a t t h io e n la . w Re p s e o r u m rc i e ts fu in ln d e iv ss id i u s a a l ls re o s l o im ur i c t e e s d ( b s u co t r l e ac 1 k ) s ; t c h o e lla la b w or p a e ti r v m e i o ts r i a n d d a iv p i t d iv u e al co re m so p u o r n c e e n s t b s u li t k l e ac p k u s b c li o c ll a a w b a o r r e a n ti e v s e s, o d r i a g d it a a p l t p iv la e tf c o o r m m p e o n n g e a n g ts em lik e e nt pu or bl m ic e a d w ia a l r i e t n er e a s c s y , d p i r g o i m ta o l t p i l o a n t . fo L r a m stl e y n , g it a s g r e a m pi e d n it t y o i r s m al e s d o ia l n it o e n ra -e c x y is p t r e o n m t o (s t c io o n re . L 0 a ) s a t s ly s , t i a ts n r d a a p r i d di c t o y u i r s t a p l r s o o c n ed o u n r e e s xi a st r e e n i t nh (s e c r o e r n e tl 0 y ) l a o s ng st a a n n d dard c ta o k u e rt t p im ro e c . edures are inherently long and take time. I I t t i i s s w w o o r r t t h h n n o o t t i i n n g g t t h h a a t t t t h h e e l l a a w w h h a a s s a a v v e e r r y y n n a a r r r r o o w w s s c c o o p p e e a a n n d d f f o o c c u u s s e e s s m m a a i i n n l l y y on i o n n di i v n i d d i u v a id l u re a p l u re ta p t u i t o a n t a io l n h a a l rm ha . r A m ll . o A w ll i o n w g i o n n g ly on fo ly r f c o iv r il ci l v it i i l g l a it t i i g o a n ti m on ea m n e s a i n t s is it n i o s t s n u o i t te s d ui t t o ed ad to dr a e d ss dr t e h s e s s t p h e e e s d p , e s e c d a , le sc a a n le d a s n ys d te s m ys i t c em na ic tu n re at o u f re co o o f r c d o in o a rd te in d a d te is d inf d o i r s m in a fo ti r o m n a c t a io m n p c a a i m gn p s a . i P g o n l s i . cy P m ol a ic k y e m rs a s k h e o rs ul s d ho a u ck ld no a w ck le n d o g w e le t d h g a e t t t h h e at la t w he , w la h w il , e i w m h p il o e rt i a m n p t o f r o t r a i n n t d f i o v r id i u n a d l iv r i i d g u h a ts l , r o ig f h fe t r s s , o n f e f g e l r i s g n ib e l g e l p ig r i o b t l e e c p ti r o o n te o c r ti r o e n sp o o r n r s e e sp a o g n a s in e st s a h g o a c in k s s t li s k h e o d ck is s in li f k o e rm d a is t i i n o f n or a m n a d t h io y n br a i n d d th h r y e b a r t i s d . threats. Law No. 06/L-082 on Protection of Personal Data Rapidity Robustness 3 2 1 0 Redundancy Resourcefulness F F i i g g u u r r e e 2 2 : : 4 4 R R s s F F r r a a m m e e w w o o r r k k A A s s s s e e s s s s m m e e n n t t o o f f L L a a w w N N o o . . 0 0 6 6 / / L L 0 0 8 8 2 2 o o n n P P r r o o t t e e c c t t i i o o n n o o f f P P e e r r s s o o n n a a l l D D a a t t a a . . (Source: O (S w o n ur c c r e e : a O ti w on n ) creation) The law is especially important in addressing these shocks as it provides strong d st a r t o a n p g ro d t a e t c a ti p o r n o , te in c d ti i o re n c , t i l n y d s i u re p c p t o ly rt s i u n p g p r o e r s t i i l n ie g nc re e s a il g ie a n in ce st a t g h a e i m nst by th p e r m ote b c y ting a key a p t r t o a t c e k ct v in e g ct a or k . e T y he at l t a a w ck re v c e e c i t v o e r d . T a h h e ig la h w re r s e i c l e ie iv n e c d e s a c h o i r g e h o r f e 8 s 3 il % ie . nce score of 83%. Due to its alignment with GDPR, a dedicated supervisory authority(Information a D n u d e P to riv it a s cy al A ig g n e m nc e y n ) t , w an it d h a G c D le P a R r , e a n d fo e r d c i e c m at e e n d t s m up e e c r h v a is n o is r m y a t u h t r h o o u r g it h y i ( n I s n p fo e r c m tio a n s a ti n o d n f a ine d s P , i r t iv e a x c c y el A s g in en r c o y b ) u , s a t n n d es a s c (s le c a o r re en 3 f ) o . r R c es m o e u n rc t e m fu e ln ch e a ss nism als th o ro h u ig g h h (score 3) b in e s c p a e u c s t e io t n h s e a la n w d f e in m e p s o , w it e e r x s c d el a s ta in s r u o b b j u ec s ts ne w s i s th (s r c i o g r h e ts 3) ( . a R cc e e s s o s u , r c c o e r f r u e l c n t e io s n s , is delet a io ls n o ), h m ig a h n ( d s a co te r s e t 3 r ) an b s e p cau re s n e c t y h a e n l d aw en e a m b p le o s w a e d r a s p d t a iv ta e r s e u s b p j o ec n t s s e w s. i I t t h s r r i e g d h u ts ndancy (access, correction, deletion), mandates transparency and enables adaptive responses. Its redundancy is moderate(score 2); layered data protection principles and data minimisation principles offer some backup, but specific 16 Friedrich-Ebert-Stiftung e.V. Labour shortages due to automation 17

is moderate(score 2); layered data protection principles and data minimisation principles offer some backup, but specific institutional backup plans are lacking institutional backup plans are lacking if the main agency is compromised. if the main agency is compromised. Rapidity is also moderate(score 2) with Rapidity is also moderate(score 2) with defined timelines for handling defined timelines for handling requests from data subjects, but provisions rerequests from data subjects, but provisions related to emergency operational lated to emergency operational systems for rapid actions(e.g. hybrid threats or systems for rapid actions(e.g. hybrid threats or disinformation campaigns disinformation campaigns exploiting personal data) are absent. exploiting personal data) are absent. The strong robustness makes it harder for malicious actors to exploit personThe strong robustness makes it harder for malicious actors to exploit al data for disinformation, therefore complementing cybersecurity efforts in personal data for disinformation, therefore complementing cybersecurity the country(will be explained below). While it shows high resourcefulness, its efforts in the country(will be explained below). While it shows high resourcemoderate redundancy implies potential risks if the primary authority fails during fulness, its moderate redundancy implies potential risks if the primary a crisis. In terms of rapidity, the law functions well for standard protection, but authority fails during a crisis. In terms of rapidity, the law functions well for it is not designed for the immediate intervention speed needed during an acute standard protection, but it is not designed for the immediate intervention data-driven information crisis. Therefore, its contribution remains primarily speed needed during an acute data-driven information crisis. Therefore, its preventative. contribution remains primarily preventative. L L a a w w N N o o . . 0 0 8 8 / / L L 1 1 7 7 3 3 o o n n C C y y b b e e r r S S e e c c u u r r i i t t y y Rapidity Robustness 3 2 1 0 Redundancy Resourcefulness F F i i g g u u r r e e 3 3 : : 4 4 R R s s F F r r a a m m e e w w o o r r k k A A s s s s e e s s s s m m e e n n t t o o f f L L a a w w N N o o . . 0 0 8 8 / / L L 1 1 7 7 3 3 o o n n C C y y b b e e r r S S e e c c u u r r i i t t y y ( ( S S o o u u r r c c e e : : O O w w n n c c r r e e a a t t i i o o n n ) ) T T h h i i s s i i s s a a f f o o u u n n d d a a t t i i o o n n a a l l l l a a w w i i n n t t h h e e p p r r o o t t e e c c t t i i o o n n a a g g a a i i n n s s t t c c y y b b e e r r t t h h r r e e a a t t s s t t h h a a t t t t a a c c k k l l e e K K o o s s o o v v o o ’ ’ s s c c y y b b e e r r s s p p a a c c e e . . T T h h e e l l a a w w w w a a s s a a s s s s e e s s s s e e d d w w i i t t h h a a n n o o v v e e r r a a l l l l s s c c o o r r e e o o f f 7 7 5 5 % % , , maki m ng ak it in m g o i d t e m ra o t d e e ly ra r t e e s l i y lie re n s t i . lient. A A s s i i t t i i s s v v i i s s u u a a l l i i s s e e d d i i n n t t h h e e f f i i g g u u r r e e 3 3 , , t t h h e e l l a a w w d d e e m m o o n n s s t t r r a a t t e e s s s s i i g g n n i i f f i i c c a a n n t t r r o o b b u u s s t t n n e e s s s s ( ( s s c c o o r r e e 3 3 ) ) , , e e s s t t a a b b l l i i s s h h i i n n g g a a s s t t r r o o n n g g i i n n s s t t i i t t u u t t i i o o n n a a l l b b a a s s i i s s w w i i t t h h t t h h e e C C y y b b e e r r s s e e c c u u r r i i t t y y Agenc A y g ( e C n S c A y ) (C w S it A h ) c w le it a h r r c e le sp a o r n re s s ib p i o li n ti s e ib s, il a it n ie d s, e a n n fo d rc e e n a f b o l r e ce p a e b n l a e lt p i en s a fo lt r ie n s o f n o r complinon-compliance. 41 Redundancy is moderately present(score 2) through the mandated cyber security incident response teams(CSIRTs), but it overall lacks depth regarding alternative communications infrastructure or comprehensive contingency plans, should the primary system fail. Similarly, resourcefulness is moderate(score 2) as it authorises CSA to coordinate nationally and internationally as well as plan training 42 . However, limitations exist in Disinformation and Hybrid Threats 17 18 Friedrich-Ebert-Stiftung e.V.

broader stakeholder engagement(civil society, local actors) and a lack of provisions for flexible funding or fostering innovation in response strategies. Rapidity is also moderate(score 2); mandated reporting timelines exist (24-hour incident notification) 43 , but the framework lacks defined fast-track decision-making or crisis coordination protocols crucial for effective and timely responses to dynamic cyber or disinformation events. The strong robustness of the law provides a solid base for managing cyber threats and can serve as a legal foundation for related strategies. Its effectiveness against disinformation depends largely on the coordination with other - currently weak- bodies. However, it is worth noting that the moderate redundancy means that Kosovo remains vulnerable if primary cyber defences are overwhelmed in complex attacks. In terms of rapidity, while the alerts are timely, coordinated responses could face procedural delays without specific crisis protocols defined elsewhere. Policymakers should recognise the limitations of this law in addressing the shocks as disinformation and hybrid threats. The law overall provides a necessary but insufficient condition for resilience; its potential can only be fully materialised through strong strategic direction(like the National Cybersecurity Strategy), other operational procedures and crucially, complementary measures addressing the information environment. Labour shortages due to automation 19

Administrative Instruction No.04/2024 on Registry of Cyber InciA de d n m ts inistrative Instruction No.04/2024 on Registry of Cyber Incidents Robustness 3 2 Rapidity 1 Redundancy 0 Resourcefulness Figure 4: 4Rs Framework Assessment of Administrative Instruction No. 04/2024 on Registry of C o y f b C e y r b I e n r c I i n d c e i n d t e s n . t (S s o . u (S rc o e u : r O ce w : n Ow cr n ea c t r i e o a n t ) ion) The instruction is a crucial policy as it helps in logging incidents, but it overall r o e v v e e r a a l l s l r s e ig v n ea if l i s ca s n ig t n r i e f s ic il a ie n n t c r e s g il a ie p n s c . e Th g e ap in s s . t T ru h c e t in o s n tru ece ti i o v n ed re a ce s i c v o e r d e a of s 5 co 8 r % e o in f dic 5 a 8 t % ing in a di m ca o ti d n e g ra a te m le o v d e e l ra o t f e re le s v il e ie l n o c f e r . esilience. The robustness of the instruction is moderate(score 2); it requires the CSA to keep a s k e e c e u p re a i s n e c c id u e re nt in r c e i g d i e st n r t y r a e n g d ist o ry ut a li n n d es o r u e t l l e in v e a s nt re p le ro v c a e n d t u p r r e o s c f e o d r u n re o s tifi o c r a n ti ot n if , i t c r a a t c io k n in , g and a tr n a a c l k y i s n is g . 4 a 4 n H d o a w n e a v l e y r s , is n . o 44 m H e o a w s e u v r er s , n sp o e m cif e i a ca su lly re t s a s rg p et ci d fi i c s a in ll f y or t m ar a g t e i t on di o si r n c fo la r s m si a f t y io h n ybrid t o h r re cl a a t ss , if r y es h t y ri b c r t i i d ng th in re s a ti t t s u , ti r o e n st a r l ic s t t i r n e g ng in t s h t . it R u e t d io u n n a d l a s n tr c e y n i g s th w . e R a e k d ( u s n co d r a e n 1 c ) y ; w is h w il e e a t k he r ( e s g co is r t e ry 1) is ; w ut h il i i l s e e t d he fo r r e f g u is tu tr r y e i r s is u k ti a li s s s e e d ss fo m r e f n u ts u 4 r 5 e , n ri o sk b as c s k e -u ss p m re e g n i t s s t 4 r 5 i , e n s o of b d a u ck p l u ic p ate syst r em gist a ri r e e s m of e d n u ti p o l n ic e a d t , e o s f y fe s r t i e n m g s lit a t r l e m pr e o n o t f io o n f e fa d l , lb o a ff c e k rin in g fr l a it s t t l r e u p ct ro u o re f . o R f e f s a o ll u b r a ce ck fulness is nf m ra o s d tr e u r c a tu e r ( e s . c R o e re so 2 u ) r w ce it fu h ln o e p s p s o i r s tu m n o it d y e f r o a r te an (s o c n o y r m e 2 o ) u w s r it e h por p t p in o g rt o u f n in ty ci f d o e r nts through t a h n e o C ny S m A o w u e s b r s e i p te o 4 r 6 t p in o g te o n f t in a c ll i y de b n ro ts ad th in ro g u in g p h u t t h , e bu C t S i A t l w ac e k b s sit n e c 4 l 6 u p s o io t n en o t f ia w ll i y d b er o d a iv d e in rs g e s in ta p k u e t h , b o u ld t e i r t s l . a S c i k m s i i l n a c rly u , s r i a o p n id o i f ty w i i s d m er o d d iv e e ra rs t e s (s t c a o k r e e h 2 o ) ld ; t e h rs e . C S S im A il h a a rl s y, a ra d p u i t d y it t y o is respond q m u o ic d k e ly ra to e r ( e sc p o o r r e te 2 d ); e t v h e e n C ts S 47 A , b h u a t s t a he du in t s y tr t u o c r t e io sp n o s n la d c q k u m ic u k lt y it a o g r e e n p c o y rt c e o d op ev e e ra n t t i s o 4 n 7 , protoc b o u l t s t o h r e s i p n e s c t i r f u ic t f i a o s n t s -t l r ack m pr u o l c t e is a s g e e s n f c o y r c u o rg o e p n e t ra a t c io ti n on p s r . otocols or specific fast-track processes for urgent actions. As it is, the instruction provides a solid administrative and operational proced A u s re it f i o s, r t r h e e gi i s n t s e t r r i u n c g tio n n cid p e ro n v t i s d , e b s u a t i s t o s l l i a d c a k d o m f i s n p is e t c r i a fi t c iv c e la a s n s d ifi o c p a e ti r o a n ti s o f n o a r l hybrid or d p i r s o in ce fo d r u m re at fo io r n r e r g el is a ter d in c g yb in e c r id in e c n id ts e , n b t u s t li i m ts it la s c it k s o u f t s il p it e y c f if o i r c t c a l r a g s e s t if e i d ca a t n io a n ly s s f i o s r . The w hy e b a r k id re o d r u d n i d si a n n fo cy rm m a a ti k o e n s -r t e h l e at s e y d st c e y m be l r a i r n g c e i l d y e v n u t l s n l e im ra i b ts le i , t w s h u i t l i e lit t y he fo C r S ta A r ’ g s e d t u e t d y to r a e n s a p l o y n si d s. q T u h ic e k w ly e i a s k p r o e s d it u iv n e d , a b n u c t y w m it a h k o e u s t t m he ul s t y is a te g m enc la y rg p e ro ly to v c u o l l n s e , r i a t b ri l s e k , s w s h lo il w e er c th o e or C d S in A a ’s te d d u a ty ct t ion r . e P sp o o li n c d ym q a u k ic e k r l s y s i h s o p u o l s d it c iv o e n , s b id u e t r w in ith ro o d u u t c m in u g lt e in a h g a e n n c c e y ments, e p s r p ot e o c c ia o l l l s y , w it i r t i h sk r s es s p lo e w ct e t r o co ro o b rd u i s n t a n t e e s d s, a r c e t d io u n. d P a o n l c ic y y a m n a d k r e a r p s id sh it o y u . ld consider introducing enhancements, especially with respect to robustness, redundancy and rapidity. 44 45 46 47 20 Admnistrative Instruction No.04/2024 on Registry of Cyber Incidents. Article 4(5). Ibid. Art. 4(2) Ibid. Art 5(2) Ibid. Art 5(1) and(3) Friedrich-Ebert-Stiftung e.V.

Administrative Instruction No.05/2024 on Registry of Cyber Security Risks and Threats Rapidity Robustness 3 2 1 0 Redundancy Resourcefulness F F i i g g u u r r e e 5 5 : : 4 4 R R s s F F r r a a m m e e w w o o r r k k A A s s s s e e s s s s m m e e n n t t o o f f A A d d m m i i n n i i s s t t r r a a t t i i v v e e I I n n s s t t r r u u c c t t i i o o n n N N o o . . 0 0 5 5 / / 2 2 0 0 2 2 4 4 o o n n R R e e g g i i s s t t r r y y of C o y f b C e y r b S e e r c S u e r c it u y ri R ty is R ks is a ks nd an T d hr T e h a r t e s a . t (S s o . u (S rc o e u : r O ce w : n Ow cr n ea c t r i e o a n t ) ion) Assessed as highly resilient, with a score of 83%, the instruction provides a strong f s r t a ro m n e g w f o ra rk m f e o w r o th rk e f s o y r ste h m e a sy ti s c te id m e a n tic fic id a e ti n o t n ifi a c n a d tio m n a a n n a d ge m m a e n n a t g o e f m c e y n b t e o r f ri c s y k b s. er risks. The instruction has high robustness(score 3) as it establishes a mandatory, organi T se h d e r in eg st is ru tr c y ti f o o n r h cy a b s e h r ig ri h sk r s ob m u a s n tn a e g s e s d ( b sc y o t r h e e 3 C ) S a A s i i t n e c s o ta ll b a l b is o h r e a s tio a n m w a i n th da o t t o h r e y r , instit o u r t g io ani s s , e s d up re p g o i r s t t e ry d f b o y r cl y a b s e s r if r ic is a k t s io m n a c n ri a te g r e ia d a b n y d th a e na C l S yt A ic i a n l c too lla ls b . 4 o 8 r I a t t a io ls n o w h i a th s a high r o e t s h o e u r r i c n e s f t u it ln u e ti s o s n ( s s , c s o u r p e p 3 o ) r a te s d it b f y ac c i l l a it s a s t i e fi s ca th ti e on de c v ri e t l e o r p ia m a e n n d t a o n f a s l p y e t c ic i al is to e o d ls to . 4 o 8 l I s t and g a u ls i o de h li a n s e a s, h in ig te h g r r e a s t o e u s r s c e e v fu er ln al es o s rg ( a sc n o is re at 3 io ) n a s s ( i m t f i a li c ta il r it y a , tes le t c h o e m d s e , v r el g o u p l m at e o n rs t ), o a f nd o sp ff e e c rs ia f l l is e e x d ib t le oo ri l sk a e n v d a g lu u a i t d i e o l n in s 4 e 9 s , , e i nc te o g u r r a a t g e i s ng se c v o e o ra p l e o ra rg ti a v n e is a a n t d io a n d s a ( p m ta il b it l a e ry in , stituti e o l n ec a o l m be s h , a re v g io u u la r. t I o t r s s) r , e a d n u d nd o a f n fe c r y s i f s le m xi o b d le era is t k e e (s v c a o lu re at 2 io ); n a s l 4 t 9 h , o e u n g co h u t r h a e gi s n y g stem priori c t o is o e p s e a ra n t d iv r e ec a o n r d s a r d is a k p s t , a i b t l d e o in es t n it o u t ti c o r n e al te be b h a a c v k i u o p ur o . p It e s ra re ti d o u n n a d l a le n v c e y ls is o m r a o l d te e r r n a a te tive r ( e s g co is r t e ri 2 e ) s ; t a o lt p h r o e u v g e h nt th fa e il s u y r s e te if m th p e ri p o r r i i m tis a e ry s a re n g d is r t e r c y o i r s d c s o r m isk p s ro , i m t d is o e e d s . T n h ot e c r r a e p a id te ity is a b l a s c o k m up od o e p r e a r t a e ti ( o s n c a o l re le 2 v ) e s ls in o c r e a t l h te e rn in a s t t i r v u e c r t e io g n is d tr o ie e s s t n o o p t r f e o v r en se t e fa a il n u y re u i r f g t e h n e t action or r p e r a im l t a im ry e re th g r is e t a r t y e is c c a o l m at p io r n om ba is s e e d d . T on he re r g a i p s i t d ry ity da is ta al a s l o on m e o . d It e d ra o t e e s ( , s h c o o w re e 2 ve ) r s , i i n n c c e lude a th n e nu in a s l t re u p c o ti r o t n in d g o a e n s d n c o o t n f t o in re u s e e s e d a a n t y a u e r n g t e ry n . t action or real time threat escalation based on registry data alone. It does, however, include annual reporting T an h d e i c n o s n t t r i u n c u t e io s n d ’s at r a ob e u n s t t ry s . ystem for risk identification and highly resourceful interagency cooperation are key strengths, directly supporting the National C T y h b e e i r n s s e t c r ur c i ti y on S ’ t s ra ro te b g u y st b s y y p st ro em vid f i o n r g r s is y k st i e d m en ic tif d ic a a ta ti . o I n ts a e n f d fe h c i t g iv h e l n y e r s e s so in ur a ce c f r u is l is d in e t p e e ra n g d e s n l c a y rg c e o ly op o e n ra its io i n t a e r g e ra k t e i y on st w re i n th gt o h t s h , e d r i p re o c l t ic ly ie s s u c p a p p o a r b ti l n e g o t f h t e ra N n a s t la io t n in a g l the i C d y e b n e ti r f s i ec d u r r i i s t k y i S n t t r o at a e c g t y io b n y . providing systemic data. Its effectiveness in a crisis depends largely on its integration with other policies capable of translating the identified risk into action. 48 Administrative Instruction No. 05/2024 on Registry of Cyber Security Risks and Threats. Articles 1-7. 49 Ibid. Article 2 and 8. 20 Friedrich-Ebert-Stiftung e.V. Labour shortages due to automation 21

N N a a t t i i o o n n a a l l C C y y b b e e r r S S e e c c u u r r i i t t y y S S t t r r a a t t e e g g y y 2 2 0 0 2 2 3 3 2 2 0 0 2 2 7 7 5 5 0 0 Rapidity Robustness 3 2 1 0 Redundancy Resourcefulness F F i i g g u u r r e e 6 6 : : 4 4 R R s s F F r r a a m m e e w w o o r r k k A A s s s s e e s s s s m m e e n n t t o o f f N N a a t t i i o o n n a a l l C C y y b b e e r r S S e e c c u u r r i i t t y y S S t t r r a a t t e e g g y y 2 2 0 0 2 2 3 3 2 2 0 0 2 2 7 7 ( ( S S o o u u r r c c e e : : O O w w n n c c r r e e a a t t i i o o n n ) ) T T h h e e s s t t r r a a t t e e g g y y i i s s a a n n o o t t h h e e r r i i m m p p o o r r t t a a n n t t r r e e g g u u l l a a t t o o r r y y p p o o l l i i c c y y a a n n d d i i t t o o p p e e r r a a t t i i o o n n a a l l i i s s e e s s t t h h e e L L a a w w o o n n C C y y b b e e r r S S e e c c u u r r i i t t y y ( ( d d i i s s c c u u s s s s e e d d a a b b o o v v e e ) ) , , a a i i m m i i n n g g f f o o r r c c o o o o r r d d i i n n a a t t e e d d c c y y b b e e r r resili r e e n s c il e ie . n T c h e e . T st h ra e t s e t g r y at i e s g a y ss is es a s s e s d es a s s ed hi a g s hl h y ig re h s ly ili r e e n s t ili w e i n t t h w a it s h co a re sc o o f re 83 o % f . 83%. A A s s p p r r e e s s e e n n t t e e d d i i n n F F i i g g . . 6 6 , , t t h h e e s s t t r r a a t t e e g g y y e e x x h h i i b b i i t t s s h h i i g g h h r r o o b b u u s s t t n n e e s s s s ( ( s s c c o o r r e e 3 3 ) ) ; ; i i t t clearly a c s le s a ig r n ly s a in ssi t g it n u s ti i o n n s a ti l tu re t s io p n o a n l s r ib es il p it o ie n s si t b o il e it n ie t s iti t e o s e li n k t e it t ie h s e l M ike in t is h t e ry M o i f ni I s n t t r e y rn o a f l Aff I a n i t r e s r a n n a d l A th ff e ai C rs S a A n , d m t a h n e d C at S e A s , s m ec a t n o d ra a l te C s S s IR ec T t s o , r a a n l d CS re IR qu Ts ir , e a s n p d eri e o q d u ic ire s s ec p u e r r i i t o y d a ic ud s i e t c s u f r o it r y c a ri u ti d c i a t l s i f n o f r a c s r t it r i u c c a t l u i r n e fr o a p s e tru a c to tu rs re (p o p p . e 2 ra 0 t o 2 r 2 s , ( 3 p 4 p . 3 2 8 0 ). -2 It 2 s , r 3 e 4 so -3 u 8 rc ). e I f t u s lness is a re ls s o ou h r i c g e h fu (s ln co es re s 3 is ), a p ls r o m hi o g t h in ( g sc a o m re u 3 l ) t , is p e r c o t m or o a t l in a g pp a ro m a u ch lt , is in ect lu o d ra in l g ap c p o r l o la a b c o h r , ation b in e c tw lu e d e ing g c o o v l e la rn b m or e a n ti t o , n pr b iv e a t t w e e s e e n ct g o o r v a e n rn d m a e c n a t d , e p m ri i v a a , t o e u s t e li c n t e o s r a n n d at a io ca n d a e l m cy i b a, er risk m ou a t n li a n g e e s m a e n n a t t s io y n st a e l m cy , b a e n r d ri p s l k an m s a f n o a r g C e S m O e i n n t c s lu y si t o e n m i , n a a n w d a p r l e a n n e s s f s o c r a C m S p O aigns(pp. 2 in 5 c , l 2 u 2 si , o 2 n 8 i , n 4 a 0 w -4 a 1 r ) e , n in e d ss ic c a a ti m ng pa a ig f n le s xi ( b p l p e . a 2 n 5 d , 2 w 2 e , l 2 l8 c , o 4 o 0 rd -4 in 1 a ) t , e in d d r i e c s a p ti o n n g se a s f y le s x te ib m le . H an o d we w v e e l r l , -c re o d o u rd n i d n a a n te c d y r is es m pon d s e e ra s t y e s ( t s e c m or . e H 2 o ) w ; a ev lt e h r o , u re g d h u t n h d e an m c e y a i s s u m re o e d n e c r o a u te rages v (s u c ln o e re ra 2 b ) i ; li a ty lth m o a u p g p h in th g e a m nd ea in s t u r r o e d e u n c c e o s u C r S ag IR e T s s v ( u p l p n . e 2 ra 2 b i 2 li 4 ty ), m it a d p o p e i s ng no a t n e d nsure c in o t m ro p d le u t c e es re C d S u I n R d T a s n ( c p y p. a 2 cr 2 os -2 s 4 a ) l , l i s t e d c o to es rs n o o r t d e e n t s a u il r e e d c , o c m om pl p e r t e e h r e e n d s u iv n e da p n la c n y s for b a a c c ro k s u s ps a . ll R s a e p c i t d o i r t s y o is r a d l e s t o ai m le o d d , e co ra m te pr ( e sc h o e r n e s 2 iv ) e a p s la th n e s m fo e r a b s a u c r k e u d p o s e . s Ra in p t i r d o i d ty uc is e e a m ls e o rg m e o n d c e y ra re t s e p ( o s n co se re p 2 ro ) c a e s d t u h r e es m l e ik a e su E r m e e d r o g es nc in y tr T o e d a u m ce (E e K m R e S rg H e ) n a c n y d res a p rl o y n w se arni p n r g oc a e le d r u ts re ( s p l p ik . e 26 E , m 4 e 0 r ) g , e b n u c t y it T d e o a e m s ( n E o K t R y S e H t s ) p a e n c d ify ea le rl g y a w lly ar o n b in li g ga a t l o e ry ts e ( m pp e . rg 2 e 6 n , cy p 4 r 0 o ) c , e b d u u t re it s d o o r e f s o n rm ot a y l e fa t s s t p -t e r c a i c fy k l r eg so a u lly rce ob a l l i l g o a c t a o t r i y on e . mergency procedures or formal fast-track resource allocation. 50 Government of Republic of Kosovo(2023). National Cyber Security Strategy 2023- 2027 22 Friedrich-Ebert-Stiftung e.V. Disinformation and Hybrid Threats 21

Kosovo Security Strategy 2022- 2027 51 Rapidity Robustness 3 2 1 0 Redundancy Resourcefulness F F i i g g ure 7: 4Rs Framework Assessment of Kosovo Security Strategy 2022- 2027. (Source: Own creat c i r o e n a ) tion) This is an overarching strategy which acknowledges various threats. Howev er, it d v em r, i o t n d s e t m rat o e n s st lo ra w te r s es lo il w ien re ce sil c ie o nce r c n o ing ce s r p n e in c g ifi s c p c e h c a if l i l c en c g h e a s lle p n o g s es d p b o y s d ed isi b n y format d io is n in a fo n r d m h a y t b io ri n d a t n h d re h a y ts b , r a id ss t e h s r s e e a d ts w , a it s h se a sse c d or w e i o th f 5 a 0 s % c . ore of 50%. Robustness is moderate(score 2) as the strategy acknowledges hybrid threats i t n h c r l e u a d t i s n i g nc d l i u s d in in fo g rm di a si t n io fo n r c m a a m ti p o a n ig c n a s m a p n a d ig c n y s b a e n ra d tt c a y c b k e s r , a a t n ta d ck a s, si a g n n d s a re s sp ig o n n s sibility o re f s i p n o st n i s tu ib t il o it n y s o li f k i e ns th ti e tu K ti o o s n o s vo lik I e nt t e h l e lig K e o n s c o e vo Ag In e t n e c l y lig a e n n d ce Se A c g u e r n it c y y F a o n rc d e S s e ( c p u p r . it 7 y -8). H Fo o r w ces ve (p r, p s . p 7 e c 8 if ) i . c H t o o w ol e s v a e n r, d sp o e p c e i r f a ic ti t o o n o a ls l m an e d an o s pe fo ra r t m io i n si a n l f m or e m a a n t s io f n or re m s i p s o in n f s o e rremai t n io b n ro re a s d p ly on d s e e sc re ri m be a d in a b n r d oa u d n l d y e d rd e e sc v r e i l b o e p d ed a . n R d e u d n u d n e d r a d n ev cy elo is p w ed e . a R k e ( d sc u o n r d e a 1 n ) c ; y the s is tr w at e e a g k y ( n sc o o te re s 1 in ) a ; d th e e qu st a r t a e te in g f y ra n s o tr t u es ct i u n r a e d a e n q d ua r t e e lia in n f c r e as o tr n u b ct il u a r t e er a a n l d ag re re li e a m nc e e nts f o o n r b in il t a e t l e li r g a e l n a c g e re (p e . m 9 e ), n w ts it f h or n i o nt e e x l p li l g ic e i n t c p e a ( r p a . ll 9 e ) l , s w ys it t h em no s e o x r p b l a ic c i k t u p p ar c a o ll m el munication f s r y a s m te e m w s or o k r s b m ac e k n u t p io c n o e m d m to u p n r i e c v a e ti n o t n c f y r b a e m r e o w r o in rk fo s r me a n ti t o io n n f e a d ilu to re p s r d e u ve ri nt g c h y y b b e r r id att o a r c i k n s f . o I r t m s a re t s io o n ur f c a e il f ur l e n s es d s u i r s in m g o h d y e b r r a id te a ( t s t c a o c r k e s. 2 I ) ts as re i s t o re u f r l c e e c f t u s ln in e s s t s it i u s t m io o n d al er a a d t a e pta (s b c i o li r t e y 2 a ) n a d s a i i t m re s f t le o c s t t s re in n s g t t it h u e t n io g n o a v l e a r d n a a p n t c a e b , i h li o ty w a e n ve d r, a it m la s c t k o s s m tre u n lt g it s h t e a n keholder c g o o l v la e b rn o a ra n t c i e o , n h ( o e w sp e e v c e i r a , l i l t y la w c i k th s me u d lt i i a -s , t C a S ke O h s o f l o d r er di c s o in ll f a o b r o m ration ) ( . e R s a p p e i c d ia it l y ly is w w it e h ak ( m sc e o d r i e a, 1 C ) S a O s s th f e or m d e is a i s n u fo re rm la a c t k io s n c ) o . n R c a re p t id e it ra y p is id w -r ea sp k o ( n sc s o e r m e 1 e ) ch a a s n t i h s e m m s e sp a e su ci r f e ically t l a c il k o s re c d on to cr t e h t e u ra rg p e id n c re y s o p f o d n i s s e in m fo e r c m h at n io is n m c s a s m p p e a cif g ic n a s ll o y r t h a y il b o r r i e d d th to re t a h t e s. urgency of disinformation campaigns or hybrid threats. Although the strategy is an important overarching instrument, its low resilience i A n l d th ic o a u te g s h t t h h a e t s K t o ra s t o e v g o y ’s is pr a i n m i a m ry po se rt c a u n ri t ty ov s e t ra t rc e h g i y ng is i no str w um el e l n e t q , u it ip s p lo e w d to effect r i e v s e il y ien co c u e n in te d r ic d a is te in s f t o h rm at a K ti o o s n ov a o n ’ d s p h r y im br a id ry th s r e e c a u t r s i . ty It s i t s ra im te p g o y rt is ant o th w a e t l t l he strategy i e s q r u e i v p i p se e d d t t o o i e n f c f o ec rp ti o v r e a ly te c r o o u b n u t s e t r c d o is u i nt f e o r r m di a s t in io f n or a m n a d ti h o y n b t r o id ol t s h , r en a h ts a . n It ce is its redund im an p c o y rt t a h n r t ou th g a h t c t o h n e t s in tr g a e t n eg cy p is la re n v n i i s n e g d , t a o nd in e co st r a p b o l r i a s t h e c r l o e b a u r, s r t a c p o id un c t r e is r i s di r s e i s n p for n se me a c ti h o a n n t is o m ol s s, th en a h t a in n t c e e gr it a s te re e d f u fe n c d t a iv n e c ly w th i r t o h u o g t h he c r ont a i t n io ge n n a c l y st p ra la te n g n i i e n s g . , and establish clear, rapid crisis response mechanisms that integrate effectively with other national strategies. 51 Government of Republic of Kosovo(2022). Kosovo Security Strategy 2022- 2027. 22 Friedrich-Ebert-Stiftung e.V. Labour shortages due to automation 23

L L a a w w N N o o . . 0 0 4 4 / / L L 0 0 4 4 4 4 o o n n t t h h e e I I n n d d e e p p e e n n d d e e n n t t M M e e d d i i a a C C o o m m m m i i s s s s i i o o n n ( ( I I M M C C ) ) Rapidity Robustness 3 2 1 0 Redundancy Resourcefulness F F i i g g u u r r e e 8 8 : : 4 4 R R s s F F r r a a m m e e w w o o r r k k A A s s s s e e s s s s m m e e n n t t o o f f t t h h e e L L a a w w N N o o . . 0 0 4 4 / / L L 0 0 4 4 4 4 o o n n t t h h e e I I n n d d e e p p e e n n d d e e n n t t M M e e d d i i a a Comm Co is m sio m n i . ss (S io o n ur . c ( e S : o O u w rc n e: c O re w at n io c n re ) ation) T T h h i i s s l l a a w w i i s s i i m m p p o o r r t t a a n n t t a a s s i i t t e e s s t t a a b b l l i i s s h h e e s s t t h h e e I I M M C C a a s s t t h h e e r r e e g g u u l l a a t t o o r r f f o o r r a a u u d d i i o o v v i i s ual m su e a d l ia m i e n d K ia o i s n ov K o o . s A o l v t o h . o A u l g t h o im ug p h or im ta p n o t r i t n an ta t c i k n li t n a g ck d l is n i g nf d o i r s m in a fo ti r o m n a a t n io d n h a y n b d rid t h h y r b ea ri t d s t i h n r m ea e t d s i i a n , m it e re d c ia ei , v i e t d re a ce s i c v o e r d e a of sc 5 o 0 r % e , o i f n 5 d 0 ic % at , i i n n g di l c o a w tin re g si l l o ie w nc res . ilience. I I t t s s r r o o b b u u s s t t n n e e s s s s i i s s h h i i g g h h ( ( s s c c o o r r e e 3 3 ) ) f f o o r r i i t t s s m m a a n n d d a a t t e e d d s s p p h h e e r r e e . . T T h h e e l l a a w w e e s s t t a a b b l l i i s s h h e e s s the I t M he C I a M s C a a c s on a s c t o it n u s t t io it n u a ti l o ly n m all a y n m da a t n e da , t in ed, e i p n e d n e d p e e n n t d b e o n d t y bo ta d s y ke ta d s w ke it d h w li i c t e h nsing, m lic o e n n i s to in r g in , g m , a o nd ito s r a ing ct , i a o nd in s g a a n u c d ti i o o n v in su g a a l u b d ro io a v d is c u a a st l e b r r s o , a w d i c th as l t e e g r a s, ll w y i b th in l d e i g n a g ll a y nd e b n in fo d r i c n e g a a b n le d r e u n li f n o g r s c . e 5 a 2 b T l h e ro ru u l g in h g t s h . 5 i 2 s, T t h h r e ou la g w h c th re is a , t t e h s e a la st w ro c n r g ea i t n e s s ti a tu s t t io ro n n a g l govern in a s n t c it e u s ti t o ru n c a t l u g r o e v f e o r r n t a ra n d ce iti s o t n ru a c l t b u r r o e a f d o c r a t s r t ad m it e io d n ia a . l It b s ro re a d d u c n as d t a m nc e y d is a. w It e s ak(score 1 re ) d a u s n t d h a e n m cy ea is su w r ea d k o ( e s s co n r o e t 1 p ) ro a v s id th e e fo m r e a a l s te u r r n e a d ti o v e e s o n v o e t rs p ig ro h v t id o e rg f a o n r i a sa lt t e io rn n a s ti o r p v a e ra o l v l er l s s i t g r h u t ct o u r r g e a s n i i f sa th ti e on IM s C or is pa o r v a e ll r e b l u s r t d r e u n c e tu d re o s r i c f o t m he pr I o M m C is i e s d o . v W er h b i u le rd it en p e ro d vides c o o r ll c a o b m o p ra r t o i m on is w ed it . h W o h th il er it in p s r t o it v u i t d i e o s ns c 5 o 3 l , l s a p b e o c r i a f t ic io f n al w lb it a h ck ot p h r e o r ce in d s u t r i e tu s t o io r n m s 5 u 3 , ltiple e s n p f e o c r i c fi e c m fa e l n lb t a ro c u k t p e r s o a c r e e d n ur o e t s s o p r ec m if u ie lt d ip . l R e e e s n o f u o r r c c e e f m uln en e t ss ro is ut a e l s o ar w e e n a o k t ( sp co ec re i1); a fi l e th d o . u R g e h so t u h r e ce IM fu C lne ca ss n i c s r a ea ls t o e w in e te a r k n ( a s l c r o u r l e es 1) a ; n a d lth coo u r g d h in t a h t e e I w M i C th c t a h n e c N re a a ti t o e nal A in s t s e e r m na b l ly ru , t le h s e a la n w d c d o o o e r s d n in o a t te fo w st i e th r b th ro e a N de a r ti c o o n o a p l e A r s a s t e io m n b w ly i , th th o e th la e w r s d ta o k e e s h n o o l t ders ( f e o s s p t ec r i b a r l o ly a w de it r h co C o S p O e s ra o t r io t n ec w h it p h la o tf t o h r e m r st t a o ke c h o o u l n d t e e r r s d ( i e s s in p f e o c r i m al a ly ti w on it ) h , o C r S h O a s ve or an a te d c a h pt p iv la e tf r o es rm po s n t s o e c t o o u o n l t l e ik r e d d is i i g n it fo a r l m m a o t n io it n o ) r , i o n r g h s a y v s e te a m n s a . S da im pt il i a ve rly r , e i s t p s o r n a s p e id t i o ty ol is a li s k s e es d s ig ed ita a l s m w o e n a i k to ( r s i c n o g re sy 1 s ) t ; e w m h s i . le Si t m he ila IM rly C , i h ts as ra t p h i e di a ty ut i h s o a r s it s y es t s o e s d u a sp s e w n e d a l k icenses a (s n c d or is e s 1 u ) e ; p w u h n il i e sh t m he en IM ts C , t h h a e s la th w e d a o u e t s ho n r o ity o t u o tl s in u e sp o e f n fi d ci l a ic l e e n m s er s g a e n n d cy is p s r u o e cedures o p r u e n x is p h e m di e te n d ts m , t e h t e ho la d w s d fo o r e h s a n n o d t li o n u g tl s in h e oc o k f s fi s c u ia c l h e a m s e d rg is e inf c o y rm pr a o t c i e o d n u o re r s h o yb r rid t e h x r p e e a d ts it o ed ve m r m et e h d o i d a s . for handling shocks such as disinformation or hybrid threats over media. While the law is generally a positive step towards creating resilience against d W is h in il f e or t m he a l t a io w n, is in ge it n s e c r u a r l r ly en a t p s o h s a i p ti e v , e it st r ep m t a o in w s a l r a d r s g c e r ly ea in ti e n f g fe r c e t s i i v li e en a c g e ai a n g s a t i t n h s e t p d r i i s m in a f r o y rm ch a a ti n o n n e , l i s n o i f ts m c o u d rr e e r n n t d s i h s a in p f e o , r i m t a re t m ion ain a s nd la h rg y e b l r y id in t e h f r f e e a c t t s iv . e Its ag li a m in it s e t d th sc e ope ( p e r x i c m lu a d ry in c g h o a nl n in e e ls m of ed m ia o ) d , e c r o n u d p i l s e i d nf w or it m h a t t h io e n ot a h n e d r h w y e b a r k id ne th ss rea s t m s. e It n s ti l o im ne it d ed above, m sc e o a p n e s ( i e t x c c a lu n d n i o n t g b o e n r l e in li e ed m u e p d o ia n ), a c s o a up c l e e n d tr w al it p h il t l h a e r o o f th K e o r s w ov e o a ’ k s n e e f s fo se rt s s m to en co ti u o n ter d n i e s d inf a o b r o m v a e t , i m on e . ans it cannot be relied upon as a central pillar of Kosovo’s efforts to counter disinformation. 52 Ibid, 30. Article 1-4. 53 Ibid. Art. 8 24 Friedrich-Ebert-Stiftung e.V. Disinformation and Hybrid Threats 23

Code of Ethics of the IMC(IMC-2016/03) 54 Robustness 3 2 1 Rapidity 0 Redundancy Resourcefulness F F igure 9: 4Rs Framework Assessment of Code of Ethics. (Source: Own creation) The IMC Code of Ethics, although important in establishing professional stand st a a r n d d s, a d rd e s m , o d n em str o a n t s e t s ra m te o s d m era o t d e era e t s e ili r e e n s c il e ie a n g c a e in a s g t a d in isi t n d fo is r i m nf a o t r i m on at a io n n d a h n yb d r h id ybrid threats, receiving a score of 58%. As visualised in Fig. 9, its robustness is high(score 3) because it sets legally binding requirements such as accuracy, fairness and the correction of inaccurat e c te on c t o e n n t t e . n T t h . e Th C e od C e od is e s i u s p s p u o p r p t o e r d te b d y b th y e th L e aw La o w n o IM n C IM a C nd a , n t d h , r t o h u r g o h ug it h , c it a , n ca e n nforce s e a n n fo ct rc io e n s s a l n ik c e tio fi n n s es lik o e r l f ic n e e n s s o e r s l u ic s e p n e s n e si s o u n s s pe fo n r si b o r n o s ad fo c r as b t r e o r a s d , c e a n s s t u e r r i s n , g en ac su co ri u n n g tab cc il o it u y n a ta n b d il p it r y om an o d tin p g ro s m ys o t t e in m g ic sy s s ta te b m ilit c y. st T a h b e ili r t e y d . u T n h d e a r n e c d y u i n s d w an ea cy k i ( s sc w o e re ak 1) ( ; score a 1 l ) t ; h a o l u th g o h u s g a h n s c a ti n o c n t s io a n r s e a le re ga le ll g y a b ll i y nd b ing di a n n g d a d n o d n d ot n r o e t qu re ir q e u f ir u e rt f h u e rt r h leg r a le l g a a c l tions, t a h c e tio sy n s s t , e t m he la s c y k st s e f m all l b a a c c k k s f m al e lb ch a a ck ni m sm e s ch if a t n h is e m IM s i C f t it h s e el I f M is C u it n s a e b lf le is to un a a c b t l o e r t i o s act c o o r m is p c r omp is r e o d m . i F s u e r d t . h F e u rm rth o e re rm , t o h r e e, a t p h p e o a in p t p m o e in n t t m o e f n th t e of IM th C e b IM oa C rd bo b a y rd th b e y N t a h t e ional A N s a s t e io m n b a l l y A a s l se o m in b t l r y od al u s c o e i s n a tro p d o u te c n e t s ia a l p v o u t ln en e t ra ia b l il v i u ty ln t e o ra p b o i l l i i t t i y ca t l o in p f o l l u it e i n ca ce l , in li f m lu i e ti n n g r c e e s , ilie m n i c ti e n d g u r e s t i o lie r n el c i e an d c u e e o t n o a re s lia n n g c le e a o c n to a r s w in it g h le ou a t ct p o ro r t w e i c t t h iv o e ut o p ve ro rs te ig c h ti t v . e The r o e v s e o r u s r ig ce h f t u . l T n h e e ss re is so m u o rc d e e f r u a l t n e es (sc i o s re m 2 o ) d a e s ra t t h e e (s m co e r a e su 2 r ) e a i s n t c h lu e d m es eas c u co re un in t c a l b u i d li e ty s m ac e c c o h u a n n t i a s b m il s ity lik m e e t c h h e a r n ig is h m t s of li r k e e p t ly he an ri d gh c t o o rr f e r c e t p io ly n. a H n o d w c e o v rr e e r, ct it io l n a . ck H s o c w o e ll v a e b r, o i r t ative f l r a a c m ks ew co o l r la k b s o th ra a t t iv w e o f u ra ld m h e e w l o p r m ks e t d h i at a w d o a u p l t d to he e l v p o m lvi e n d g ia h a yb d r a i p d t t t h o re e a v t o s lv o i r n d g is h i y n b fo ri r d m th a re ti a o t n s t o a r c d tic s s in b fo e r y m on a d tio tr n ad ta it c i t o ic n s al b b e r y o o a n d d ca tr s a t d in it g io e n t a h l ic b s r . o I a ts dc rap st id in it g y e is th a ic ls s o . I w ts eak ( r s a c p o id re it 1 y ) is w a it l h so fe w w ea p k ro ( c s e c d o u re ra 1 l ) t w im it e h lin fe e w s( p li r k o e ce t d h u e r s a e l v t e im n e d l a in y e l s im (lik t e fo t r h t e h s e e r v i e g n ht d t a o y r l e im pl i y t ) f , o it r d th o e es rig n h o t t o o ff r e e r p e ly m ), e i r t g d e o n e c s y n m o e t a o s f u fe re r s e , m ex e p rg e e d n it c e y d m re e v a ie s w ur s es o , r e f x a p st e d tr it a e c d k e re n v f i o e r w ce s m o e r n fa t s f t o r tr u a r c g k e e n n t f s o it rc u e a m tio e ns t . for urgent situations. The effectiveness of the Code is closely tied to the Law on the IMC, which limits i l t i s m a it p s p i l t i s ca a b p i p li l t i y ca t b o ilit c y en to se l d ice a n u s d e io d v a is u u d a io l v m is e u d a ia l , m e e x d cl ia u , d e in x g clu th d e in o g n t l h in e e o s n p l h in e e re w sp h h e e re re m w u h c e h re o m f t u h c e h d o is f in th fo e r d m is a i t n io fo n rm oc a c t u io rs n . o T c h c e ur C s o . d T e he ne C e o d d s e s n ig e n e i d fi s ca si n g t n m ifi o c d a e n r t nis m a o ti d o e n rn to is e a x ti p o a n n t d o i e ts xp m a a n n d d i a ts te m to an t d h a e t o e n t l o in t e he sp o h n e l r in e e , a s c p c h o e m re p , a a n c i c e o d m b p y a n n e ie w d m by eas n u e r w es m to ea e s n u h r a es nc t e o i e t n s h in a d n e c p e e i n ts d i e n n d c e e p , e c n re d a e t n e c r e e , d c u re n a d t a e n r c e i d es un a d n a d n c c r i ea s t a e n c d ol c l r a e b a o t r e ative r c e o s l p la o b n o s r e at m iv e e c r h e a s n p i o sm ns s e . mechanisms. 54 Independent Media Commission. Code of Ethics for the IMC. 24 Friedrich-Ebert-Stiftung e.V. Labour shortages due to automation 25

Press Code for Kosovo of the Press Council of Kosovo Robustness 3 2 1 Rapidity 0 Redundancy Resourcefulness Figure 10: 4Rs Framework Assessment of Press Code for Kosovo. ( ( S S o o u u r r c c e e : : O O w w n n c c r r e e a a t t i i o o n n ) ) The Press Code is a self-regulatory ethical framework for journalists, editors and a p n u d bl p is u h b e l r i s, h a e n rs d , a it n i d s im t i p s o im rta p n o t rt a a s nt it a is t it h i e s o th n e ly o r n eg ly u r l e a g to u r l y at p o o ry lic p y o t l h ic a y t t c h a a n t a ca p n ply a to pp o l n y li t n o e o p n l l a in tf e or p m la s t / f m or e m d s ia /m . T e h d e ia c . o T d h e e r c e o c d ei e ve re d c a eiv sc e o d re a o sc f o 4 r 2 e % of in 4 d 2 i % cat in in d g ic a t l i o n w g a re l s o il w ien re c s e il a ie g n a c i e ns a t g d a i i s n in st fo d r i m sin a f t o io r n m an ti d on hy a b n r d id h t y h b r r e id at t s h . reats. Fig. 10 demonstrates its limitations. Its robustness is weak(score 1); although h th o e ug co h d t e he pr c o o m de ot p e r s o p m rof t ess p io ro n f a e l s e s t io h n ic a s l s e u t c h h ics as su tr c u h th a f s u t l r r u e t p h o fu rt l in re g p a o n rt d in n g o a n n -d d isn cr o i n m i d n i a sc ti r o im n, in th a e tio e n n , fo th rc e e e m n e fo n r t c o e f m t e h n e t se of ru th le e s s r e e r li u e l s es on re v li o e l s u o n n ta v ry ol c u o n m ta p ry liance c a o n m d p p l e ia e n r c c e on a t n r d ol p r e a e th r e c r o t n h tr a o n l l r e a g th a e l r a t u h t a h n or l i e ty g . a I l ts au re t d h u o n ri d ty a . n It c s y r i e s d a u l n so da w n e c a y k is (score a 1 l ) s ; o w w hi e le ak re ( q sc u o ir r e e m 1 e ); n w ts h f i o le r r f e a q ir u n i e re s m s, e b n a t l s an fo c r ed fa r i e rn p e o s r s ti , n b g a , l and ce t d he re r p ig o h rt t in to g, r a e n pl d y t p h r e om rig o h te t a to d r e e g p r l e y e p o ro f m et o h t i e ca a l d re e d g u re n e da o n f c e y th a i n ca d l i r n e f d o u rm nd a a ti n o c n y d a i n ve d rs in it f y o , r i m t d at o i e o s n d n i o v t er o s u ity li , n i e t d sy o s e t s em no a t ti o c u d tl e in fe e n s c y e s s te a m ga a i t n ic st d d e i f s e inf c o e r s m a a g t a io in n s , t s d u i c s h in a fo s r c m o a o t p io er n a , t s iv u e ch a fa s c c t o -c o h p e e c r k a i t n iv g e n f e a t c w to c r h k e s c o k r in p g ro n t e o t c w o o ls rk fo s r o m r p a r i o n to a c in o i l n s g fo in r f m or a m in a t t a io in n in in g t i e n g f r o i r t m y ac ross t m io u n lt i i n p t l eg p r l i a ty tf a o c rm ro s s d m ur u in lt g ip a le c p ri l s a is tf . o R r e m s s ou d r u c r e i f n u g ln a e c ss ris is is a . l R s e o s w ou e r a c k ef ( u sc ln o e re ss 1 i ) s as it a la ls c o ks w p e r a o k vi ( s s i c o o n r s e f 1 o ) r a b s ro i a t d la e c r k i s ns p t r i o tu v t is io io n n a s l a fo d r a b p r t o a a ti d o e n r o in r s t t e it c u h t n io o n lo a g l i a c d a a l p in t n a o ti v o a n tion o e r ss t en ch ti n a o l l f o o g r i a c d al ap in t n iv o e va re t s io il n ie e n s c s e e . n Its ia r l a f p o i r d a it d y a i p s t m iv o e d r er s a il t i e n (s c c e o . r I e ts 2 r ) ap as id i i t ty em is phasism es o p d r e o r m at p e t ( c sc o o rr r e e c 2 ti ) o a n s s i o t f e f m al p s h e a in si f s o e r s m p a r t o io m n p , t b c u o t r i r t ec d t o io e n s s n of t f e a s l t s a e b i l n is f h or e m m a e t r io g n en , cy b p u ro t c i e t d d u o r e e s s n o o r t re e a s l t a t b im lis e h sy e s m te e m rg s en to cy q p u r ic o k c l e y d c u o re u s nt o e r r r c e o a o lr t d im in e at s e y d st a e t m ta s ck to s or visual q d u is i i c n k f l o y rm co a u t n io te n r c c a o m or p d a in ig a n t s e . d attacks or visual disinformation campaigns. The Press Code’s main limitation lies in its self-regulatory nature, which is insufficient against external, often state-backed, hybrid threat actors who do not n a o d t he a r d e h t e o re su to ch su e c t h ic e a th l i s c t a a l n s d t ar n d d s a . r I d ts . p I r t i s m p a r r im y c a o ry nt c r o ib n u tr t ib o u n t s io ta n n s d t s an o d n s f on stering f e o t s h t i e c r a i l n c g o e n t d h u ic c a t l w c i o t n h d in uc th t e w p it r h o i f n es t s h i e on p a ro l f j e o s u s r i n o a n l a is l t j i o c u c r o n m al m ist u i n c i c ty o , m w m hi u c n h it i y s , indeed w a h v i a c l h ua is bl in e d c e o e m d p a on va e l n u t a o b f le a c h o e m al p t o h n y e inf t o o r f m a at h i e o a n lt e h c y os in y f s o te rm m a . t H io o n w e e c v o e s r, y t s h tem co . de H se o r w ve e s ve a r s , t a h g e o c o o d de fo s u e n r d ve a s tio a n s a a l g e o th o i d ca f l o l u a n y d e a r t u io p n o a n l w et h h ic ic h al m la o y re r ro u b p u o s n t w re h g i u ch latory m or o c r o e ro e b gul s a t t r o e r g y u m la e to a r s y ur o e r s c c o o u re ld gu b l e at b o u ry ilt m , e e n a s s u u r r i e n s g c e o f u fo ld rt b s e to bu co il u t, n e t n er su d r i i s n in g formae ti f o fo n rt d s o t n o o c t o ( u n n e t g e a r t d iv is e i l n y f ) o i r m m p a a t c io t n jo d u o rn n a o li t st (n ic e f g r a e t e i d ve o l m y) s i . mpact journalistic freedoms. 26 Friedrich-Ebert-Stiftung e.V. Disinformation and Hybrid Threats 25

D igital Agenda a f f o o r r K K o o s s o o v v o o 2 2 0 0 3 3 0 0 5 5 5 5 Rapidity Robustness 3 2 1 0 Redundancy Resourcefulness Figure 11: 4Rs Framework Assessment of Digital Agenda for Kosovo 2030. (Source: Own creaFigure 11: 4Rs Framework Assessment of Digital Agenda for Kosovo 2030. (Source: Own creation) tion) T Th h e e D D i i g g i i t t a a l l A A g g e e n n d d a a , , a a l l t t h h o o u u g g h h i i t t i i s s n n o o t t a a d d e e d d ic ic a a t t e e d d s s t t ra ra te te g g y y to to c c o o u u n n te te r r disinfor m dis a i t n io fo n r , m in a c t l i u o d n, e i s n e c l l e u m de e s n e ts le r m el e e n v t a s n r t e t le o v b a u n i t ld to in b g u r i e ld si i l n ie g n r c e e si a li g e a n i c n e s a t g d a is in in s f t ormation a d n is d in h fo y r b m ri a d ti t o h n re a a n ts d , h a y s b se ri s d se th d r w ea it t h s, a as s s c e o s r s e e o d f w 5 i 8 th % a . score of 58%. T Th h e e s s t t r r a a t t e e g g y y d d e e m m o o n n s s t t r r a a t t e e s s a a m m o o d d e e r r a a t t e e r r o o b b u u s s t t n n e e s s s s (s (s c c o o re re 2 2 ); ); it it a a c c k k n n o o w w le le d d g g e e s s d di i s s i i n n f f o o r r m m a a t t i i o o n n a a n n d d h h y y b b r r i i d d t t h h r r e e a a t t s s w w i i t t h h i i n n t t h h e e c c o o n n t t e e x x t t o o f f c c y y b b e e r r re re s s il i i l e ie n n c c e e a a n n d d a as s s s i i g g n n s s i i n n s s t t i i t t u u t t i i o o n n a a l l r r e e s s p p o o n n s s i i b b i i l l i i t t i i e e s s ( ( C C S S A A , , M M in in is is t t r r y y o o f f In In te te rn rn a a l l A A ff f a fa ir i s r ) s , ), a a im im in in g g t to o a a l l i i g g n n w w i i t t h h E E U U a a n n d d N N A A T T O O s s t t a a n n d d a a r r d d s s . . H H o o w w e e v v e e r, r, it it d d o o e e s s n n o o t t m m e e n n ti t o io n n a a n n y y enf e o n r f c o e r a ce b a le bl l e eg le a g l a fr l a f m ra e m w e o w rk or d k ir d e i c re tl c y tl a y d a d d r d e r s e s s in si g ng di d si i n si f n o f r o m rm at a io ti n on or o h r y h b y r b id rid threats. R th e r d e u at n s d . a R n e c d y u i n s d w an e c a y k i ( s sc w o e r a e k 1 ( ) s ; c a o lt r h e o 1 u ); g a h lt i h t o e u n g co h u it ra e g n e c s o i u n r d a e g p e e s n in d d e e n p t e m nd ed en ia t a m n e d di p a u a b n li d c p aw ub a l r i e c n a e w ss a , re s n p e e s c s if , i s c p i e n c s i t f i i t c u i t n io s n ti a tu l t o io r n sy a s l t o e r m s i y c st f e a m llb ic ac fa k ll m ba e c a k sures are n m o e t a p s r u e r s e e s n a t r . e It n s o r t es p o re u s r e ce n f t u . l I n ts es re s s i o s u h rc ig e h fu ( l s n c e o s r s e is 3) h a ig s h it (s p c r o o r m e o 3 t ) e a s s c i o t l p la r b o o m r o at te io s n b co e l t l w ab e o e r n at g i o o v n e b rn e m tw e e n e t n , f g o o r v e e ig rn n m pa en rt t n , e fo rs r , e m ign ed p i a a r a tn n e d rs C , S m O e s d , i a a n a d nd it C a S ls O o s f , a a c n il d ita it tes a al d s a o p f t a iv c e ili r t e a s t p es on a s d e a s p t t h iv r e ou re g s h po e n d s u e c s at t i h o r n ou c g a h m e p d a u ig c n at s io a n nd ca c m ap p a a c ig it n y s b a u n il d ding initiat c i a v p e a s. ci R ty ap b i u d i i l t d y in is g w in e i a ti k at ( i s v c e o s r . e R 1 a ) p ; i a d l i th y o is ug w h ea it k m (s e c n o t r i e on 1 s ); e a a lt r h ly ou w g a h rn it in m g e s n y t s i t o e n m s s a ea n r d ly th w r a e r a n t in m g o s n y i s to te ri m ng s , a f n o d rm th a r l e r a a t p m id o r n e i s t p o o ri ns g e , f m or e m th a o l d ra s p o id r f r a e s s t p -t o r n a s c e k m pr e o t c h e o d d u s res a o re fa a s b t s -t e r n a t c . k procedures are absent. T he Digital Age e n n d d a a c c a a n n c c o o n n t t r r i i b b u u t t e e p p o o s s it it iv iv e e ly ly t t o o lo lo n n g g -t e te rm rm re re s s il i i l e ie n n c c e e b b y y enhanc i e n n g ha d n ig c i i t n a g l l d it i e g r it a a c l y l . it H e o ra w c e y v . e H r o , m we o v r er, c m on o c r r e et c e on m c e re a t s e u m re e s a in su t r h e e s s i e n d th ir es c e tions are r d e ir q e u c i t r i e o d n , s e a s r p e e r c e ia q l u ly ire in d, ter s m pe s c o ia f ll f y or in m t a e l r e m d s u o ca f t f i o o r n m o a n l e d d is u i c n a fo ti r o m n a o t n io d n is a i nd fo m redia l m it a e t ra io c n y a s n k d ills m i e n d h ia ig l h ite s r c a h c o y o s l k s i a ll n s d in h h ig ig h h er sc e h d o u o c l a s ti a o n n d . higher education. 55 Government of Republic of Kosovo(2023). Digital Agenda for Kosovo 2030. 26 Friedrich-Ebert-Stiftung e.V. Labour shortages due to automation 27

Discussing the Findings Discussing the Findings The 4Rs assessment of Kosovo’s regulatory framework reveals a fragmented and underdeveloped framework for countering the level of disinformation T an h d e 4 h R yb s r a id ss t e h s r s e m at e s n t t h o e f c K o o u s n o tr v y o’ h s a r s e , g a u n la d to c r o y nt fr in a u m e e s w to or f k ac re e v . e W al i s th a a f n ra o g v m e e ra n l t l ed and u 5 n 9 d % er r d e e s v il e ie lo n p c e e d sc fr o a r m e e (m wo o r d k e f r o a r te co r u es n i t l e ie ri n n c g e) t , h t e h l e ev re e g l u o l f a d to is r i y nf f o ra r m m e a w tio o n rk a s n h d ow hy s brid t s h tr r e e n a g ts th t s he (e c s o p u e n c t ia ry lly ha in s, t a h n e d cy c b o e n r t s in e u cu e r s it t y o d fa o c m e a . W in) i ; th ho a w n e o v v e e r, ra sy ll st 5 e 9 m % ic resilience s re c s o i r l e ien (m ce o i d s e s r i a g t n e if r i e ca si n li t e ly nc u e n ) d , e th rm e i r n e e g d ul d a u to e ry to fr c a r m iti e ca w l o g rk ap s s ho in w a s ll st f r o e u n r g d t i h m s e (e n s s p iec o i n a s lly of in th t e he 4R cy s b f e ra rs m ec e u w r o it r y k. domain); however, systemic resilience is significantly undermined due to critical gaps in all four dimensions of the 4Rs framework. Table 5: Total Score of Assessed Policies Table 5: Total Score of Assessed Policies # Policy Score 1 Law No. 02/L-65- Civil Law Against Defamation and Insult 2 2 Law No. 06/L-082 on Protection of Personal Data 10 3 Law No. 08/L-173 on Cyber Security 9 4 Administrative Instruction No.04/2024 on Registry of Cyber Incidents 7 5 Administrative Instruction No.05/2024 on Registry of Cyber Security Risks and 10 Threats 6 National Cyber Security Strategy 2023- 2027 10 7 Kosovo Security Strategy 2022- 2027 6 8 Law No. 04/L-044 on the Independent Media Commission(IMC) 6 9 Code of Ethics of the IMC(IMC-2016/03) 7 10 Press Code for Kosovo of the Press Council of Kosovo 5 11 Digital Agenda for Kosovo 2030 7 Total 79 Robustness issues raise major concerns when trying to address or counter R di o s b in u f s o t r n m es a s ti i o s n su a e n s d ra h i y s b e r m id a t j h o r r e c a o ts n . c T e h rn e s o w u h td e a n te tr d yi L n a g w to on ad IM dr C es , s cr o it r ica o l u ly nt f e a r iling d to is inc fo lu rm de at o i n o l n in a e n m d e h d y i b a r , id le t a h v r e e s a a ts. si T g h n e ifi o c u a t n d t a r t e e g d u L la a t w or o y n ga IM p. C F , u c r r t i h ti e c r a m lly or f e a , iling to i p n o c l l i u c d ie e s o d n e l s in ig e n m ed ed fo ia r , tr le a a d v it e io s n a a s l i m gn e i d fi i c a an o t r e re t g h u ic l al to g r u y id g a a n p c . e F , u s r u th ch er a m s o t r h e e , p IM ol C icies d C e o s d ig e n o e f d E f t o h r ic t s ra a d n it d io t n h a e l P m re e s d s ia Cod r e et o h f ic K a o l s g o u v i o d , a d n e c m e, o s n u s c t h ra a t s e t v h e e ry IM lo C w C to d lo e w of E re t s h i i l c ie s n a c n e d sc th o e re P s r a e g ss ai C n o st d c e o o o f rd K i o n s a o t v e o d , d d i e si m nf o o n r s m tr a a t t i e on ve c r a y m lo p w aig to ns lo , w lac r k e i s n il g ie t n h c e e s n c e o c r e e s s sar g y a l in eg st al co a o u r t d h i o n r a it t y e , d sc d o is p in e f a o n rm d a e t n io fo n rc c e a m m e p n a t ig m n e s c , h la a c n k i i s n m g s t . h E e ve n n ec p e o s l s i a ci r e y s l w eg it a h l i a n u h t e h r o en ri t y r , o s b c u o s p t e ne a s n s d , l e ik n e fo th rc e em Da e t n a t P m ro ec te h c a t n io is n m L s a . w E , v h e a n v p e o l l i i m ci i e t s ed w a it p h p i l n ic h a e rent r t o io b n us in tn c e o s u s n , l t i e k r e in t g he di D si a n t f a or P m ro a t t e io c n ti . on Law, have limited application in countering disinformation. Max points 132 59% 28 Friedrich-Ebert-Stiftung e.V. Disinformation and Hybrid Threats 27

Furthermore, the assessment consistently exposed a minimal systemic redundancy in the regulatory framework. Generally, there is prevalent over-reliance on single institutions within their respective domains(e.g. IMC for audiovisuals, CSA for cybersecurity, PCK for online media ethics) without clearly defined or adequate resource backup systems, alternative operational protocols or contingency plans to address institutional failure or overload during crisis. Other overarching or strategic documents, such as the Kosovo Security Strategy, acknowledge coordination gaps but generally fail to outline concrete fallback mechanisms. This lack of redundancy in the regulatory framework increases its vulnerability to disruptions due to disinformation and hybrid threats. Adaptability and multi-stakeholder collaborative approaches are also underdeveloped, which leads to an overall limited systemic resourcefulness. Although instruments like the National Cybersecurity Strategy and Digital Agenda promote multi-stakeholder approaches, this is not reflected across the rest of the regulatory framework. Most of the laws tend to prioritise administrative structures over fostering innovation or mandating broad collaboration. Most importantly, Kosovo lacks an overarching national strategy or an institutionalised platform dedicated to fostering collaboration specifically to counter disinformation and hybrid threats among diverse actors, including governments, security agencies, policymakers, CSOs, academia and tech platforms. Additionally, the lack of a national strategy to increase media literacy(especially within formal education) represents a major deficit in building the societal resilience to resist manipulation and disinformation campaigns. The assessment also emphasises the insufficient rapidity present across the board. The speed of disinformation(especially through online platforms) significantly outpaces the response capacity provided within the policies of the current regulatory framework. Most policies assessed lack specific provisions for rapid detection, real-time analysis capabilities, fast-track decision-making processes, or protocols for emergency coordination. Even the policies which demonstrate a moderate rapidity in certain aspects(e.g. the Law on Cyber Security) lack defined crisis action plans for a fast and coordinated reaction. Policies which are reliant on self-regulation(e.g. PCK) or those that are reliant on judicial processes(e.g. Defamation law) are too slow to be effective against disinformation. This systematic lack of rapidity leads to interventions being too little, too late to effectively mitigate or address the impact of disinformation and hybrid threats. Another important finding worth noting is the significant degree of fragmentation and lack of strategic cohesion among the various policies assessed. For instance, although the efforts made in the cybersecurity domain are relatively advanced, they are poorly connected to the regulatory framework for the information space. Or in the case of the Kosovo Security Strategy, which fails to effectively integrate or guide specific measures countering disinformation as a security risk, creating a strategic disconnect. Similarly, the Digital Agenda, although it mentions digital literacy goals, lacks strong operational links to security frameworks or regulatory enforcement concerning disinformation. “The speed of disinformation (especially through online platforms) significantly outpaces the response capacity provided within the policies of the current regulatory framework.” Labour shortages due to automation 29

Conclusions and Recommendations Addressing disinformation and hybrid threats presents a complex challenge, requiring careful navigation to avoid infringing upon fundamental rights like freedom of expression and media freedom. However, the preceding analysis and other studies conducted clearly demonstrate significant vulnerabilities within the current regulatory framework, necessitating strategic and holistic interventions that move beyond the existing fragmented efforts. The following recommendations aim to advance the regulatory framework, learning from best practices, particularly the ones in the EU, concerning digital services and disinformation, while adapting them to the specific context of Kosovo. The assessment consistently revealed critical weaknesses across the 4Rs of resilience. To build a more resilient framework, a primary focus must be on modernising the regulatory framework for “Building societal resilience is probably the most the information space in Kosovo, particularly concerning online media. This problematic part as it necessitates a comprehensive reform, by substantially amending the Law on the requires dedicated longcovering online media(news portals and IMC to grant it a clear, expanded mandate term investment.” other online platforms) with adequate resources and independence. This reform body is crucial for providing institutional strength where it is currently lacking. Building on the reform of the Law on IMC, it is crucial to adopt specific legislative measures focused on enhancing transparency and accountability in the online space, drawing particular lessons from the EU’s Digital Services Act(DSA) and the Strengthened Code of Practice on Disinformation. Instead of creating laws and regulations that could attempt content censorship, raising significant freedom of expression concerns, legislation should focus on the dynamics of disinformation spread. This could include(i) mandating transparency for online political advertising, for example, by requiring platforms operating in Kosovo to maintain publicly accessible ad repositories similar to those required under the DSA,(ii) clear labeling requirements for state-sponsored content and(iii) establishing mechanisms to address coordinated inauthentic behaviour(like bot networks). Additionally, adopting a proportionate risk-based approach for online platforms could be useful. By doing this, online platforms will be required to 30 Friedrich-Ebert-Stiftung e.V.

assess and mitigate systemic disinformation risks(akin to DSA Article 34) under the oversight of IMC. Furthermore, exploring a co-regulatory model, blending formal regulation with structured self-regulation inspired by the EU’s Strengthened Code of Practice, could also foster industry responsibility. Key adaptable commitments include the demonetisation of disinformation, enhancing service integrity against fake accounts/bots, empowering users, and facilitating secure data access for researchers studying disinformation, while respecting data protection laws, in line with the GDPR. Beyond specific regulation related to media and online platforms, enhancing strategic cohesion and institutional capacity across public institutions is crucial. The Kosovo Security Strategy needs to be revised to integrate actions to counter disinformation and hybrid threats as core priorities. Furthermore, this instrument as an overarching strategy should clearly define cross-agency roles and ensure effective connection with other strategies(e.g. the National Cybersecurity Strategy). Similarly, the operational capacity of all relevant institutions must be enhanced through adequate funding, specialised training and technical resources, while protecting their independence. Building societal resilience is probably the most problematic part as it requires dedicated long-term investment. On this goal, the development and sustained implementation of a comprehensive National Media and Information Literacy Strategy is paramount. Furthermore, the integration of this strategy and its actions across the education system and supporting public programmes(non-formal education) to empower citizens with media literacy skills and countering disinformation would be necessary. Fostering a pluralistic and sustainable independent media environment through transparent public funding mechanisms and support for quality journalism would provide citizens with diverse, reliable information sources, acting as a natural buffer against disinformation and hybrid threats. Throughout this process, strengthening international cooperation and alignment remains crucial. Continuous engagement with the EU, NATO, and bilateral partners for intelligence sharing, adopting best practices, and harmonising Kosovo’s framework with evolving international standards, particularly learning from the implementation of the DSA and related initiatives, will be key to building effective, modern, and rights-respecting resilience against disinformation and hybrid threats. As mentioned throughout the paper, addressing these challenges requires strategic and holistic interventions that go beyond the current fragmented efforts. Moving forward, a dedicated and sustained commitment to implement reforms will be essential to properly enhance the capacities of institutions to navigate and counter disinformation and hybrid threats. Labour shortages due to automation 31

References 1 Classified based on the OECD(2014) “Guidelines for Resilience Systems Analysis: How to Analyse Risks and Build a Roadmap to Resilience”. OECD Publishing. 2 Vishnska, I.(2023)“Geopolitical Perspective of Disinformation Flows in the Western Balkans”. Metamorphosis Foundation for Internet and Society. 3 NDI(2022)“Information Integrity in Kosovo: Assessment of the Political Economy of Disinformation”. National Democratic Institute. 14 Shaban Mexharraj(2025)“‘The Six Against Turkey’ Does Not Give Up on Prizren, Officials Remain Silent”. Koha. 15 Ibid. 16 Ibid, 11. 17 Belt and Road Initiative(known also as the One Belt One Road) is an international infrastructure development strategy implemented and funded by the Chinese Government. See more at: Belt and Road Portal. 4 Zamfir, R.(2020)“Risks and Vulnerabilities in the Western Balkans”. NATO Strategic Communications Center of Excellence. 5 Burmester, I, et al.,(2025)“Political Threat Assesment in Eastern Neighbourhood& Western Balkan Countries”. ReUnir Working Paper. 6 Ibid, 2. 7 Ibid, 3 8 Ibid 2. 18 Gashi, K.(2024)„Institutional Unpreparedness: Kosovo’s Challenge Against Disinformation”. In Balažič, P.& Brglez, L(2024)“The Mirage of Truth: Complexities and Challanges of Disinformation in the Western Balkans”. Center for European Perspective. 19 Disnfo(2022)“Under the Surveillance of Suspicious Chinese Cameras”. Sbunker 20 Mehmeti, J(2021)“National Regulatory and Self-Regulatory Framework Against Hate Speech and Disinformation”. SEENPM, Peace Institute and Kosovo 2.0. 9 EUvsDinfo(2019)“700 False New Stories in Serbian Tabloids in 2018”. EUvsDisinfo. 10 Disinfo(2022)“Misnformation of Public Opinion in Serbia as an Electoral Strategy”. Sbunker 11 Zamfir, R.(2019)“Propaganda Made-toMeasure: Dimensions of Risk and Resilience in the Western Balkans”. Global Focus/The Balkan Trust for Democracy. 12 Prime Minister Office(2024).“Agreement signed with Turkish state-owned defense industry producer“Makine ve Kimya Endüstrisi”. Last accessed: May 5, 2025. 21 Ibid, 3. 22 ISD(2024)“Monitoring Influence& Disinformation Campaigns in the Western Balkans”. 23 Constitution of the Republic of Kosovo. 24 Law No. 02/L-65 Civil Law Against Defamation and Insult. Article 14 and 15. 25 Law No. 04/L-137 on the Protection of Journalism Sources. 26 Law No. 06/L-085 on Protection of Whistleblowers. 13 Die Morina(2018)“Kosovo Minister and Spy Chief Sacked Over Turkish Arrests”. BIRN/ Balkan Insights(Last accessed: May 5, 2025). 32 Friedrich-Ebert-Stiftung e.V. 27 Law No. 06/L-081 on Access to Public Documents.

28 Law No. 06/L082 on Protection of Personal Data. 29 Ibid, 3. 30 Law No. 04/L-044 on the Independent Media Commission. Article 3(2). 51 Government of Republic of Kosovo(2022). Kosovo Security Strategy 2022- 2027. 52 Ibid, 30. Article 1-4. 53 Ibid. Art. 8 31 Ibid, 3. 32 Ibid, 2. 33 Ibid, 30. Article 11. 54 Independent Media Commission. Code of Ethics for the IMC. 55 Government of Republic of Kosovo(2023). Digital Agenda for Kosovo 2030. 34 Press Code of Kosovo, March 2005. 35 Ibid, 3. 36 Ibid. 37 Law No. 08/L-173 on Cyber Security. 38 Ibid, Article 12, and 21. 39 Ibid, 14. 40 For more information regarding the methodology, please refer to the methodology section. 41 Ibid, 37. Article 12-16 and 24. 42 Ibid. Article 9. 43 Ibid. Article 6. 44 Admnistrative Instruction No.04/2024 on Registry of Cyber Incidents. Article 4(5). 45 Ibid. Art. 4(2) 46 Ibid. Art 5(2) 47 Ibid. Art 5(1) and(3) 48 Administrative Instruction No. 05/2024 on Registry of Cyber Security Risks and Threats. Articles 1-7. 49 Ibid. Article 2 and 8. 50 Government of Republic of Kosovo(2023). National Cyber Security Strategy 2023- 2027 Labour shortages due to automation 33