How BiH can catch up in protecting critical infrastructure from Russian hybrid attacks

 

Bosnia and Herzegovina is part of a European space facing a rise in hybrid threats, including subversion and sabotage of critical infrastructure linked to Russian activity. Recent events – such as the exposure of a network of Russian instructors training provocateurs in Moldova and sabotage operations targeting the infrastructure of NATO countries – point to a growing threat.

Bosnia and Herzegovina is not isolated – in November 2024, a Russian citizen suspected of training Moldovans to cause unrest was arrested on its territory, and in early 2025, BiH extradited a Russian agent linked to sabotage against European countries to Poland. These incidents confirm the sophistication of foreign interference and the vulnerability of BiH’s strategic resources.

BiH’s key security challenges are interconnected and require urgent attention. Among the most prominent weaknesses are deep ethnic divisions that hinder a unified response to threats, the absence of a coherent national strategy for infrastructure protection, significant cyber gaps, and pervasive institutional corruption that undermines the implementation of security measures. These weaknesses, exacerbated by the country’s complex administrative structure and insufficient allocations to the security sector, make BiH vulnerable to hybrid operations.

 

Russia’s aggression against Ukraine in 2022 led to an intensification of Russian hybrid operations across Europe. Instead of an open conflict with NATO, Moscow is trying to destabilize European states through covert methods with the aim of undermining democratic processes, fomenting internal conflicts, and sabotaging critical infrastructure. An example of this is Moldova, where Russian actors secretly trained over a hundred people from Moldova and the Balkans to cause post-election unrest. As part of that operation, training camps in Serbia and Bosnia and Herzegovina linked to the Wagner Group were identified, where instructors were showing trainees how to make explosives and operate drones. The arrest of one of these Russian instructors on Bosnian territory, Aleksandr Bezrukavyju in Bosanska Krupa, directly confirmed Bosnia and Herzegovina's involvement in the broader picture of Russian destabilization efforts.

At the same time, sabotage of critical infrastructure has become more common in EU countries. Western officials warn that since the beginning of 2023 there has been a sharp increase in incidents such as burglaries, arson and attacks on energy facilities, railway networks and other key facilities. In 2023,

package bombs exploded in logistics centers in Britain, Germany and Poland. These events are suspected of being a rehearsal for a Russian plan to attack cargo planes bound for the United States. A campaign of vandalism of cars organized by Russian operatives with the aim of influencing elections was discovered in Germany. The perpetrators were young men from Serbia, Bosnia and Herzegovina and Germany, recruited and paid for via messaging apps. All of these activities are part of Russia’s arsenal of hybrid warfare with which the Kremlin seeks to sow distrust in institutions, cause economic disruption and divert the West’s attention from its support for Ukraine.

For Bosnia and Herzegovina, this broader strategy of destabilization is very relevant. Russia has long sought to maintain influence in the Balkans in order to prevent the region’s integration into the EU and NATO. BiH is particularly vulnerable due to its complex internal structure. Republika Srpska, as an entity with strong pro-Russian views, can serve as a training ground for Russian operations.

Moscow, using its connections in the RS, could turn BiH into the next target of subversion with a whole range of actions, from instigating political crises to covert sabotage targeting state institutions or infrastructure.

An extreme scenario would be Russian encouragement of the secessionist moves in the RS that the entity leadership is currently undertaking with a staged incident – e.g. an attack falsely presented as a terrorist act on a critical infrastructure facility in the RS – in order to create a pretext for escalation and the deployment of police forces on the entity border and the declaration of independence. The consequences of the absence of a strategy for the protection of critical infrastructure in BiH in such a case would be catastrophic. The competent authorities would be caught off guard, their response would be slow or non-existent, leading to long-term disruption of vital services, panic among the population and serious political instability.

Russia is also relying on digital platforms to expand its reach in its hybrid warfare. Apps like Telegram and similar ones have become new recruitment hubs for sabotage. Investigations have shown that anonymous Russian intermediaries on Telegram channels advertise the need for “European patriots” willing to carry out sabotage in exchange for generous rewards. In one such case, journalists uncovered an ad offering up to $10,000 in cryptocurrency for tasks such as spying on military bases, setting vehicles on fire, or even liquidating a target. The first calls are often answered by young men with criminal backgrounds or financial problems, motivated by a quick profit. This recruitment model means that Russia can mobilize networks of saboteurs ad hoc, reducing the clues that would point to direct Moscow’s involvement.

Bosnia and Herzegovina, including at the Federation of Bosnia and Herzegovina and cantonal levels, does not have a comprehensive plan or law to protect key systems, which increases its vulnerability. Unlike many European countries that improved protection mechanisms after 2022, Bosnia and Herzegovina still has not defined what is considered critical infrastructure and how to protect it.

Despite its awareness of the threat, BiH faces a number of internal challenges that make it difficult to establish an effective defense against Russian hybrid threats. The complicated constitutional structure means that there is no unified security policy. The authorities of the Republika Srpska entity often block or slow down state initiatives that they perceive as a threat to entity autonomy or opposition to Russia. RS political leaders, such as entity President Milorad Dodik and National Assembly Speaker Nenad Stevandić, openly cultivate ties with Moscow and often deny or minimize the Russian threat, calling it Western propaganda.

 

As a result, BiH lacks a unified strategy. While political actors based in Sarajevo recognize the need to strengthen the protection of critical infrastructure and security in general, Banja Luka disputes this. The result is paralysis on key decisions, such as the adoption of a state-level law on critical infrastructure or a new security strategy, which remain mired in political disagreements. Internal disunity is precisely what a hybrid attacker like Russia can exploit. Either by supporting one side, Republika Srpska, to defy the other, the Federation, or by provoking incidents that the state leadership will not be able to address unanimously. Theoretically, the RS authorities could refuse assistance from state institutions or NATO partners after an incident against critical infrastructure, which would lead to a chaotic situation. Even actual sabotage by a third party could be used for political wrangling within BiH instead of a coordinated response. This would multiply the consequences of a harmful event.

Institutional weaknesses and the lack of a strategic framework pose another significant challenge to developing Bosnia and Herzegovina’s resilience to potential threats to critical infrastructure.

BiH’s security institutions are fragmented along entity lines and often staffed by political expediency, which undermines professionalism. The OSA has been suffering from internal pressures for years. If the OSA is not functioning optimally, early detection of Russian covert operations may fail. SIPA and police agencies have limited capacities to proactively monitor sophisticated hybrid threats. Their investigations mostly respond post festum. Outdated or inadequate laws are also a problem. BiH and entity criminal codes criminalize terrorism, espionage, and sabotage, but evidentiary procedures can be slow and complex. There is no explicit category of “hybrid action” or “foreign malign influence” in the law that would facilitate the sanctioning of domestic individuals who engage in subversion on behalf of a foreign power.

BiH’s greatest weakness is the lack of a unified, proactive front against a threat that is multidimensional. Until domestic political actors reach a consensus that the Russian or other hybrid threat is real and serious, and until institutions and plans capable of acting swiftly and in a coordinated manner are built, BiH will remain vulnerable. This vulnerability does not necessarily mean that an attack is imminent, but it does mean that its consequences would be significantly more severe. Overcoming these challenges is essential for the recommendations to have their full effect.

 

Here are the recommendations that BiH can leverage:

 

 

Time is of the essence. BiH no longer has the luxury of delaying preparations. Every month without a strategy, law, and training increases the space for those who would exploit loopholes in the system. In contrast, timely action before a serious incident occurs can thwart the plans of those who lurk.