Reacting to media reports about the deal, in July 2024 the US embassy in Sarajevo said the lack of clarity “raises serious concerns about the services provided, the risks for RS residents, and why the RS government chose a company with ties to China’s military-industrial complex over more reputable alternatives”.
With a highly-decentralised system of ethnic power-sharing, Bosnia lacks a unified legal architecture to vet foreign technology for national security risks.
The state-level Law on Personal Data Protection provides some consumer protections, but no requirement for risk assessment of foreign digital systems.
Meanwhile, the Law on Public Procurement on the state level and in both entities allows secret contracts in the security sector.
Oversight bodies are either politically compromised or lack the technical capability to scrutinise such complex software; in Republika Srpska, for example, the two companies able to run such checks are subject to US sanctions due to their connections to the Dodik family.
The state-level Intelligence-Security Agency, OSA, can only intervene if a clear national threat is identified, while the Personal Data Protection Agency does not have the capacity to audit foreign surveillance tools.
“There is no requirement to check for embedded surveillance functions, nor are there standards to evaluate the software’s compliance with local data laws,” Kulenovic told BIRN.
There is no hard evidence as yet that the security software is anything more than that, but that has not stopped many in Republika Srpska from speculating about where it might lead.
A cyber security expert, who spoke on condition of anonymity, said: “They are mixing genuine cybersecurity needs with authoritarian tools of control; this conflation is deliberate and dangerous.”
“Once you build a surveillance system, it becomes part of the institutional fabric,” he said. “Future governments may use it in ways that current leaders never imagined, or never admitted.”
Chinese digital infrastructure can be found elsewhere in the Balkans.
In Serbia, authorities have deployed Huawei-built facial recognition cameras in Belgrade, while Montenegro and North Macedonia have experimented with similar tools.
“Southeast Europe is becoming a laboratory for digital authoritarianism,” said Vuk Vuksanovic of the Belgrade Centre for Security Policy. “China is exporting its surveillance playbook, and local elites are eager to buy in.”
