×

Responsible State Behavior in Cyberspace – International Norms and the Role of the EU in Cyberdiplomacy

12.11.2024

Image for Responsible State Behavior in Cyberspace – International Norms and the Role of the EU in Cyberdiplomacy

The Western Balkans Cyber Capacity Centre (WB3C), in partnership with the Geneva Centre for Security Sector Governance (DCAF), will be hosting a three-day workshop titled "Responsible State Behavior in Cyberspace: International Norms and the Role of the EU in Cyberdiplomacy" from 12 to 14 November. This event brings together experts from across the region and the EU to explore critical aspects of cyberdiplomacy, focusing on international norms, the role of international law in cyberspace, and the European Union's efforts in fostering cyber cooperation.

Workshop Highlights:

  • Day 1: An in-depth exploration of the UN Framework on Responsible State Behavior in Cyberspace, including key components such as UN norms, international law, capacity building, and confidence-building measures.
  • Day 2: A detailed examination of the EU’s cyber ecosystem and its collaborative efforts with the Western Balkans to enhance regional cybersecurity cooperation.
  • Day 3: A hands-on tabletop exercise simulating international cooperation and national coordination in response to a cyber incident.

Why Cyberdiplomacy Matters

As cyber threats continue to evolve, the importance of diplomatic engagement to establish rules of behavior in cyberspace has never been more crucial. Cyberdiplomacy plays a key role in preventing cyber conflicts, promoting trust between nations and ensuring a stable and secure digital environment. The European Union, with its robust cyber ecosystem and diplomatic efforts, is at the forefront of shaping these international norms.

WB3C is actively contributing to these efforts by providing a platform for regional and international cooperation, training and capacity-building. By hosting workshops such as this, WB3C strengthens the ability of Western Balkans countries to engage in global cyberdiplomacy and contribute to the development of a secure and resilient cyberspace.


Image for Regional Conference on Foreign Information Manipulation and Interference and Disinformation
Upcoming
Regional Conference on Foreign Information Manipulation and Interference and Disinformation

Regional Conference on Foreign Information Manipulation and Interference (FIMI) and Disinformation

REGIONAL CONFERENCE ON FIMI AND DISINFORMATION

📅 6–7 May 2026
📍 Science and Technology Park, Podgorica (Conference Hall Unicorn, II floor)

Held under the Chatham House Rule, the conference explores how governments and societies can anticipate (prebunk), prevent, and respond (debunk) to malign information operations. Filming is allowed only in the opening session. 

Conference programme:

DAY 1 – Wednesday, 6 May 2026

 

🕘 09:00 – 09:30 | OPENING REMARKS

Objectives, Chatham House Rule, Expected Outcomes

Speakers:

  • Gilles Schwoerer, WB3C
  • Filip Ivanović, Deputy Prime Minister for Foreign and European Affairs, Montenegro
  • EU representative (TBC)

 

🕤 09:30 – 10:15 | KEYNOTE ADDRESS

FIMI as a National Security and Governance Challenge

How foreign influence exploits governance gaps — a historical reflection and how states respond without undermining freedoms.

Speaker: David Colon, PhD, Associate Professor, Sciences Po, France

 

🕥 10:15 – 11:15 | CASE STUDY

Anatomy of Disinformation Operations: Case Study and Lessons Learned

From storyline to impact: mapping actors, vectors, and decision-making pressure points.

Speaker: Ronan Mouchoux, Co-founder and CTO,  XRATOR, France

 

11:15 – 11:45 | NETWORKING BREAK

 

🕦 11:45 – 12:30 | PANEL 1

How FIMI Operations Actually Work

What distinguishes organic debate from coordinated manipulation? Evidence thresholds: what is enough to act as a government? How can early detection enable prebunking of emerging narratives before they take hold?

Speakers:

  • Lejla Turčilo, PhD, Full Professor at the Faculty of Political Science, University of Sarajevo
  • Miroslav Sazdovski, Senior Analyst, European Centre of Excellence for Countering Hybrid Threats, Finland

Moderator: Marko Banović, Digital Forensic Centre, Montenegro

 

🕧 12:30 – 13:15 | CASE STUDY

Disrupting a Covert Influence Operation: The REST Media / Rybar Case

A deep dive into a Russian state-affiliated influence operation, examining tactics, attribution, and links to the Western Balkans. The session will also explore how such networks can be exposed and disrupted, including legal and operational approaches to tackling FIMI infrastructure.

Speaker: Eto Buziashvili, Research Fellow at the Atlantic Council DFR Lab

 

🍽 13:15 – 14:15 | LUNCH BREAK

 

🕑 14:15 – 15:00 | PANEL 2

Election Integrity: Building Resilience

A whole-of-society approach to countering FIMI — institutions, platforms, media, and rapid response protocols for the final mile including prebunking of electoral manipulation narratives.

Speakers:

  • Milica Kovačević, President, Centre for Democratic Transition (CDT)
  • Zlatko Vujović, PhD, CEO of the European Network for Election Monitoring (ENEMO)
  • OSCE/ODIHR (TBC)

Moderator: Olivera Komar, PhD, Full Professor at the Faculty of Political Science, University of Montenegro

 

🕒 15:00 – 15:45 | PANEL 3

Response Options: What is Legitimate, Effective, Safe                                                                                                                                                                                                                                                                                                          Public communication under uncertainty, legal tools, cross-government coordination, institutional trust, media literacy.

 Speakers:

  • Thibaud Perrard (Mhack), THUCY, Cybersecurity expert and founder of Offensive Intelligence
  • Radica Zeković, Director General at the Directorate for Media, Ministry of Culture and Media, Montenegro
  • Jetmir Rajta, Specialist at the Sector for Statistics, Modelling and Indicator Analysis, National Authority for Cybersecurity of Albania

Moderator: Draško Jabučanin, Analyst, Digital Forensic Centre, Montenegro

 

🕓 15:45 – 16:00 | DAY 1 CLOSING

Reflection and Family Photo

 

DAY 2 – Thursday, 7 May 2026

🕘 09:00 – 09:15 | MORNING BRIEFING

Recap & Key Takeaways

 

🕤 09:15 – 10:15 | PANEL 4

Safeguarding the European Path: Building Resilience in the Western Balkans

Strengthening institutions, defending public trust, and reducing vulnerabilities to foreign interference.

Speakers:

  • Biljana Papović, State Secretary, Ministry for European Affairs of Montenegro
  • Natalie Pauwels, Head of the Strategic Coordination and Communication Unit, DG ENEST
  • Miroslav Sazdovski, Senior Analyst, European Centre of Excellence for Countering Hybrid Threats, Finland
  • Armela Krasniqi, Chairwoman of the Audiovisual Media Authority of Albania

Moderator: Nikoleta Đukanović, PhD, Associate Professor, Faculty for Humanistic Studies, University Donja Gorica

 

🕥 10:15 – 11:00 | PANEL 5

Judicial Response to FIMI and Disinformation
From digital evidence to prosecution of FIMI. Strengthening rule of law in the digital space.

Speakers:

  • Audrey Gerbaud, Cyber Department J3, Court of Paris
  • Arben Murtezić, PhD, Legal Counsel at the Office of Vice President of the Federation of Bosnia and Herzegovina
  • Marina Barbir, Judge at Higher Court in Belgrade
  • Ivan Jokić, Head of Cybercrime Unit, Police Administration of Montenegro (TBC)

Moderator: Ana Bukilić, Programme Manager at IDLO

 

11:00 – 11:30 | NETWORKING BREAK

 

🕦 11:30 – 12:30 | PANEL 6

Media on the Frontline of the Fight Against Disinformation    

How media organisations detect, verify, respond to, and build resilience against disinformation, including AI-generated content with a focus on debunking practices and audience trust.

Speakers:

  • Nicolas Goinard, Journalist, Ouest-France
  • Marko Banović, Analyst, Digital Forensic Centre, Montenegro
  • Adelina Hasani, Head of Research  at Kosovar Institute for Policy Research and Development (KIPRED)
  • Sunčica Bakić, Director, Agency for Audio-Visual Media of Montenegro

Moderator: Olivera Nikolić, PhD, Director of Montenegro Media Institute

 

🕧 12:30 – 14:00 | INTERACTIVE EXERCISE

War Game: Tabletop Simulation

Mixed country groups with assigned roles. Injects: manipulated video, leaked documents, coordinated hashtags, proxy media, diaspora channels, offline incidents. Participants will test both prebunking and debunking responses under time pressure.

Facilitators:

  • Ronan Mouchoux, Co-founder and CTO, XRATOR, France
  • Thibaud Perrard (Mhack), THUCY, Cybersecurity expert and founder of Offensive Intelligence
  • Nicolas Goinard, Journalist, Ouest-France 

 

🕑 14:00 – 14:15 | CLOSING REMARKS

Conference Wrap-up and Family Photo

 

🍽 14:15 – 15:15 | LUNCH  

✈️ DEPARTURE

 

CTI for Critical Infrastructure Training Completed

Last week at WB3C, we wrapped up a four-day training on Cyber Threat Intelligence (CTI) focused on the energy sector and government infrastructure, led by Ljuban Petrovic.

Working with SOC, CSIRT and CERT teams from across the region, the training reinforced a simple point: CTI only matters when it informs decisions. When it helps prioritise. When it changes how teams prepare and respond.
The sectoral focus proved its value. Energy infrastructure comes with its own risk landscape, and the discussions reflected that reality—specific, operational, and directly relevant.

We are continuing this work in September, building on what started here.
Because strengthening resilience is not a one-off effort. It is something that develops over time, through practice, exchange, and trust. 

What is Cyber Threat Intelligence (CTI) — and why does it matter?

Simply put, CTI is about turning information into insight, before a threat happens.

Not just collecting data on threats, but understanding who is behind them, how they operate, and what that means for your own systems.
Without that understanding, cybersecurity remains reactive. With it, organisations can anticipate, prioritise and respond with purpose.

Next week at WB3C, we will be running a four-day regional training on Cyber Threat Intelligence (CTI).
The training is designed for SOC, CSIRT and CERT teams, as well as IT professionals working within critical entities—specifically the energy sector. The choice is deliberate.

We are taking a sectoral approach to cybersecurity capacity building. Because threats are not abstract—they target specific systems, infrastructures and vulnerabilities. And the energy sector, as a backbone of economic and societal stability, requires tailored, operationally relevant skills that reflect its real risk landscape.
Over four days, participants will cover:
💡 understanding CTI in the context of critical infrastructure
💡 analysing threats and assessing their impact
💡 translating intelligence into actionable outputs

All week, we will be working closely with cybersecurity professionals from across the region’s energy sector—moving from concepts to application, and building capabilities that can directly support operational decision-making.
This is where CTI becomes operational. Protecting our energy infrastructure means protecting our economy, our security and our livelihood.

Image: Patrick https://lnkd.in/diYnZEgB


Copyright © WB3C

Disclaimer: Translations of the original content written in English into other languages are AI generated by Weglot.