What happens when an entity-level government procures a massive, centralized digital defense system before establishing independent oversight mechanisms?
In Republika Srpska—one of the two entities comprising Bosnia and Herzegovina—a newly formed technology agency recently embarked on a massive digital overhaul. The technical details, procurement paper trail, and geopolitical entanglements reveal a concerning precedent in critical infrastructure deployment and digital surveillance.
Below is an overview of an ongoing investigation into the Agency for Information and Communication Technologies (AIKT), its director Dražen Višnjić, and the high-stakes tech infrastructure currently being built on the European Union's external border.
1. The Architecture: Chinese Hardware, Russian Methods, Israeli Training
At the center of the overhaul is a 57 million BAM (approx. $31M USD) ten-year agreement signed with ELINC, a subsidiary affiliated with state-owned China Electronics Corporation (CEC).
While public officials initially attempted to keep the contract details quiet, technical briefings revealed the intended operational footprint:
- 15 interconnected nodes deployed across government administration, energy, healthcare, and financial sectors.
- Data centers based at the Faculty of Electrical Engineering in East Sarajevo, with primary external support routing through Kragujevac, Serbia.
- Operational doctrine: Hardware and software provided by Chinese vendors, operational oversight modeled on Russian state-run "control and supervision" mechanisms (publicly justified under the guise of child safety), and technical training sourced from Israeli contractors.
Director Višnjić publicly characterized the perimeter hardware as standard firewalls processing only "threat-related metadata."
However, from an information security and privacy perspective, metadata aggregation at this scale provides high-fidelity visibility into administrative communications, traffic patterns, and institutional behavior. When asked who would independently audit the system to guard against political surveillance or systemic abuse, Višnjić admitted that an oversight framework was still only under consideration—long after the $31M contract was already signed.
2. Institutional Ties to Foreign Influence Networks
AIKT’s responsibilities encompass information security, electronic government, and administrative data integrity. Yet, the agency's external partnerships raise immediate supply-chain and governance red flags.
In mid-2024, AIKT leadership formally confirmed planned collaboration with Mikhail Zvinchuk, the head of Rybar—a Kremlin-aligned media operation sanctioned by the European Union. While framed locally as a digital educational initiative and "media school" in partnership with regional universities, international threat-intelligence assessments have categorized Rybar as an Advanced Persistent Manipulator.
Entrusting core institutional credentials and public training to sanctioned foreign influence operatives represents an unprecedented operational compromise for an agency tasked with regional cybersecurity defense.
3. The Sanctions-Evasion Paper Trail
In August 2025, investigative reporting by CAPITAL.ba exposed a detailed technical questionnaire circulated directly from an official AIKT institutional email address.
The document mapped regional IT capacity while probing specific regulatory and financial workarounds:
- Identifying alternative banking channels outside the SWIFT/EU framework (specifically targeting Chinese and UAE financial institutions).
- Assessing capabilities for secondary sanctions resistance and non-EU routing through Serbia and Turkey.
- Examining options for state-level settlement using cryptocurrencies and stablecoins.
Although the agency publicly denied authoring the inquiry, no technical audit, server header log, or incident response report was ever produced to account for how official agency infrastructure was utilized to circulate sanctions-evasion inquiries.
4. Procurement Anomalies: 12 Minutes, 1 Million Marks
The agency's public procurement record mirrors its technical controversies.
In June 2024, AIKT published a 1 million BAM (~$550k USD) tender for twelve months of media production and advertising. Watchdog organizations quickly discovered that the expenditure was amended into the public procurement schedule just 12 minutes before the tender notice went live.
The technical requirements were unusually specific:
- Mandatory studio footprints across three distinct cities (Banja Luka, East Sarajevo, and Trebinje).
- Five full film crews, five dedicated editing suites, and specific drone configurations.
These demanding criteria directly mirrored the existing operational footprint of broadcasters linked to the governing political leadership, raising questions about whether state tech procurement is being leveraged to funnel public funds into aligned media ecosystems.
5. From Police Wiretapping to Entity-Level Cyber Chief
Director Dražen Višnjić’s trajectory is critical to understanding the system's architecture.
A military academy graduate, Višnjić previously led the high-tech crime unit within the entity's Interior Ministry, earning a formal commendation from the FBI Director in 2016 for international cybercrime cooperation.
However, his tenure was also marked by controversies:
- In 2011, investigative reports alleged unauthorized access modifications to state wiretapping equipment, reportedly expanding intercepted call playback beyond licensed thresholds.
- Following his departure from the police department, Višnjić transitioned directly into senior political advisory roles under Milorad Dodik before being appointed to head AIKT.
The progression illustrates a recurring systemic vulnerability: an official with deep technical expertise in lawful interception transitioning into political advisory roles, only to reemerge at the helm of an agency deploying expansive, unaudited digital infrastructure.
Read the Full Investigation
This case study highlights the growing friction between Western cybersecurity standards and the adoption of non-aligned surveillance technologies across the Western Balkans.
The complete long-form investigative reports, featuring exhaustive citations, procurement filings, and public records, are available on Medium:
- Full English Report: Dodik’s Digital Insider: The Secret Deals and Russian Ties of Dražen Višnjić
- Original Bosnian/Serbian Report: Dodikov digitalni insajder: Tajni poslovi i ruske veze Dražena Višnjića
Top comments (0)