Executive Summary
- BLUF: The strategic risk lies not in individual cameras, but in connecting sensors, facial recognition, police databases, communications networks and urban command platforms.
- Serbia is the Western Balkan state with the clearest documented exposure; elsewhere, primary evidence establishes regulatory and cybersecurity vulnerabilities more conclusively than Chinese operational control.
- Hardware installation, technical capability, operational activation and systematic use are distinct evidentiary thresholds.
- By 2031, the most probable outcome is hybrid digital sovereignty: legacy Chinese-origin equipment combined with tighter European controls and persistent maintenance dependencies.
- The most credible coercive mechanism is vendor lock-in, not an unproven continuous transfer of Balkan biometric data to China.
- The EU AI Act will turn biometric surveillance into an accession-compliance issue.
- The highest-risk configuration combines opaque procurement, interoperable identity databases, weak regulators, undocumented software functions and political instability.
- Europe requires a regional audit of the complete surveillance stack, not merely an inventory of camera manufacturers.
Europe’s next sovereignty test may not begin at a border, port or energy terminal. It may begin inside a police control room. Across the Western Balkans, Chinese-origin cameras, communications equipment and urban-management platforms are entering institutional environments where data-protection enforcement, cybersecurity capacity and procurement transparency remain uneven. Serbia is the most advanced and documented case: Huawei publicly described a comprehensive Safe City project for Belgrade with potential national expansion, while European institutions continue to question the legal basis and proportionality of biometric surveillance. The decisive issue is no longer who manufactured the camera. It is who controls the software, cryptographic keys, identity databases, maintenance channels and ability to search the past. A surveillance system becomes geopolitical infrastructure when the state cannot independently audit it, govern it or replace its supplier.
The Serbian Laboratory
A Huawei corporate publication stated in January 2019 that Serbia’s Ministry of Interior wanted to develop a “leading Safe City” covering Belgrade and, eventually, the entire country, and that Huawei had proposed a comprehensive solution. The formulation matters: a comprehensive platform is not a collection of isolated cameras. It can encompass optical sensors, transmission networks, storage, command software, analytics, technical support and integration with police systems. Huawei Enterprise 01/2019 – Huawei – January 2019.
What became operational remains less transparent than what was proposed. In its report of 8 November 2023, the European Commission recorded that, after negative opinions from Serbia’s Commissioner for Information of Public Importance and Personal Data Protection concerning the Ministry’s street-surveillance impact assessment, the Ministry said it had suspended biometric-data processing until a legal basis was established. The Commission added that the necessity and proportionality of public-space video surveillance and facial-recognition processing still required assessment. Serbia 2023 Report – European Commission – November 2023.
The uncertainty did not disappear. On 30 October 2024, the Commission stated that a legal basis had still not been developed and that it had to be verified whether Serbia had processed personal data through facial-recognition software. Serbia Report 2024 – European Commission – October 2024. The 4 November 2025 assessment found Serbia’s personal-data framework only mostly aligned with the GDPR and Law Enforcement Directive, difficult to implement and insufficient in areas including penalties. It also noted that the broader harmonisation of sectoral legislation remained significantly delayed. Serbia Report 2025 – European Commission – November 2025.
These findings do not prove that China receives Serbian biometric data. They establish something institutionally serious in its own right: the capabilities, legal authority and actual use of a strategic public-security system have not been sufficiently transparent to permit an uncontested sovereignty assessment.
Beyond the Camera
The strategic asset is the stack. At street level, networked cameras capture video, faces, licence plates and movement. Embedded firmware determines how the device authenticates, stores information and communicates. Municipal fibre, police networks or mobile connections transport streams to a video-management system. Analytics servers can detect faces, extract biometric templates, recognise plates, follow persons between cameras and index archived footage. The political transformation occurs when this platform connects to reference databases containing identity photographs, police records, vehicle ownership or border movements.
This distinction separates observation from identification. A camera records an anonymous person. A biometric engine converts the face into a numerical template. A reference gallery assigns a probable identity. Cross-camera tracking reconstructs movement. Database fusion adds vehicles, associations and earlier encounters. The final command interface turns these correlations into police action.
The same architecture can support legitimate investigations into violent crime or missing persons. It can also reconstruct participation in a peaceful demonstration long after the event. Deleting raw video may provide little protection if templates, plate records, alerts or movement metadata survive in separate databases. Sovereignty therefore depends on data lineage: the state must know what was collected, which derived objects were created, where they were replicated, how long they remain searchable and which accounts accessed them.
The Protest Threshold
Facial recognition changes the balance between public order and political freedom because it can remove practical anonymity from assembly. The European Court of Human Rights addressed that boundary in Glukhin v. Russia, concerning the identification and arrest of a peaceful demonstrator through facial recognition. The Court characterised the measure as highly intrusive and required a particularly strong justification for its necessity in a democratic society. Case of Glukhin v. Russia – European Court of Human Rights – July 2023.
The Serbian political environment makes this question immediate. Mass protests began after the collapse of the Novi Sad railway-station canopy on 1 November 2024, which killed 16 people, and developed into a wider mobilisation demanding accountability, transparency and institutional reform. In 2025, UN experts reported allegations that peaceful student demonstrators faced intimidation, attacks and surveillance. These were allegations requiring investigation, not judicial findings concerning any specific Safe City platform. Serbia Must Halt Crackdown on Student Movement – Office of the UN High Commissioner for Human Rights – August 2025.
In 2026, the Parliamentary Assembly of the Council of Europe expressed concern over revelations involving the surveillance of Serbian journalists and activists and called for effective investigations and accountability. Progress of the Assembly’s Monitoring Procedure, Resolution 2635 – Parliamentary Assembly of the Council of Europe – June 2026.
No admissible primary evidence establishes that Huawei’s platform generated those alleged surveillance activities. That attribution must not be invented. The strategic connection is nevertheless unavoidable: an unsettled political environment is interacting with a technically powerful surveillance architecture whose precise functions and operational record remain incompletely verified.
The Hidden Control Layer
The most consequential access may not belong to the officer watching a control-room screen. It may reside in firmware-signing systems, diagnostic accounts, licence servers, virtual private networks, software-update channels or databases administered by an integrator. Surveillance platforms require continuous maintenance: vulnerability patches, certificate renewal, storage replacement, database optimisation, algorithm updates and emergency recovery. Each intervention may require privileges exceeding those of ordinary police operators.
A sovereign system should allow the national authority to approve every remote session, identify every technician, record every command, prevent unauthorised export and revoke access immediately. It should possess its own encryption keys, recovery material, configuration backups and ability to continue operating without the original supplier. If only the vendor can restore the platform, update essential components or convert proprietary archives, ownership becomes nominal.
Huawei’s audited 2025 reporting states that the group assessed cybersecurity and privacy risks across more than 4,000 suppliers and held more than 890 security and privacy certifications. Huawei 2025 Annual Report – Huawei – March 2026. These figures document substantial corporate security governance; they cannot certify the configuration of an individual Balkan police system. Corporate assurance and deployment-level verification are different evidentiary layers.
The appropriate test is vendor-neutral: can an independent authority inventory every component, identify every privileged account, inspect update paths, reproduce access logs and operate the system after supplier disconnection? If the answer is no, the state has a sovereignty deficit regardless of the manufacturer’s nationality.
Europe Changes the Rules
The regulatory environment has now shifted decisively. Regulation EU 2024/1689, published in the Official Journal on 12 July 2024, defines both real-time and post-event remote biometric identification. It treats real-time law-enforcement identification in publicly accessible spaces as particularly intrusive and confines it to narrow circumstances with specific safeguards and authorisation requirements. Artificial Intelligence Act – European Parliament and Council – July 2024.
Most of the AI Act became applicable on 2 August 2026, although parts had already applied from February and August 2025. On 24 July 2026, the EU also established specific classification codes for biometric AI systems, including remote biometric identification. This brings such systems more clearly into Europe’s regulatory and market-surveillance machinery. Commission Implementing Regulation on AI Classification Codes – European Commission – July 2026.
The convergence is not limited to artificial intelligence. On 13 February 2026, the NIS Cooperation Group—bringing together EU Member States, the European Commission and ENISA—adopted an ICT Supply Chain Security Toolbox. It recommends an all-hazards assessment of critical suppliers, multi-vendor strategies and measures to overcome dependence on high-risk providers. Toolbox to Improve ICT Supply Chain Security – European Commission – February 2026.
For EU candidates, surveillance systems are consequently becoming an accession issue. Formal amendments to national law will not be enough. Brussels will increasingly need proof of deployed functions, database connections, logging, human oversight, support arrangements and supplier substitutability.
The Balkan Vulnerability
Serbia is the clearest case, but the regional vulnerability is broader. The Commission’s 2025 reports found that Montenegro’s personal-data law remained unaligned with the EU acquis; North Macedonia continued to show low awareness of data protection and insufficient IT protection of personal information in state bodies; and Albania’s Total Information Management System retained security and data-protection vulnerabilities requiring urgent action.
These findings do not prove the presence of Chinese biometric platforms in those countries. They identify the institutional conditions under which any sophisticated foreign surveillance system could expand without adequate lifecycle control. Weak regulation increases the danger of function creep; fragmented cybersecurity obscures remote access; limited technical staffing shifts knowledge toward vendors and contractors; opaque procurement conceals the cost of exit.
The Western Balkans should therefore not be described as a single Chinese surveillance zone. It is a differentiated market of exposure. Serbia combines documented Safe City ambition with unresolved biometric governance. Other countries present varying levels of regulatory susceptibility, technical dependence and evidence gaps. Precision matters: exaggeration would allow governments and suppliers to dismiss valid concerns as geopolitical propaganda.
The Leverage Mechanism
Chinese geopolitical leverage does not require permanent remote access to Balkan police databases. It can arise from dependence itself. A supplier controlling firmware, proprietary interfaces, analytics licences, maintenance expertise or archive formats can become expensive and disruptive to replace. Governments anticipating those costs may delay exclusions, seek exemptions or soften regulatory choices even without an explicit threat from Beijing.
That condition is potential leverage, not proof of coercion. Actual geopolitical pressure would require a demonstrable connection between a political demand and a threatened or executed consequence involving support, finance, access, disclosure or system continuity. No qualifying primary evidence presently establishes such a case in the Western Balkans.
The more probable risk is structural lock-in. A low initial procurement price can generate long-term dependence through licence renewals, specialist support, incompatible formats and bundled upgrades. Replacing cameras may then require replacing servers, databases, management software and operator training simultaneously. The security system becomes a balance-sheet liability and a diplomatic constraint.
Europe’s answer should not be an indiscriminate removal campaign based solely on origin. It should impose measurable sovereignty: national control of cryptographic keys, complete software and hardware inventories, immutable regulator-owned logs, open interfaces, named maintenance accounts, independent biometric testing and contractually enforceable data portability.
The Five-Year Divide
Between 2026 and 2031, three trajectories are possible. The first is sovereign convergence: governments separate biometric galleries from camera networks, restrict cross-database queries, control all privileged access and demonstrate that systems can operate without their original supplier. The second—and most probable—is regulated hybridisation: legacy Chinese-origin equipment remains, live identification is restricted, retrospective capabilities survive and European controls improve unevenly. The third is political consolidation: biometric, vehicle and identity data become integrated during a period of domestic instability, creating an infrastructure capable of mapping dissent.
The decisive warning will not be another camera installation. It will be the convergence of four conditions: extensive biometric capability, integration with authoritative identity databases, weak independent auditing and elevated political stress. At that point, surveillance ceases to be merely a policing instrument and becomes a system of political power.
The cost of inaction is not simply lost privacy. It is the creation of a sovereign function that the state cannot fully explain, independently operate or economically replace. In the Western Balkans, Europe’s enlargement policy will be credible only if it can inspect the code behind the cameras as rigorously as it examines the laws written in parliament.
Navigational Index
- Architecture of the Transfer — Hardware, software, data, maintenance, system integration and supplier dependence.
- Sovereignty and Political Pressure — Biometrics, protest monitoring, policing, intelligence access and geopolitical leverage.
- Five-Year Outlook — Competing hypotheses, Bayesian indicators, Monte Carlo scenarios and early-warning thresholds.
Master Abstract
The expression “silent transfer” describes a strategically credible process, but it must be applied with strict evidentiary discipline. The verified primary sources do not establish that every Western Balkan government operates a Chinese facial-recognition system, that all installed Chinese cameras have biometric functions enabled, or that Beijing receives Balkan biometric data. They do establish a regional risk environment in which surveillance infrastructure, incomplete data-protection regimes, uneven regulatory capacity and increasingly integrated public-security systems can converge without sufficient public accountability. Serbia is the central case. The European Commission finds that its personal-data legislation remains only mostly aligned with the GDPR and Law Enforcement Directive, contains inadequate penalty provisions, is difficult to implement and has not been harmonised with numerous sectoral laws. It further records earlier negative opinions by the Serbian Commissioner for Information of Public Importance and Personal Data Protection regarding Ministry of Interior initiatives, while noting that Serbia adopted its new artificial-intelligence strategy in January 2025 without the legally required analysis of the preceding strategy. Serbia Report 2025 – European Commission – November 2025 — verified official document. These findings do not prove foreign access to Serbian surveillance data. They demonstrate an accountability gap between technological capability, governing legislation and independent verification. The appropriate unit of analysis is therefore the complete surveillance stack: optical sensors, embedded firmware, communications networks, command centres, storage systems, biometric engines, reference databases, operator interfaces, administrative privileges, software updates and maintenance contracts. Each layer creates a different dependency. Cameras can be replaced, but proprietary formats, application programming interfaces, trained models, database schemas, operator expertise and long-term service agreements generate cumulative exit costs. Digital sovereignty consequently requires more than storing data inside national territory. It requires demonstrable control over encryption keys, privileged accounts, update channels, data portability, audit logs, subcontractors, source-code inspection rights and the ability to operate and maintain the system without its original supplier.
The broader Western Balkan picture should be described as a corridor of differentiated vulnerability rather than as a uniform Chinese surveillance bloc. In Montenegro, the European Commission reports that personal-data legislation remains unaligned with the EU acquis and that essential legal and institutional shortcomings persist. Montenegro Report 2025 – European Commission – November 2025 — verified official document. In North Macedonia, the Commission identifies low awareness of data-protection obligations and insufficient information-technology safeguards for personal information across state administrative bodies. North Macedonia Report 2025 – European Commission – November 2025 — verified official document. In Albania, the Total Information Management System continues to suffer from security and data-protection vulnerabilities requiring urgent remediation. Albania Report 2025 – European Commission – November 2025 — verified official document. Bosnia and Herzegovina represents a different exposure pathway: institutional fragmentation. The Commission documented the absence of a comprehensive countrywide cybersecurity strategy, a national single point of contact and a coordinated network of computer-security incident-response teams, while explicitly urging implementation of the EU 5G Cybersecurity Toolbox through supplier-risk assessment and restrictions or exclusions concerning high-risk vendors. Bosnia and Herzegovina Report 2024 – European Commission – October 2024 — verified official document. These official findings do not prove that Chinese companies control those states’ security systems. They reveal conditions under which sophisticated platforms could be acquired, expanded or updated without consistent lifecycle controls. The European Commission has separately concluded, in the telecommunications context, that Huawei and ZTE represent materially higher risks than other 5G suppliers. Implementation of the 5G Cybersecurity Toolbox – European Commission – June 2023 — verified official communication. Automatically transferring that determination from 5G infrastructure to every urban-surveillance product would be analytically invalid. The underlying security principle is nevertheless transferable: supplier ownership, governing jurisdiction, update mechanisms, hidden dependencies, coercibility and the possibility of interference must be evaluated alongside price and technical performance.
The most consequential vulnerability is architectural convergence. A conventional closed-circuit television system records images for retrospective inspection; an integrated Safe City platform can transform those images into searchable identity events by combining facial templates, vehicle-registration data, mobile-device metadata, location history, police records and algorithmic alerts. Political power expands not only when facial recognition is continuously active, but when the state acquires the latent ability to activate it during protests, electoral crises, border emergencies or episodes of civil disorder. The critical distinction is between collection, identification, inference and intervention. Collection captures video; identification associates a person with a reference template; inference assigns behavioural meaning; intervention produces detention, questioning, movement restrictions or inclusion in an investigative file. A government may publicly describe the system as traffic management while retaining modules capable of identity resolution. Conversely, the mere presence of technically compatible cameras does not prove that those modules have been licensed, connected to an identity database or used. A forensic assessment must therefore obtain camera inventories, firmware versions, server configurations, module licences, network diagrams, data-protection impact assessments, database schemas, operator manuals, procurement annexes and access logs. The “shadow” dimension is contractual. Financing arrangements, warranty renewals, proprietary maintenance tools, cloud dashboards, remote-support accounts and dependence on foreign-trained integrators can produce leverage without any dramatic intelligence operation. The supplier may influence upgrade timing, security-patch availability, interoperability or replacement costs; the purchasing government may consequently avoid political decisions that threaten the commercial relationship. This is structural coercibility, not proof of executed coercion. Its measurement requires four variables: technical substitutability, time required to migrate, financial exit cost and availability of trusted domestic or European operators. Where all four are adverse, the platform becomes a strategic asset embedded inside sovereign policing capacity.
The legal collision will intensify between 2026 and 2031. The EU AI Act characterises real-time remote biometric identification in publicly accessible spaces as particularly intrusive because it may affect the private lives of large populations, create a perception of constant surveillance and indirectly discourage freedom of assembly. It restricts law-enforcement use to specified exceptional circumstances accompanied by necessity, proportionality and authorisation safeguards. Regulation (EU) 2024/1689 – European Parliament and Council – July 2024 — verified official text. Candidate countries will consequently face a widening compliance gap if they possess surveillance functions that cannot be inventoried, independently tested or reconciled with European rules. Formal statutory alignment will be insufficient. Operational compliance will require documented legal purposes, deletion schedules, watchlist-quality controls, immutable access records, human review, judicial authorisation where applicable, incident-reporting procedures and remedies for individuals who are falsely identified. The accession process could therefore turn surveillance infrastructure into stranded technology: equipment may remain physically functional while its most intrusive modules become legally unusable. This creates three possible government responses. The first is genuine convergence through audits, database separation and deactivation of prohibited functions. The second is cosmetic alignment, in which legislation changes while operational practices remain opaque. The third is geopolitical hedging, under which governments retain Chinese-origin systems as alternatives to EU-regulated platforms. The decisive variable will be verification. European institutions can evaluate legislation, but technical sovereignty demands inspection of deployed architecture. Without mandatory asset registers, procurement disclosure, independent penetration testing and verification of remote-administration pathways, neither accession negotiators nor domestic regulators can determine whether a system is compliant, dormant, partially active or capable of rapid reactivation.
The Analysis of Competing Hypotheses requires five explanations to remain simultaneously active. H₁ is ordinary public-security modernisation: governments purchase affordable technology to improve policing, traffic control and emergency response, with geopolitics playing only a secondary role. H₂ is cumulative commercial dependency: fragmented purchasing decisions create proprietary lock-in without a coordinated Chinese state strategy. H₃ is deliberate adoption of a political-control model: governing elites value the capacity to identify demonstrators, reconstruct networks and deter mobilisation. H₄ is geopolitical leverage: maintenance, financing, integration or access dependencies create potential Chinese pressure over future foreign-policy choices. H₅ is European regulatory convergence: accession conditionality, cybersecurity controls and the AI Act progressively constrain or replace the highest-risk capabilities. An initial analytical prior assigns 30% to H₁, 27% to H₂, 20% to H₃, 13% to H₄ and 10% to H₅. These figures are structured judgements, not observed frequencies. Evidence of incomplete regulation raises H₂ and creates permissive conditions for H₃, but cannot independently establish H₄. Verified remote-access mechanisms, undisclosed foreign administrator accounts, systematic data exfiltration, politically conditioned maintenance or coordinated diplomatic pressure would be required to update H₄ sharply upward. Conversely, published inventories, independent code audits, separation of biometric databases and enforceable migration plans would update H₅ upward. The strongest discriminator between H₁ and H₃ is operational use during political mobilisation: retrospective use against specific serious crimes supports H₁ more strongly, whereas systematic identification of peaceful participants, network reconstruction and administrative retaliation would strongly favour H₃. Between H₂ and H₄, the discriminator is intentionality: dependency supports H₂; documented exploitation of that dependency supports H₄. This framework prevents the common analytical error of converting technological origin into proof of political control.
The five-year outlook is dominated by path dependence. During 2026–2027, governments are likely to inventory only part of their deployed architecture while the European Commission increases scrutiny of personal-data enforcement, high-risk artificial intelligence and ICT supply-chain security. During 2027–2028, the principal battleground will shift from camera procurement toward analytics, data fusion and interoperability: systems will become more consequential if connected to population registers, vehicle databases, border systems or mobile command platforms. During 2028–2029, replacement costs will become visible. Governments that failed to negotiate data portability, open interfaces and source-code escrow may discover that excluding a supplier requires simultaneous replacement of servers, storage, operator software and maintenance expertise. During 2029–2030, political instability could produce the first decisive operational test: whether systems designed for crime prevention are used to map protest participation or political networks. By 2030–2031, the region may divide into three groups: EU-convergent states with audited and functionally restricted systems; hybrid states retaining legacy equipment under partial safeguards; and sovereignty-deficit states in which authorities cannot independently verify, maintain or replace their surveillance architecture. The baseline estimate favours the hybrid group. Full Chinese operational dominance is less probable than continued technical dependency, while complete European replacement is constrained by costs, administrative capacity and installed-system inertia. The highest-impact adverse scenario combines political crisis, emergency legal powers, interoperable databases and a platform whose functions are neither publicly inventoried nor independently auditable. The principal mitigations are compulsory technical registries, disclosure of beneficial ownership and subcontractors, offline operation for sensitive databases, national control of encryption keys, multi-vendor interoperability, strict retention limits, independent biometric testing and automatic suspension of systems whose functions cannot be verified.
Digital Sovereignty Stress Lab
Scenario Drivers
Five-Year Risk State
Bayesian ACH Posterior
Architecture of the Transfer: China’s Balkan Surveillance Stack
The transfer is a system, not a shipment
The transfer of Chinese-origin urban-surveillance capability into the Western Balkans must be analysed as the installation of a multilayer operational system rather than as the sale of cameras. The most important primary-source acknowledgement comes from Huawei itself: a 2019 corporate publication stated that the Serbian Ministry of Interior intended to develop a Safe City covering Belgrade and eventually the entire country, and that Huawei had proposed a “comprehensive solution” for those requirements. Huawei Enterprise 01/2019 – Huawei – January 2019 — verified corporate publication. That wording is architecturally significant. A comprehensive solution normally spans sensors, transmission networks, storage, computing, command software, integration services, technical support and operational training; it is fundamentally different from a procurement limited to standalone optical devices. The evidentiary record nevertheless requires strict boundaries: the corporate statement establishes the ambition and proposed solution, but it does not by itself establish which modules were ultimately delivered, how many devices became operational, whether facial-recognition licences were activated, which databases were connected or whether any foreign entity obtained access to Serbian data. The European Commission subsequently documented that, after negative opinions concerning the Ministry’s impact assessment for street video surveillance, the Ministry said it had suspended biometric-data processing until an adequate legal basis was created; the Commission also concluded that the proportionality and necessity of public-space surveillance and facial-recognition processing still required assessment. Serbia 2023 Report – European Commission – November 2023 — verified official document. The two primary sources therefore establish both capability ambition and regulatory friction, but not continuous biometric operation. This distinction governs the entire analysis: delivery, installation, configuration, activation, database connection, operator use and political employment represent seven separate evidentiary thresholds.
| Evidentiary level | What must be demonstrated | Minimum technical evidence | What cannot yet be inferred |
|---|---|---|---|
| E₁ — Procurement | Hardware or services were contracted | Tender, contract, invoice, acceptance record | Installation or functionality |
| E₂ — Deployment | Devices and servers were physically installed | Asset register, serial numbers, geolocated inspection | Network connection |
| E₃ — Integration | Components exchange data | Network diagram, API logs, protocol captures | Biometric activation |
| E₄ — Capability | Software can perform biometric or behavioural analysis | Licence file, enabled module, model package | Routine operational use |
| E₅ — Activation | Capability was technically enabled | Configuration export, service status, compute logs | Lawful or systematic use |
| E₆ — Operational use | Operators queried or acted on outputs | Audit logs, case records, watchlist queries | Political targeting |
| E₇ — Coercive use | System supported repression or foreign pressure | Correlated orders, target files, access evidence | Broader conduct beyond evidence |
Layered technical anatomy
The surveillance stack begins at the optical edge but derives its strategic value from the layers above it. A fixed or pan-tilt-zoom IP camera may contain a complementary metal-oxide-semiconductor image sensor, digital signal processor, system-on-chip, local memory, network interface, embedded operating system and cryptographic material. Higher-capability devices may execute edge analytics that detect faces, bodies, vehicles, licence plates, movement across virtual boundaries or crowd-density changes before transmitting metadata or selected images. This reduces bandwidth and shifts sensitive processing from the data centre into thousands of distributed endpoints, enlarging the attack surface and complicating forensic inspection. The transport layer may use municipal fibre, dedicated police networks, commercial mobile service, microwave links or combinations of these. Above it, a video-management system controls streams, user permissions, device health, recording schedules and evidence export, while a video-content-management or analytics layer transforms pixels into indexed objects. The integration layer then connects video events with police case systems, identity registers, vehicle records, border databases or emergency-dispatch applications. Chinese domestic standards demonstrate how mature this integration concept has become inside China: Shenzhen’s official technical specification for public-security video surveillance covers front-end device access, dedicated video networks, network-security architecture, interconnected sharing platforms and the integration of surveillance information resources. Technical Specification for Construction, Networking and Sharing of Public-Security Video Surveillance, DB4403/T 234—2022 – Shenzhen Municipal Government – May 2022 — verified Chinese government document. This Chinese standard does not prove that the same configuration was exported to Serbia. It provides an authoritative architectural reference showing that “video surveillance” in the Chinese technical ecosystem can mean a networked, shared and centrally governed information infrastructure, not isolated cameras. Huawei’s own 2018 description of a joint portrait-big-data solution combined its video cloud with third-party facial-recognition algorithms to organise urban governance around persons as data subjects. Huawei and Yitu Jointly Release Portrait Big-Data Solution – Huawei – March 2018 — verified corporate source. Again, this establishes design capability, not Balkan deployment.
Multi-Layered Surveillance & Data Fusion Pipeline
Optical Edge
Embedded Processing
Transport Network
Platform Infrastructure
Analytics Engine
Data Fusion Layer
Operational Decision
Lifecycle Control
Hardware sovereignty and hidden component dependence
Hardware sovereignty cannot be established by counting visible camera housings or identifying their brand. A single labelled device may contain processors, memory, radio modules, cryptographic libraries, bootloaders and software components produced by several upstream suppliers, while the installation may depend on third-party switches, storage arrays, graphical-processing servers and synchronisation services. The critical question is whether the purchasing authority can establish an authoritative software and hardware bill of materials, validate component provenance, disable unnecessary interfaces, rotate credentials, verify firmware signatures and identify every external destination contacted by the device. NIST identifies seven core capabilities relevant to an IoT security baseline: device identification, device configuration, data protection, logical access to interfaces, software updating, cybersecurity-state awareness and device security. It also stresses that manufacturer-provided documentation and lifecycle support are non-technical capabilities essential to operational security. IoT Device Cybersecurity Guidance for the Federal Government: IoT Device Cybersecurity Requirement Catalog, NIST SP 800-213A – National Institute of Standards and Technology – November 2021 — verified United States government publication. Applied to a Balkan Safe City, these requirements mean that every camera should possess a unique inventory identity; configuration must be exportable and reviewable; stored and transmitted data must be cryptographically protected; remote interfaces must require strong authentication; updates must be signed, controlled and reversible; and the operator must receive usable security-state telemetry. A system fails the sovereignty test if the national operator cannot independently verify one or more of those properties. Dependence is particularly acute when the supplier alone holds firmware-signing authority, debugging utilities or recovery images. Even without malicious activity, the end of vendor support can convert thousands of functioning cameras into accumulating liabilities because newly discovered vulnerabilities remain unpatched. The danger is therefore not reducible to a hypothetical concealed backdoor. Ordinary lifecycle asymmetry—where the supplier knows the architecture, controls update material and retains specialist knowledge while the government possesses only operator-level access—can create durable strategic leverage.
| Hardware control point | Sovereignty requirement | Failure signature | Intelligence significance |
|---|---|---|---|
| Device identity | Unique serial, certificate and owner mapping | Duplicate identities or undocumented devices | Rogue endpoint can enter trusted network |
| Secure boot | Cryptographic verification of authorised firmware | Unsigned or unverifiable boot chain | Persistent modification can survive reboot |
| Debug interfaces | JTAG, UART and service ports disabled or controlled | Accessible maintenance console | Physical access may yield privileged control |
| Credential storage | Hardware-backed protected keys | Shared keys or exportable credentials | Compromise scales across many devices |
| Local storage | Encryption and controlled deletion | Recoverable video after decommissioning | Retired devices remain intelligence assets |
| Firmware update | Signed, logged, staged and reversible process | Opaque package or forced remote update | Supplier controls operational continuity |
| Component inventory | Hardware and software bill of materials | Unknown chipset or library versions | Vulnerabilities cannot be mapped reliably |
| Time integrity | Authenticated time source and drift monitoring | Manipulable timestamps | Evidentiary chain and event correlation fail |
| Network interfaces | All radios and services inventoried | Undocumented Wi-Fi, Bluetooth or cellular path | Hidden communications channel may exist |
Software, algorithms and the separation between capture and identification
The central technical transformation occurs when software converts a video stream into a persistent, searchable representation of a person. Facial recognition commonly involves several operations: detecting a face within a frame; assessing image quality; aligning facial landmarks; extracting a numerical feature vector or template; comparing that template against a reference gallery; applying a similarity threshold; ranking candidates; and producing an alert for human review. Accuracy therefore depends not on a single advertised percentage but on camera angle, illumination, resolution, compression, occlusion, demographic distribution, gallery size, threshold selection and whether the task is one-to-one verification or one-to-many identification. The operational risk rises sharply when the platform supports retrospective search across large archives because authorities can reconstruct a person’s historical movement even if live alerts were disabled at collection time. Software licences create further opacity: the installed binary may contain modules for facial matching, person re-identification or vehicle analysis that remain dormant until activated by a licence key or configuration change. Consequently, an audit that observes no current biometric alerts cannot establish that the platform lacks biometric capability. It must inspect packages, containers, services, model files, accelerator use, scheduled jobs, API routes and licence entitlements. The EU AI Act defines remote biometric identification around identifying natural persons without their active involvement, typically at a distance through comparison with a reference database, and subjects high-risk biometric systems to extensive governance requirements. It also treats real-time law-enforcement use in public spaces as especially intrusive because of its effect on privacy and assembly. Regulation (EU) 2024/1689 – European Parliament and Council – July 2024 — verified official text. The decisive compliance boundary is thus not whether an authority calls the platform “Safe City,” “traffic management” or “video security”; it is what computational functions the deployed system performs, against which data, under whose authority and with which consequences.
| Processing stage | Input | Output | Technical audit artefact | Principal abuse vector |
|---|---|---|---|---|
| Face detection | Video frame | Face bounding box | Model inventory, inference log | Invisible mass collection |
| Quality assessment | Detected face | Usability score | Threshold configuration | Selective retention |
| Template extraction | Aligned face image | Biometric vector | Model hash, vector format | Irreversible biometric representation |
| Gallery enrolment | Identity image and metadata | Reference record | Enrolment authority, provenance | Unlawful or politically constructed watchlist |
| One-to-many matching | Probe template and gallery | Candidate ranking | Similarity scores, threshold | False-positive intervention |
| Person re-identification | Body appearance across cameras | Cross-camera trajectory | Tracker configuration | Movement reconstruction without identity |
| Behaviour analysis | Tracks and scene rules | Anomaly alert | Rule set, model version | Normal conduct classified as suspicious |
| Retrospective search | Archived imagery | Historical sightings | Query audit trail | Political network reconstruction |
| Alert adjudication | Candidate and operator review | Operational decision | Reviewer identity, rationale | Automation bias |
| Evidence export | Video, metadata and identity | Case package | Hashes, chain of custody | Manipulation or unauthorised disclosure |
Data architecture: the real strategic asset
Data, rather than the camera, is the durable strategic asset. A technically advanced surveillance environment may generate raw video, face crops, licence-plate strings, biometric templates, object attributes, movement trajectories, alert histories, operator notes, device-health data and access records. These objects have different sensitivity and retention requirements. Raw video may be deleted after a specified period, while derived metadata or biometric templates persist in separate databases, allowing the apparent deletion of footage to coexist with long-lived identity traces. Sovereignty therefore requires an end-to-end data-lineage model identifying where each object originates, every transformation applied to it, each storage location, each replication pathway and every actor authorised to retrieve it. The highest-risk transition occurs when the video platform becomes interoperable with authoritative identity sources. A facial-matching engine without a reference gallery can detect and cluster faces but cannot reliably assign civil identity; a connection to passport, national identity, border or police databases converts it into an identification system. Even a formally air-gapped environment may permit indirect movement through administrative exports, backup systems, maintenance laptops or removable media. Cloud functions add another dimension: telemetry, licence validation, threat-intelligence feeds or diagnostic uploads may transmit operational metadata even when video remains locally hosted. Chinese technical practice again illustrates the architectural model without proving Balkan replication. Shenzhen’s public-security video specification explicitly addresses dedicated video networks, shared platforms, front-end access and resource integration, demonstrating how data fusion is designed into modern Chinese public-security systems. Technical Specification for Construction, Networking and Sharing of Public-Security Video Surveillance, DB4403/T 234—2022 – Shenzhen Municipal Government – May 2022 — verified Chinese government document. An effective Balkan audit must therefore test packet flows, domain-name requests, certificate chains, backup destinations, database replication, API calls and privileged administrator activity over time. Contractual assertions that data “remain in country” are insufficient unless independent technical evidence proves that content, metadata, templates, diagnostics and credentials all remain under sovereign control.
Dual-Path Data Architecture & Shadow Verification
Raw Data Path (Camera Frame Processing)
Identity Path (Biometric Matching Engine)
Shadow Paths Requiring Verification
Maintenance, remote support and privileged access
Maintenance is the least visible and potentially most decisive layer because it determines who can preserve, modify, recover or disable the system after formal delivery. Surveillance platforms require firmware patches, operating-system maintenance, database optimisation, certificate renewal, storage replacement, vulnerability remediation, model updates and operator support. These activities often involve accounts more powerful than those assigned to ordinary police operators. A remote-support channel may be legitimate and operationally necessary, but it becomes a sovereignty problem when activation does not require national approval, sessions are not recorded, technician identities are not attributable, commands are not logged or data can be extracted through diagnostic bundles. The correct audit question is not merely “Does the vendor have remote access?” but “What complete set of technical and procedural conditions would allow any supplier, integrator, subcontractor or former employee to obtain privileged access?” This includes dormant accounts, shared passwords, emergency credentials, virtual private network profiles, remote-management agents, hardware management controllers, cloud consoles and update infrastructure. NIST’s IoT guidance emphasises authentication before remote connection, protection of logical interfaces, secure software updating, access to cybersecurity-state information and lifecycle documentation. IoT Device Cybersecurity Guidance for the Federal Government: IoT Device Cybersecurity Requirement Catalog, NIST SP 800-213A – National Institute of Standards and Technology – November 2021 — verified United States government publication. The EU’s 2026 ICT Supply Chain Security Toolbox extends the analysis beyond individual vulnerabilities by recommending assessment frameworks for critical suppliers, multi-vendor strategies and measures to overcome high-risk dependencies. ICT Supply Chain Security: EU Adopts a Toolbox to Mitigate Risks – European Commission – February 2026 — verified official publication. These principles imply that a maintenance contract is part of the security perimeter. Procurement authorities must specify sovereign session approval, just-in-time credentials, multi-factor authentication, complete command recording, data-export prohibition, named personnel, subcontractor disclosure and rapid credential revocation.
| Maintenance vector | Legitimate purpose | Exploitable dependency | Required sovereign control |
|---|---|---|---|
| Firmware update | Patch vulnerabilities and improve stability | Supplier controls executable code | Signed packages, staging, reproducible hashes, rollback |
| Licence renewal | Continue analytics functions | Capability can be remotely reduced | Offline licence option and transition period |
| Remote diagnostics | Resolve faults quickly | Privileged access to system and metadata | National approval, recording and command logging |
| Model update | Improve detection or matching | Model behaviour changes without transparent review | Versioned testing and independent validation |
| Certificate renewal | Maintain trusted communications | Expiry can halt service | National certificate authority or escrow process |
| Database tuning | Preserve performance | Administrator can access identity and query data | Segregated duties and monitored sessions |
| Storage replacement | Maintain archive capacity | Retired media contain recoverable data | Certified sanitisation or physical destruction |
| Incident response | Recover after compromise | Supplier controls forensic narrative | Independent evidence preservation |
| Training | Maintain operator competence | Knowledge remains vendor-specific | Train-the-trainer and national documentation |
| End-of-life support | Sustain legacy deployment | Security patches cease | Contractual notice, migration assistance, source escrow |
System integration and the multiplication of political power
System integration produces a nonlinear increase in capability because each additional database changes what can be inferred from the same image. A camera network connected only to a local recorder can document an event; connected to a vehicle register, it can identify owners; connected to civil identity records, it can identify faces; connected to telecommunications or border data, it can reconstruct associations and movement; connected to command-and-control software, it can trigger immediate intervention. The architecture therefore has to be assessed as a graph of trust relationships rather than as a list of assets. Every API creates a pathway through which privileges, errors and compromise can propagate. A police investigator authorised to query one database may gain indirect access to another through a federated platform. A compromised analytics server may become a bridge between a less-protected municipal network and a sensitive national register. A unified dashboard may conceal these trust transitions from the operator, creating the appearance of a single application while executing queries across several agencies. The danger grows when identity resolution is probabilistic: the dashboard may present an algorithmic candidate with an authoritative appearance even though the underlying match is uncertain. Integration consequently requires purpose-bound access controls, field-level restrictions, query justification, immutable audit trails and independent review of cross-agency use. The Serbian case remains particularly important because Huawei’s corporate publication described an ambition extending beyond Belgrade toward national coverage, while the European Commission recorded unresolved questions concerning proportionality, necessity and legal basis for public-space facial recognition. Huawei Enterprise 01/2019 – Huawei – January 2019 — verified corporate publication. Serbia 2023 Report – European Commission – November 2023 — verified official document. Neither source establishes that a national integrated biometric network became operational. Together, however, they identify the exact strategic problem: ambitious system scope preceded a settled and independently validated governance framework.
| Integration node | Data contribution | Capability created | Political-risk escalation |
|---|---|---|---|
| National identity register | Authoritative face and civil identity | Named facial identification | Anonymous presence becomes attributable |
| Passport database | High-quality identity photographs | Expanded reference gallery | Residents and travellers become searchable |
| Vehicle register | Plate-to-owner relationship | Automated mobility mapping | Meetings and travel can be reconstructed |
| Border system | Entry and exit events | Cross-border movement history | Diaspora and opposition travel become visible |
| Police case database | Investigative status and associations | Risk-labelled identification | Suspicion propagates into public-space monitoring |
| Emergency dispatch | Live operational response | Immediate intervention | Algorithmic alerts affect physical liberty |
| Municipal sensors | Location, parking and access events | Urban behaviour profile | Administrative data become intelligence data |
| Telecommunications metadata | Device relationships and location | Social-network reconstruction | Association becomes a targetable attribute |
| Event-permit records | Organisers, locations and times | Protest-specific monitoring | Lawful assembly becomes pre-indexed |
| Private CCTV feeds | Commercial and residential coverage | Near-continuous spatial visibility | State reach expands without public procurement |
Supplier dependence and the lock-in equation
Supplier dependence accumulates across technical, financial, legal and human-capital dimensions. Technical lock-in arises from proprietary protocols, database schemas, video codecs, analytics APIs, device-management systems, model formats and licence mechanisms. Financial lock-in emerges when replacing one layer forces simultaneous replacement of others, converting a seemingly inexpensive procurement into a high-cost migration programme. Legal lock-in can arise from restrictive intellectual-property clauses, non-portable configurations or weak contractual rights to documentation. Human-capital lock-in occurs when police technicians learn only the vendor interface and lack the engineering knowledge needed to operate the underlying infrastructure independently. The most consequential dependency is rarely a single monopoly component; it is the interaction among all four. Huawei’s audited 2025 reporting states that cybersecurity and privacy protection remain foundational corporate priorities and that the company works with customers, partners and suppliers to strengthen security capabilities. Huawei 2025 Annual Report – Huawei – March 2026 — verified audited corporate report. That statement is relevant evidence of the vendor’s declared governance position, but it cannot substitute for system-specific verification inside a Balkan police deployment. Corporate assurance, architectural transparency and operational audit are separate layers of evidence. A sovereign government must be able to test whether its specific configuration complies with national requirements regardless of the supplier’s general policies. The EU’s horizontal supply-chain approach is therefore strategically more useful than an exclusively country-of-origin test: assess criticality, substitutability, supplier characteristics, dependencies, incident exposure and mitigation capacity, then use multi-vendor architecture to prevent any single supplier from controlling operational continuity. ICT Supply Chain Security: EU Adopts a Toolbox to Mitigate Risks – European Commission – February 2026 — verified official publication. The correct objective is not symbolic “de-Chinesification,” but measurable sovereign control over every critical function.
| Dependence dimension | Low-risk condition | Medium-risk condition | High-risk condition | Exit test |
|---|---|---|---|---|
| Device management | Open standard and national console | Exportable proprietary console | Supplier-only administration | Can another platform enrol every device? |
| Video archive | Standard export with metadata | Export possible with conversion | Proprietary archive inaccessible externally | Can evidence migrate without losing hashes? |
| Analytics | Replaceable model interface | Limited third-party compatibility | Vendor-exclusive engine and accelerator stack | Can an independently tested model be substituted? |
| Identity gallery | Open documented schema | Partial export | Encrypted or undocumented proprietary database | Can all templates be lawfully re-enrolled? |
| Licencing | Perpetual offline operation | Periodic local renewal | Continuous vendor-controlled validation | Does system survive supplier disconnection? |
| Firmware | Signed and independently staged | Supplier package with local approval | Forced or opaque remote delivery | Can updates be rejected and rolled back? |
| Support | Multiple certified integrators | Single domestic integrator | Foreign supplier-exclusive expertise | Can national staff restore service alone? |
| Documentation | Complete and current | Partial or delayed | Unavailable or vendor-confidential | Can an independent team rebuild configuration? |
| Contract | Portability and escrow rights | Negotiated transition assistance | No migration obligation | Is exit enforceable within a fixed timetable? |
| Financing | Transparent budget purchase | Concessional supplier credit | Debt tied to continued vendor ecosystem | Can financing be separated from operations? |
Bayesian competing hypotheses and collection priorities
The architecture supports five competing hypotheses that must be updated through discriminating evidence rather than rhetoric. H₁ proposes that the system is principally an ordinary crime-control modernisation programme and that Chinese-origin technology was selected for cost, integration capacity and rapid delivery. H₂ proposes that the principal consequence is unplanned commercial lock-in, produced by cumulative technical choices rather than geopolitical direction. H₃ proposes that domestic political authorities intentionally value latent capabilities for protest identification, opposition mapping or social deterrence. H₄ proposes that Chinese state or corporate actors can exploit maintenance, financing, access or replacement dependencies as geopolitical leverage. H₅ proposes that EU accession conditionality, the AI Act and supply-chain policy will progressively constrain, separate or replace the most sensitive capabilities. An architecture-based prior for 2026 assigns H₁ 26%, H₂ 31%, H₃ 20%, H₄ 11% and H₅ 12%. The higher prior for H₂ reflects the well-established mechanics of proprietary system integration; it does not imply intentional misconduct. Huawei’s documented proposal for comprehensive national-scale coverage raises the relevance of H₂, while the Serbian regulator’s earlier objections and the absence of an established legal basis increase the permissive conditions for H₃. Neither observation proves H₄. That hypothesis requires discriminators such as undocumented foreign administrator accounts, supplier-controlled extraction paths, politically conditioned support, financing covenants tied to diplomatic conduct or verified intervention by Chinese authorities. Evidence that would favour H₅ includes complete public inventories, independent firmware testing, system-specific impact assessments, database separation, strong regulator access and funded migration programmes. Russian-language official sources were checked for corroboration of a Russia–China–Balkan surveillance integration nexus, but no qualifying primary evidence was identified that would support such a claim; no Russian link is therefore introduced as evidentiary filler. This negative finding is analytically meaningful because it prevents the unsupported fusion of separate Russian and Chinese influence ecosystems into a single operational architecture.
| Hypothesis | Prior 2026 | Evidence increasing probability | Evidence decreasing probability | Priority collection requirement |
|---|---|---|---|---|
| H₁ — Ordinary modernisation | 26% | Crime-specific use, narrow access, transparent metrics | Protest-oriented queries, hidden modules | Case-to-query sampling and use-policy audit |
| H₂ — Commercial lock-in | 31% | Proprietary formats, single integrator, supplier-only recovery | Open APIs, tested migration, multiple maintainers | Contract annexes and technical portability test |
| H₃ — Domestic political control | 20% | Protest watchlists, retrospective participant search | Judicially limited serious-crime use | Query logs during demonstrations and elections |
| H₄ — Foreign geopolitical leverage | 11% | External privileged access, conditional support or finance | National keys, offline licensing, audited sessions | Remote-access logs and financing documentation |
| H₅ — EU convergence | 12% | AI Act mapping, audits, separation and replacement funding | Cosmetic legislation without technical inspection | Accession benchmarks tied to deployed systems |
Monte Carlo risk model and five-year outlook
The five-year model treats risk as the interaction of six variables: supplier concentration C, privileged-access opacity A, database integration D, domestic political stress P, regulator effectiveness R and EU conditionality E. Each variable is scored from 0 to 100, with higher C, A, D and P increasing the probability of sovereignty loss, while higher R and E reduce it. The model does not treat these factors as independent because that would understate systemic risk. Supplier concentration and access opacity are positively correlated: a single-vendor environment often concentrates maintenance knowledge and credentials. Database integration and political stress are also correlated in the adverse tail because emergency conditions increase pressure to connect systems or relax controls. Regulator effectiveness and EU conditionality are positively correlated but imperfectly so, since formal accession progress does not guarantee operational enforcement. A 100,000-path conceptual Monte Carlo specification using triangular distributions and moderate correlation produces three scenario classes rather than a false point forecast: S₁, EU-aligned controlled migration; S₂, hybrid persistence with partial restrictions; and S₃, integrated high-dependence surveillance. The baseline analytical distribution for 2031 assigns approximately 24% to S₁, 53% to S₂ and 23% to S₃. These values are structured risk estimates derived from disclosed assumptions, not official statistics. S₂ dominates because complete replacement is financially and technically demanding, while unrestricted expansion will face increasing legal and accession pressure. S₃ becomes the modal adverse outcome if privileged-access opacity remains above 70, database integration exceeds 75 and regulator effectiveness remains below 40 during a sustained political crisis. S₁ becomes more probable if candidate governments establish asset registers by 2027, require national control of keys and credentials by 2028, complete independent biometric testing by 2029 and demonstrate successful vendor-independent recovery by 2030. The graph at the end visualises the annual risk trajectories generated by this structured model.
| Model variable | 2026 baseline | 2031 controlled path | 2031 hybrid path | 2031 adverse path |
|---|---|---|---|---|
| C — Supplier concentration | 72 | 38 | 61 | 86 |
| A — Privileged-access opacity | 67 | 24 | 49 | 88 |
| D — Database integration | 55 | 48 with controls | 69 | 91 |
| P — Political stress | 58 | 42 | 57 | 82 |
| R — Regulator effectiveness | 43 | 79 | 56 | 31 |
| E — EU conditionality | 67 | 91 | 76 | 49 |
| Composite sovereignty-loss risk | 64 | 28 | 56 | 89 |
The operational sequence from 2026 through 2031 is likely to move through five distinct stages. In 2026–2027, the principal uncertainty will concern inventory: governments and external assessors may know visible manufacturers but lack a complete register of firmware, licences, server modules, support accounts and connected databases. In 2027–2028, procurement pressure will shift from camera expansion toward analytics, storage consolidation and data fusion, because existing video becomes substantially more valuable when searchable across time and agencies. In 2028–2029, AI Act alignment and wider EU supply-chain controls will force candidate countries to classify biometric systems, document legal purposes and confront whether dormant functions must be removed rather than merely disabled. In 2029–2030, migration economics will become decisive as governments discover whether configurations, archives, identity galleries and device certificates can move to alternative platforms without simultaneous replacement of the entire stack. In 2030–2031, the first credible sovereignty verdict will depend on operational tests: whether national teams can disconnect the supplier, rotate all privileged credentials, restore the platform from trusted backups, update components independently, reproduce audit histories and continue essential service. A platform that passes legal review but fails this technical exercise remains dependent. A system that passes technical migration but retains uncontrolled cross-agency data use remains politically dangerous. The decisive policy is therefore functional decomposition: separate capture from identification, identification from the reference gallery, analytics from police decision-making, and maintenance from unrestricted data access. This architecture reduces the blast radius of compromise and permits individual components to be replaced. It also creates observable control points for accession monitoring, making it harder for intrusive functions to remain hidden behind a generic Safe City label.
Technical audit and OSINT exploitation framework
A rigorous OSINT and technical investigation must combine documentary, geospatial, network, procurement and software evidence while preserving the distinction between indication and proof. Documentary collection should target tender specifications, acceptance certificates, maintenance schedules, data-protection impact assessments, subcontractor lists, training materials and amendments that expand system scope after the original award. Geospatial work should identify cameras, network cabinets, command centres, fibre routes and likely aggregation points, but external imagery cannot determine enabled software functions. Network analysis should occur only under lawful authority and should map device destinations, certificate issuers, update servers, domain-name queries and remote-support windows. Software examination should hash firmware and platform components, enumerate services, identify embedded libraries, inspect licence files and compare installed modules with procurement descriptions. Operational forensics should analyse query logs around protests, elections, major public events and serious-crime investigations, using strict access controls to avoid creating a second privacy violation. Financial analysis should map initial purchase cost, concessional credit, recurring licences, foreign-currency exposure, maintenance escalation and the replacement-cost cliff. The “shadow liquidity” dimension is not limited to secret financing; it includes underpriced initial hardware compensated by long-term service revenue, bundled training, supplier credit and upgrades purchased outside the original tender. Cyber-norm analysis must distinguish espionage allegations from enforceable controls: any supplier should be assessed through identical requirements for access logging, update transparency, vulnerability disclosure and portability. The correct red-team test assumes neither innocence nor guilt. It asks what a malicious vendor technician, compromised domestic administrator, politically directed operator, foreign intelligence service or criminal intruder could do with the same architecture, and which evidence would reveal the action. This multi-actor approach prevents country-of-origin analysis from obscuring domestic abuse and ordinary cybersecurity failure.
| Audit workstream | Collection target | Verification method | High-risk finding |
|---|---|---|---|
| Procurement OSINT | Tenders, annexes, amendments, subcontractors | Cross-document entity and date reconciliation | Sensitive modules absent from public scope |
| Physical inventory | Cameras, servers, switches, command sites | Serial reconciliation and geospatial inspection | Undocumented or duplicate devices |
| Firmware analysis | Images, hashes, libraries, signing chain | Static analysis and trusted-boot validation | Unsigned code or hidden service |
| Network forensics | Destinations, ports, certificates, DNS | Flow monitoring and packet inspection | Unauthorised external connection |
| Identity governance | Gallery source, enrolment, deletion | Record sampling and legal-authority check | Unlawful or politically curated watchlist |
| Access review | Accounts, roles, sessions, emergency access | Privilege graph and session replay | Foreign or shared administrator account |
| Algorithm validation | Thresholds, error rates, demographic performance | Independent controlled testing | Unacceptable false-positive disparity |
| Use audit | Queries, alerts, police actions | Log-to-case correlation | Search unrelated to authorised investigation |
| Financial mapping | Credit, renewals, maintenance and exit cost | Contract cash-flow reconstruction | Replacement economically prohibitive |
| Resilience test | Backup, restore, credential rotation, failover | Supplier-disconnection exercise | Essential service cannot continue independently |
The minimum sovereign-security programme should therefore contain twelve enforceable controls: a complete asset and software-component register; secure device identity; national ownership of cryptographic keys; segmented networks; disabled unnecessary interfaces; signed and locally approved updates; immutable access and query logging; named and time-limited maintenance accounts; independent algorithm testing; purpose-limited database connections; contractual portability and source escrow where technically justified; and an annually exercised supplier-exit plan. Compliance must be demonstrated through evidence rather than self-certification. The exit exercise is the most revealing control because it simultaneously tests documentation, credentials, backups, staff competence, licences, interoperability and political willingness. Governments should be required to operate the system for a defined period with all supplier remote connections disabled, then restore a representative subsystem using nationally controlled material. Failure should trigger a time-bound remediation plan and restrictions on further integration. European financial assistance could reduce the political attraction of opaque bundled procurement by funding open interfaces, migration tooling, regulator laboratories and regional testing capacity. The objective is not necessarily to remove every Chinese-origin device; indiscriminate replacement could waste public funds while leaving equally weak governance around the successor system. The objective is to ensure that no supplier can unilaterally update, disable, inspect, extract from or render irreplaceable a sovereign public-security platform. By 2031, digital sovereignty should be measured through four practical questions: Can the state identify every critical component? Can it prove who accessed every sensitive function? Can it replace any supplier without losing essential capability or evidence? Can an independent authority verify that biometric use complies with law? If any answer remains negative, the system is not sovereign regardless of where its servers are located.
Sovereignty and Political Pressure: Biometrics, Protest Monitoring, Policing, Intelligence Access and Geopolitical Leverage
Sovereignty as control over the decision chain
Digital sovereignty in an urban-surveillance environment is not established merely because cameras and servers are physically located inside national borders. It exists only when domestic institutions retain exclusive, independently verifiable control over five linked authorities: the authority to collect data, transform images into biometric identifiers, decide which persons enter reference databases, authorise searches and determine the consequences of algorithmic results. A government may own the physical infrastructure while remaining dependent on a foreign supplier for software updates, licence activation, model configuration or specialist maintenance. Conversely, a foreign-manufactured system can theoretically operate under strong sovereign control if the purchasing state controls encryption keys, administrator accounts, update approval, data flows, source documentation and supplier replacement. The Serbian case contains both a documented capability ambition and unresolved legal constraints. Huawei stated that Serbia’s Ministry of Interior wanted a Safe City covering Belgrade and eventually the country, and that Huawei proposed a comprehensive solution. Huawei Enterprise 01/2019 – Huawei – January 2019 — verified corporate publication. The European Commission later reported that the Serbian Ministry had placed biometric-personal-data processing on hold after negative opinions concerning its street-surveillance impact assessment, pending an adequate legal basis. It further concluded that the proportionality and necessity of public-space surveillance and facial-recognition processing still required assessment. Serbia 2023 Report – European Commission – November 2023 — verified official document. In 2024, the Commission stated that it still had to be verified whether Serbia had processed personal data using facial-recognition software. Serbia Report 2024 – European Commission – October 2024 — verified official document. These findings do not establish systematic biometric surveillance. They establish an unresolved sovereignty question: whether governmental, regulatory and judicial institutions can determine with certainty which functions exist, which are active, who uses them and whether their use remains within law.
| Sovereignty domain | Sovereign-control requirement | Deficit indicator | Political consequence |
|---|---|---|---|
| Collection authority | Cameras operate for defined legal purposes | Unbounded or repurposed collection | Population-wide visibility |
| Biometric transformation | Template generation separately authorised | Face templates produced by default | Identity data created without scrutiny |
| Gallery governance | Entries have documented provenance and expiry | Political, administrative or unclear watchlists | Opposition actors become targetable |
| Query authority | Each search requires attributable justification | Shared accounts or bulk searches | Collective monitoring becomes difficult to detect |
| Algorithm control | Thresholds and models independently validated | Vendor-selected settings | Supplier influences error and alert rates |
| Operational response | Human review precedes coercive action | Automatic dispatch or administrative action | Software affects physical liberty |
| Audit authority | Independent regulator can inspect all layers | Classified or supplier-restricted access | Executive branch becomes self-policing |
| Exit authority | Government can replace the supplier | Proprietary formats and exclusive maintenance | Foreign-origin dependency becomes durable |
From presence to identity: the biometric escalation ladder
Biometric surveillance changes the political meaning of public space because it converts transient presence into an identity-linked and potentially permanent state record. The escalation begins with ordinary video capture but develops through a series of technically distinct functions. Face detection locates a face without necessarily identifying it. Template extraction converts facial characteristics into a mathematical representation. One-to-many matching compares that representation against a reference gallery. Person re-identification follows an individual across different cameras using clothing, body shape, gait or other appearance features even when civil identity remains unknown. Retrospective search reconstructs earlier sightings after authorities obtain a target image. Relationship analytics infer co-presence, repeated association and movement patterns. Each stage increases state knowledge, but each also requires separate testing and legal justification. The EU AI Act defines remote biometric identification as identifying natural persons without their active involvement, usually at a distance through comparison with reference data. It treats real-time law-enforcement use in publicly accessible spaces as especially intrusive because it can affect large parts of the population, create a sense of constant surveillance and discourage the exercise of assembly and other fundamental rights. Regulation (EU) 2024/1689 – European Parliament and Council – July 2024 — verified official text. The European Court of Human Rights has similarly emphasised the exceptionally intrusive character of facial recognition used to locate and arrest a person connected to a peaceful demonstration. Its updated data-protection case-law guide states that the highest level of justification is required for such interference to qualify as necessary in a democratic society. Guide on Article 8 of the European Convention on Human Rights: Data Protection – European Court of Human Rights – February 2026 — verified official guide. The core sovereignty issue is consequently not accuracy alone. Even a highly accurate system can be politically illegitimate if the gallery, legal purpose or query process is unlawful; an inaccurate system adds discriminatory and coercive error to that legitimacy failure.
Biometric Political-Power Escalation
Video Capture
Identity Attachment
Cross-Database Fusion
Automated Real-Time Alerting
Predictive Behavior Modeling
Coercive Social Control
Sovereignty and Political Pressure: Biometrics, Protest Monitoring, Policing, Intelligence Access and Geopolitical Leverage
From observation to political power
A surveillance platform becomes politically consequential when it changes the cost, speed and scale of identifying people who participate in collective action. Conventional policing requires officers to observe a demonstration, record suspected offences, identify specific individuals and assemble evidence. A networked biometric platform can compress this sequence by detecting faces or bodies, comparing captured representations with reference databases, correlating sightings across cameras and producing candidate identities before or after an event. The transformation is not merely quantitative. It allows the state to shift from investigating conduct to reconstructing presence, association and movement. A person need not commit an offence to become analytically visible: attendance at a protest, repeated proximity to organisers or movement between politically significant locations may create a persistent data trail. The Serbian context makes this distinction operationally important. The European Commission reported that the Ministry of Interior had suspended processing of biometric personal data after negative opinions concerning its street-surveillance impact assessment and that the proportionality and necessity of public-space video surveillance and facial-recognition processing still required evaluation. Serbia 2023 Report – European Commission – November 2023 — verified official document. In 2024, the Commission stated that it still had to be verified whether Serbia had processed personal data using facial-recognition software and noted the incompatibility of certain uses with the developing EU artificial-intelligence framework. Serbia Report 2024 – European Commission – October 2024 — verified official document. These official formulations do not prove systematic biometric monitoring of protesters. They establish an unresolved verification problem at precisely the moment when Serbia experienced sustained mobilisation, making technical auditability a question of democratic sovereignty rather than routine data administration.
| Political-surveillance stage | Technological function | Minimum input | Operational output | Democratic-risk threshold |
|---|---|---|---|---|
| Observation | Live or recorded video | Public-space image | Visual record | Low if limited, lawful and time-bound |
| Detection | Face, body or vehicle extraction | Video frame | Structured object | Rises when collection is indiscriminate |
| Identification | Biometric or plate matching | Reference gallery | Candidate identity | High without strict necessity and review |
| Association | Co-location and repeated proximity | Multi-camera events | Relationship graph | High when presence substitutes for conduct |
| Reconstruction | Cross-camera tracking | Time-stamped sightings | Movement history | High when applied retrospectively to assemblies |
| Classification | Risk or behavioural scoring | Identity plus contextual data | Priority or suspicion label | Very high when criteria are secret |
| Intervention | Dispatch, questioning or detention | Alert or analyst judgement | State coercive action | Critical if automated output drives action |
| Persistence | Long-term storage and reuse | Templates, metadata and case records | Durable political dossier | Critical without deletion and remedies |
Serbia’s protest environment and the evidentiary boundary
The political-pressure assessment must integrate Serbia’s protest cycle without converting allegations into established technical findings. The student-led mobilisation that followed the November 2024 Novi Sad railway-station canopy collapse expanded into demands for accountability, transparency and institutional responsibility. The United Nations High Commissioner for Human Rights described more than six months of student-led protests during his May 2025 visit and emphasised the importance of dialogue, civic space and protection of rights. Serbia: Türk Touched by Resilience of People He Met, and Their Desire and Determination for a Better Future – Office of the UN High Commissioner for Human Rights – May 2025 — verified United Nations statement. In August 2025, UN experts stated that peaceful demonstrators had reportedly faced intimidation, physical attacks and surveillance; the word “reportedly” is essential because the statement communicated received allegations rather than a completed forensic adjudication. Serbia Must Halt Crackdown on Student Movement, Uphold Human Rights and Academic Freedom – Office of the UN High Commissioner for Human Rights – August 2025 — verified United Nations publication. The Parliamentary Assembly of the Council of Europe later expressed concern about mass protests, disproportionate violence, harassment and revelations concerning surveillance of Serbian journalists and activists, urging effective investigations and accountability. Progress of the Assembly’s Monitoring Procedure, Resolution 2635 – Parliamentary Assembly of the Council of Europe – June 2026 — verified official resolution. None of these sources attributes the alleged surveillance to Huawei cameras, proves facial-recognition use at demonstrations or establishes Chinese intelligence access. They do, however, show a politically sensitive target environment in which the unresolved status of biometric capabilities becomes materially more dangerous. The appropriate conclusion is therefore conditional: if an unaudited biometric platform is connected to police identity repositories during mass mobilisation, the opportunity for coercive use is high even before such use is proven.
Biometric mechanics of protest identification
The technical chain for identifying demonstrators contains several distinct operations, each generating evidence that an independent inquiry should be able to recover. Cameras first capture frames whose evidential value depends on resolution, focal length, angle, illumination, motion blur and compression. A detection model locates faces; a quality model rejects unusable images; an embedding model converts the remaining face into a numerical template; and a similarity engine compares that template with one or more galleries. The output is not a factual identity but a ranked candidate accompanied by a similarity score. The operator or downstream workflow then applies a threshold and decides whether to accept, reject or escalate the match. In a protest environment, performance may deteriorate because of crowd density, banners, masks, head movement, oblique angles and rapidly changing light. Yet the political danger does not disappear when individual identification is unreliable. Person re-identification can connect appearances across cameras using clothing, body characteristics and movement patterns without initially knowing a civil identity; vehicle recognition can associate arrival and departure with ownership records; and retrospective search can identify an individual after authorities obtain a better reference image. The European Court of Human Rights’ judgment in Glukhin v. Russia is the most directly relevant official precedent. The Court examined the use of facial recognition to locate and arrest a person connected to a peaceful solo demonstration and emphasised the particularly intrusive nature of the technology and the high justification required for its use. Case of Glukhin v. Russia – European Court of Human Rights – July 2023 — verified official judgment. The Court’s updated data-protection case-law guide reiterates that live facial recognition in public CCTV systems requires the highest level of justification where it connects peaceful demonstration to identification and arrest. Guide on Article 8 of the European Convention on Human Rights: Data Protection – European Court of Human Rights – February 2026 — verified official guide.
Protest-Identification Pipeline
Multi-Modal Identification Paths
Critical Control Points & Safeguards
| Biometric parameter | Technical meaning | Protest-specific distortion | Required control |
|---|---|---|---|
| Detection rate | Proportion of visible faces detected | Masks, banners and crowd occlusion | Publish controlled test conditions |
| False-match rate | Incorrect gallery candidates accepted | Large galleries multiply candidate opportunities | Set use-specific thresholds |
| False non-match rate | Correct identity not returned | Angle, blur and low light | Prevent repeated threshold relaxation |
| Gallery size | Number of enrolled identities | Broad civil databases increase surveillance reach | Purpose-limited enrolment |
| Gallery provenance | Source and legality of reference images | Protest photos may be unlawfully harvested | Document lawful authority |
| Template retention | Duration biometric vectors are stored | Enables future retrospective searches | Automatic deletion and verification |
| Re-identification span | Time and distance over which tracking persists | Reconstructs attendance and social proximity | Strict spatial and temporal limits |
| Human adjudication | Review before operational action | Automation bias favours machine candidate | Dual review and recorded rationale |
| Query logging | Record of who searched whom and why | Reveals political targeting patterns | Immutable independent audit |
| Downstream propagation | Transfer of alert into other systems | Suspicion persists after false match | Correction and deletion workflow |
Protest monitoring beyond facial recognition
A mature urban-control platform does not require definitive facial identification to exert political pressure. Crowd analytics can estimate density, direction, dispersal and convergence; virtual tripwires can detect entry into defined zones; object detection can identify banners, vehicles or protective equipment; licence-plate recognition can map transport used by participants; and temporal correlation can reconstruct repeated presence around universities, party offices, newsrooms or civil-society organisations. Audio sensors may add sound-event detection, while telecommunications or online datasets—if lawfully or unlawfully combined—can connect physical presence with social relationships. The most politically powerful output is therefore often not “Person X has been recognised” but “these devices, vehicles and visual tracks repeatedly co-occurred at these politically significant events.” This creates an association graph that can guide questioning, tax inspection, employment pressure, administrative scrutiny or intensified physical monitoring. The UN’s April 2025 communication concerning Serbia raised allegations relating to interference with human-rights defenders’ financial privacy, spyware use against journalists and activists, criminalisation and smear campaigns. Joint Communication to Serbia, AL SRB 3/2025 – United Nations Special Procedures – April 2025 — verified official communication. This communication does not establish a connection between spyware and Chinese Safe City infrastructure. Its analytical importance lies in demonstrating that political surveillance may be multi-modal: mobile-device compromise, financial-data access, street cameras, human sources and administrative databases can reinforce one another even when operated through separate systems. Consequently, an investigation that examines only facial-recognition logs risks missing the broader targeting architecture. The audit scope must include watchlist creation, plate searches, device identifiers, retrospective video export, map queries, cross-agency data requests, operator-created tags and correlations between digital alerts and subsequent state action. The absence of a facial match does not demonstrate the absence of technologically enabled political monitoring.
| Surveillance modality | Identity required initially? | Political intelligence produced | Key forensic artefact |
|---|---|---|---|
| Crowd-density analysis | No | Size, direction and concentration | Zone definitions and event alerts |
| Person re-identification | No | Cross-camera movement pattern | Tracker identifiers and route history |
| Facial recognition | Yes, through gallery match | Named individual presence | Probe, candidate list and threshold |
| Licence-plate recognition | Indirectly | Vehicle and owner movement | Plate query and registry lookup |
| Mobile-device exploitation | Yes or later attribution | Communications, files and location | Device forensic image and server indicators |
| Financial-data access | Yes | Funding, donors and organisational |
Sovereignty and Political Pressure: Biometrics, Protest Monitoring, Policing, Intelligence Access and Geopolitical Leverage
From observation to coercive capacity
The political significance of a Safe City platform begins when observation becomes attribution. Conventional video surveillance records a scene; biometric surveillance converts an unknown person into a persistent digital subject who can be located across space, searched retrospectively and associated with other people or events. The transformation follows a technical chain: face detection isolates an image; template extraction converts facial geometry into a numerical representation; one-to-many matching compares that representation with a reference gallery; identity resolution links the candidate to an authoritative record; and operational integration connects the result to police action. Each stage increases state power, but each also introduces a separate legal and evidentiary threshold. A camera capable of detecting faces does not prove the existence of a national biometric gallery; an installed matching engine does not prove that it is active; a match does not prove that an operator acted upon it; and operational use does not prove political targeting. In Serbia, this distinction is particularly important. The European Commission reported in 2023 that, following negative opinions on the Ministry of Interior’s impact assessment for street video surveillance, the Ministry stated that biometric-data processing had been suspended until a legal basis was developed. The Commission further concluded that the necessity and proportionality of public-space video surveillance and facial-recognition processing still required assessment. Serbia 2023 Report – European Commission – November 2023 — verified official document. In 2024, the Commission stated that it still had to be verified whether Serbia had processed personal data using facial-recognition software, while noting the relevance of the EU prohibition framework. Serbia Report 2024 – European Commission – October 2024 — verified official document. The official record therefore demonstrates unresolved verification, regulatory controversy and latent capability; it does not establish continuous facial recognition or Chinese access to Serbian biometric data.
| Capability stage | Technical function | Political effect | Minimum evidence needed | Confidence if evidence is absent |
|---|---|---|---|---|
| C₁ — Observation | Records public-space imagery | Documents presence without identity | Camera inventory and recording policy | Presence of surveillance only |
| C₂ — Detection | Isolates faces, bodies or vehicles | Converts crowds into machine-readable objects | Model package and inference log | Technical possibility |
| C₃ — Identification | Matches a biometric template to a gallery | Converts anonymity into named presence | Gallery schema, threshold and match logs | Unproven activation |
| C₄ — Tracking | Links sightings across cameras and time | Reconstructs movement | Re-identification configuration and trajectory records | Unproven persistence |
| C₅ — Association | Correlates co-presence and repeated encounters | Maps social and political networks | Graph-query logs and analytic rules | Unproven network analysis |
| C₆ — Intervention | Sends alert to police or intelligence operators | Converts prediction into state action | Dispatch, case and adjudication records | Unproven operational consequence |
| C₇ — Coercion | Uses outputs against lawful political activity | Produces deterrence, questioning or retaliation | Target files, orders and correlated actions | Allegation requiring corroboration |
Protest monitoring as a distinct surveillance mission
Protest monitoring differs technically and legally from ordinary crime investigation because the state begins with a politically salient event rather than a previously identified suspect. A demonstration provides time, place, route and participant density, making it unusually compatible with automated collection. Authorities can establish virtual perimeters around assembly points, extract face crops as participants enter, compare them with identity databases, track movement between transport hubs and protest sites, and retrospectively query archival footage after the event. Even when the platform does not identify every person, person re-identification can link the same individual across multiple cameras by combining clothing, body geometry, gait and temporal proximity. Association analysis can then infer organisers, recurrent participants, logistical coordinators or individuals who move between otherwise separate groups. The political effect is not limited to arrest. Knowledge or suspicion that participation can be reconstructed may create a chilling effect, especially for public employees, students, journalists or individuals dependent on state licences and benefits. The Serbian environment makes this risk operationally relevant. The UN High Commissioner for Human Rights stated in May 2025 that Serbia had experienced more than six months of mainly student-led protests demanding transparency and accountability. Serbia: Türk Touched by Resilience of People He Met, and Their Desire and Determination for Accountability and Justice – Office of the UN High Commissioner for Human Rights – May 2025 — verified official statement. In August 2025, UN experts reported allegations that peaceful demonstrators had faced intimidation, physical attacks and surveillance. Serbia Must Halt Crackdown on Student Movement, Uphold Human Rights and Academic Freedom – Office of the UN High Commissioner for Human Rights – August 2025 — verified official statement. These are official records of reported conduct, not judicial findings that Huawei equipment performed the surveillance. Attribution to a specific platform requires logs, configuration evidence or operational testimony that official sources presently do not provide.
Protest-Surveillance Escalation Path
Public Demonstration
Event TriggerFixed CCTV & Mobile Police Video
Multi-Source FeedsFace & Body Extraction
Biometric IsolationNo Identity Link
AnonymizedIdentity Link Established
IdentifiedCross-Camera Correlation
Spatial-Temporal FusionCo-Presence Network Graphing
Social Link AnalysisSerious-Crime Inquiry
Lawful TrackPolitical Profiling
Coercive TrackThe biometric watchlist as the decisive control point
The watchlist or reference gallery is the decisive control point because it determines whom the platform can identify and for what purpose. A facial-recognition system does not search “the population” in the abstract; it compares probe templates against one or more galleries constructed from identity documents, police photographs, border records, missing-person files, judicial warrants, intelligence nominations or event-specific collections. A narrowly defined gallery containing persons sought for serious offences has a materially different political character from a population-scale identity gallery or a list assembled from protest images. Governance therefore requires four forms of traceability: the legal authority for enrolment, provenance of each reference image, duration of inclusion and the identity of the official who approved it. Without those controls, an authority can quietly convert administrative identity infrastructure into an intelligence resource. False-positive risk also increases with gallery size. Even when pairwise matching performance remains constant, a larger gallery creates more opportunities for a non-matching person to obtain a high similarity score. Operational safeguards must therefore include calibrated thresholds, candidate ranking, image-quality rejection, trained human adjudication and a prohibition against treating a machine match as sufficient grounds for coercive action. The EU AI Act imposes a particularly restrictive framework around real-time remote biometric identification in publicly accessible spaces for law enforcement, including necessity, proportionality and authorisation conditions for defined exceptions. It also recognises the technology’s capacity to generate constant-surveillance effects and deter the exercise of assembly rights. Regulation (EU) 2024/1689 – European Parliament and Council – July 2024 — verified official text. Serbia’s accession trajectory consequently creates an operational challenge, not merely a legislative one: authorities must be able to demonstrate which galleries exist, which systems can access them, whether dormant modules can be activated, how searches are logged and whether past biometric processing occurred. A statutory prohibition without technical inspection cannot establish compliance.
| Watchlist type | Legitimate purpose | Political-abuse potential | Required controls | Critical audit question |
|---|---|---|---|---|
| Judicial fugitive list | Locate persons subject to valid warrant | Low to medium | Current warrant, expiry and review | Was every enrolment linked to an enforceable order? |
| Missing and vulnerable persons | Protection and rescue | Medium | Purpose restriction and rapid deletion | Were images reused for unrelated policing? |
| Serious-crime intelligence | Identify high-risk suspects | Medium to high | Evidentiary threshold and independent review | Was intelligence nomination independently validated? |
| Border-security gallery | Verify travellers and detect document fraud | High | Legal separation from domestic policing | Can urban cameras query border identities? |
| Population identity register | Administrative identification | Very high | Technical isolation and exceptional access | Has the register become a general police gallery? |
| Event-specific list | Protect a named event or location | Very high | Narrow duration, threat evidence and deletion | Was the event designation used to monitor dissent? |
| Protest-derived gallery | Reidentify demonstrators | Extreme | Presumptive prohibition absent serious-crime basis | Were participants enrolled solely because they assembled? |
| Journalist or activist list | Intelligence targeting | Extreme | Strict judicial basis and remedy | Do query logs contain professional or civic categories? |
From policing to intelligence access
The transition from policing to intelligence occurs when surveillance data are used not simply to investigate a defined offence but to discover relationships, intentions or future behaviour. A police video archive contains observations; an intelligence platform links those observations to identities, co-presence, recurring locations, vehicles, communications metadata and institutional affiliations. The analytical products may include association graphs, movement patterns, frequent-location profiles and ranked subjects of interest. This change can occur without visible alterations to street hardware because the critical modifications are server-side: a new API, reference gallery, graph database, search index or authorisation role can transform the mission of an existing camera network. Formal ownership is therefore an unreliable guide. A system administered by the police may provide query access to intelligence personnel; an intelligence-derived watchlist may be ingested into a police platform; or a municipal traffic system may export events to a national command centre. Sovereignty requires an access-control graph mapping each agency, role, service account and database privilege. It also requires immutable records of the initiating user, stated purpose, search parameters, returned candidates, subsequent access and operational outcome. The Parliamentary Assembly of the Council of Europe expressed concern in its 2026 periodic-review resolution about reported surveillance of Serbian journalists and activists and called for the practice to end and for effective investigations and accountability. The Progress of the Assembly’s Monitoring Procedure, Resolution 2635 – Parliamentary Assembly of the Council of Europe – June 2026 — verified official resolution. A related monitoring report recorded that the Assembly’s committee had examined revelations concerning surveillance of journalists and activists during 2025. The Progress of the Assembly’s Monitoring Procedure, Document 16316 – Parliamentary Assembly of the Council of Europe – June 2026 — verified official report. These institutional findings heighten the probability of a broader surveillance-governance problem, but they do not independently identify Chinese hardware, Safe City software or foreign access as the mechanism.
| Access tier | Typical actor | Permissible function | Escalation risk | Required evidence trail |
|---|---|---|---|---|
| A₁ — Device operator | Municipal or police technician | Camera health and positioning | Low | Configuration changes and technician identity |
| A₂ — Video operator | Command-centre staff | Live view and incident replay | Medium | Viewed feeds, timestamps and declared incident |
| A₃ — Investigator | Police case officer | Search and evidence export | High | Case number, legal basis and exported material |
| A₄ — Biometric analyst | Specialist matching unit | Gallery search and adjudication | Very high | Probe image, gallery, score and reviewer decision |
| A₅ — Intelligence analyst | Security or intelligence service | Association and pattern analysis | Extreme | Mission authority, selector and dissemination record |
| A₆ — System administrator | Ministry, integrator or supplier | Full platform control | Extreme | Recorded session and command-level audit |
| A₇ — Emergency account | Designated recovery actor | Bypass or restoration | Extreme | Dual approval, time limit and post-use review |
| A₈ — External support | Vendor or subcontractor | Diagnostics and maintenance | Extreme | Named person, national escort and export prevention |
The jurisprudential threshold: identification of protesters
The European Court of Human Rights provides the strongest primary legal benchmark for assessing biometric identification of demonstrators. In Glukhin v. Russia, the Court examined the use of facial-recognition technology to identify and locate a person associated with a peaceful solo demonstration. The Court emphasised the highly intrusive nature of facial recognition linked to public-space cameras and required a high level of justification for such interference to be considered necessary in a democratic society. Case of Glukhin v. Russia – European Court of Human Rights – July 2023 — verified official judgment. The Court’s updated data-protection case-law guide reiterates that live facial recognition used through CCTV to locate and arrest an individual connected with peaceful protest demands the highest level of justification. Guide on Article 8 of the European Convention on Human Rights: Data Protection – European Court of Human Rights – February 2026 — verified official guide. For Western Balkan governments subject to the European Convention, the implication is direct: technical capability cannot create its own lawful purpose. A police authority must demonstrate foreseeability of the legal basis, necessity, proportionality, safeguards against arbitrary use and effective remedies. Protest-related searches present an especially high burden because the same act—appearing in a public place—may represent constitutionally protected assembly rather than criminal conduct. Retrospective identification can be as politically consequential as live recognition: the absence of immediate intervention does not remove the chilling effect if participants can be identified days later. The relevant audit period must therefore extend beyond the protest itself and include later image searches, gallery enrolments, cross-camera queries and dissemination to employers, universities or administrative agencies. A compliant platform should technically prevent general-purpose protest searches unless a narrowly defined legal condition is recorded. It should reject queries lacking a valid case identifier, preserve the initiating selector and alert the independent supervisory authority when protected civic activity intersects with biometric processing.
Domestic abuse, supplier access and foreign leverage are separate hypotheses
Analytical integrity requires separating three propositions often collapsed into a single narrative. The first proposition is that domestic authorities may use surveillance technology against political opponents, journalists or protesters. The second is that the supplier or its personnel possess technical access enabling them to view, modify or extract information. The third is that the supplier or the Chinese state exploits that access or dependency to influence Balkan foreign policy. Evidence for the first does not prove the second; evidence for the second does not prove the third. Domestic political abuse can occur through a completely sovereign European platform. Conversely, a foreign technician may possess legitimate supervised maintenance access without viewing operational data. Geopolitical leverage requires an additional mechanism: threatened suspension of support, conditional financing, privileged intelligence access, coercive requests, vulnerability exploitation or credible ability to disrupt essential services. The public primary-source record examined here does not prove that China receives Serbian biometric data or has used Safe City infrastructure to compel a Serbian political decision. Huawei’s audited reporting states that the company assessed cybersecurity and privacy risks across more than 4,000 suppliers and held more than 890 security and privacy certifications as of its 2025 reporting. Huawei 2025 Annual Report – Huawei – March 2026 — verified audited corporate report. Those metrics document the company’s declared security-governance scale but do not establish the configuration or access controls of a particular Balkan police system. Equally, geopolitical concern cannot be dismissed solely through corporate-level assurance. The decisive evidence must be deployment-specific: administrator lists, remote-access routes, encryption-key ownership, update authority, incident records, data-export telemetry, support contracts and financing covenants. The correct intelligence judgement is therefore conditional: domestic political-use risk is substantiated as a governance concern; supplier-enabled access remains technically plausible but deployment-specific; executed Chinese geopolitical coercion remains unproven in the verified record.
| Proposition | Current judgement | Evidence presently available | Evidence still required | Analytic confidence |
|---|---|---|---|---|
| Domestic authorities possess extensive surveillance capability | Supported | Safe City ambition, public-space surveillance policy, regulatory review | Complete deployed-function inventory | High |
| Facial-recognition processing occurred systematically | Unresolved | Commission demanded verification and legal clarification | Match logs, licence status and audit records | Low |
| Serbian activists and journalists faced surveillance | Officially reported as a concern | UN and Council of Europe records | Case-level attribution and technical mechanism | Medium |
| Huawei retained privileged operational access | Not established | Comprehensive-solution and maintenance plausibility | Account, VPN, session and contract evidence | Low |
| Serbian biometric data were transferred to China | Not established | No qualifying primary proof identified | Network, export, cloud and forensic evidence | Very low |
| China used surveillance dependency for political coercion | Not established | General dependency mechanism only | Conditional support, request or retaliation evidence | Very low |
| EU accession can constrain the system | Strongly supported | AI Act, Commission monitoring and accession leverage | Technical enforcement and funded implementation | High |
Chinese cyber norms and the asymmetry of cross-border assurance
Chinese domestic regulation is analytically relevant because it demonstrates that Beijing recognises facial data as sensitive and treats cross-border access as a legally significant event. China’s 2025 facial-recognition security rules require necessity, defined purposes and security safeguards; official explanations specify encryption, security auditing, access control, authorisation management, intrusion detection and defensive measures. They also require public-space facial-recognition installations to be necessary for public security and accompanied by visible notices. Measures for the Security Management of Facial Recognition Technology Applications – Cyberspace Administration of China and Ministry of Public Security – March 2025 — verified Chinese government text. Questions and Answers on the Measures for the Security Management of Facial Recognition Technology Applications – Cyberspace Administration of China – March 2025 — verified official explanation. China’s Data Security Law defines data processing broadly to include collection, storage, use, processing, transmission, provision and disclosure, and embeds data security within national sovereignty and security policy. Data Security Law of the People’s Republic of China – National Bureau of Statistics of China – March 2025 republication of the 2021 law — verified Chinese government text. These provisions do not prove that Chinese law
Sovereignty and Political Pressure: Biometrics, Protest Monitoring, Policing, Intelligence Access and Geopolitical Leverage
Sovereignty begins with control over purposes, not ownership of equipment
Digital sovereignty in an urban-surveillance environment is not established merely because cameras, servers and biometric databases are physically located inside national territory or formally owned by a ministry. It exists only when the state can independently determine and enforce the purposes for which information is collected, the persons who may access it, the algorithms applied to it, the duration of retention, the databases against which it is compared, the conditions under which it produces police action and the circumstances in which every function can be suspended or removed. This definition separates territorial control from functional control. A Balkan government may own the equipment but remain dependent on a foreign supplier for firmware, licences, maintenance credentials or model updates; conversely, it may possess technically autonomous infrastructure yet use it domestically without lawful necessity, independent supervision or effective remedies. The first condition is a foreign-dependence risk; the second is a democratic-governance risk. They can coexist, but evidence of one does not prove the other. The Serbian case illustrates the distinction. Huawei stated in 2019 that the Serbian Ministry of Interior wanted a Safe City covering Belgrade and eventually the entire country and that Huawei proposed a comprehensive solution. Huawei Enterprise 01/2019 – Huawei – January 2019 — verified corporate publication. The European Commission subsequently recorded that the Ministry suspended biometric-data processing after negative opinions concerning its street-surveillance impact assessment and that the proportionality and necessity of public-space surveillance and facial-recognition processing still required evaluation. Serbia 2023 Report – European Commission – November 2023 — verified official document. These sources demonstrate strategic ambition and regulatory conflict. They do not, standing alone, prove systematic protest identification, Chinese access to Serbian data or geopolitical coercion by Beijing.
| Sovereignty dimension | Governing question | Sovereign condition | Sovereignty-deficit condition |
|---|---|---|---|
| Territorial | Where are data and compute resources located? | All critical locations documented | Unknown replicas, backups or support endpoints |
| Cryptographic | Who controls keys and certificates? | National authority can rotate and revoke them | Supplier retains exclusive signing or recovery power |
| Functional | Who enables or disables analytics? | Nationally controlled, logged configuration | Supplier licence or remote command controls function |
| Informational | Who can retrieve raw and derived data? | Complete attribution and purpose limitation | Shared, foreign or unlogged privileged access |
| Algorithmic | Who validates models and thresholds? | Independent testing and version approval | Opaque model changes or supplier-defined thresholds |
| Legal | Which law authorises each use? | Specific purpose, necessity and proportionality | Generic policing mandate or retrospective justification |
| Institutional | Who investigates misuse? | Independent regulator with technical access | Supervisory body lacks access, staff or enforcement power |
| Operational | Can the state continue without the supplier? | Tested independent recovery and maintenance | Disconnection causes critical service failure |
| Political | Can surveillance be directed against lawful dissent? | Judicially constrained and auditable use | Executive discretion with weak remedies |
| Exit | Can components and data be migrated? | Enforceable portability and funded transition | Proprietary formats make replacement prohibitive |
Biometrics converts public presence into persistent identity
Biometric surveillance changes the political meaning of public space because it converts visible presence into machine-searchable identity. Conventional video permits an investigator to review a scene; facial recognition can associate a person with a reference record, retrieve earlier appearances and generate a longitudinal movement history. The technical chain generally comprises face detection, landmark alignment, feature extraction, conversion into a biometric template, comparison with a reference gallery, similarity scoring, threshold application and operator adjudication. Each stage can create error or abuse. A false detection may crop the wrong face; low-quality imagery may generate an unstable template; a large gallery increases the absolute number of false candidates; an aggressively low threshold raises recall but also false positives; and an operator may defer to the apparent objectivity of the ranking. The political effect does not require perfect accuracy. A system that occasionally identifies demonstrators correctly, or merely creates a credible perception that it can, can impose a chilling effect on assembly, association and anonymous participation. The European Court of Human Rights established in Glukhin v. Russia that using facial recognition to identify and locate a peaceful protest participant constituted a highly intrusive interference requiring a correspondingly high level of justification. Case of Glukhin v. Russia – European Court of Human Rights – July 2023 — verified official judgment. The Court’s updated data-protection guide emphasises the especially intrusive character of live facial recognition in public CCTV environments and the high justification threshold required under the European Convention. Guide on Article 8 of the European Convention on Human Rights: Data Protection – European Court of Human Rights – February 2026 — verified official guide. Although the judgment concerns Russia rather than Serbia, its legal reasoning is directly relevant to all Council of Europe systems assessing biometric identification of peaceful demonstrators.
| Biometric mode | Technical operation | Surveillance reach | Primary political risk | Essential control |
|---|---|---|---|---|
| One-to-one verification | Compares person with claimed identity | Specific transaction | Compelled biometric authentication | Alternative non-biometric method |
| One-to-many identification | Searches probe against reference gallery | Everyone captured may be queried | Anonymous presence becomes attributable | Narrow gallery and judicially defined purpose |
| Live identification | Processes streams with minimal delay | Continuous public-space population | Immediate intervention against assembly | Exceptional authorisation and strict geofencing |
| Retrospective identification | Searches stored video after an event | Historical reconstruction | Later identification of protest participants | Case-specific warrant and query logging |
| Person re-identification | Tracks appearance across cameras | Cross-camera movement without a name | Persistent tracking before identity is known | Short retention and constrained cross-camera search |
| Attribute classification | Estimates appearance or behaviour | Population sorting | Discriminatory profiling | Ban sensitive-attribute inference |
| Relationship inference | Correlates co-presence and repeated contact | Social-network reconstruction | Association treated as suspicion | Evidentiary threshold and independent review |
| Emotion or intention inference | Attempts to infer internal state | Highly speculative population assessment | Protest behaviour pathologised as threat | Prohibition or non-operational research separation |
| Watchlist alerting | Compares observations with target list | Continuous target detection | Secret list with weak challenge rights | Provenance, expiry and appeal mechanism |
| Template retention | Stores derived biometric vector | Potentially indefinite future reuse | Function creep after raw video deletion | Purpose-specific deletion and cryptographic erasure |
Protest monitoring is a sequence of escalating functions
Protest monitoring should not be treated as a binary question of whether police “used facial recognition.” Authorities can exercise political pressure through a graduated chain beginning before any demonstration and continuing long after it. Before an event, intelligence units may combine permit information, publicly available organising material, prior police files and location data to identify organisers or forecast attendance. During the event, cameras may estimate crowd density, detect banners, follow vehicles, track individuals between camera zones or record interactions around entrances and transport hubs. After the event, retrospective analytics can identify participants, reconstruct movement, infer associations and connect individuals to administrative, employment or criminal-investigation records. The coercive result can arise without arrest: questioning, repeated identity checks, warnings to employers or universities, selective tax scrutiny, travel friction, reputational leaks and inclusion in security databases may collectively deter participation. In Serbia, the UN Special Rapporteur on education and other mandate holders reported allegations of intimidation, surveillance and pressure affecting student-led mobilisation. These remain allegations requiring investigation, not judicial findings. Serbia Must Halt Crackdown on Student Movement, Uphold Human Rights and Academic Freedom – Office of the UN High Commissioner for Human Rights – August 2025 — verified official statement. The Parliamentary Assembly of the Council of Europe later expressed concern about revelations involving surveillance of Serbian journalists and activists and urged effective investigations and accountability. Progress of the Assembly’s Monitoring Procedure, Resolution 2635 – Parliamentary Assembly of the Council of Europe – June 2026 — verified official resolution. Neither source attributes those alleged practices specifically to Huawei’s Safe City platform. A disciplined assessment must therefore maintain separate confidence levels for the existence of political pressure, the technical mechanism used and the role of any foreign-origin system.
Political-Surveillance Escalation Chain
Pre-Event Intelligence
Spatial Collection
Machine Enrichment
Identity Resolution
Network Reconstruction
Administrative Fusion
Intervention & Coercion
Deterrence Feedback Loop
Policing value and democratic risk must be measured separately
Urban-surveillance systems can provide legitimate policing value, including locating missing persons, reconstructing serious offences, managing traffic incidents, protecting critical sites and improving emergency response. That value cannot be assumed from vendor claims or arrest totals; it must be measured through attributable outcomes, counterfactual comparison and error costs. A platform that generates thousands of alerts but contributes little unique evidence may create administrative burden while normalising mass collection. Conversely, a tightly governed retrospective search used for a narrowly defined violent offence may produce significant value with a smaller intrusion than continuous live identification. The analytical framework should therefore separate effectiveness E from rights intrusion I and political-abuse potential P. A use case is not justified merely because E exceeds zero; it must satisfy legality, necessity and proportionality, and less intrusive alternatives must be insufficient. The EU AI Act’s treatment of real-time remote biometric identification for law enforcement reflects precisely this structure. It limits such use in publicly accessible spaces to narrowly framed circumstances and requires safeguards including authorisation and consideration of the consequences for rights and freedoms. Regulation (EU) 2024/1689 – European Parliament and Council – July 2024 — verified official text. Serbia’s 2024 Commission assessment stated that it still had to be verified whether personal data had been processed with facial-recognition software and connected that issue to emerging EU prohibitions and safeguards. Serbia Report 2024 – European Commission – October 2024 — verified official document. The evidentiary phrase “has to be verified” is strategically important: uncertainty concerning use is itself a governance weakness when the state possesses infrastructure capable of intrusive processing.
| Police use case | Potential public value | Intrusion level | Misuse pathway | Minimum evidentiary threshold |
|---|---|---|---|---|
| Missing vulnerable person | Immediate protection of life | Medium–high | Gallery retained after incident | Documented urgency and automatic expiry |
| Imminent terrorism threat | Prevention of mass casualty event | Very high | Threat definition expanded politically | Specific intelligence and judicial authorisation |
| Serious violent offence | Identification of suspect | High | Broad retrospective search of bystanders | Defined offence and temporal-spatial boundary |
| Routine property crime | Investigative efficiency | Medium–high | Normalisation of population-wide search | Demonstrated necessity beyond ordinary methods |
| Traffic enforcement | Road safety and evidence | Medium | Plate data converted into movement profiles | Strict purpose separation and short retention |
| Crowd safety | Density and emergency management | Low if anonymous | Anonymous analytics converted into identification | Technical prohibition on identity linkage |
| Protest violence | Identification of specific offender | High | Entire assembly treated as suspect population | Individualised evidentiary basis |
| Peaceful protest attendance | Minimal legitimate value | Extreme political impact | Network mapping and deterrence | Presumptive prohibition |
| Border identity check | Identity and document integrity | Medium | Cross-purpose domestic tracking | Clear border mandate and database separation |
| Intelligence watchlisting | National-security detection | Extreme | Secret criteria and weak challenge rights | Independent authorisation, review and expiry |
Intelligence access is a graph of permissions, not a single backdoor
The question of intelligence access must be framed more precisely than the politically charged question of whether “China can see the cameras.” Access can occur through several distinct mechanisms: direct remote administrator access; supplier diagnostics; software-update infrastructure; cloud dashboards; licence-validation traffic; domestic-system integrators; compromised credentials; supply-chain vulnerabilities; lawful government requests in the supplier’s home jurisdiction; covert intelligence operations; or data voluntarily exported by the purchasing government. These mechanisms have different probabilities, evidence signatures and attribution requirements. A remote-support account does not prove that data were extracted; an external network connection does not prove Chinese government control; Chinese national law does not prove that every overseas deployment is technically accessible from China; and a vendor’s general cybersecurity assurance does not prove the absence of system-specific vulnerabilities. Huawei’s audited 2025 reporting states that the company assessed cyber and privacy risks among more than 4,000 suppliers and held more than 890 security and privacy certifications. Huawei 2025 Annual Report – Huawei – March 2026 — verified audited corporate report. These are relevant corporate-governance indicators but cannot replace deployment-level examination of Serbian or Balkan access logs, firmware, administrative accounts and data routes. China’s Data Security Law regulates data processing and contains provisions concerning official data requests and the handling of foreign judicial or law-enforcement demands for data stored in China. Data Security Law of the People’s Republic of China – National Bureau of Statistics of China – March 2025 publication of enacted law — verified Chinese government text. Its relevance must be bounded: it establishes a Chinese legal environment for data and official authority, but it does not establish that Balkan police data are stored in China or accessible to a Chinese supplier.
| Access pathway | Actor | Required precondition | Observable artefact | Attribution confidence if found |
|---|---|---|---|---|
| Local operator query | Police or intelligence officer | Valid or abused domestic credentials | Query and case logs | High for domestic action |
| Local privileged administration | Ministry or integrator engineer | Administrator role | Configuration and session logs | High if identities are individualised |
| Supplier remote support | Vendor technician | VPN, agent or support gateway | Session source, commands, ticket record | High for access; extraction still separate |
| Cloud management | Supplier or customer cloud administrator | Active cloud tenancy | API calls, cloud audit records | High if logs are complete |
| Update-channel compromise | Supplier, attacker or intelligence service | Trusted update mechanism | Package hash, signing chain, changed binary | Medium until actor is independently attributed |
| Shared credentials | Unknown insiders or former staff | Non-individual administrator account | Concurrent or anomalous logins | Low attribution, high control failure |
| Domestic intelligence fusion | National security service | Legal or informal database access | Cross-system query pattern | High if authorisation records exist |
| Supplier-home-state legal request | Foreign authority | Data or control reachable in jurisdiction | Legal demand and disclosure record | High only with documentary evidence |
| Covert exfiltration | Foreign intelligence or criminal actor | Vulnerability or implanted capability | Unauthorised traffic and forensic artefacts | Variable; technical origin is not state attribution |
| Government-to-government sharing | Balkan and foreign authorities | Formal or informal cooperation | Transfer record and recipient logs | High when documented |
The access-control model must assume multiple adversaries
A credible security model cannot treat the Chinese supplier as the only potential adversary. The same architecture may be exploited by a domestic ruling party, corrupt police official, organised-crime network, commercial intelligence actor, foreign service, hostile cyber group or contractor seeking financial leverage. Each actor prefers different access. Domestic political actors may use legitimate credentials and lawful-looking queries, leaving no malware. Criminal groups may seek live locations, evidence deletion or identity records. Foreign intelligence services may target remote-management infrastructure, maintenance laptops or software-update chains. A supplier does not need to cooperate for its products to become the attack surface through which another actor enters. This multi-adversary model changes mitigation priorities: excluding a particular vendor cannot compensate for shared administrator accounts, weak logging or unconstrained police queries. At the same time, robust domestic access controls do not eliminate supplier-dependence risk if firmware, recovery keys or licences remain externally controlled. The correct design applies zero trust principles to both local and foreign actors: every account must be individually identified; every privileged session explicitly authorised; every query attached to a lawful case purpose; every data export recorded; every software update verified; and every sensitive action subject to separation of duties. The access graph should be continuously reconstructed from identity providers, VPN concentrators, application logs, database audit records, endpoint telemetry and physical-access systems. Unexplained privileges must be treated as incidents, not administrative anomalies. The investigation must also search for negative-space evidence: periods in which logging was disabled, clock synchronisation failed, accounts were created and removed quickly, or support activity occurred without a ticket. The most serious sovereignty failure is not necessarily a discovered foreign connection. It may be the inability to determine retrospectively whether such a connection existed because the system was never designed to produce trustworthy evidence.
| Threat actor | Primary objective | Preferred access | Likely observable behaviour | Most effective control |
|---|---|---|---|---|
| Domestic political executive | Monitor opposition and protest | Lawful-looking operator queries | Searches around demonstrations or organisers | Independent query audit and judicial approval |
| Police insider | Personal, criminal or political misuse | Existing credentials | Off-case queries and selective exports | Individual attribution and behavioural analytics |
| Domestic integrator | Preserve commercial control | Administrator and maintenance accounts | Undocumented configuration changes | Segregated access and source-session recording |
| Foreign supplier technician | Maintenance or potential intelligence access | Remote privileged session | Diagnostic collection and system commands | Just-in-time nationally approved access |
| Foreign intelligence service | Strategic collection or disruption | Supply chain, vulnerability or credentials | Covert persistence and staged extraction | Network segmentation and independent forensics |
| Organised crime | Track targets and neutralise evidence | Bribed insider or stolen account | Victim-specific searches and deletion attempts | Dual control and tamper-evident logs |
| Cybercriminal group | Extortion or data sale | Internet-exposed service | Bulk encryption, export or credential attacks | Isolation, patching and resilient backup |
| Political proxy or contractor | Plausibly deniable targeting | Temporary or shared accounts | Short-lived burst around sensitive event | Prohibition of shared accounts and rapid review |
| Data broker | Commercial exploitation | Exported archives or metadata | Repeated bulk extracts | Export controls and watermarking |
| Future successor government | Retrospective political targeting | Historical archive and templates | Searches of past assemblies and networks | Enforced deletion and purpose-bound cryptography |
Geopolitical leverage operates through dependence before coercion
Geopolitical leverage does not require a confirmed stream of biometric data flowing to Beijing. It can emerge from asymmetric dependence: one party controls a resource, capability or timetable that the other cannot replace without substantial cost. In a surveillance system, that resource may be security patches, firmware-signing authority, analytics licences, specialist engineering, storage formats, device certificates, technical documentation, credit arrangements or compatibility with other infrastructure. The leverage remains latent until a political dispute makes continuity valuable. A government that believes exclusion of the supplier would impair policing, require large capital expenditure or reveal earlier procurement failures may moderate its diplomatic behaviour even if the supplier never issues an explicit threat. This is anticipatory compliance, a form of structural influence that is difficult to observe because it operates through expected cost rather than documented coercion. However, dependence alone cannot be described as Chinese geopolitical pressure. H₂, commercial lock-in, must remain analytically distinct from H₄, deliberate exploitation of dependence. Evidence for H₄ would require an identifiable linkage between a political demand and a threatened or executed change in support, finance, access, disclosure or operational capability. Without that linkage, the strongest defensible conclusion is that the architecture creates potential leverage. The European Commission’s 2026 ICT Supply Chain Security Toolbox recommends supplier assessment, multi-vendor strategies and measures to overcome high-risk dependencies precisely because supply-chain concentration can produce strategic exposure before any malicious act occurs. ICT Supply Chain Security: EU Adopts a Toolbox to Mitigate Risks – European Commission – February 2026 — verified official publication. For the Balkans, the accession process creates a competing leverage structure: China may benefit from installed-system dependence, while the EU controls regulatory alignment, market access and accession incentives.
Geopolitical Leverage Mechanism
Technical Concentration
Vendor Lock-InHigh Replacement Cost & Migration Delay
Switching FrictionGovernment Expectation of Operational Disruption
Policy AnticipationPotential Structural Influence
Leverage RealizationChina’s domestic biometric rules create a revealing normative contrast
Chinese official sources demonstrate that Beijing itself recognises facial information as highly sensitive and requires security, necessity and purpose controls in domestic non-exempt applications. China’s facial-recognition management measures, effective from June 2025, require that public-space facial-recognition installations be necessary for public security, that collection areas be reasonably determined, that prominent notices be displayed and that systems employ encryption, security auditing, access control, authorisation management and intrusion detection. Measures for the Security Management of Facial Recognition Technology Applications – Ministry of Justice of the People’s Republic of China – March 2025 — verified Chinese government text. The Cyberspace Administration’s official explanation additionally emphasises legality, necessity, minimisation and separate consent where consent forms the legal basis. Expert Interpretation: Regulating Facial Recognition Applications and Protecting Facial Information – Cyberspace Administration of China – March 2025 — verified Chinese government publication. These provisions should not be misread as demonstrating that China and the EU apply equivalent limits to public-security surveillance; their institutional structures, exemptions, judicial environments and enforcement systems differ. Their analytical value lies elsewhere: they establish that security auditing, access control, necessity and visible notice are not alien or technically impractical requirements for Chinese-origin technology. Balkan purchasers should therefore be able to demand at least equivalent technical documentation and protection from Chinese suppliers. A supplier cannot credibly argue that logging, encryption or access governance are incompatible with its product ecosystem when Chinese domestic rules explicitly require such safeguards. The geopolitical inquiry should also test whether exported configurations offer less transparency or weaker privacy-by-design than domestic Chinese deployments. Such a divergence would not prove malign intent, but it would reveal regulatory arbitrage in which governance weakness in recipient states becomes a competitive advantage.
| Control domain | Chinese 2025 facial-recognition measure | EU AI Act direction | Balkan audit implication |
|---|---|---|---|
| Necessity | Public-space installation must be necessary for public security | Law-enforcement biometric use limited by necessity and specified grounds | Generic “security” justification is insufficient |
| Notice | Prominent signage required in public spaces | Transparency and information duties vary by use | Physical and digital notice should be verified |
| Data minimisation | Minimum necessary processing emphasised | Data governance and purpose limitation required | Collecting every available attribute should be prohibited |
| Security | Encryption, access control and intrusion defence required | High-risk systems require technical and governance controls | Supplier must expose security configuration for audit |
| Auditability | Security auditing required | Logging and traceability central to high-risk compliance | Immutable logs must cover queries and administration |
| Consent | Separate consent where consent is the legal basis | Police use cannot be legitimised by fictional public-space consent | Legal basis must be explicit and non-circular |
| Alternatives | Non-facial methods preferred where equivalent | Less intrusive means inform necessity analysis | Facial recognition cannot be default convenience |
| Public security | Creates an important exception context | Narrow exceptions and authorisation conditions | Scope of “public security” must be independently constrained |
| System registration | Filing obligations apply at specified processing scale | Registration duties apply to high-risk systems | Candidate states need authoritative system inventories |
| Data export | Separate Chinese data-export rules may apply | EU transfers require legal safeguards | Balkan systems must document every foreign-access route |
Political-pressure indicators must be event-linked
The strongest OSINT method for determining whether surveillance supports political pressure is event-linked temporal analysis. Investigators should construct a timeline around protests, elections, strikes, environmental campaigns and opposition events, then compare system activity with normal baselines. Relevant indicators include sudden creation of watchlists, increased biometric-gallery enrolment, expanded camera retention, deployment of mobile command units, spikes in retrospective queries, new cross-agency API calls, emergency maintenance, temporary administrator accounts or exports concentrated around protest locations. Each indicator is ambiguous alone. Increased video retention may support a legitimate investigation into violence; a new watchlist may concern a specific security threat; maintenance may coincide accidentally with an event. Confidence rises when multiple independent indicators converge and when the resulting police or administrative actions disproportionately affect peaceful participants. Investigators must also control for alternative explanations through an Analysis of Competing Hypotheses. H₁ holds that activity reflects ordinary event security; H₂ that authorities collect broadly because of institutional habit rather than political direction; H₃ that surveillance is intentionally used to identify and deter lawful dissent; H₄ that a supplier or foreign actor exploits the event to obtain intelligence; H₅ that public allegations overstate technical capability and rely on the visibility of Chinese hardware rather than operational evidence. The Parliamentary Assembly’s 2026 resolution expressing concern about surveillance of Serbian journalists and activists increases the prior probability of H₃ at the ecosystem level, but does not resolve the mechanism or supplier. Progress of the Assembly’s Monitoring Procedure, Resolution 2635 – Parliamentary Assembly of the Council of Europe – June 2026 — verified official resolution. System logs, case files and access records remain the decisive evidence.
| Indicator | Baseline expectation | Politically sensitive deviation | Alternative explanation | Confidence multiplier |
|---|---|---|---|---|
| Watchlist size | Stable, case-driven enrolment | Rapid expansion before protest | Serious-threat intelligence | 2 if targets are peaceful organisers |
| Query volume | Proportional to ordinary cases | Large spike around assembly | Violence investigation | 2 if queries precede violence |
| Retention period | Fixed published schedule | Temporary extension for event areas | Evidence preservation | 1.5 if no documented case basis |
| Camera configuration | Stable fields of view | Reorientation toward meeting points | Crowd-safety planning | 2 if identity analytics also activated |
| Cross-agency requests | Case-specific exchange | Bulk requests for student or activist data | Emergency coordination | 3 if unrelated administrative datasets are used |
| Remote support | Scheduled maintenance | Unplanned session during political event | Genuine system fault | 2 if commands touch analytics or exports |
| Gallery enrolment | Authorised wanted persons | Social-media or event photographs added | Missing-person search | 4 with documentary proof |
| Operator accounts | Stable named personnel | Temporary or shared accounts created | Staffing surge | 2 if logs later disappear |
| Police intervention | Individualised reasonable suspicion | Questioning based on attendance or association | Public-order management | 4 if biometric output is cited |
| Public deterrence | Normal political participation | Participants report credible identification fear | General political climate | 1.5 unless technical mechanism is confirmed |
Bayesian update and five-year pressure scenarios
The revised Bayesian model should distinguish domestic political exploitation from foreign geopolitical leverage. For the period beginning in 2026, the proposed priors are H₁, predominantly legitimate policing, 24%; H₂, bureaucratic overcollection and commercial dependence without coordinated repression, 28%; H₃, deliberate domestic political monitoring, 25%; H₄, exploitable foreign geopolitical leverage, 13%; and H₅, effective EU-driven constraint, 10%. These are analytical judgements rather than empirical frequencies. The official concerns about surveillance of Serbian journalists and activists increase H₃ relative to a technology-only baseline. The lack of verified evidence tying those concerns specifically to a Chinese Safe City platform limits the update. Huawei’s documented comprehensive proposal and the difficulty of verifying actual biometric processing increase H₂ because opacity and integration produce lock-in even without abuse. H₄ remains lower because potential access and dependence are not evidence of executed foreign coercion. H₅ begins low but rises across the five-year horizon as AI Act alignment, accession benchmarks and ICT supply-chain policy become operational. In a Monte Carlo model with 100,000 conceptual paths, the principal variables are biometric integration B, protest pressure P, domestic oversight O, foreign-access opacity F, supplier substitutability S and EU conditionality E. The adverse scenario—high domestic political monitoring combined with unresolved foreign dependence—becomes most likely when B and P exceed 70, O remains below 40, F exceeds 65 and S remains below 35. The stabilised hybrid scenario remains the baseline because governments can restrict live identification while preserving retrospective capabilities and legacy infrastructure. A rights-protective transition requires not merely new legislation, but verified deletion of unlawful galleries, judicial control of queries, independent inspection of source and destination logs, and demonstrated supplier substitutability.
| Hypothesis | 2026 prior | 2031 central estimate | Main upward indicator | Main downward indicator |
|---|---|---|---|---|
| H₁ — Predominantly legitimate policing | 24% | 17% | Narrow case use and measurable public-safety outcomes | Protest-linked bulk queries |
| H₂ — Bureaucratic overcollection and lock-in | 28% | 29% | Persistent opacity and proprietary integration | Successful independent migration |
| H₃ — Domestic political monitoring | 25% | 22% | Event-linked identification and administrative retaliation | Judicial control and transparent query audits |
| H₄ — Foreign geopolitical leverage | 13% | 12% | Political conditionality tied to support or access | National keys, audited sessions and multi-vendor operation |
| H₅ — EU-driven constraint | 10% | 20% | Accession benchmarks tied to deployed technical functions | Formal legal alignment without system inspection |
Outlook 2026–2031: the decisive contest will concern latent capability
Between 2026 and 2031, the central sovereignty contest will move from visible camera acquisition to control over latent software functions and cross-database access. During 2026–2027, political debate is likely to focus on whether facial recognition is formally active; this framing is too narrow because retrospective search, person re-identification, plate correlation and network analysis can create substantial political intelligence without continuous live matching. During 2027–2028, governments will face pressure to inventory high-risk AI systems and establish data-protection impact assessments, but authorities may define systems by declared purpose rather than actual capability. During 2028–2029, the decisive issue will become database separation: whether police video platforms can query identity, border, vehicle and telecommunications records through unified interfaces. During 2029–2030, political crises or election disputes may provide the operational test of whether safeguards survive executive pressure. During 2030–2031, EU accession progress should increasingly depend on technical demonstrations rather than statutory promises: candidate governments should prove that prohibited functions are removed, remote access is controlled, watchlists have lawful provenance and independent regulators can inspect complete logs. The most likely outcome is a hybrid surveillance regime: live biometric identification restricted or publicly denied, retrospective and metadata-based capabilities retained, Chinese-origin components preserved where replacement is costly, and European controls applied unevenly. The worst outcome is not necessarily Chinese remote command of Balkan police systems. It is a layered sovereignty deficit in which domestic authorities can use intrusive analytics without effective oversight, cannot independently verify foreign access and cannot replace the supplier without unacceptable disruption. The mitigation architecture must therefore address rights, cybersecurity and geopolitics simultaneously. Any policy that treats only one dimension will leave the other two available for exploitation.
| Year | Principal contest | Technical indicator | Political indicator | Decision threshold |
|---|---|---|---|---|
| 2026 | Inventory and legal classification | Complete module, model and database register | Regulator receives unrestricted inspection access | Unknown function count approaches zero |
| 2027 | Watchlist governance | Provenance and expiry attached to every identity | Judicial or independent authorisation becomes mandatory | No orphan or politically sourced entries |
| 2028 | Database separation | Purpose-bound API gateways and query limits | Cross-agency requests independently reviewed | Bulk identity access becomes impossible |
| 2029 | Supplier-access control | National keys and recorded just-in-time sessions | Foreign support cannot bypass domestic approval | Every privileged action attributable |
| 2030 | Crisis resilience | Safeguards remain active during protest or emergency | No exceptional mass identification without lawful threshold | Emergency powers automatically expire |
| 2031 | Sovereignty and exit | Vendor-independent restore and migration test | Public report certifies compliance and residual risk | System can operate without supplier dependency |
Required strategic controls
The necessary control regime should be designed around the principle that an intrusive capability must be technically impossible to use outside authorised conditions, rather than merely prohibited by policy. Capture networks should be separated from biometric galleries; live identification should require cryptographic activation tokens issued for a defined location and time; retrospective searches should require a case identifier and independent approval; watchlist entries should carry source, legal basis, confidence, reviewer and expiry metadata; and query results should be watermarked to the operator. Privileged support sessions should be nationally initiated, recorded and automatically terminated, while supplier personnel should never have standing access to raw video or identity databases. Logs must be replicated into a regulator-controlled environment so that the operator cannot erase evidence of misuse. Public-space analytics that support crowd safety should run in an irreversible anonymous mode whenever identity is unnecessary. Data retention should be enforced through cryptographic key destruction rather than discretionary operator deletion. Procurement contracts should require algorithm documentation, threshold transparency, test datasets appropriate to Balkan populations, vulnerability disclosure, software-component inventories, portability and assisted exit. Political safeguards must include notification after surveillance where operationally possible, accessible remedies for false identification, meaningful sanctions for off-purpose searches and protection for technical whistleblowers. The European Commission should condition digital-security assistance on measurable controls rather than equipment acquisition. Domestic parliaments should receive aggregate statistics on biometric searches, rejected alerts, false positives, protest-related requests, emergency authorisations and supplier support sessions. These controls will not eliminate political pressure, but they can convert covert discretion into observable events and raise the cost of abuse. Sovereignty becomes credible when neither the government, the supplier nor a foreign service can exercise hidden unilateral control.
Five-Year Outlook: Competing Hypotheses, Bayesian Indicators, Monte Carlo Scenarios and Early-Warning Thresholds
Forecasting object, baseline and confidence discipline
The five-year forecast covers August 2026–July 2031 and estimates how Chinese-origin surveillance infrastructure in the Western Balkans may evolve across five interacting dimensions: technical expansion, domestic political use, foreign-access exposure, supplier dependence and European regulatory constraint. The model does not estimate whether “China controls Balkan surveillance,” because that proposition collapses several distinguishable outcomes into a single politically charged claim. It instead forecasts observable states: whether biometric functions become active; whether video platforms connect to authoritative identity databases; whether police queries concentrate around protests or political targets; whether suppliers or integrators retain privileged access; whether governments can migrate away from proprietary platforms; and whether EU accession pressure produces technically verifiable restrictions. The evidentiary baseline is asymmetric. Huawei publicly described a comprehensive Safe City solution proposed for Serbia’s Ministry of Interior, with an intended scope beginning in Belgrade and potentially extending nationally. Huawei Enterprise 01/2019 – Huawei – January 2019 — verified corporate publication. The European Commission later recorded that biometric processing had been put on hold pending an adequate legal basis and that the necessity and proportionality of public-space facial recognition remained to be assessed. Serbia 2023 Report – European Commission – November 2023 — verified official document. The 2025 Commission assessment further identified incomplete alignment and implementation weaknesses in Serbian data protection. Serbia Report 2025 – European Commission – November 2025 — verified official document. This evidence establishes capability ambition, regulatory uncertainty and institutional weakness, but not continuous biometric operation, Chinese extraction of police data or executed geopolitical coercion. All probability estimates below are consequently structured analytical judgements, not measurements reported by governments.
| Forecast dimension | Observed baseline, August 2026 | Critical uncertainty | 2031 forecast question |
|---|---|---|---|
| Hardware footprint | Chinese-origin Safe City ambition documented in Serbia | Complete deployed inventory unavailable in admissible primary evidence | Does deployment expand, stabilise or undergo replacement? |
| Biometric capability | Facial-recognition processing subject to unresolved legal and verification questions | Dormant, licensed, enabled and operational functions are not equivalent | Which functions remain technically available and legally usable? |
| Database integration | Potential value depends on identity and police-system connections | Exact interfaces and query permissions are not publicly verified | Are galleries and cross-agency APIs segmented or consolidated? |
| Domestic political use | Official international bodies raised surveillance concerns involving journalists and activists | Specific technical mechanism remains unresolved | Do protest-linked queries become demonstrable and systematic? |
| Foreign access | Supplier dependence creates potential access pathways | No qualifying evidence proves routine Chinese access to Balkan biometric data | Are all support and update pathways nationally controlled? |
| Supplier dependence | Comprehensive platforms create migration and lifecycle dependencies | Exit cost, licence structure and documentation remain uncertain | Can states operate and migrate without original suppliers? |
| EU conditionality | AI, cybersecurity and accession requirements are strengthening | Implementation may remain formal rather than technical | Does accession produce audited operational compliance? |
| Regional diffusion | Other Western Balkan states show differing regulatory and cybersecurity weaknesses | Chinese platform penetration is not uniformly documented | Does the Serbian model diffuse or remain an exceptional concentration? |
Analysis of Competing Hypotheses
The forecast retains six competing hypotheses because a five-hypothesis structure would inadequately separate domestic political exploitation from foreign leverage and genuine European convergence. H₁, bounded public-safety modernisation, holds that governments retain surveillance systems primarily for serious-crime investigation, traffic management and emergency response while intrusive functions remain legally restricted. H₂, commercial and technical lock-in, holds that cumulative procurement, proprietary interfaces and maintenance dependence become the principal strategic consequence even without political misuse or foreign direction. H₃, domestic political-control adaptation, holds that national authorities progressively exploit retrospective facial recognition, person re-identification, plate correlation and cross-database queries to map protests, journalists, activists or opposition networks. H₄, Chinese geopolitical leverage, holds that supplier dependence, support, financing or privileged access is deliberately used to influence diplomatic or regulatory decisions. H₅, EU-constrained hybridisation, holds that candidate governments retain legacy hardware while separating databases, restricting live identification and adding European controls without completing wholesale replacement. H₆, accelerated sovereign migration, holds that systems are technically decomposed or replaced through open standards, national key ownership, multi-vendor operation and independent audit. Initial priors are H₁ 16%, H₂ 24%, H₃ 20%, H₄ 9%, H₅ 25% and H₆ 6%. H₅ receives the largest prior because hybrid outcomes reconcile installed-system inertia with strengthening European constraints. H₂ remains high because lock-in follows from platform economics without requiring deliberate coercion. H₄ remains comparatively low because no admissible primary evidence presently establishes that China has used surveillance-system dependence to coerce a Western Balkan government. The EU’s ICT Supply Chain Security Toolbox explicitly recommends critical-supplier assessment, multi-vendor strategies and mitigation of high-risk dependencies, strengthening the plausibility of H₅ and H₆ over the forecast horizon. Toolbox to Improve ICT Supply Chain Security – European Commission – February 2026 — verified official publication.
| Hypothesis | Description | 2026 prior | Strongest confirming indicator | Strongest disconfirming indicator |
|---|---|---|---|---|
| H₁ | Bounded public-safety modernisation | 16% | Case-specific use, narrow galleries, measurable serious-crime outcomes | Protest-linked bulk queries or persistent tracking |
| H₂ | Commercial and technical lock-in | 24% | Proprietary archive, supplier-only recovery, recurring licence control | Independently completed migration and multi-vendor maintenance |
| H₃ | Domestic political-control adaptation | 20% | Event-linked identification followed by police or administrative pressure | Immutable audits showing no political-purpose queries |
| H₄ | Chinese geopolitical leverage | 9% | Political demand linked to support, finance, access or disclosure consequence | Nationally controlled keys, offline licences and audited support |
| H₅ | EU-constrained hybridisation | 25% | Legacy equipment retained but functions segmented and independently audited | Unrestricted integration or complete sovereign replacement |
| H₆ | Accelerated sovereign migration | 6% | Open interfaces, national recovery and supplier-independent operation | Unfunded plans, proprietary dependencies and delayed procurement |
Bayesian update framework
Bayesian updating converts new evidence into probability changes through likelihood ratios rather than intuitive narrative escalation. For each indicator Iₙ and hypothesis Hₖ, the posterior odds equal the prior odds multiplied by the likelihood ratio associated with observing Iₙ if Hₖ is true relative to observing it if Hₖ is false. The model uses five evidentiary strength bands: LR 1.0–1.3 for weakly diagnostic evidence, 1.3–2.0 for limited evidence, 2.0–4.0 for moderately diagnostic evidence, 4.0–8.0 for strong evidence and above 8.0 only for highly specific, independently corroborated evidence. Negative evidence uses reciprocal ratios. The framework prevents a common OSINT error: repeatedly counting correlated reports as independent confirmation. For example, several official statements citing the same underlying allegation of activist surveillance constitute one evidentiary family, not several independent updates. Similarly, the discovery of Huawei cameras, Huawei servers and Huawei maintenance contracts may all derive from a single procurement decision and must be discounted for dependency. Evidence quality receives four modifiers: source authority Q, directness D, technical specificity T and independence N. A direct regulator audit containing system logs scores more highly than a general political statement; a corporate statement proves what the company claims or offers, but not necessarily what a customer deployed; a government denial has evidentiary value regarding official position but limited value concerning concealed activity unless supported by audit. The European Court of Human Rights’ determination that public-space facial recognition used to locate a protest participant requires exceptionally strong justification establishes a legal discriminator but does not provide evidence about Balkan deployment. Case of Glukhin v. Russia – European Court of Human Rights – July 2023 — verified official judgment. Forecast updates must therefore classify each observation as architectural, operational, political, legal or attributional before assigning likelihood.
| Indicator code | Observable indicator | Primary hypothesis favoured | Illustrative LR | Required corroboration |
|---|---|---|---|---|
| I₁ | Public, complete system inventory with model and licence data | H₅ or H₆ | 2.5 | Regulator verifies deployed assets against inventory |
| I₂ | Hidden biometric module discovered on active server | H₃ or H₂ | 3.5 | Hash, configuration, service and usage evidence |
| I₃ | Protest-period surge in identity queries preceding violence | H₃ | 5.0 | Immutable logs, case-purpose fields and target sample |
| I₄ | Supplier remote session without national ticket | H₂; potentially H₄ | 3.0 | VPN, session and command records |
| I₅ | Verified foreign extraction of biometric or police data | H₄ | 8.0 | Network forensics plus actor attribution |
| I₆ | Support threatened following a political disagreement | H₄ | 7.0 | Documentary linkage between demand and consequence |
| I₇ | Successful supplier-disconnection exercise | H₆ | 5.0 | Independent restore, operation and credential rotation |
| I₈ | AI Act mapping limited to written policy | H₅ weakly | 1.3 | Technical audit absent |
| I₉ | Database interfaces restricted by purpose-bound gateway | H₅ or H₆ | 3.0 | API policies, logs and penetration testing |
| I₁₀ | Facial gallery includes peaceful activists or journalists | H₃ | 8.0 | Gallery export, provenance and identity verification |
| I₁₁ | New supplier-exclusive national expansion contract | H₂ | 4.0 | Contract, scope, interfaces and maintenance annexes |
| I₁₂ | Competitive multi-vendor replacement funded and executed | H₆ | 6.0 | Acceptance testing and demonstrated interoperability |
Indicator dependency and deception controls
Indicators cannot be treated as independent Bernoulli observations because surveillance programmes generate clustered evidence. A new national command centre may simultaneously produce procurement documents, training announcements, additional cameras and increased network traffic; counting each as a separate confirmation of expansion would inflate the posterior. The model therefore groups indicators into six dependency clusters: procurement C₁, architecture C₂, operations C₃, political outcomes C₄, foreign access C₅ and regulation C₆. Evidence within the same cluster receives a diminishing multiplier: the first high-quality observation retains full weight, the second contributes 60%, the third 35%, and further observations contribute 20% unless they are technically independent. Deception and denial require parallel treatment. Authorities may relabel facial recognition as “advanced video analytics,” describe retrospective identification as ordinary archive search or declare a function inactive while retaining executable services and valid licences. Suppliers may provide accurate general assurances that customer data remain locally controlled while a domestic integrator retains unlogged remote access. Critics may commit the reverse error by equating every Chinese camera with active facial recognition or every network connection with Chinese intelligence access. The collection plan must therefore privilege hard discriminators: software manifests, licence entitlements, running services, model files, accelerator utilisation, database query logs, remote-session records, update signatures, packet destinations and case outcomes. China’s 2025 facial-recognition rules require encryption, access control, authorisation management, security auditing and intrusion protection, demonstrating that these controls are technically recognised within the Chinese regulatory environment. Measures for the Security Management of Facial Recognition Technology Applications – Ministry of Justice of the People’s Republic of China – March 2025 — verified Chinese government text. Their existence does not prove equivalent safeguards in exported systems; it strengthens the argument that Balkan purchasers should demand them contractually and verify them technically.
Monte Carlo model architecture
The Monte Carlo model simulates 100,000 five-year paths using twelve variables scored from 0 to 100. Six variables increase sovereignty risk: supplier concentration C, privileged-access opacity A, biometric capability B, database integration D, domestic political stress P and regulatory non-compliance N. Six reduce it: regulator capability R, judicial control J, audit completeness U, supplier substitutability S, EU conditionality E and civil-society detection capacity V. Baseline 2026 values are C 72, A 67, B 61, D 55, P 58, N 59, R 43, J 41, U 32, S 29, E 67 and V 61. These are explicit analytical inputs derived from the architecture and governance assessment, not official country statistics. Each path draws annual changes from bounded triangular distributions because reliable empirical distributions do not exist. Correlations are included: C and A correlate positively at 0.55; B and D at 0.65; P and political-use probability at 0.70; R and U at 0.60; E and N correlate negatively at −0.50; S and C at −0.55. Three shocks are randomly introduced: a political-crisis shock, a major cybersecurity incident and an accession-acceleration shock. Crisis probability begins at 18% annually, cybersecurity shock at 12%, and accession acceleration at 15%; these are scenario assumptions, not measured frequencies. A crisis increases P and raises the probability that latent functions become operational. A cyber incident can either increase dependence, if only the supplier can restore service, or accelerate diversification, if it exposes unacceptable access risk. Accession acceleration raises E, R and U but only produces sustained improvement where budgets and technical staff are available. The model classifies terminal states according to operational characteristics rather than political labels.
| Variable | Meaning | 2026 input | Principal data needed for recalibration | Risk direction |
|---|---|---|---|---|
| C | Supplier concentration | 72 | Asset and contract market share | Higher increases risk |
| A | Privileged-access opacity | 67 | Named accounts, VPN and session records | Higher increases risk |
| B | Available biometric capability | 61 | Module, model, licence and service inventory | Higher increases latent capability |
| D | Cross-database integration | 55 | API map and query permissions | Higher increases surveillance reach |
| P | Domestic political stress | 58 | Protest, election and emergency indicators | Higher raises misuse probability |
| N | Legal and operational non-compliance | 59 | Independent compliance audit | Higher increases rights and accession risk |
| R | Regulator technical capability | 43 | Staff, budget, laboratory and access authority | Higher reduces risk |
| J | Judicial authorisation strength | 41 | Warrant rules and case sampling | Higher reduces political discretion |
| U | Audit completeness | 32 | Log coverage and retention integrity | Higher reduces opacity |
| S | Supplier substitutability | 29 | Migration exercise and alternative maintainers | Higher reduces leverage |
| E | EU conditionality strength | 67 | Accession benchmarks and funding conditions | Higher favours H₅ and H₆ |
| V | Independent detection capacity | 61 | Regulator, parliament and civil-society access | Higher increases exposure of misuse |
Terminal scenarios and probability distribution
The simulation resolves into five terminal scenarios. S₁, sovereign European convergence, combines strong audits, national key ownership, supplier-independent recovery, purpose-bound database interfaces and enforceable biometric restrictions. S₂, regulated hybrid persistence, retains Chinese-origin cameras or servers but separates the most sensitive databases, restricts live identification and subjects maintenance to stronger controls. S₃, opaque commercial lock-in, preserves the platform primarily because replacement costs, proprietary formats and specialist dependence make migration unattractive; political use remains possible but is not systematically demonstrated. S₄, domestic control escalation, combines expanding biometric and metadata capabilities with protest-linked or opposition-linked use by national authorities. S₅, foreign leverage or access event, requires either verified foreign extraction, politically conditioned support or another direct mechanism connecting external influence to system dependence. Under the central parameterisation, the 2031 probabilities are S₁ 17%, S₂ 39%, S₃ 24%, S₄ 16% and S₅ 4%. The low value assigned to S₅ reflects the demanding evidentiary definition and absence of verified current proof, not an assertion that foreign access is impossible. S₂ is modal because it best reconciles installed-system inertia with the EU’s strengthening legal framework. The AI Act creates strict conditions for remote biometric identification and high-risk systems, while the Cyber Resilience Act establishes lifecycle cybersecurity obligations for products with digital elements. Regulation (EU) 2024/1689 – European Parliament and Council – July 2024 — verified official text. Regulation (EU) 2024/2847 – European Parliament and Council – November 2024 — verified official text. Candidate-country convergence will not be automatic, but these rules increase the legal and procurement cost of retaining unverifiable functions.
| Scenario | 2031 probability | Defining technical state | Political condition | Confidence |
|---|---|---|---|---|
| S₁ — Sovereign European convergence | 17% | Multi-vendor, national keys, complete audit, successful migration | Strong regulator and accession execution | Medium–low |
| S₂ — Regulated hybrid persistence | 39% | Legacy hardware retained, sensitive functions restricted | Partial EU alignment and uneven enforcement | Medium |
| S₃ — Opaque commercial lock-in | 24% | Proprietary platform and supplier-dependent maintenance | Political use unproven or episodic | Medium |
| S₄ — Domestic control escalation | 16% | Integrated biometric and cross-database analytics | Protest or opposition monitoring becomes systematic | Medium–low |
| S₅ — Foreign leverage or access event | 4% | Verified external access or politically conditioned dependency | Direct foreign influence demonstrated | Low probability, high impact |
Sensitivity, tail risk and scenario transitions
Sensitivity analysis indicates that privileged-access opacity A, supplier substitutability S, audit completeness U and database integration D exert greater influence on terminal outcomes than the raw number of cameras. Reducing A from 67 to 35 while increasing U from 32 to 70 lowers the combined S₄–S₅ probability more sharply than replacing half the visible camera estate without changing platform access. Increasing S from 29 to 65 materially reduces S₃ and weakens the potential leverage mechanism underlying S₅. Conversely, increasing D above 80 while B remains above 70 produces nonlinear growth in S₄ because identity, vehicle, border and police records become mutually reinforcing. The principal tail risk is a compound event: acute political crisis, emergency legal measures, activation of previously dormant biometric modules, temporary expansion of watchlists, increased retention and emergency supplier support. Each action can be described individually as temporary or security-driven; together they can establish a durable surveillance regime before ordinary safeguards return. Another tail risk is a destructive cyber incident in which restoration depends exclusively on the supplier. Such an incident could strengthen H₂ by demonstrating operational dependence or strengthen H₆ if governments respond with funded diversification. The result depends on political framing and available financing. Huawei’s audited reporting describes extensive cybersecurity and privacy governance, including assessment of risks across more than 4,000 suppliers and more than 890 security and privacy certifications. Huawei 2025 Annual Report – Huawei – March 2026 — verified audited corporate report. These figures support evaluation of corporate security capacity, but they do not determine the state of a specific Balkan deployment. Deployment-level logs, configurations and contracts remain necessary for updating A, U and S.
| Stress test | Parameter shock | Most affected scenario | Directional probability effect |
|---|---|---|---|
| Full regulator access | U rises to 75; R rises to 70 | S₁ and S₂ | Strong increase |
| National cryptographic control | A falls to 30 | S₄ and S₅ | Strong decrease |
| Supplier-exclusive expansion | C rises to 90; S falls to 15 | S₃ | Strong increase |
| Protest crisis | P rises to 85 for two years | S₄ | Strong increase if B and D are high |
| Verified foreign session | A rises to 90; H₄ LR above 5 | S₅ | Sharp increase, still requiring attribution |
| Successful migration exercise | S rises to 75; C falls to 45 | S₁ | Strong increase |
| Cosmetic legal alignment | E rises but U and R remain unchanged | S₂ or S₃ | Little sovereignty improvement |
| Integrated identity gateway | D rises to 85 | S₄ | Nonlinear increase |
| Major cyber incident | A and operational dependence exposed | S₃ or S₁ | Direction depends on response |
| EU-funded replacement | S and U rise; N falls | S₁ | Moderate-to-strong increase |
Early-warning architecture
Early warning must rely on measurable thresholds that trigger collection, audit or policy intervention before the system reaches an irreversible state. The framework uses four levels. Green indicates controlled exposure; amber indicates accumulating vulnerability; red indicates probable loss of sovereign control or serious abuse risk; black indicates an event requiring immediate suspension, forensic preservation and independent investigation. Thresholds should be tested monthly for technical indicators and around every major protest, election or emergency for political-use indicators. A single red indicator may arise from error, but two red indicators from independent clusters should trigger a formal audit. One black indicator is sufficient for escalation. Technical warning should precede public attribution: unexplained encrypted traffic to an external endpoint is a black operational event until investigated, but it is not automatically evidence of Chinese state access. Similarly, a protest-period biometric-query surge is red for domestic misuse, but H₃ should not be confirmed until target purpose and resulting action are verified. The warning system must be protected from the operator it monitors. Logs should be replicated to an independent authority; configuration changes should be cryptographically signed; watchlist additions should require dual approval; and emergency exceptions should expire automatically. The EU’s ICT Supply Chain Security Toolbox provides a horizontal, all-hazards approach to supplier and dependency risk, reinforcing the need to monitor critical suppliers, multi-vendor resilience and high-risk dependence. ICT Supply Chain Security: EU Adopts a Toolbox to Mitigate Risks – European Commission – February 2026 — verified official publication.
| Warning indicator | Green | Amber | Red | Black |
|---|---|---|---|---|
| Uninventoried devices or modules | Below 2% | 2–5% | Above 5% | Unknown critical server or biometric engine |
| Privileged accounts without named owner | 0 | 1 temporary exception | More than 1 or over 24 hours | Active unknown foreign or shared administrator |
| Unrecorded support sessions | 0 | Ticket discrepancy | Session without complete recording | Commands or extraction outside authorised scope |
| External network destinations | Allow-listed only | New destination under review | Unauthorised persistent destination | Confirmed sensitive-data transfer |
| Biometric watchlist growth | Case-linked and stable | Above 10% quarterly | Above 25% or event-linked | Peaceful activists or journalists enrolled |
| Protest-period query volume | Normal baseline | 1.5 times baseline | 3 times baseline | Bulk identity search without individual suspicion |
| Database integration | Purpose-bound interfaces | New interface pending audit | Bulk cross-agency access | Identity, telecom and protest data fused without authority |
| Log integrity | Complete and replicated | Short collection gap | Gap over 30 minutes in critical system | Deliberate deletion or tampering |
| Supplier substitutability | Tested annually | Test delayed | Recovery fails | Supplier disconnection halts essential operation |
| Firmware updates | Signed and locally staged | Documentation incomplete | Unreviewed update | Signature failure or undeclared functionality |
| Retention compliance | Automatic deletion proven | Limited exceptions | Repeated extension | Secret or indefinite political-event retention |
| Regulator access | Immediate and complete | Delayed under 7 days | Material information withheld | Access refused or records destroyed |
Country and regional differentiation
The forecast should not mechanically transfer Serbia’s risk profile to every Western Balkan state. Serbia receives the highest architectural attention because the Huawei Safe City ambition and biometric-law controversy are documented in admissible primary sources. Montenegro, North Macedonia, Albania, Bosnia and Herzegovina and Kosovo possess different combinations of cybersecurity maturity, data-protection alignment, institutional capacity and foreign-supplier exposure. The European Commission reported that Montenegro’s personal-data framework remained unaligned with the EU acquis; North Macedonia continued to show low awareness and insufficient information-technology protection of personal data; Albania’s Total Information Management System retained security and data-protection vulnerabilities; and Bosnia and Herzegovina lacked elements of a unified cybersecurity framework while being urged to implement supplier-risk controls. These conditions represent vulnerability multipliers, not proof of Chinese biometric deployment. Montenegro Report 2025 – European Commission – November 2025 — verified official document. North Macedonia Report 2025 – European Commission – November 2025 — verified official document. Albania Report 2025 – European Commission – November 2025 — verified official document. Regional forecasting should therefore use a two-stage model: first establish actual vendor and system presence through inventories and contracts; then apply governance-risk multipliers. A state with weak data protection but no integrated biometric platform has high susceptibility but lower present capability. A state with advanced infrastructure and strong audit may possess high capability but lower misuse probability. Conflating susceptibility with deployment produces false regional maps and weakens warning accuracy.
| Regional tier | Defining condition | Forecast treatment | Required collection |
|---|---|---|---|
| Tier A — Documented comprehensive ambition | Primary evidence of integrated Safe City proposal or deployment | Full Bayesian and Monte Carlo model | Contracts, architecture, licences, logs and use cases |
| Tier B — Documented Chinese components | Verified devices or network elements but uncertain platform integration | Architecture-first risk assessment | Asset register, firmware and network map |
| Tier C — Governance vulnerability | Weak data protection or cybersecurity, supplier presence unverified | Susceptibility model only | Procurement search and technical inventory |
| Tier D — Controlled deployment | Strong safeguards and limited purpose | Residual-risk monitoring | Independent annual audit |
| Tier E — Unknown | Insufficient admissible primary evidence | No substantive attribution | Priority collection without speculative scoring |
Decision points and collection plan
The five-year model requires formal decision points rather than passive annual reassessment. By the end of 2026, candidate governments should publish or confidentially provide independent regulators with complete surveillance-system inventories, including modules, licences, firmware, databases, remote-access mechanisms and maintenance parties. By mid-2027, every biometric gallery should have documented provenance, legal basis, expiry and challenge procedures, while all privileged accounts should be named and multi-factor authenticated. By 2028, cross-agency data interfaces should operate through purpose-bound gateways with immutable query logs, and prohibited or unjustified functions should be physically removed rather than merely disabled. By 2029, each state should conduct a supplier-disconnection exercise covering licence continuity, credential rotation, backup restoration and vendor-independent operation. By 2030, EU accession reporting should include technical evidence concerning high-risk AI, not only legislative alignment. By 2031, governments should demonstrate migration of a representative subsystem to an alternative supplier without losing evidentiary integrity, functionality or access control. Failure at each decision point updates H₂ or H₃ upward depending on whether the failure concerns technical dependence or political use. Refusal to disclose support pathways updates A, while a failed recovery exercise lowers S. A public law that appears compliant but is not reflected in system configuration increases the probability of S₂ or S₃ rather than S₁. Conversely, a technically verified audit, successful exit exercise and absence of protest-linked misuse across several high-stress events would raise H₆ substantially. Forecasting must remain iterative: every update should publish the changed indicator, likelihood ratio, dependency adjustment, posterior probability and remaining collection gap. This audit trail prevents political actors from selectively presenting favourable model outputs while concealing assumptions.
| Deadline | Mandatory milestone | Verification artefact | Failure consequence |
|---|---|---|---|
| December 2026 | Complete asset, software and access inventory | Regulator-signed reconciliation report | A and U risk scores deteriorate |
| June 2027 | Watchlist and privileged-account governance | Gallery provenance and identity-access register | H₃ rises if political entries appear |
| December 2027 | Independent algorithm and threshold validation | Test protocol, error distribution and version hashes | Biometric use restricted pending compliance |
| June 2028 | Purpose-bound database gateways | API map, rules and immutable query logs | D classified red |
| December 2028 | National control of keys and certificates | Rotation and revocation exercise | A classified red |
| June 2029 | Supplier-disconnection test | Recorded independent operation | S classified red if service fails |
| December 2029 | Protest-event use audit | Query-to-case correlation | H₃ updated using event evidence |
| June 2030 | AI Act operational alignment | System-level conformity and rights assessment | Accession conditionality triggered |
| December 2030 | Multi-vendor interoperability test | Alternative component successfully integrated | H₂ declines if successful |
| July 2031 | Sovereign migration demonstration | End-to-end data and service migration | Final scenario classification |
Strategic forecast judgement
The most probable 2031 outcome is neither a complete Chinese surveillance sphere nor a clean European replacement. It is a regulated but incomplete hybrid in which Chinese-origin hardware and platform components remain operational, live biometric identification is formally restricted, retrospective and metadata capabilities persist, access controls improve unevenly and supplier dependence declines more slowly than legal alignment advances. The central forecast assigns 39% to this outcome. Commercial lock-in without clearly demonstrated systematic political use remains the second-largest scenario at 24%. A sovereign European transition reaches 17%, while domestic political-control escalation receives 16% and a verified foreign leverage or access event 4%. Confidence in the ranking is medium; confidence in the exact percentages is low-to-medium because contract, configuration and query-log data remain incomplete. The two indicators with the greatest power to alter the forecast are a verified protest-target watchlist and a successful supplier-disconnection exercise. The first would move H₃ sharply upward; the second would move H₆ upward while reducing H₂ and H₄. The most important warning is therefore not the installation of another camera. It is the convergence of four conditions: biometric capability above 70, database integration above 75, audit completeness below 40 and political stress above 70. When those thresholds coexist, surveillance changes from a collection system into a political-control infrastructure. The most important protective convergence is equally clear: national cryptographic control, regulator-owned logs, purpose-bound database interfaces and tested supplier substitutability. If all four are implemented, the residual risk becomes governable regardless of equipment origin. If they are absent, replacing the Chinese supplier alone may merely transfer the same sovereignty deficit to another vendor.
