Introduction

Salafi-jihadist networks in Southeast Europe pose an ongoing and evolving threat to national and regional security. Since the early 2000s, countries in the Western Balkans have served as both a source of recruitment and a logistical transit space for extreme groups targeting the Middle East and North Africa (Bieber, 2018, pp. 338–341; Kanellopoulos 2023a, p. 88). Between 2012 and 2016 alone, an estimated 1,070 individuals from the Western Balkans travelled to Syria and Iraq, representing the highest per capita foreign fighter mobilisation in Europe. While progress has been made by state institutions with counterterrorism (CT) legislative and operational response, vulnerabilities remain acute where socio-economic deprivation intersects with ethno-political divides and poor border management, including unresolved inter-ethnic tensions, fragmented governance arrangements, understaffed border posts, and limited interoperability between border, police, and intelligence authorities. A major facilitator of these activities has been mobility. Extremist actors take advantage of porous borders and gaps in passenger data analysis to hide travel to training sites, conflict zones, or when meeting with one another in operational settings. Mobility techniques of Balkan jihadist networks are consistent with those endorsed by members of Islamic State (ISIS) and Al-Qaeda, including travelling on commercial flights, taking multi-leg trips and utilising legitimate pretexts, for instance, business or humanitarian self-justification (Kanellopoulos, 2023a, pp. 89–91).

While this article designates the Western Balkans as a regional system, the empirical analysis concentrates on Albania, Kosovo, North Macedonia, and Montenegro. These cases have been repeatedly identified in academic and institutional reporting as sites of Salafi activism, foreign fighter mobilisation, and convergence between extremist facilitation and smuggling routes, particularly along the Albania–Kosovo–North Macedonia corridor (Augestad Knudsen, 2017; European Union Agency for Law Enforcement Cooperation [Europol], 2024; Frontex, 2023; Vidino et al., 2017). Bosnia and Herzegovina (BiH) fits our general selection criteria, which include Salafi activism, foreign fighter outflows, and migration-related weaknesses. We exclude BiH for two reasons related to the design of the research. First, BiH’s consociational governance and policing at the entity level generate data architectures and inter-agency workflows that are not like those in the four main cases. This makes it challenging to draw conclusions about TRAVINT integration across cases. Second, recent changes to the law and operations in BiH’s border and aviation sectors, such as the use of Passenger Name Records (PNR) and pilots for sharing information, need to be examined separately so that unique dynamics are not overlooked in a regional average. Consequently, we set aside BiH for a supplementary study and address it in the comparative analysis solely when regional spillovers are critical. This maintains internal validity for the four-case framework while recognising BiH’s significance to the overall policy context.

Furthermore, current research on Salafi activities and foreign-fighter mobilisation in the Western Balkans has delineated networks, profiles, and legal responses; nevertheless, it seldom incorporates Travel Intelligence (TRAVINT), including passenger data, border-crossing metadata, and mobility-pattern analytics, into a cohesive, cross-jurisdictional counterterrorism framework. Previous research either (a) examines specific countries, (b) considers mobility as an anecdotal evidence, or (c) concentrates on PNR and Advanced Passenger Information (API) compliance without evaluating its operational significance for network disruption (Kanellopoulos, 2024a). This manuscript advances the field by focusing on the operational role of mobility-mediated facilitation and the counterterrorism relevance of TRAVINT. This contribution elucidates how TRAVINT addresses identified counterterrorism deficiencies and delineate the circumstances under which it enhances decision-making value beyond the existing literature. Moreover, this article asks how TRAVINT can be operationalised to improve the detection and disruption of Salafi-jihadist mobility across the Western Balkans. The aim of the study is to assess the counterterrorism value of TRAVINT by examining mobility-mediated facilitation patterns that are not fully captured by the existing intelligence approaches. Hence, to avoid repetition, subsequent sections focus on analytical differentiation and comparative findings, rather than restating established background conditions related to mobility, border management, and interoperability.

Literature review

This literature review draws on academic and policy sources published primarily between 2010 and 2024, a period corresponding to the rise of foreign fighter mobilisation from the Western Balkans, the emergence of ISIS-related travel patterns, and the institutionalisation of intelligence-led counterterrorism and travel-data regimes in Europe. The review is structured around three interrelated analytical strands: (a) Salafi-jihadist networks and mobilisation dynamics in the Western Balkans; (b) mobility, facilitation, and crime–terror convergence; and (c) intelligence-led policing and TRAVINT as emerging counterterrorism capabilities. This framing allows the literature to be assessed not only descriptively but in terms of its analytical and operational contributions.

Salafi-Jihadist networks in the Western Balkans

Since the disintegration of Yugoslavia, the Western Balkans have been framed as Europe’s “soft underbelly of security,” a location prone to radicalisation, transnational crime, and a locus of extremist mobility (Bieber, 2018, pp. 339–343). This characterisation is reflected in empirical indicators, such as high per-capita foreign fighter mobilisation rates, persistent use of Balkan transit routes for illicit trafficking, and repeated identification of the region as a vulnerability zone in European Union (EU) and international threat assessments (Augestad Knudsen, 2017; Europol, 2024; Frontex, 2023). The weakness of regional institutions, porous borders, contested sovereignties, and law enforcement deficits rendered the region particularly vulnerable to infiltration by transnational jihadist networks (Kanellopoulos, 2024c, pp. 56–58). In practice, this vulnerability has been most evident along the Albania–Kosovo–North Macedonia corridor and at lightly resourced land border crossings and secondary airports, which have been cited in multiple cases of foreign fighter transit, facilitation activity, and exploitation by extremist-linked networks (Europol, 2024; Frontex, 2023; Vidino et al., 2017).

The conflict in the 1990s offered material and ideological openings for external actors. Gulf-funded charities and religious organisations entered the post-war context in BiH and later Kosovo and Albania, providing humanitarian relief while also promoting Wahhabi and Salafi readings of Islam (Elbasani and Roy, 2017, pp. 1–3). Specifically in Kosovo, Saudi-funded religious nongovernmental organisations (NGOs) were specifically involved in reshaping the religious landscape. These actors supported mosque-building, the education of imams, and informal religious education, thereby carving out a space for Salafi ideas to resonate with disaffected youth.

While most Balkan Muslim populations remain committed to moderate traditions based on Hanafi legal thought and affiliated with Sufi orders, radical Salafi subculture has remained a recurrent milieu for radicalisation and militant mobilisation. Between 2012 and 2016, about 1,070 men and women from the Western Balkans travelled to Syria and Iraq, representing the highest per capita mobilisation on the continent, with Kosovo accounting for some 300–350 fighters (Augestad Knudsen, 2017, pp. 5–7, 12, 13; Vidino et al., 2017, pp. 27–29). Albanian, North Macedonian, and Montenegrin Muslims also contributed dozens of fighters during this period, indicating a regional threat, not just within specific countries (Kanellopoulos, 2023a, pp. 88, 89).

Furthermore, recruitment is a result of both religious radicalisation and structural socio-economic deprivation and clan social behaviour, understood here as kinship-based social networks that shape trust, obligation, and informal support structures, alongside robust diaspora networks present throughout Western Europe (Kanellopoulos, 2023a, pp. 89–97). This multifactorial understanding is consistent with official prevention and counter-radicalisation frameworks adopted by the EU and regional governments, which identify violent extremism as shaped by interacting social, economic, political, identity-based, and contextual drivers, rather than religious ideology alone (Council of the European Union, 2014; European Commission, 2020; Organization for Security and Co-operation in Europe [OSCE], 2018). This is in line with work done on authoritarian resilience in the Balkans and the structural dynamics of weak governance and being a victim of the extremist mobilisation process (Bieber, 2018, pp. 342–345). Recruitment is also shaped by substantive issues of legitimacy (e.g. personal context and government capability to govern), economic precarity, and the persistence of unresolved ethnically sectarian cleavages (Vidino et al., 2017, pp. 24–29).

Mobility, Concealment, and Criminal Convergence

Mobility is fundamental to Balkan jihadist networks. Fighters and facilitators availed themselves of flight and land routes, particularly entry through Turkey as a preferred mainstay to travel to Syria. Official assessments indicate that during the peak mobilisation period between 2012 and 2016, the majority of Western Balkan foreign fighters transited through Turkey en route to Syria and Iraq, with several hundred individuals from Kosovo, Albania, and North Macedonia documented as using this pathway (Augestad Knudsen, 2017; Europol, 2024; United Nations Office on Drugs and Crime [UNODC], 2023; Vidino et al., 2017). Travel was disguised as family visits or tourism, business travel or participation in business delegations, and humanitarian work. Maritime travel was reported via Turkey in one case and land travel was adopted as a multi-leg itinerary route through hubs of Europe, such as Vienna, Budapest, and Istanbul, to avoid scrutiny. Such practices were most frequently documented during the 2012–2016 period of foreign fighter mobilisation, with multiple academic studies and official assessments identifying the use of tourism, humanitarian cover, and indirect multi-leg routes through European transit hubs as common concealment strategies (Basra and Neumann, 2016; Europol, 2024; Vidino et al., 2017). Groups utilised diaspora communities in Germany, Switzerland and Scandinavian countries as support mechanisms, and to provide a basis of transportation, lodging, and funds for families of fighters as well as for housing, lodging, and funds for the incoming fighter, thus reinforcing the transnational dimension of Balkan radicalisation (Kanellopoulos, 2023a, pp. 90–93).

In addition to diaspora support, extremist actors often utilised the pre-existing organised crime infrastructure. Various studies (Basra and Neumann, 2016, pp. 11–13, 23–27; UNODC, 2023, pp. 17–21; 2025, pp. 32–36) about how extremist actors exploited routes, typically used for trafficked drugs, weapons, and migrants, for extremist mobility, have a high level of consensus. Collectively, these studies cover both peak foreign fighter mobilisation period of 2012–2016 and subsequent years up to the early 2020s, indicating that the exploitation of criminal trafficking routes for extremist mobility has persisted beyond the ISIS’ territorial decline. The porous borders of Montenegro, Albania, and North Macedonia acted as enablers, supported by the fact that two-thirds of the trafficked drugs passing through the region were destined for the EU. This assessment is consistent with UNODC analyses of the Balkan route, and document that a substantial majority of drugs transiting through the region are intended for EU markets (UNODC, 2023; 2025). In addition to borders with low regulatory barriers, significant numbers of secondary airports in Albania and Kosovo with limited exit screening also offered convenient inherent vulnerabilities. While smuggling economies of the Balkans and extremist networks overlap in persons, logistics, and financing, the potential for convergence between crime and terrorism is minimal at a global level (Basra and Neumann, 2016; UNODC, 2023).

Security Risk Analysis and TRAVINT as Counterterrorism Capability

The analysis in this section is informed by a mobility-mediated brokerage perspective, which treats movement, facilitation, and logistical coordination as central enabling mechanisms in transnational extremist networks, alongside an intelligence-led policing approach that emphasises anticipatory risk analysis and data-driven intervention.

Eventually, the difficulty of detecting movement that is so hidden has therefore necessitated structured risk analysis. The Common Integrated Risk Analysis Model (CIRAM) produced by Frontex (2021; 2023) is a doctrinal approach for analysing cross-border threats through evaluating intelligence, operational information, and geopolitical context. The model encourages national and EU agencies to develop a prospective and intelligence-based posture, noting risks, vulnerabilities, and scenarios. In counterterrorism contexts, a prospective posture differs from traditional reactive policing by emphasising early risk identification, scenario anticipation, and preventive intervention before incidents occur, rather than responding primarily after an attack or offence has taken place. Contributions to locating CIRAM in the context of counterterrorism note its capacity to displace states from reactive policing with anticipatory intelligence practices (Kanellopoulos, 2023d, pp. 83–85; Ratcliffe, 2016). From theoretical perspective, its grounding in open systems theory is especially relevant. Open systems emphasise adaptability, resilience in networks, and two-way feedback between environments and organising forms, all elements that mimic how Salafi-jihadist threats existed as cross-border and networked (Kanellopoulos, 2024b, pp. 59–61). In terms of operational counterterrorism, this perspective supports analytical approaches that focus on dynamic threat adaptation, cross-border information flows, and continuous feedback between intelligence collection, risk assessment, and operational response.

Besides, CIRAM provides the analytical framework, while TRAVINT operationally supports this framework through the analysis of travel data. TRAVINT is the collection, fusion, and analysis of travel data, such as API, PNR, and European Travel Information and Authorisation System (ETIAS), that provide operational leads, identify anomalies, and improve responses to terrorism (Kanellopoulos 2023c, p. 26–34). TRAVINT is different to general border checks, as it enables the analysis of itineraries, travel companions, booking patterns, and payment methods to see obscure movement by extremists. The EU has integrated TRAVINT into its existing legal arrangements. Directive (EU) 2016/681 on PNR obligates member states to collect and retain booking data for counterterrorism or as serious crime data. API data transfer is made available through Council Directive 2004/82/EC, and all states, according to UNSCR 2396 (UN Security Council, 2017) must develop API–PNRs and develop biometric systems to combat the travel patterns of terrorist actors. Across the selected case studies, implementation has been uneven: while some states have developed functional API–PNR units with partial interoperability with EU systems, others remain at earlier stages of technical capacity-building and legal alignment, relying on transitional or pilot arrangements rather than fully operational frameworks. The EU’s proposed ETIAS, which should launch in 2026, will add an additional layer of pre-travel vetting of visa-exempt travellers (European Commission, Migration and Home Affairs, 2025; Kanellopoulos, 2024c, pp. 60–62). In addition to ETIAS, the Entry/Exit System (EES), which commenced in 2025, records third country nationals with biometric and biographic data when they cross the borders of Schengen. The interoperability framework of the EU represents a dynamic new way to integrate data on identity resolution and detection across systems with the combination of EES, ETIAS, Visa Information System (VIS), Schengen Information System (SIS), European Asylum Dactyloscopy Database (Eurodac), and European Criminal Records Information System for Third-Country Nationals (ECRIS-TCN). However, access to and integration with these interoperable systems remains uneven across Southeastern European states, particularly between EU member states and non-EU partners, resulting in varying levels of operational connectivity and detection capability. Comparative experience demonstrates the viability of TRAVINT. For example, the US Secure Flight program combines PNR data analysis with security watchlist checks and other anomaly detection and behavioural indicators to assist in prescreening airline passengers (Directorate of Health Services [DHS] Privacy Office, 2008; Elias, 2014; US Government Accountability Office [GAO], 2007). Such systems demonstrate that TRAVINT is not simply a storage of passenger records but integrated analytic function of doctrine, governance, and collaboration across agencies (Gill and Phythian, 2018, pp. 112–116; Kanellopoulos, 2024a, pp. 57–59).

Functional Dimensions of TRAVINT

TRAVINT is a multifaceted capacity that results in raw travel data being converted into actionable intelligence for counterterrorism and border security. A key component of TRAVINT is threat identification which maximises the potential results of passenger data matched against the existing watchlists and the identification of deviations in travel behaviour. Using API and PNR, officials can identify not only those already on security lists but also “unknown associates” who match timelines, booking behaviours, or travel companions consistent with radical actor profiles (DHS Privacy Office, 2008; Europol, 2024, pp. 19–29; Organization for Security and Co-operation in Europe [OSCE], 2022). The focus on using APIs and PNRs is consistent with the general shift towards anticipatory security practices that serve to ameliorate data systems that are designed to act before extremist actors get to their operational theatre (Frontex, 2021; Kanellopoulos, 2024a, pp. 55–58).

The second function relates to risk assessment and corridor mapping, in which TRAVINT assists in the identification of high-risk travel routes and mobility hubs. Through the combined use of datasets across jurisdictions and carriers, authorities are able to map corridors of concern, such as the historic Albania–Kosovo–Turkey axis that has previously been exploited for foreign fighter facilitation. This corridor was most intensively exploited during the 2012–2016 period of foreign fighter mobilisation, although elements of the route and associated facilitation networks have remained relevant in subsequent years. In this regard, CIRAM of the European Border and Coast Guard Agency, Frontex, serves as an instrumental framework for operationalising TRAVINT for data fusion to identify more clearly vulnerabilities in the Balkan–Schengen mobility continuum (Frontex, 2021; Kanellopoulos, 2023a, pp. 91–93).

TRAVINT also facilitates operational response during the journey, as real-time operational capabilities offer alerts as the journey continues, thereby enabling remediation measures, such as a flight’s course change, secondary screening, or interdicting ongoing journeys at connecting hubs (Europol, 2024, pp. 26–29; GAO, 2007). The good practice of embedding TRAVINT into Passenger Information Units (PIUs), and regional fusion centres sustains the possibility to respond dynamically to evolving threat signatures while limiting expiring time sensitive gaps in interdiction between custodial–immigration jurisdictions (Kanellopoulos and Stavropoulos, 2024, pp. 89–91). Another important function is watchlist governance and validation. Watchlists are only as good as their accuracy; out-of-date or incorrect entries compromise operational efficiency and civil liberties. By pairing watchlist entry data with real-time travel data, TRAVINT allows for the regular updating and validation of records, resulting in fewer false positives and less unnecessary scrutiny of low-risk travellers (European Parliament and the Council, 2016; OSCE, 2021). Evaluations of passenger data used in EU’s PIUs and comparable systems have shown that iterative watchlist validation and data-matching practices reduce outdated alerts and misidentifications, thereby improving targeting accuracy over time (European Commission, 2022; Europol, 2024). This dimension aligns with wider European commitments to proportionality and oversight in data-centric counterterrorism initiatives.

Also related is the role of TRAVINT as an agency and transnational intelligence-sharing platform. Travel data is inherently transnational as it identifies locations of departure, transit, and destination, providing an intelligence-sharing platform where border police and intelligence services can collaborate with international partners, such as Europol, and Frontex. Recent EU risk-analysis doctrine and travel-intelligence scholarship points out that the activation of TRAVINT within European counterterrorism capabilities strengthens and legitimises the intelligence-led framework of CIRAM and enhances overlap and interoperability across the nation-state (Frontex, 2023; Kanellopoulos, 2024a, pp. 55–58). Additionally, the TRAVINT system provides operational decision support at border entry and exit points. The generation of risk scores, anomaly alerts, and network linkages system provides border and frontline officers analytical support to determine which travellers to prioritise for secondary screening and/or interviews (Everton, 2012; Ratcliffe, 2016). This is particularly useful in the Western Balkans, where analytical resources are typically limited and there is a need for systems to assist decision-making to augment human analysis (Bieber, 2018, pp. 344–346).

Moreover, a significant development of TRAVINT is its link to Financial Intelligence (FININT). Informal value transfer methods, such as hawala, are widely employed throughout the Balkan diaspora and are acknowledged as routes for financing of terrorists (Financial Action Task Force [FATF], 2013; UNODC, 2023; 2025). Hawala transactions disguise as remittances, as hawala usage is interrelated with violent extremist mobility and criminal activities around smuggling. By connecting travel patterns to financial flows that are suspicious, it exposes converging facilitation pathways to provide a comprehensive understanding of network activity.

Subsequently, the successful application of TRAVINT is ultimately dependent on the nimbleness of intelligence systems. Intelligence to succeed in a limited-resource environment, strategic management, and adaptability is a key. This was echoed in broader literature: Ratcliffe (2016) stated that police agencies utilising an intelligence-led paradigm need a commitment to continual institutional learning, and Gill and Phythian (2018) contend that it is often governance and not technological advances that curtail the effectiveness of intelligence system responses to crime. The Western Balkans region presents a unique environment where there is highly variable and unpredictable intelligence capacity, often tremendous political sensitivities, and the absence of trust; embedding of TRAVINT therefore requires more than simply technical integration of TRAVINT, and there has to be a willingness to reshape governance, accountability, and trust between and across agencies.

Privacy, Proportionality, and Legitimacy

The effectiveness of TRAVINT also depends on its legitimacy, rooted in compliance with the principles of lawfulness, necessity, and proportionality. Legitimacy is particularly salient in the Western Balkans because of historically low levels of public trust in security institutions, sensitivities surrounding surveillance practices, and the legacy of politicised law enforcement, which heighten the risk of resistance to data-driven counterterrorism measures. The European regulatory framework—including the General Data Protection Regulation (GDPR), the Law Enforcement Directive (LED), and the PNR directive—establishes robust safeguards, including data minimisation, masking, retention limits, independent oversight, and redress mechanisms (European Commission, 2022; European Parliament and the Council, 2016). In counterterrorism practice, GDPR primarily governs administrative and pre-travel passenger screening activities, while the LED applies to intelligence-led policing and criminal investigations, allowing a more flexible data processing, subject to necessity, proportionality, and purpose limitation. Human rights bodies, such as the Organization for Security and Co-operation in Europe (OSCE, 2021), stress that API–PNR and biometric systems must be risk-targeted, auditable, and subject to effective remedies. In the context of Southeastern European, these requirements are closely linked to OSCE commitments on the rule of law, democratic policing, accountability of security institutions, and the protection of fundamental rights in counterterrorism and border-management practices. Rather than obstructing counterterrorism efforts, these safeguards enhance analytic precision by reducing noise, limiting over-collection, and ensuring that counterterrorism measures are both effective and proportionate.

Taken together, the literature provides extensive descriptive insight into Salafi-jihadist networks, foreign fighter mobilisation, and counterterrorism responses in the Western Balkans. However, it remains fragmented across disciplinary and policy domains. Studies of radicalisation and recruitment rarely engage with mobility as an operational variable, while work on API, PNR, and border technologies often focuses on legal compliance, rather than network disruption. This gap underscores the need for an integrated analytical approach that situates TRAVINT within broader counterterrorism frameworks, a gap this study seeks to address.

Research Methodology

While the article does not follow a rigid Introduction–Methods–Results–Discussion format, its analytical components are structured to address each of these functions within dedicated sections. Consequently, the study adopts a qualitative hybrid research design by combining structured literature review with comparative case analysis. The paper is not based on original fieldwork or primary data collection; rather, it synthesises the existing academic research, policy reports, and institutional assessments to examine the counterterrorism relevance of TRAVINT in the Western Balkans.

The empirical material analysed includes peer-reviewed academic literature, policy and threat assessment reports produced by European and international institutions (including Europol, Frontex, OSCE, FATF, and UNODC), and publicly available case materials related to Salafi-jihadist networks, foreign fighter mobilisation, and border security practices in Southeastern Europe. These sources were selected for their relevance to extremist mobility, intelligence-led counterterrorism, and travel data governance.

The analytical approach follows a comparative qualitative design focused on four cases: Albania, Kosovo, North Macedonia, and Montenegro. Case selection was guided by four criteria: (1) documented Salafi-jihadist activity or foreign fighter outflows; (2) relevance as transit or facilitation spaces within regional mobility corridors; (3) exposure to mixed migration and smuggling routes; and (4) partial integration with European counterterrorism and border-management frameworks. Together, these cases provide sufficient variation while remaining comparable in institutional scale and regional context.

The analysis was conducted through thematic synthesis. Relevant sources were reviewed and coded according to recurring themes, including mobility patterns, facilitation roles, use of travel documentation, border vulnerabilities, and the application of API–PNR systems. These themes were then examined across cases to identify common patterns and divergences. Particular attention was paid to how travel-related data could support anticipatory risk analysis and network disruption when integrated with the existing intelligence practices. While the study does not claim statistical generalisability, it seeks analytical generalisation by identifying mechanisms, specifically mobility-mediated facilitation, that recur across cases and have relevance for counterterrorism policy beyond the individual country contexts. The methodological approach prioritises transparency and replicability by clearly specifying sources, selection criteria, and analytical steps.

Applying TRAVINT to Albanian Salafi Networks

This section presents analytical findings derived from the comparative assessment of Salafi-jihadist mobility and facilitation patterns in the Western Balkans.

Structural and Governance Challenges

Despite its potential, the integration of TRAVINT into counterterrorism strategies in the Western Balkans is constrained by a series of structural and governance challenges. These challenges reflect a combination of political, technological, legal, and operational deficits that hinder the transition from fragmented national practices to a coherent, regionalised, intelligence-led system.

Initially, the most persistent barrier remains the lack of consistent and trusted intelligence-sharing mechanisms across the Western Balkans. Historical mistrust, unresolved disputes over sovereignty, and the asymmetric recognition of Kosovo undermine the development of common frameworks. For instance, Kosovo’s contested international status has prevented its full participation in regional security initiatives, leaving it reliant on ad hoc memoranda of understanding (MoUs) rather than binding multilateral agreements (Kanellopoulos, 2022, pp. 94–100). This political fragmentation translates directly into operational silos, as liaison officers often lack legal authority to exchange sensitive data in real time. Legal scholarship on recognition and non-recognition provides useful explanatory context, demonstrating how international legal ambiguities spill over into day-to-day counterterrorism cooperation. In the context of TRAVINT, the most sensitive data typically includes passenger biographic identifiers, travel itineraries, contact details, payment and booking information, travel companions, and, where applicable, biometric identifiers and watchlist associations. The result is a patchwork of bilateral arrangements that are insufficient for addressing transnational terrorist mobility, which thrives on regional permeability.

Another major obstacle is the disparity in technological infrastructure across the Western Balkan states. While some countries, such as Serbia, have made progress in implementing API and PNR systems with EU assistance, others continue to lag in data collection, standardisation, and system interoperability (European Commission, 2022; OSCE, 2022). These interoperability gaps limit the ability to trace travel sequences across borders, correlate passenger records from different jurisdictions, and detect repeated or coordinated movements that are central to identifying cross-border extremist facilitation through TRAVINT. Inconsistent data quality and divergent implementation timelines weaken the potential for corridor-level analytics that could track suspicious travel across borders. Without harmonised systems, patterns of facilitation that stretch across Albania, Kosovo, Montenegro, and North Macedonia remain hidden in fragmented datasets, leaving significant blind spots in counterterrorism detection. Thus, the adoption of TRAVINT technologies raises legitimate concerns regarding privacy and human rights. According to OSCE (2021), the use of API–PNR, biometric screening, and algorithmic profiling must be grounded in clear legal bases and subject to necessity and proportionality tests. Effective safeguards—including data minimisation, strict retention periods, independent oversight, data protection impact assessments (DPIAs), and accessible remedies for individuals—are essential to maintaining legitimacy. Comparative research on counterterrorism governance underscores that systems designed with privacy-by-design principles not only ensure compliance with international human rights norms but also enhance analytic quality by reducing noise and bias in larger datasets. In the Western Balkans, where public trust in state institutions is often weak, embedding strong rights protections into TRAVINT is particularly important for avoiding the perception of surveillance overreach.

Subsequently, even where data is available, effective utilisation is hampered by organisational silos and limited analytical expertise. Specialist TRAVINT skills—ranging from understanding airline reservation systems and itinerary anomalies to applying graph analysis, social network analysis (SNA), and open-source corroboration—are scarce within the Western Balkan security services (Frontex, 2021; Ratcliffe, 2016). Front-line border officers, often under-resourced and overburdened, rarely receive the advanced training required to interpret TRAVINT outputs or apply CIRAM methodologies to operational decisions. Without sustained capacity-building programs and decision-support tools, TRAVINT risks remaining a technical capability on paper rather than a functional counterterrorism tool in practice.

Furthermore, the sequencing of EU border security systems—EES and ETIAS anticipated in late 2026—fundamentally reshape the balance between pre-travel vetting and at-border screening (European Commission, 2025; European Commission, Migration and Home Affairs, 2025). Unless the Western Balkan partners align their systems with these new EU architectures, gaps will emerge, in which terrorist travellers could exploit discrepancies between EU and non-EU jurisdictions. For example, failure to integrate with EU interoperability frameworks may leave regional actors unable to detect multiple identities, overstays, or watchlist hits flagged elsewhere in Europe. As migration and mobility patterns evolve, Balkan states face the dual challenge of upgrading infrastructure while also ensuring their systems remain interoperable with the EU’s rapidly developing security ecosystem.

Finally, this analysis is subject to several limitations. It is based on secondary sources and comparative synthesis, rather than primary empirical data, which constrains causal inference. The focus on four Western Balkan cases limits generalisation to regions with different governance and border regimes. In addition, reliance on open-source and institutional reporting may underrepresent facilitation practices that evade detection.

Policy Implications and Recommendations: Institutionalising TRAVINT in the Western Balkans

This section translates the above-outlined analytical findings into policy-relevant implications. Institutionalising TRAVINT across the Western Balkans requires a coordinated approach that combines technical harmonisation, cross-border governance, and strong safeguards. A central priority is the establishment of cross-border TRAVINT fusion cells. By linking Tirana, Pristina, Podgorica, and Skopje in a network of centres co-located with border police and intelligence liaison officers, states could generate corridor-level analytics anchored in the CIRAM. These cells would not only harmonise watchlists and conduct quality assurance on PIUs but also monitor high-risk mobility routes, such as recurrent travel corridors linking the Western Balkans with Turkey and key Schengen transit hubs, and coordinate real-time interdictions in partnership with carriers. To ensure legitimacy, such centres should operate under clear MoUs defining data protection, purpose limitation, and oversight. Embedding independent supervisory authorities, ombudspersons, or fundamental rights officers would reinforce public trust and align practices with OSCE guidance. Another critical step is the standardisation of API and PNR pipelines. Divergent implementations currently undermine regional interoperability and obscure cross-border patterns of extremist mobility. Harmonisation with EU data schemas, International Civil Aviation Organization (ICAO) Annex 9 (Facilitation) standards, and the technical requirements of ETIAS and the EES would address these gaps. Carrier compliance programmes should be formalised, with sanctions for late or incomplete submissions, ensuring that data quality is sufficient to support predictive analytics. At the regional level, enforcement could be supported through harmonised regulatory standards, coordinated oversight by civil aviation and border authorities, and alignment with EU carrier sanction regimes, complemented by information-sharing mechanisms among the Western Balkan states. This standardisation would allow Balkan systems to plug into the EU’s interoperability framework, enabling corridor-level monitoring, rather than fragmented state-by-state detection.

Moreover, the development of a shared analytical playbook for extremist mobility is also essential. Codifying risk indicators, such as multi-leg itineraries, one-way tickets, cash or third-party payments, group travel with weakly substantiated ties, and repeated short stays in Turkey or other conflict-adjacent hubs, would institutionalise common detection practices. Embedding social SNA templates, such as ego-network mapping, broker detection, and co-travel graphs, would allow analysts to identify facilitators and hidden brokers more effectively. A region-wide playbook would reduce reliance on individual expertise, provide consistency across agencies, and strengthen early-warning capacity.

Subsequently, integrating FININT with TRAVINT represents another decisive opportunity. Hawala networks and other money or MVTS continue to underpin both licit remittances and illicit facilitation in the Western Balkans. Joint analysis by financial intelligence units (FIUs) and border agencies could correlate travel anomalies with suspicious transactions, mapping hawaladar nodes located near transport hubs and diaspora corridors. This convergence of FININT and TRAVINT would allow the identification of chokepoints where funds and individuals intersect, enabling both interdiction and asset disruption. FATF guidance, UNODC reports, and recent regional research underscore the importance of treating hawala not merely as an informal remittance system but as a potential enabler of extremist logistics.

Preparing for the EES–ETIAS convergence is equally urgent. The sequencing of these systems, with EES and ETIAS in 2026, will reshape the balance between pre-travel screening and at-border checks. Unless the Western Balkans align with EU interoperability frameworks, particularly the European Search Portal, the shared biometric matching service, and the common identity repository, they risk becoming blind spots at the Schengen perimeter. Aligning with these systems allows Balkan agencies to detect overstays, looping travel patterns (repeated travel sequences in which individuals depart, transit, and return along similar routes over short periods without a clear legitimate purpose), and multiple identities, strengthening their ability to contribute to European counterterrorism cooperation rather than remaining security gaps. None of these reforms can succeed without investment in training and professionalisation. TRAVINT requires specialist skills that go beyond traditional border management. Analysts must understand Computer Reservation Systems (CRS), Global Distribution Systems (GDS), PNR field structures, and itinerary analytics, while also being trained in graph analysis, bias mitigation, and privacy engineering. Front-line officers must be trained to interpret risk flags and escalate suspicious cases appropriately, ensuring that analytic insights are operationalised. Curricula should be developed at a regional level, drawing on Frontex doctrine and best practices documented by the US GAO, to create a cadre of professional TRAVINT practitioners across the Western Balkans. Equally important is embedding privacy-by-design and accountability into all TRAVINT workflows. European and international human rights frameworks emphasise data minimisation, retention controls, role-based access, audit trails, and proportionality tests. These safeguards should not be viewed as obstacles but as enablers of more precise and legitimate counterterrorism. Independent oversight panels and regular transparency reports on API–PNR use would reinforce legitimacy, while audits and data protection impact assessments could help reduce bias and false positives.

Eventually, operationalisation must also extend to the field. Targeted joint operations along key corridors, such as Albania–Kosovo–Montenegro–North Macedonia, would demonstrate the practical value of TRAVINT. Coordinated days of action, conducted with carrier liaison and synchronised with Europol’s European Travel Intelligence Centre (ETIC), could focus on high-risk outbound routes to Istanbul, Gulf hubs, and Schengen connection points. Such actions would not only disrupt ongoing facilitation networks but also build habits of cooperation across Balkan agencies (Europol, 2019).

Finally, institutionalisation should be supported by research and evaluation. Measuring the impact of TRAVINT integration by comparing interdiction rates, false positives, and operational yields before and after implementation would generate evidence for policymakers. Academic–policy partnerships could refine red-flag indicators, test disruption models, and adapt analytic frameworks to evolving mobility patterns. Embedding a culture of continuous evaluation and learning would ensure that TRAVINT remains an adaptive and resilient counterterrorism capability in a rapidly changing threat environment.

Conclusions

The conclusions drawn in this study are based on the comparative findings regarding mobility-mediated facilitation, recurring travel signatures, and corridor-level dynamics identified across the Western Balkans. The study demonstrates that TRAVINT fundamentally changes the manner in which decisions are made about counterterrorism in Southeastern Europe. When mobility data is systematically integrated, it becomes evident that the most significant actors within Salafi networks are not the ideologues or financiers typically highlighted in the literature, but rather the logistical brokers who facilitate cross-border movement. Identifying and halting these brokers, changes counterterrorism efforts from reactive arrests to proactive interdictions and route-hardening measures. In theory, this shifts the way we approach network-centric counterterrorism by highlighting mobility-mediated brokerage as an important way for fragmented governance systems to stay strong. In these situations, the movement of people and information, regardless of social ties, provides the most useful information. As a result, TRAVINT contributes to Human Intelligence (HUMINT) and OSINT, instead of repeating them. This allows agencies to utilise their limited investigative resources more effectively.

The findings necessitate institutional and procedural innovations that transcend established recommendations. Each state should choose an operational authority to handle TRAVINT triggers. This authority should have a clear escalation matrix for cross-border referrals. Route-level risk scoring that takes into account crossing patterns and sequences should be added to individual-level profiling. A rotating analyst fellowship might render analytical practices more uniform across regions, while micro-sanctions regimes and privacy-preserving data-linkage tools could make important corridors safer without breaking the law. These insights are primarily relevant to small states with developing API–PNR frameworks and hybrid Schengen interfaces; their applicability may be diminished in centralised or fully harmonised systems. Subsequent research ought to broaden this investigation to BiH, where consociational governance creates a unique institutional context, and assess via quasi-experimental techniques the impact of route-based risk scoring on the timeliness of interdiction and operational results.

Finally, this study has several limitations. It relies on secondary sources and comparative synthesis, rather than primary empirical data, which limits causal inference. The focus on four Western Balkan cases constrains generalisation to other regions with different governance and border regimes. These limitations notwithstanding, the findings provide analytically grounded insights into extremist mobility and counterterrorism practices.