Rinas is Under Observation

Albania’s only international airport has been under persistent open-source surveillance by a Serbian-linked collection account since the unrest began. The method is cheap, legal and complete except for the last 300 metres of the approach. One receiver on the ground near Rinas would close that gap, and nobody in Tirana has looked for it. The 6 November product, and the five minutes it took an Albanian protest account to weaponise it, show what the collection is for.

By Drizan Shala (Security Desk)

Dunav Intel (@Lukai1861) has been watching Albanian airspace continuously since the first days of the protests, by its own statement, and its product on the Emirati Air Force C-17 that landed at Rinas on the evening of 6 November shows the collection to be real, persistent and competent within known limits. This is a standing collection operation against a NATO member’s main airport, run from outside the country on open infrastructure, undisrupted. Its output is being injected into Albania’s domestic information space within minutes of publication by an account aligned with the protest movement.

This publication has documented the same account’s images of Albanian Armed Forces exercises at Bizë, its Kuçovë material, its filming of a cargo flight at Pristina airport from outside the perimeter, and its 29 October post on business jets from Tel Aviv to Tirana during the protests. On 11 August it described itself as three years into gathering information, with an administrator “in the homeland” in discussions with Serbian stakeholders and findings discussed with analysts in Belgrade. Each product has the same structure: open collection, a suggestive frame, amplification inside Albanian channels. Rinas has now joined Bizë on its target list.

Every aircraft with a Mode S transponder transmits a unique 24-bit address, its callsign and its altitude throughout the flight. The address 896C2E belongs to the block ICAO allocates to the United Arab Emirates and resolves in public databases to C-17 registration 1226. Military transports normally fly with the ADS-B position broadcast disabled, as this one did; position is then recovered by multilateration, with four or more volunteer receivers on the ground timing the same transmission and an aggregator computing the fix from the differences. Dunav’s own screenshot of the track, taken from the tar1090 map used by adsb.fi, airplanes.live and ADS-B Exchange, records the position source as MLAT. At cruising altitude over the Adriatic the receivers in Puglia, Montenegro and northern Greece deliver that fix comfortably. Flightradar24 uses the same technique but keeps most military traffic off its public map at operators’ request and cannot follow an MLAT-only aircraft below roughly 1,000 feet. The aircraft Dunav called a “ghost” transmitted its own identity for the entire flight and filed a flight plan under its own callsign into the Eurocontrol system. The word is the influence component of the product.

The same product shows where the collection stops. The landing and departure are given as “around 19:00” and “around 21:00” because the signal dropped below the receivers’ horizon on approach and reappeared after take-off. The count of five flights since the protests began is the hex code’s history on the aggregator. The cargo is unknown and stated as unknown. The apron is invisible: which stand the aircraft used, how long the ramp was down, what came off, who met it. That is the one piece of the picture a collector against Rinas would want and does not yet have.

Closing that gap requires a receiver with line of sight to the airport. A feeder is a USB dongle and an antenna costing under 50 euros, passive, licence-free, legal, and it uploads automatically to a server abroad whether or not its owner ever looks at the data. The aggregators publish coverage maps and the Tirana area is on them; the timing gap in the 6 November product indicates that none of the existing feeders sees the Rinas apron. A collector who wanted it would need one flat in Fushë-Krujë or Rinas village with a view of the runway, or one existing enthusiast persuaded to feed a second server. The purchase, the delivery and the installation would pass every control Albania has, because none of those controls was built to see them. A service that has kept the airport under observation for months will want the apron, and nothing in Albania’s current posture would stop it being obtained. Albanian counter-intelligence should be working from the assumption that such a receiver either exists or will.

The search is feasible and has not been done. A receiver of this kind emits nothing, so no direction-finding will locate it; it is found by its uploads and by its position. Every feeder holds a continuous connection to a handful of known servers, and an internet provider can identify, under the ordinary legal authority for traffic data, which subscribers in the Tirana and Durrës districts hold such connections. The aggregators publish approximate feeder locations, and the hobbyist communities around them know their members by name. The physical signature is a short vertical antenna on a roof or balcony with a line of sight to the runway, cabled to a single-board computer, and the ground with that line of sight is a few square kilometres of Fushë-Krujë, Rinas village and the high ground at Preza. A survey of it is a day’s work for a counter-intelligence team with the airport operator’s cooperation. Feeding is lawful and will remain so. The state’s task is to know who feeds from where. It should expect to find a small number of genuine enthusiasts, who are no part of the problem, and it should then be able to say whether any receiver has appeared in that ground since June that nobody can account for. Until that survey exists, every statement about who sees the Rinas apron, including the one in this assessment, rests on inference. The Albanian authorities are the only party able to replace the inference with a list of addresses, and there is no sign they have tried.

Tirana Report, an X account aligned with the protest movement, republished the Dunav post with a screenshot showing it five minutes old, a photograph of the Prime Minister beside the President of the UAE, the question of what military equipment the Emirates were bringing to Albania, and the statement that the government was silent. The collection account supplied the signal and the caveat on cargo. The domestic account kept the signal, dropped the caveat and supplied the target. The intended audience is the protest public and the foreign observers who follow it; the intended effect is to make the government’s closest Gulf partnership read as a covert military arrangement during unrest, with official silence folded in as confirmation. Whether the two accounts coordinate is not established. The sequence performs the function of coordination either way, and at five minutes the distinction has no operational meaning.

Nothing in this chain requires anyone to enter Albania, and nothing in it is illegal. It is stopped, if at all, by a state that knows what its own airport looks like on 1090 MHz, knows which receivers in Tirana and Durrës feed which servers, and would notice a new one appearing on a hillside above the runway. There is no indication that any Albanian institution holds that picture. The aircraft announced itself from the moment it left Abu Dhabi. The receivers heard it. The account framed it. The protest channel delivered it. That is the division of labour in a hybrid war, and the only party that did not take part was the state whose airport it is.