The Address in Tirana

A Serbian intelligence operation against Kosovo’s prime minister moved through an Albanian portal and borrowed the name of Albania’s intelligence service. Neither is Kosovo’s problem to solve. Both are Albania’s.

By Drizan Shala

An intelligence operation is legible in what it borrows. When a service wants a fabrication to travel, it does not send it under its own name. It dresses the thing in an authority the target audience already trusts, and the authorities it reaches for tell you where it thinks the audience is soft. The Serbian case now before Kosovo’s Special Prosecution — the body that handles the state’s gravest crimes, espionage among them — reached, at two separate moments, for Albanian authority. It moved a document through an Albanian portal, and, on the accused man’s own testimony, it invoked the name of Albania’s intelligence service. Kosovo’s courts will handle the espionage. The two Albanian borrowings are Tirana’s to reckon with, and this is an argument that they should be reckoned with.

The case is that of Fatmir Sheholli, indicted on 25 August for espionage and blackmail, charged as an asset of Serbia’s Security and Information Agency, the BIA, taking orders from a handler the indictment identifies as a BIA director. He is presumed innocent. The charging papers describe a man who received material from that handler and pushed it outward, and in the strands that concern us, outward meant across the border, into the Albanian information space.

The document

The material at the center is a file the prosecution catalogues as Exhibit Z#4.1, codenamed “Leptiri,” which presents itself as a 2001 plan by Serbia’s former State Security, the RDB, to compromise and recruit Albin Kurti during his years in a Serbian prison. It is not a file from 2001. Examined against its own claimed date, it is salted with particulars from a life that had not yet been lived when it purports to have been typed, which is the one thing a genuine 2001 document cannot be. It is a forgery, back-dated, and its contents are a fabricated personal smear that no court has tested and that we will not reproduce, because to repeat the smear is to do the operation’s remaining work for it. What matters here is not what the document alleges. It is what the document is: a recent fabrication built to wear the authority of an aged secret. Counterfeit provenance is this operation’s instinct, shown in its central exhibit, and once that instinct is visible, the rest of the case reads as variations on it.

The portal

The first Albanian variation is a matter of venue. Sheholli, by the account in the case, tried and failed to place the document in Kosovo’s own media. It surfaced instead on Prapaskena, an Albanian portal, and from there re-entered the Kosovo conversation carrying the appearance of foreign reporting rather than a Belgrade plant. The document that would not move at home moved once it had an address in Tirana.

The portal deserves a careful look, because its character is the point. Prapaskena is an anonymous outlet: material appears there without bylines and without accountability, and its very ownership is publicly disputed in Albania, claimed by no one and attributed by others to figures who reject the attribution. For this argument the disputes do not matter. What matters is upstream of all of them: it is a place where authorship is obscured by design, and therefore a place where a planted document is indistinguishable from the ordinary product.

That is precisely what a laundering operation looks for. A hostile service floating a forgery does not want a credible outlet with a masthead and a standards desk; it wants an outlet where one more anonymous document raises no eyebrow, because anonymous documents are the house style. Nothing in the case suggests the portal knew what it was carrying, and the mechanism does not require that it did. Laundering works whether or not the launderer reads the serial numbers. The document needed only an address that would let it re-cross into Kosovo wearing the words “as reported in Albania,” and it found one.

And then, its work done, the document ceased to be there. It does not appear on Prapaskena today, and its absence is unremarkable by the outlet’s own documented habit, reported elsewhere, of publishing material and later erasing it. For a laundering operation this is not a flaw but a feature. The forgery needed only to surface long enough to be cited across the border as Albanian reporting; once the citations existed, the original could vanish. What remains is a set of downstream references pointing back to a source that now shows nothing, which is the condition a service wants: the laundered copy still in circulation, the plant itself gone, and no original left at the address for anyone to examine. A document that surfaces, is picked up, and then disappears from its own source is not evidence that failed to hold. It is evidence that was never meant to stay.

The badge

The second Albanian variation is sharper, and it is the one that should command Tirana’s attention, because it borrows not a portal but an institution.

Asked by the prosecutor to whom he had distributed the “Leptiri” document, Sheholli answered, in words the indictment records: that he had sent it to Milazim Gashi, “a friend of mine who is in Albania’s SHISH under the name Dritan Gjoni, chief of SHISH in Durrës,” along with two other men of whom, in one case, he was unsure.

SHISH is Albania’s State Intelligence Service. Read plainly, the claim is that a Kosovar political figure is a covert officer of Albania’s intelligence service, running its Durrës station under an assumed name. We report that Sheholli said this. We do not report that it is true, and the grounds for doubt are not delicate. Milazim Gashi is a public figure in Kosovo, a former deputy minister for Communities and Return, who in July 2024 stood before the Kosovo public under his own name to allege that structures tied to Serbia were financing the construction of mosques in Kosovo, a claim the Islamic Community of Kosovo rejected and answered. A man conducting public political controversy in his own name, in his own country, is not credibly the cover-named chief of a foreign intelligence station across a border. The public official and the secret officer do not fit on one body.

So the badge does not hold, any more than the date did. But note that these are different failures. The document was fabricated. The Albanian provenance was real, and really acquired, which is what made it worth acquiring. The affiliation was asserted, and nothing in the record corroborates it. An operation is made of exactly this mixture: one forgery, one genuine address, one claim no one has checked. What the file cannot establish, and what we will not pretend to know, is where the uncorroborated claim came from. Sheholli may have inflated his own network for his handler or his interrogators. Someone may have claimed the affiliation to Sheholli, who then repeated it. It may be a third thing. The claim’s origin is unresolved, and it stays unresolved on this page. We name Gashi only as the indictment names him, as the subject of a defendant’s claim, and hold him to nothing the public record does not already carry.

But a false claim about SHISH is not, for Albania, a harmless one, and the right response to it is not the one that first suggests itself. We do not ask SHISH to confirm or deny a personnel relationship; no serious service authenticates its rosters on request, and a denial issued today becomes a confirmation implied by silence tomorrow. The question is institutional, and it belongs to Tirana rather than to the service’s press office: whether SHISH’s identity has been appropriated in an alleged foreign intelligence operation, and whether the appearance of its name in a neighbouring state’s espionage indictment warrants a counterintelligence examination of how it got there. That is a question Albania’s government can be asked in public and can answer in public. It is the question this file puts on Tirana’s desk.

Why the address matters

Two Albanian elements, then, in a Serbian file: an address that carried the document, and a name that entered the record beside it. Neither makes Albania the author of anything. Both make Albania the terrain.

That is the uncomfortable part, and it is the reason a Kosovo indictment is a Tirana story. A hostile service reads its neighbours’ information spaces for weak points the way it reads a border for unguarded crossings, and this file is a map of where Belgrade found Albania soft: an outlet where authorship dissolves and material can be erased once it has done its work, an institutional name available to be worn. These are not exotic vulnerabilities. They are the ordinary vulnerabilities of an open media environment that has not yet hardened itself against deliberate abuse, and they are precisely the ones the European Union and NATO have spent years urging the Western Balkans to close. Albania, negotiating its accession, is expected to close them. An information space through which a foreign forgery can transit, gather false credibility, and then disappear without a trace is not a closed one.

The document that began this — the forged file about Kurti — will be argued in a Prishtina courtroom, where its impossible date will be its undoing. The Albanian questions will not be settled there. They are questions about an address in Tirana that a Serbian operation found useful, and about a name that entered the operation with it. Both were available. The reckoning is with why.

Read also: Building Kandahar.

Drizan Shala is a Kosovar security researcher and doctoral candidate at the University of Sarajevo. He writes on defense, private security, and the security architecture of the Western Balkans.