The Caption Was the Operation

The footage was authentic. The captions were written elsewhere. Inside a week a domestic grievance was re-labelled into a hostile information operation, led from Tehran and amplified by every actor that profits from a weaker Albania.

Drizan Shala

Start with the artifact, because the artifact gives up the method. A video circulates: a building on fire at night, a crowd in the street, and an overlaid caption stating that Jared Kushner and Ivanka Trump bought protected Albanian land, that the prime minister altered the law for them, and that the burning house is his. The clip cleared a million views. The building is not Edi Rama’s residence. It is the former Hoxha villa. The fire is not from this week and not from Zvërnec. It is February footage, from an opposition protest over an unrelated grievance. France 24 had already established this.

The image was real. The caption was fabricated. That distance, between authentic footage and a sentence attached to it from outside, is the operating principle of everything that hit Albanian networks this past week, and it is where the attribution lives.

Take the ground situation first, because the operation was constructed on top of it and required it. Zvërnec sits inside the Vjosa-Narta protected zone. At the end of May the developer fenced the site and posted private security, and access disputes followed. On 30 May a confrontation at the perimeter ended with a protester injured, the regional police chief suspended, a guard arrested, the security contract cancelled, and SPAK opening an investigation into how the land titles were assembled. The grievance is real, the demonstrators are overwhelmingly Albanian and largely young, and their anger is authentic.

That authenticity is the precondition, not a footnote. An information operation cannot run on a fabricated grievance; fabrication is brittle and gets exposed. It runs on a real one. The anger at the fence existed independently, which is precisely what made it usable. The operation did not manufacture the protest. It captured it.

Return to the burning building. The technique is the lowest-cost item in the inventory and the most resistant to correction, because it does not invent the event. It relocates it. Real fire, real crowd, real footage, moved in time and re-captioned. A fact-checker can authenticate the image and still not touch the lie, because the lie is in the caption, and the caption is unfalsifiable from the frame. That asymmetry is why the clip propagated and the correction did not. Most of what saturated the feed was not synthetic. It was displacement: winter opposition violence, foreign protest footage, a construction-site clash from the Greek coast hundreds of kilometres away, each relabelled as Zvërnec. The production cost was near zero. The payload was in the text.

Across networks with no shared politics, the text was identical. An Italian outlet that carries Russian and Iranian lines and treats NATO as the adversary. Accounts from the Iranian activist-art space producing toy-format animations in which a figure with an Iranian flag patch defends the coast against actors the audio names as the Zionists. Pro-Russian channels with a standing Albanian-language output. Greek far-right accounts of the kind the prime minister named directly. Four origins, one message: Albania is not for sale, and the buyer is Israel.

This is not algorithmic coincidence. It is a single seam pressed by multiple hands. Iran is the lead. Attribution in this domain is never made from a confession or from command logs, which no service publishes; it is made from capability, motive, prior pattern and convergence, and on all four the same actor stands first. In March, before Zvërnec was contested ground, Meta dismantled an Iran-linked network of roughly three hundred Instagram accounts, several operating under Albanian cover, one posing as an Albanian cartoonist. The capability was already oriented on this target. The pattern is consistent with prior Iranian activity: the 2022 cyberattacks on Albanian state infrastructure and the renewed intrusions this spring, attributed to the same Iran-linked group. The motive is structural. Tirana severed relations with Tehran and hosts several thousand MEK members, the Iranian regime’s principal opposition, in a camp a few hours up the coast from Zvërnec. For Tehran, the Albanian shore is a long-standing target set. The resort supplied the pretext.

Behind the lead are the beneficiaries, and they did not need to author the operation to advance it. Moscow gains from any EU candidate state recast as a site of Western plunder, and its Albanian-language channels carried the frame without needing to originate it; Belgrade, with its standing interest in an Albania in friction with its neighbours and stalled on the accession track, gains from the same picture. Amplification was sufficient, because the end-state each prefers is the one Albania: weaker, more isolated, turned from the West. Convergence at this scale is not an artefact of the feed. It is the observable signature of several services reaching for one wound simultaneously.

The narrative carried a payload, and the payload is diagnostic. Beneath the slogan, in Albanian, on the ground and not confined to foreign feeds, ran the operative claim: the coast sold to Israel, Palestinians from Gaza to be resettled on it, the Jews buying Albania. It was present and we recorded it. The analytic point is what its presence indicates. That hatred has no domestic baseline. Albania emerged from the Second World War having sheltered its Jews rather than surrendered them; antisemitism is not a resident strain in Albanian politics. A narrative with no local root that materialises fully formed inside a week, fixed to a single target, did not develop organically. It was introduced. The appearance of the payload is itself evidence of external introduction.

This is not the first time the method has been catalogued. In the spring of 2024, operatives linked to Russian intelligence, working through a proxy network, were arrested in Paris after painting Stars of David on buildings where Jews lived and red hands across the Holocaust Memorial, an operation assessed as designed to inflame French society against itself. The antisemitism there did not erupt. It was a deliverable, stencilled onto walls by people paid to apply it. The Albanian version arrived as a caption rather than a stencil, but the production logic is the same: a hatred a population does not hold, supplied from outside, to turn it against its own interest. The medium changes. The technique does not.

That is why this was not the demonstrators’ operation, whatever their sincerity. The objective at the fence was the site. The objective behind the caption was an Albania that hates on instruction, written in Tehran, amplified in Moscow, exploited in Belgrade. The grievance was genuine and it was repurposed, in real time, into a frame that served none of the people holding it.

None of this is novel, and there is a cold comfort in that, because a documented method is a method that can be recognised in advance. The playbook is on the record. In July 2024 the United States’ own Director of National Intelligence stated that Iranian government actors had posed as activists online, encouraged the Gaza protests then spreading across American campuses, and in some cases provided the protesters with money, while stating plainly that the Americans marching were acting in good faith and were not the subject of the warning. That is this operation, attributed to this regime, a year before Zvërnec: a sincere protest entered from outside and steered, with the participants distinguished from the hand that exploited them. Tehran did not design a new instrument for the Albanian coast. It reached for one already in the rack.

Closer to home, Moldova has spent two election cycles absorbing the fuller version. A Kremlin-linked network selected vulnerable communities, built narratives engineered to ring true, paid for protest attendance by the night, and moved tens of millions in Russian funds into the accounts of ordinary citizens, all directed at a single outcome: a small EU candidate state pulled back from Brussels and held in Moscow’s orbit. That is the category Zvërnec belongs to. Not an environmental dispute that turned heated, but one node in a standing regional campaign against every Balkan state on the European path. Georgia, further down the same road, supplies the endpoint: a society that absorbed the operation so thoroughly it opened an investigation into the analysts who named it, rather than the operation they named.

The countermeasure was never a moderation policy or a fact-checking unit. It is a refusal to accept enemy designation from actors whose entire interest is Albanian weakness. The site dispute is real. The grievance is Albanian. The hatred attached to it this week is the single imported component in the picture, and it is the one component there is no reason to keep.

Drizan Shala writes on security, institutions, and political violence for Kosovo Dispatch and Tirana Examiner. He is a doctoral candidate at the University of Sarajevo.