The Confession

Edi Rama said the protest had been entered. His critics called it deflection. Then the man leading the protest said the same thing, and named the groups.

By Drizan Shala   (Security Affairs Contributor)

“There are infiltrated groups among us who drop the disguise and join us. In the days ahead we will bring them out, with faces and names. We know the Greek groups operating here against Albania, and we know the Serbian groups too. We also know the religious channels from Turkey that want to give the protest a religious narrative. They will not undo it. This is the will of the Albanians.”
Arben Kola, organizer of the Zvërnec protest, speaking to reporters in Tirana.

That was Kola, not Edi Rama, and the distinction is the whole of the matter. Kola is the most prominent voice of the protest, a man marching against the government, and by any ordinary calculation the last person who should want to tell the country that his own movement has been penetrated. He told them anyway, and he attached three labels to the people he says did the penetrating.

For the better part of two weeks the prevailing reading among Rama’s critics had run in the opposite direction. The Prime Minister, cornered by a genuine revolt over a protected coastline handed to a Trump family development structure, was said to have reached for the instrument every government keeps within reach and cried foreign hand. On that account the Greek operatives and Serbian agents and outside agendas were a fabrication, a smokescreen released to discredit Albanians exercising a legitimate right, and the talk of infiltration was a false narrative manufactured to protect a man who had traded away a shore.

The reading depended on a single load-bearing assumption, that the infiltration was Rama’s invention. Kola has now removed it.

Why the source matters more than the claim
Intelligence work assigns weight to a statement according to the interest of the person making it, and a claim that injures the speaker’s own cause carries more weight than one that serves it. A protest leader has every reason to insist that his crowd is clean and his square is exactly what it looks like from the platform. When that same leader instead announces that hostile groups have worked their way inside his movement, the statement runs directly against his interest, and it cannot be dismissed as the self-serving line a government would feed the press. Kola is not a hostile witness brought in to damage the protest. He is its central figure.

The flag belongs in the same column of evidence. On the night before Kola spoke, the Israeli flag was torn down at the Zvërnec protest and desecrated, and the leadership did not treat the act as its own. It moved to distance the movement from it and signalled a formal statement would follow. An organic civic gathering with nothing to hide produces no flag it has to disown. This one did, and the desecration is the clearest physical trace of an agenda inside the crowd that is neither Albanian nor concerned with a coastline.

The second surface
Kola is describing people in a physical space. Above that space sits a second environment, and there the activity is not a matter of testimony but of measurement. A narrative intelligence assessment of the conversation between 22 May and 9 June processed 879,067 documents from 222,854 authors generating more than 3.2 million engagements, and the picture it returns is not the picture of a spontaneous civic argument.

The largest single narrative by volume, at 179,765 posts, was the openly antisemitic framing that celebrated the rejection of a “Jewish Trump-Kushner land grab.” Below it ran the “Epstein island” conspiracy at 103,146 posts and a cluster of corruption and ecosystem narratives in the tens of thousands. A separate narrative, 2,231 posts, framed Albania and Serbia as united against the project, a pairing no Albanian protest generates on its own. Hostile actors were using a real grievance for ends that have nothing to do with Zvërnec.

The behavioural signals are the part that does not occur by accident. Roughly thirty percent of accounts in the Greek-language segment showed bot-like characteristics, and more than twelve percent of those were assessed as Russian state-aligned. Greek-language activity amounted to less than one percent of the total, yet close to a fifth of it recycled positions tied to the Storm-1516 network, a known Russian influence operation, with a handful of accounts driving most of the engagement. The assessment flagged at least seven separate conversations carrying strong indicators of coordination, each built from waves of near-identical multilingual messaging pushed through bot-like repost chains. In one case on 2 June a seed post was replicated almost word for word across a concentrated network inside roughly twenty minutes, and the amplification was sustained in bursts for two further days to manufacture the appearance of broad public concern.

None of that is the cause of the protest, and it is not offered as one. It is what was layered on top of the protest. The body of the thing is in the square, among the people Kola says he will name. The amplification is in the feed, among networks whose function is to take a domestic flashpoint and convert it into reach, polarization, and antisemitic noise. A genuine mobilization entered on both surfaces at once is the working definition of a hybrid operation, and it is what Rama identified before either surface had been documented.

Where this leaves the critics
Two accounts now sit on the table. One comes from a Prime Minister with an obvious incentive to invoke a foreign hand. The other comes from his most committed opponent, a man with every incentive to deny one, who has confirmed the foreign hand inside his own movement and undertaken to produce the names. Where the accused and the man working to remove him converge on the one disputed fact, that fact has stopped being a partisan instrument and become simply a fact.

That convergence is what empties the critics’ position. They did not, in the end, defend the protest, because the protest’s own leader announced its penetration before they had finished calling the penetration a lie. What they defended was an account too convenient to survive contact with its own protagonists, one in which an Albanian crowd was treated as sealed and incorruptible and somehow beyond the interest of any service that might find it useful. Honest doubt looks at the flag, the slogans, the dataset, and the leader’s own words, and it goes where they lead. The critics did the reverse, fixing the conclusion in advance and setting aside the evidence, including the evidence volunteered by the people they claimed to represent.

I will put my own name to the conclusion. Rama was right. The evidence no longer permits the infiltration thesis to be dismissed as a political fabrication. He was right about the infiltration on the ground, now confirmed by the man leading the protest, and he was right about the operation running above it, now set out in detail in the data. One may hold the man in contempt, distrust the deal, and oppose the sale of the coastline, and still concede the narrow and decisive point. The protest was entered. The flag was brought down. Its own leader said so, on the record, with names to come. The single fiction at Zvërnec was the one composed by those who insisted there was nothing there to find.

Drizan Shala writes on security, institutions, and political violence for Kosovo Dispatch and Tirana Examiner. He is a doctoral candidate at the University of Sarajevo.