Who Owns the Rumour

By nine on Tuesday the state had denied that two students were dying. Two hours later the claim was louder than before, a 1,400-follower account in Germany was on Serbian front pages, and nobody in Tirana could say which of three things was happening to Albania on the night it closed an EU chapter.

By Drizan Shala (Security Desk)

By nine on Tuesday evening the Agency for Media and Information had put out a denial. Two students were not intubated. The claim had been running on Instagram pages while masked groups were still setting fire to market stalls at Pazari i Ri and bins outside the Tirana Prosecution Office. Every injured person on the Health Ministry’s list was out of danger. The rumour said two were dying.

That is the moment a security analyst looks at, more than the molotovs. Molotovs tell you someone prepared the afternoon. A false casualty count in circulation after the crowd has scattered has one measurable property whatever its author meant by it: a dying student is the single message that can bring a dispersed crowd back to the street, and this one was attached to the “student” label the organisers had chosen for the day, not to the masked line that did the fighting.

The same evening a man climbed a pole on Rruga e Durrësit to smash the security cameras. Masks for the faces, a broken camera for the street, an anonymous page for the casualty count. Three ways of making sure nobody can say who.

Nobody owns the rumour. No account, no party, no movement has claimed it. That is the first question for the police and the prosecution, and it is cheaper to answer than who supplied the petrol: which pages posted first, when, and who runs them.

In the late afternoon, with the fighting at the ministry an hour old, an X account called Tirana Report told its followers that clashes had hit a “critical tipping point” and police had deployed “massive violence” against students, a flamingo on the post. The account was created last November, has about 1,400 followers, lists Germany as its sign-up country and carries an English and German bio. By evening Serbian tabloids had embedded it. Later the same account ran graphic footage of the 19-year-old under a line about unofficial reports of victims in comas. Around eleven, two hours after the official denial, an account called YourAnonTV repeated the intubation claim in capitals and added unverified reports of a 16-year-old’s death. The denial did not kill the rumour. It came before the rumour’s loudest version.

Sali Berisha shared police footage and called it terror against students. Tirana Report demanded the arrest of Rama and Berisha both, so whatever it is, its public line is not the Democratic Party’s. Srbija Danas and 24sedam ran the day under “War on the streets of Tirana” and folded it into a wave of youth activism across Europe, the same Belgrade press that calls its own students a colour revolution paid from abroad. A Reuters quote from one demonstrator, Luljeta Kola, that Albania needs a revolution and the complete demolition of the system, travelled further than any sentence about dormitories.

None of this proves a foreign hand. It shows what a foreign hand would not need to build, because it is already there.

Nothing in those posts says which of three things happened. Angry people and opportunist accounts repeat unverified casualty claims without anyone directing them; that is the ordinary noise of a riot night. Or a domestic network, political or activist, circulates them on purpose to keep the confrontation alive; that is a crime under Albanian law and a police matter. Or an outside actor finds a real crisis and amplifies it through accounts it controls, to make Albania look ungovernable on the day it closed an accession chapter; that is a counterintelligence matter. A 1,400-follower account registered in Germany is consistent with all three. So is a Serbian tabloid embedding it within hours. What separates them is not the content of the posts but their chronology, their first sources, whether the same video assets moved across accounts in the same minute, and whether any of the operators have been seen before. That is work, and it is work the Albanian state has not published on any incident since it declared foreign interference a threat.

By 23:10 the state had instead written the next day’s headline on its own. Four officers and the chief of Commissariat No. 1 were suspended over a 19-year-old’s broken femur. The Ombudsman opened an investigation into police force under the European Convention and said nothing about who threw the molotovs. The US Embassy told its citizens the protest had turned violent, without a word on by whom. None of that is false. All of it meant that by Wednesday morning the question in Tirana was police conduct, and the question of who prepared Tuesday was gone from the page before anyone had to push it off.

Albania has a draft Strategy against Foreign Interference and Disinformation for 2025 to 2030 on the parliament’s website. It names Russia as the main threat, and the Russian embassy in Tirana answered it by calling the Russian threat a myth and the strategy a witch-hunt. Rama told CNN in June that Albania was in a hybrid war, under attack from competitors in the Mediterranean and thousands of fake profiles, and told Politico that Iran ran a disinformation campaign against the Zvërnec investment. Tirana Times pointed out, fairly, that the government has shown no public evidence for any of it. Four months later the posts claiming Albania is handing land to Israel, or that Greece organised the Flamingo protests, are still circulating, and the state still has not published a single attribution.

The region has seen the mechanism before: a real grievance, a real crowd, and an information layer around it that nobody local controls. In Skopje on 27 April 2017 a crowd stormed parliament after the election of an Albanian speaker, with organisers later shown to have been coordinated through party and security-service channels, and the Russian embassy had spent the preceding weeks warning of an “Albanian platform” taking over the state. In Podgorica on election night in October 2016 the plot was an actual coup attempt; two Russian military intelligence officers were convicted in absentia in 2019, the verdicts were overturned on appeal in 2021 and the case sent back for retrial. In Belgrade on 15 March 2025 the fight over whether a sonic device was used on a silent crowd became, within a year, a prosecution of the students and journalists who said it was. In each case the rumour did more work than the riot, and in each case the state’s first move was to name an enemy before it had found one.

Tirana has the option of doing it the other way round. The police already know how to find the men who threw paving slabs; they filmed them until the camera came down. The harder work is in the phones: the first Instagram post about intubated students, who sits behind a 1,400-follower account in Germany that Belgrade’s tabloids found within hours, the accounts that moved the “revolution” quote into Serbian before the fires were out. If the answer is a youth forum in Tirana, say so. If it is a troll farm in Niš or St Petersburg, say so with the evidence.

Whether the state can do that is the question Tuesday actually asked. The capability a strategy against foreign interference implies is a unit with the legal authority to demand account data from platforms, the technical means to reconstruct a propagation chain within a day, and a procedure that puts SHISH, the police and the prosecution in one room before the next morning’s headline is written. Albania declared the threat. On Tuesday night the threat, or something that looked exactly like it, ran for hours in plain view. If nobody in the state can now say which of the three things it was, then what Albania has on the parliament’s website is a description of the problem, and Tuesday was its first test.