Arrest of the head of SHISH: blow to national security and dilemmas between Albania and Kosovo

Vlora Hyseni, the head of the State Intelligence Service, who is being investigated by the Special Prosecutor’s Office against Corruption and Organized Crime, was stopped on Tuesday at the Vërmica border crossing while returning from a stay outside Albanian territory.

We recall that the Special Court of First Instance had imposed on September 21 the measures of “house arrest” and “suspension from public office” against her. However, the execution of these measures was not immediately possible, because Hyseni was not in Albania. She was later located at the Vërmica-Morina customs point and handed over to Albanian law enforcement.

It is reported that during the day, the senior official stayed in Kosovo, while in the evening, upon presenting herself at the border crossing, she was placed under surveillance by our authorities.

The court hearing for the review of the security measure is scheduled to be held on September 24, where Hyseni will appear before the judicial panel.

A serious precedent and the call for prudence

Journalist and analyst Adriatik Riza Dosti describes the detention of the head of SHISH as one of the most severe episodes that the Albanian state has experienced in its entire history.

He warns that the effects could be profound and calls for an extremely serious approach in assessing them.

“Arresting the number one of the secret service and national intelligence of Albania, in my opinion, constitutes one of the most alarming episodes in the entire history of our state. I fear the consequences will be considerable. It is unacceptable for the relevant hierarchies, and in this context, great responsibility also lies with Prime Minister Rama and President Begaj. A NATO member state puts in handcuffs the head of the national service… Almost unimaginable from any perspective.

The potential damages that Hyseni may have caused, especially concerning classified information that may have leaked regarding national security, both in Albania and Kosovo, must be taken with the utmost seriousness. These must also be carefully analyzed in relation to our allies and the intelligence agencies of neighboring states. Here I particularly highlight Albania–Greece relations, Albania–Serbia, as well as the Serbia–Kosovo dynamic,” Dosti stated for “Bota sot”.

The analyst expresses deep concern that President Begaj has not yet called an extraordinary meeting of the Security Council, while labeling Rama as anti-Albanian and anti-Kosovar.

“Everything is linked to the nature of the documents and data that have been leaked and which SPAK is investigating. The fact that President Begaj has not yet convened the National Security Council in an urgent session is extremely worrying and significantly weighs on the positions of the executive and the state, respectively on Rama and Begaj.

I believe that not only in this case, but throughout the entire period that Albania has been governed by Rama, whom I see as anti-Albanian and anti-Kosovar, based on evidence and not rhetoric, and as a close friend of Serbia and Vučić, Kosovo should have carefully analyzed, with increased attention, all forms of relations with the Albanian state.

The most recent case, that V. Hyseni, dismissed and accused on serious grounds by Kosovo, i.e. by Kurti and Osmani, was appointed by Rama to head an extremely sensitive institution, speaks for itself and requires little comment,” he stressed.

SPAK has included Hyseni in the list of persons under investigation for the criminal offenses provided by articles 320/2 and 295/a/1 of the Criminal Code, which relate to favoring the perpetrator of a crime and to the disclosure of official secrets or secret data.

This investigation is an integral part of criminal proceeding no. 20/1 of 2025, a file which is also linked to suspected irregularities at the National Agency of the Information Society.

In the framework of the same investigation, the Special Court has also imposed security measures on other persons. Specifically, for a sector head at the Institute of Scientific Police and an employee of an agrotourism business, the measure of “imprisonment” has been imposed, while searches have also been authorized in residences and various premises, including a villa complex in Shkozet, Durrës.

Investigations into the AKSHI file extend over a large number of individuals, including businessmen Ergys Agasi and Ermal Beqiraj, who have already been arrested in this matter, as well as the former head of AKSHI, Mirlinda Karçanaj.

A blow to the security hierarchy, what is at stake and how is the trust relationship with Kosovo affected?

Security expert Fatjon Softa argues that a case of this nature must be analyzed on several levels and cannot be simplified by limiting it only to the responsibility of the individual under investigation.

“When a criminal proceeding involves the head of an intelligence institution, we are not dealing simply with a personal matter. The extent of institutional responsibility makes the case extremely important for national security and public trust. We must make a clear separation between three levels: the criminal responsibility of the person, the institutional one, and the strategic trust in security structures. Security measures are part of a judicial process and do not constitute definitive proof of guilt. However, they make it necessary for institutions to check whether the mechanisms of supervision, control, and information protection have been functional. A consolidated state must be able to investigate a senior official without immediately jeopardizing the credibility of the entire institution. The objective should be to discover the truth and strengthen the security system, not to generate institutional panic,” Softa explained.

He adds that the risk to national security, if suspicions of exposure of classified information are confirmed, cannot be determined only by the criminal offense under investigation, but by the nature and impact of the exposed information.

Risk is not measured only by the name of the criminal offense, but by the substance of the exposed information, the subjects who may have benefited from it, the duration of access, and the effects it may have produced.

We must consider four elements:

Classified information: What level of clearance did she hold and how vital was it for intelligence operations or sources?

Control chain: How was the information managed and was there unauthorized access?

Operational consequences: Have human sources, working techniques, or concrete operations been damaged?

International trust: Is there a possible impact on the information that Albania shares with partners?

We cannot speak of a total damage to the system without having evidence. But, also, we cannot treat the matter as an ordinary bureaucratic incident if the facts show that strategic information has been affected.

The key question is: Are we facing an isolated violation, a flaw in the control mechanisms, or a broader problem in the information security architecture?”, the security expert emphasized.

The case also takes on a special nuance for Kosovo, considering that Hyseni, before being appointed as head of SHISH in Albania, had a long career in Kosovar security structures. Softa believes that this makes a careful assessment necessary, but not the creation of suspicions in the absence of concrete facts.

“The fact that an official previously held duties in Kosovo’s intelligence structures does not automatically imply that the information she managed has been compromised. This requires strong data and an assessment of institutional competencies. Some fundamental questions must be analyzed: During which periods did she have access to classified information? What type of information did she manage? Is there any factual link between the investigation in Albania and the information obtained during her service in Kosovo? If evidence of exposure of information comes to light, then the competent institutions must carry out a special risk assessment and take the necessary measures to protect sources and cooperation. National security is not preserved by casting general suspicions, but by precisely identifying the information, the risk, and the responsibility,” Softa stated.

In these circumstances, according to him, Kosovo can review in a focused manner the mechanisms of information exchange with Albania, without turning this case into a justification for halting inter-institutional cooperation.

“In such a situation, a targeted security review may be part of institutional responsibility. But we must distinguish between reviewing security measures and a general interruption of cooperation. Albania and Kosovo have common interests in the fight against organized crime, terrorism, hybrid threats, and the defense of the Euro-Atlantic space. This cooperation should not be damaged on the basis of assumptions, but should be supported by clear protocols and necessary verifications. Kosovar institutions can examine, within their competencies, whether there is a need for:

Review of information exchanges that may be relevant.

Verification of access and data storage procedures.

Assessment of possible exposure of sources or sensitive information.

Institutional coordination with Albanian authorities in accordance with the law and confidentiality obligations.

Ensuring that information circulates through reliable and controlled channels,” he said.

Softa assesses that the investigation should focus not only on the person who may have committed a potential violation, but also on how the institutional mechanisms have functioned.

“The investigation must go beyond identifying the person who may have committed a violation. It must also examine the institutional terrain in which that violation is suspected to have occurred.

Here some questions arise: Who had access to the affected information? Did internal controls and oversight mechanisms function? Have there been procedural violations or structural deficiencies? Was there a chain of responsibility that needs to be investigated? Have measures been taken to prevent further exposure of information? A security institution is measured not only by the ability to react after an incident, but also by the ability to prevent it and to correct the weaknesses that are discovered,” the expert said.

Another dimension that emerges from this case is the possible impact on the trust of international partners towards Albanian intelligence institutions.

According to Softa, such an investigation may bring additional security assessments, but does not automatically imply a cessation of cooperation.

“Trust in the intelligence field is built through confidentiality, access control, accountability, and respect for cooperation agreements.

An investigation relating to classified information may bring the need for security assessments from partners. This, however, does not automatically mean that international cooperation has been interrupted or that all Albanian information has been doubted. Partners assess not only the possible incident, but also how institutions react: Is the matter investigated independently? Are weaknesses identified? Are corrective measures taken? Is the continuity of information protection guaranteed? Trust does not require silence about problems. Trust requires institutions that know how to identify, investigate, and correct problems with professionalism,” Softa emphasized.

For the security expert, the case should also serve as a moment to analyze the functioning mechanisms of security institutions in Albania, especially regarding accountability, information protection, and institutional control.

“Such a case should serve as a moment of reflection for the national security system, without necessarily waiting for the conclusion of the investigation to consider preventive measures.

The reform must be based on several pillars: Accountability and responsibility: Clear control of the functioning of institutions and of leadership responsibilities. Information protection: Review of protocols for classification, access, and data management. Institutional control: Independent and effective oversight mechanisms, according to legal competencies. Professionalism: Recruitment and promotion of personnel on the basis of integrity, skills, and security standards. Institutional continuity: Ensuring that the critical functions of intelligence services do not depend on a single individual. Albania needs strong, professional, and stable institutions, where information security does not depend solely on the personal integrity of the leader, but on a control system that functions at every level,” he said.

In conclusion, Softa underscores that the case must be handled while simultaneously preserving the judicial process and the necessity to protect strategic information.

“National security cannot be built on assumptions, nor can it be preserved by bypassing risks. The matter of the investigation against a senior leader of the intelligence service must be treated with seriousness, impartiality, and institutional responsibility. The judicial process and the presumption of innocence must be respected, while the competent authorities must assess any possible exposure of classified information. Albania and Kosovo need reliable cooperation in the field of security. This trust is not protected by ignoring problems, but through institutional transparency, professional controls, and measures adapted to the verified risk. Ultimately, the question is not only who will bear responsibility for a possible violation, but whether our institutions are capable of protecting strategic information, maintaining the trust of partners, and guaranteeing national security even in the most difficult moments,” concluded security expert Fatjon Softa.

Vlora Hyseni was placed at the head of the State Intelligence Service in Albania in April 2023. Prior to this appointment, she had extensive experience in security institutions in Kosovo, including the Kosovo Intelligence Agency.