Uncovering the hidden network: how Serbian intelligence operates in Kosovo’s territory

Within a two-year period, Kosovo authorities have arrested several individuals suspected of cooperating with Serbia’s Security and Information Agency (BIA).

Taken together, the investigations reveal a broad range of topics that, according to Special Prosecution data, aroused curiosity: from structures of the Kosovo Police and the Kosovo Intelligence Agency (AKI), to political dynamics, electoral processes, members of specific groups and influential figures.

Some of these proceedings are still ongoing in courtrooms, while in other cases convictions have already been handed down.

The facts themselves do not necessarily confirm the existence of a single operation or of a synchronized BIA structure in Kosovo. Nevertheless, they raise the question of what objectives the agency has and how it might use data once it has obtained it.

“The main focus is recruiting people. Whether to extract information or to exert influence through institutions,” says Dushan Janjiq, founder of the Forum for Ethnic Relations in Belgrade, in a conversation with Radio Free Europe.

One of the most recent cases will begin to be examined on September 7 at the Basic Court in Pristina, where defendant Fatmir Sheholli faces charges of espionage and blackmail.

Kosovo’s Special Prosecution asserts that he was engaged by BIA to collect data on the political scene, the security climate and the functioning mechanisms of the Kosovo state.

According to the indictment file, Sheholli is suspected of having participated in a scheme to compromise local officials and to manipulate the 2025 local elections.

On his mobile device, the Prosecution claims, a photograph was found of material classified as “Top secret 2,” the text of which talks about a plan aiming to instrumentalize the Islamic faith in order to divide Albanians and to change Kosovo’s image in the eyes of the West.

The origin and authenticity of this document remain unclear to the public, while the Islamic Community of Kosovo has rejected its claims and insisted on a full investigation.

The spread of the content sparked uproar and fierce clashes on social platforms, including speculation about relations between Serbian intelligence and Muslim believers in Kosovo.

However, the indictments do not shed light on what later happens to information that, according to Prosecution claims, is collected and passed to the Serbian secret service.

Intelligence specialists stress that data collection is simply one link in a service’s activity. Equally crucial are the quality of the source, the level of access it has, and the way in which information and the network built may later be exploited.

Daniel Lomas, lecturer in intelligence and security at the University of Nottingham in England, explains that the cycle usually begins with the collection phase. “In the first step you aim to obtain information from sources, that is, about a state’s politics, economic situation, hierarchies, corridor rumors, weaving networks of people throughout society,” he tells Radio Free Europe.

According to him, networks can later take on an additional role: to be used as tools to exert political pressure.

What does BIA represent?

The Security and Information Agency constitutes Serbia’s national civilian intelligence service and operates as a separate entity within the Serbian government. Established by law in 2002, it was separated from the Ministry of Interior as a result of the split of the civilian service from the police service.

According to Serbian legislation, its mandate covers protecting Serbia’s security, identifying and preventing activities aimed at undermining the constitutional order, as well as seeking, collecting, analyzing and assessing intelligence information significant for national security. The legal framework also gives BIA the right to interact with counterpart agencies of other states and international organizations, in line with government guidelines and Serbian security policy.

Radio Free Europe has requested a response from BIA regarding these issues and the claims about its operations in Kosovo, but has so far received no reply.

Type of information targeted

The indictments filed offer some indications about the category of data believed to have been targeted. Bedri Shabani and Muharrem Qerimi are accused of obtaining and passing on information related to the KLA, Kosovo police forces and AKI. According to prosecutors, Shabani had also gathered material on the Reçak events, while Qerimi had collected data on witnesses of the Special Court. Both have pleaded not guilty and proceedings against them continue.

In another case, Fehim Sali is suspected of having gathered and forwarded files and notices about certain persons in Kosovo during 2024 and 2025, including individuals whom authorities describe as linked to Wahhabi currents. Among those already sentenced for espionage are Aleksandar Vllajiq and Jellena Gjukanoviq.

Janjiq stresses that an intelligence agency’s interest does not stop only at documents or concrete figures. Equally important are the individuals who have access to them. According to him, BIA is interested both in sources that supply data and in people who have influence. “It is known that Albanians are the dominant population in Kosovo and it is known who carries weight in the economy,” he notes, adding that the goal is to secure “quality information sources.”

However, the usefulness of a source within an institution is not simply linked to what it can get from there. Lomas uses the police as an example. “A police officer can do more than an ordinary citizen. He has supervisory powers and can have access to certain categories of data,” he explains. Such a person can also help identify other people who may be recruitment targets or create ground for other operations.

Destination of information

When asked what concretely happens with information that reaches BIA, Janjiq is measured. “To be honest, I can only imagine,” he says. In principle, he explains, data pass to analytical sectors, where they are “systematized, categorized” and then used according to an assessment, mainly political. He mentions blackmail and influence as some of the possible uses.

Lomas sees the process through the prism of the general functioning of intelligence services. Data on politics, institutions and individuals, he says, can reveal to a foreign service weaknesses or divisions within a government, party or society. “Intelligence enables you to create rifts within governments, political parties and broader society, because it gives you clear knowledge of how to exploit a particular society,” he emphasizes.

The next step, he continues, may be what in intelligence language is known as “covert action”: you are no longer satisfied with gathering information, but take concrete actions based on what you have learned. This does not mean that the cases uncovered in Kosovo prove such a coordinated BIA strategy. Court proceedings concern individual responsibility, and some of the Prosecution’s claims have not yet been proven by final rulings.

Radio Free Europe contacted the Special Prosecution to find out the number of persons under investigation, the number of indictments or proceedings for espionage in favor of Serbia, possible shared connections and tactics among the cases, as well as suspicions of involvement within public bodies, but without success. The Kosovo Intelligence Agency also remained silent. Radio Free Europe asked it for an assessment of the extent of BIA’s activity and the threat it poses to the country’s institutions.

Can espionage destabilize a state?

Lomas warns against the idea that espionage, on its own, can bring down a state. “I think espionage only takes you so far,” he stresses. Foreign services, according to him, do not need to invent divisions or grievances within a society; they can simply detect them and use them for their own purposes.

To illustrate this mechanism, Lomas takes as an example Russia and the debates over migration in Germany. He notes that the real concerns of part of German society on this topic were not produced by Russia, but external Russian actors amplified these tensions, including through social media. He compares this to a fire: grievances exist, and external intervention acts as “fuel,” giving it bigger and more dangerous flames.

Lomas does not claim that the cases in Kosovo reflect the same pattern, but in the Western Balkans context, he sees this also in light of the Russia-Ukraine conflict and the broader confrontation with the West. According to him, Russia may have an interest in spaces where existing tensions can be kept burning and where NATO’s attention can be diverted by another crisis.

In Kosovo, the controversy triggered by the “Top secret 2” document, whose origin and authenticity remain unclear, showed how quickly a sensitive issue can bring polarization. For Janjiq, information leaks, infiltration into institutions and attempts to exert influence are closely linked phenomena. He links intelligence activity with Serbia’s policy of not recognizing Kosovo and with an interest in data that can be used to discredit it. “When you do not recognize Kosovo, then you have to collect as much negative material as possible about the situation there,” Janjiq says.

Defense avenues for Kosovo

For Lomas, defense is not limited only to detecting and arresting suspects. Another powerful tool is the public exposure of the methods of foreign intelligence services. He refers to the experience of Western European countries, where making espionage cases public has served to increase the vigilance of citizens and institutions toward recruitment techniques and related risks.

“The very fact that you have carried out these arrests and that they have been made public is a way to make clear to people that these foreign intelligence services are a real threat. They are not going to disappear,” Lomas stresses. Equally essential, according to him, is counterintelligence: identifying the most vulnerable people and institutions, detecting recruitment attempts and exchanging information with international allies.

Janjiq also emphasizes strengthening intelligence and security capacities in Kosovo, but adds that the responsibility does not belong only to official Pristina. According to him, NATO, the US and European partners have a role in raising security standards, strengthening Kosovo’s institutions and creating better mechanisms for cooperation and information sharing.

However, the cases brought to light so far do not offer a complete picture of the real scale of BIA’s activity in Kosovo. It is not publicly known how many people may have been recruited, how long links with the Serbian secret service may have continued, or the amount of information that may have ended up in its hands. For some defendants, even the Prosecution’s own claims still await proof in court.