Espionage, recruitment and influence – what do the BIA cases in Kosovo show?

In just over two years, several people have been arrested in Kosovo on suspicion of spying for Serbia's Security and Intelligence Agency, BIA.

Taken together, the cases show a wide range of information for which, according to the Special Prosecution, there was interest: from the Kosovo Police and the Kosovo Intelligence Agency (KIA), to political developments, elections, members of certain communities and influential individuals.

Some of the cases are still pending. In others, there have already been convictions.

They do not in themselves prove the existence of a single operation or coordinated network of the BIA in Kosovo. But they do raise the question of what it seeks and what it can do with the information once it has obtained it.

"It works mostly for the benefit of people. Whether for information or for influence through institutions," Dušan Janjić, founder of the Forum for Ethnic Relations in Belgrade, tells Radio Free Europe.

One of the most recent cases began trial on September 7 at the Basic Court in Pristina.

Fatmir Sheholli is accused of espionage and blackmail.

The Kosovo Special Prosecution Office claims that he was recruited by the BIA and that he was collecting information about political developments, the security situation, and the functioning of Kosovo's institutions.

According to the indictment, he is also suspected of participating in a plan to compromise Kosovo officials and interfere in the 2025 local elections.

According to the Prosecution, a photograph of a document called "Top Secret 2" was also found on his phone, the content of which claims the existence of a plan to use the Islamic religion to divide Albanians and change the West's perception of Kosovo.

The authorship and authenticity of the document have not been publicly clarified.

The Islamic Community of Kosovo has denied the claims it contains and has demanded an investigation into its origin and authenticity.

The publication of the document's contents sparked reactions and clashes on social media, including allegations of links between the BIA and members of the Muslim community in Kosovo.

But the indictments do not indicate what happens next with the information that, according to the Prosecution, is collected and forwarded to Serbian intelligence.

Intelligence experts say that information gathering itself is only part of a service's job.

Equally important is who provides it, what access the source has, and what the information and network created can then be used for.

Daniel Lomas, professor of intelligence and security at the University of Nottingham in England, says the first stage is usually gathering information.

"First you try to get information from sources, so about the politics of a country, the economy of a country, who's up, who's down, political gossip, by developing networks of people throughout society," Lomas explains to Radio Free Europe.

But, according to him, the networks created could later acquire another function: being used for political influence.

What is BIA?

The Security and Information Agency, BIA, is the civilian national security service of Serbia and functions as a special organization of the Serbian Government.

It was established by law in 2002, following the separation of the civil security and intelligence service from the Ministry of Interior.

According to Serbian law, the BIA's tasks include protecting the security of Serbia, detecting and preventing activities aimed at violating the constitutional order, as well as researching, collecting, processing and evaluating intelligence data important for the country's security.

The law also stipulates that the BIA may cooperate with services of other states and international organizations, in accordance with the instructions of the Government and the security and intelligence policy of Serbia.

Radio Free Europe/Radio Liberty has reached out to the BIA to obtain its position regarding the cases and allegations regarding its activities in Kosovo, but has not received a response.

What information is required?

The indictments filed in Kosovo provide some clues about the type of information allegedly sought.

Bedri Shabani and Muharrem Qerimi are accused of having collected and forwarded information related to the KLA, the Kosovo Police and the Kosovo Intelligence Agency.

According to the indictment, Shabani had also collected materials about the Recak massacre, while Qerimi had collected information about witnesses for the Special Court.

Both have pleaded not guilty and the trial against them continues.

In another case, Fehim Sali is suspected of having collected and forwarded information and documents for certain persons in Kosovo during 2024 and 2025, including persons described by the Prosecution as members of Wahhabi circles.

Among those already convicted of espionage are Aleksandar Vllajic and Jelena Djukanovic.

Janjic says that the interest of an intelligence service is not limited to concrete documents or data. Equally important are the people who have access to them.

According to him, the BIA is interested in sources that can provide information, but also in influential people.

"We know who the majority population in Kosovo is – it's the Albanians – we know who has influence in the economy," says Janjic.

He adds that the goal is to reach "quality sources of information."

But the importance of a resource within an institution is not necessarily limited to what one can extract from it.

Lomas takes the police as an example.

"The police can do more than the average citizen can. They have different powers of surveillance. They can have access to certain types of information," he says.

A person within the police, according to him, can also help identify other people who could be targets for recruitment or create opportunities for other operations.

What happens to the information?

Janjic is cautious when asked what specifically happens with the information that reaches the BIA.

"To be honest, I can only imagine this," he says.

In principle, according to him, information passes to analytical sectors, where it is "sorted, classified" and then used depending on the assessment, primarily political.

He mentions blackmail and influence as some of the possibilities of their use.

Lomas explains the process from the perspective of the functioning of intelligence services in general.

Information about politics, institutions and individuals, he says, can show a foreign service where weaknesses or divisions lie within a government, party or society.

"Intelligence allows you to open cracks within governments, political parties, wider society, because it gives you clear knowledge of how to exploit a given society," says Lomas.

The next step, according to him, could be what is known in the intelligence world as "covert action": no longer just gathering information, but taking action based on what has been learned.

"...so, you're no longer just standing on the sidelines and collecting information, but you're also doing something based on it," he says.

This does not mean that the cases discovered in Kosovo prove the existence of such a coordinated BIA strategy.

The court proceedings deal with the individual responsibility of specific persons, while some of the Prosecution's claims have not yet been proven with final verdicts.

Radio Free Europe asked the Kosovo Special Prosecution Office about the number of people under investigation, indictment or trial for espionage in favor of Serbia, about possible connections and common methods between the cases, as well as about suspicions of the involvement of people within public institutions, but received no response.

The Kosovo Intelligence Agency, which REL asked for its assessment of the possible scope of BIA's activities and the risk it may pose to Kosovo's institutions, also did not respond.

Can espionage destabilize a country?

Lomas warns against concluding that espionage, in and of itself, can destabilize a state.

"I think espionage only takes you so far," he says.

Foreign services, he says, do not need to create divisions or discontent within a society themselves. They can identify and exploit them.

To explain this mechanism, Lomas takes Russia as an example.

He mentions the debates about migration in Germany, emphasizing that the concerns of a part of society on this issue were not created by Russia. But, according to him, external Russian actors have amplified such dissatisfaction, including through social networks.

He also compares this to a fire: grievances exist, while outside intervention can add "fuel to the fire," making them bigger and more dangerous.

Lomas does not say that the cases in Kosovo demonstrate an identical pattern.

But, in the Western Balkans region, he also sees this in the context of Russia's war against Ukraine and its broader clash with the West.

According to him, Russia may have an interest in spaces where existing tensions can be kept open and where NATO's attention can be shifted towards another crisis.

In Kosovo, the debate sparked by the "Top Secret 2" document, whose authorship and authenticity remain unclear, showed how quickly a sensitive issue can produce polarization.

For Janjic, information leaks, infiltration of institutions, and attempts at influence cannot be seen as completely separate.

He also links intelligence activity to Serbia's policy of not recognizing Kosovo and to the interest in information that, according to him, could be used to discredit it.

"When you don't know Kosovo, then you have to collect as much negative data as possible about the situation there," says Janjic.

How can Kosovo be protected?

For Lomas, protection does not just begin with the detection and arrest of suspects.

One of the tools is public exposure of the ways in which foreign intelligence services operate.

He cites the experience of Western European countries, where the publication of espionage cases has also been used to raise awareness among the public and institutions about recruitment methods and the risks they pose.

"The fact that you had these arrests and that they were made public is a way of making it clear to people that these foreign intelligence services pose a threat. They are a danger. They are not going to go away," Lomas says.

Equally important, he said, is counterintelligence: identifying people and institutions that may be most vulnerable, uncovering recruitment efforts, and sharing information with international partners.

Janjic also emphasizes strengthening intelligence and security capacities in Kosovo.

But, he says that responsibility does not fall solely on Kosovo institutions.

According to him, NATO, the United States and European partners have a role in raising security standards, strengthening the capacities of Kosovo institutions and creating better mechanisms for cooperation and information exchange.

The cases discovered so far, however, do not provide an answer to the possible extent of BIA activity in Kosovo.

It is not publicly known how many people may have been recruited, how long the connections with Serbian intelligence may have lasted, or how much information may have ended up with them.

For some of the accused, even the prosecution's own claims have yet to be proven in court.