Albania, a Nato country, is posting sensitive information about its most senior intelligence operatives on the internet, making details about their identities, vehicles, operational roles, travel movements, and daily habits publicly available in what appears to be a major and potentially dangerous breach that could have international consequences.
Salary and expense data posted in spreadsheets on the website of Albania’s Ministry of Finance show a wealth of details about the State Intelligence Service, including the locations of field offices, cash withdrawals, and minutiae such as the plumbers, technicians and mechanics they use.
The records show the names and national identification card numbers of agents in the service, known locally and in the intelligence community as SHISH, operating inside Albania and abroad, including two with sensitive posts at Nato headquarters in Brussels. The spreadsheets disclose the names, positions, salaries and expenses of at least eight senior clandestine Albanian operatives – some working under diplomatic cover – in Belgium, Greece, Kosovo, Italy, Macedonia and Serbia.
The Independent is not disclosing names or other identifying details to prevent retribution against low-level informants or others who may be associated with the agency’s operatives. Presented with the breach during a meeting in a café outside the agency’s heavily fortified Tirana compound, SHISH officials acknowledged the sensitive nature of the information.
“The principle is that everything our agency does should be hidden, but we should follow all these rules and regulations,” said one SHISH official. “The rules and regulations don’t allow us to spend the money without reporting it.”
Intelligence and security professionals told about the breach were stunned by the revelations, which could leave agents in sensitive positions vulnerable to surveillance or blackmail by hostile intelligence organisations or criminals seeking to infiltrate the Western alliance.
“By getting into Albania’s system they can get into Nato’s system,” said Xhemal Gjunkshi, an opposition member of the Albanian parliament who serves on the National Security Commission and was a former Major-General in the army.
“You start pulling a string and you end up in Brussels or London or the office of a supreme allied commander in the US.”
A former CIA field operative familiar with SHISH described it as the type of bureaucratic catastrophe that could put lives at risk.
“Your admin can screw you up if they’re not paying attention,” he told The Independent on condition of anonymity because he continues to work on sensitive security matters.
“You can put the budget online. But to put the names and the other details of agents – that’s insanity.”
A Brussels-based spokesperson for Nato said in an email that it does not comment on intelligence matters.
SHISH is the successor organisation to the much feared Sigurimi, the notorious Communist-era domestic spy service that infiltrated every aspect of Albanians’ personal lives during the country’s four-and-a-half decade Stalinesque dictatorship.
A 2007 US State Department cable published by Wikileaks described SHISH as “a professional, largely apolitical intelligence service” that is “excellent partners” with the US government and cited “close cooperation on all intelligence activities”.
The director of the organisation, currently Helidon Bendo, is appointed by the prime minister but it operates as an autonomous unit outside of the Albanian cabinet. According to the finance ministry documents, it employs 913 people. One foreign diplomat complained that SHISH operates with little accountability or oversight.
The documents revealed tantalising clues about the operations of the clandestine agency. The Independent could not confirm whether the names of the operatives inside Albania were handles or birth names. But the names of the international operatives listed matched the identities of Albanian diplomatic staff posted at embassies across Europe.
One female regional operative in the main port city of Durrës, whose name and ID card number are visible in the records, is listed as withdrawing the Albanian currency equivalent of £18,000, over at least 10 transactions this year for “special payments”, a possible reference to networks of informants.
Another agent in Gjirokastër, in Albania’s south, is recorded withdrawing a cheque for about £1,500 in November for what is described on the Albanian ministry of finance’s public website as a “secret fund”.
One set of 2017 payments, classified as secret, refers to a Nato communications system, referred to as Tumba, which might refer to several mountain peaks in the Balkans.
At one point, water bills in Albania’s Himara district, where many members of the country’s Greek minority reside, suddenly drop 95 per cent, suggesting shifting surveillance priorities.
The information appeared to be updated daily. A withdrawal of about £21,000 from Credins Bank in Tirana on 3 December was posted online by day’s end.
Details include the licence plate numbers and sometimes make and model details of vehicles used by the spies, and even where the cars are taken for repairs, as well as records of pricey hotel stays and restaurant bills.
The documents also reveal potentially uncomfortable details about the domestic spying activities of SHISH, including rental payments for offices at Tirana International Airport and TVSH, the state-owned broadcaster. Some of the payments made to the state broadcaster includs descriptions such as “installing technical devices” and “device inside the state television [offices]”.
Officials vowed to remove the data after The Independent informed the country’s prime ministry, intelligence services, foreign ministry, interior ministry, defence ministry and finance ministry publication of this article was pending. During the months the information has been online, it likely left the Nato country vulnerable to infiltration by operatives of Russian or other intelligence agencies.
The country has already become something of a battleground as dominant pro-Western political leaders fend off the Kremlin’s agenda of weakening its Nato and EU ties.
In March, Albania expelled two Russian diplomats, accusing them of unauthorised intelligence operations. “Their work did not correspond to their diplomatic status,” the foreign minister Ditmir Bushati said at the time.
Albania appears to have repeatedly suffered from a lack of information security when it comes to its intelligence services. Last year the presidency posted online an unredacted copy of SHISH director Mr Bendo’s national identification card, which includes his home address and ID number, as part of a transparency initiative.
Earlier this year, a state agency reportedly was sent a list of 250 or so names of operatives serving in the country’s Military Intelligence unit.
The SHISH documents posted online date back to 2014, as Albania struggled to show the EU that it had shaken off its history of public corruption and was seeking to be more transparent and accountable as a step towards membership in the trading and currency bloc.
Albanian laws forbids the leaking of secret state information, with penalties of up to 10 years in prison for officials who divulge the intelligence and five years for ordinary citizens.
Told of the leaks, officials of the prime minister’s office, finance ministry, interior ministry, and foreign ministry scrambled behind the scenes to remove the data, but also assign blame for the mishap.
“The treasury registers on its online system all the bills and order of payments that are executed each day,” one official said on condition of anonymity.
“All the details that are given there, are because they were written in the order of payment by the institution itself. They should have not detailed the bills with such sensitive information.”
One longtime former officer of the Albanian intelligence service told The Independent that the culpability lay with SHISH itself, for handing sensitive information to finance ministry officials who lack security clearances.
“It’s incompetence of the leadership,” said the former official, who spoke on condition he not be named discussing sensitive political issues.
“Sometimes people are hired not because of good performance or qualifications, but because of the influence of the politicians. Sometimes people coming into the security institutions aren’t well vetted. The problem starts at the top.”