(Institutional Capacity, Democratic Oversight, and Public Trust)
Gjon Culaj, Associate Fellow at the “Octopus” Institute
The recent arrests and criminal proceedings involving allegations and convictions related to espionage in Kosovo have opened an important debate about the capabilities of the country’s security institutions, the nature of intelligence threats, the role of the public and the media, and the delicate boundary between democratic transparency and operational secrecy.
In August 2026, the Special Prosecution Office of the Republic of Kosovo publicly stated that it was handling several espionage cases suspected of being linked to Serbia’s Security Intelligence Agency (BIA). Prosecutor Bekim Kodraliu stated that, by that time, seven such cases had been investigated and that four had resulted in convictions, highlighting the cooperation between the Special Prosecution Office, the Kosovo Intelligence Agency (KIA), and the Kosovo Police(Koha.net, 19/08/2026). During the same period, the arrest of Fehim Sali at the Merdare border crossing, the following legal proceedings against him and the indictment of Fatmir Sheholli on charges of espionage and intimidation, once again placed the issue of espionage and counterintelligence at the forefront of public debate (REL, 27/08/2026). These developments should not be interpreted only through the question of whether the individuals arrested or charged are guilty. The determination of criminal responsibility is ultimately a matter for the courts. From a security perspective, however, a more significant question arises: what do these cases reveal about the ability of state security institutions, particularly the Kosovo Intelligence Agency, to identify, prevent, and neutralise foreign intelligence threats, in these cases those linked to Serbia? This question is particularly important because intelligence is an area in which the traditional standards of public transparency applicable in a democratic society cannot be applied mechanically. Rather, a proper balance is required between public accountability and the protection of national security interests. Intelligence services depend on the confidentiality of sources, methods, networks of contact, and operational capabilities. As Seumas Miller (2022) argues, intelligence is a process closely connected to the collection, analysis, and dissemination of information, some of which must remain classified in order to preserve its operational and strategic value (Miller, 2022:791-792).
Therefore, cases such as these highlight a fundamental paradox and challenge of modern democracy: intelligence institutions must remain sufficiently secretive to be effective, while at the same time being sufficiently accountable to remain democratic and subject to the rule of law. The recent espionage cases in Kosovo should therefore be examined through three interconnected dimensions. First, they should be assessed in terms of the capacity and performance of Kosovo’s security institutions, particularly their ability to detect and counter foreign intelligence activities. Second, they raise questions concerning the public debate and the role of the media, including how intelligence-related cases are communicated to the public and how information is distinguished from speculation, political narratives, or deliberate disinformation. Third, they highlight the complex relationship between secrecy, accountability, and the principle that not every institutional or societal actor can or should have access to sensitive operational information. In other words, the effectiveness of an intelligence service should not be measured by the extent to which its activities are publicly exposed, but rather by its ability to produce accurate intelligence, detect emerging threats, disrupt hostile intelligence activities, and prevent potential harm, while operating within the law and under effective democratic oversight. In this context, secrecy should not be understood as the opposite of accountability. Rather, the central democratic challenge is to establish appropriate mechanisms of oversight through which intelligence institutions can remain operationally effective without becoming institutionally unaccountable.
Intelligence, Counterintelligence, and the Democratic State
Intelligence studies conceptualise intelligence not merely as the clandestine collection of information, but as an institutional process through which information is transformed into knowledge that can support strategic decision-making (Dokman, 2019:194). This makes iintelligence as an essential state capacity for countries facing persistent security threats and unresolved conflicts. The Kosovo Security Strategy (2022–2027) identifies Serbia as one of the principal threats to the security of the country and links these threats to its territorial claims, illegal structures, and continued efforts that may undermine the institutions of the Republic of Kosovo (Kosovo Security Strategy 2022-2027, 2022:7). From this perspective, espionage should be understood as part of a broader spectrum of security competition, in which information constitutes an instrument of power alongside military force and diplomatic pressure. For Serbia, the collection of information concerning Kosovo’s institutions and security capabilities can be understood as part of a broader strategy aimed at preserving influence and supporting activities that may undermine Kosovo’s institutional stability and security. Such a destructive approach by Serbia, which has become increasingly evident, extends beyond the security dimension and includes efforts to undermine the functioning of institutions, influence political processes, constrain the economy, and undermine social cohesion in Kosovo (Fetoshi, 28/05/2026). In response to such challenges, Kosovo has increasingly adopted a comprehensive approach to national security that is not limited to the defence of its territory, but also encompasses the protection of state institutions, the constitutional order, and institutional resilience.
Kosovo’s response to espionage and Serbian interference increasingly reflects a coordinated and preventive security approach, built on close cooperation among the Kosovo Intelligence Agency (KIA), the Kosovo Police, and the Special Prosecution Office. This approach reflects an institutional process in which intelligence, criminal investigation, and the justice system are closely interconnected. Recent developments indicate concrete institutional efforts to identify suspicious activities at an early stage, document them, and transform intelligence information into specific investigative and judicial proceedings. This represents an important development in Kosovo’s capacity to protect itself against external interference, particularly within a security environment in which activities conducted by Serbian intelligence services constitute a persistent threat.
The cases recently investigated by the Special Prosecution Office, its cooperation with the KIA and the Kosovo Police, as well as convictions issued in several cases, indicate that Kosovo’s institutions have developed significant capacities to transform intelligence information into concrete investigative and legal proceedings (Zëri, 19/08/2026). In relation to Serbia, this issue acquires an additional dimension given its destabilising and hostile approach towards Kosovo’s sovereignty, security, and institutional integrity. In the indictment against Fatmir Sheholli, for example, the Special Prosecution Office alleged that the information collected concerned political activities, the security situation, and the functioning of Kosovo’s institutions (REL, 25/08/2026). This case illustrates that Serbian intelligence activities have a multidimensional character and that information concerning political and security institutions can constitute an important resource for advancing the strategic objectives of an external actor, in this case, Serbia’s objectives towards Kosovo.
In this context, the role of Kosovo’s counterintelligence capabilities becomes particularly important. The activities of Serbian intelligence services should not be portrayed as an unexpected development, but rather as part of a continuing pattern of threats requiring sustained institutional attention and a high degree of preparedness. The cases identified and prosecuted in recent months indicate that Kosovo’s counterintelligence mechanisms have been capable of detecting and addressing unlawful activities conducted by Serbian intelligence actors, enabling such activities to move from the stage of threat identification and assessment to criminal investigation and legal accountability. This demonstrates that counterintelligence should not be understood merely as a reactive structure responding to threats and risks, but as an institutional pillar operating within the framework of the law to protect national interests. In other words, counterintelligence serves not only as a defensive mechanism against foreign intelligence activities, but also as an integral component of an institutional system designed to safeguard sovereignty, national security, and the constitutional order in accordance with the principles of the rule of law.
Intelligence, the Media, and Public Opinion
In the field of intelligence and national security, one of the most complex dilemmas facing democratic societies is determining the boundary between necessary secrecy and the public’s right to information. Secrecy remains an integral part of intelligence activities, however, this does not mean that every piece of information related to national security must remain classified. As Heide and Villeneuve (2021) argue, state secrecy should not be understood simply as the opposite of transparency, but rather as an instrument that can be justified only when it serves specific security objectives and contributes to the effectiveness of governance (Heide & Villeneuve, 2021:246). In a democracy, therefore, the fundamental question is not whether secrecy should exist, but where its limits should be established and who should be responsible for ensuring that those limits are respected. In this regard, protecting the truth and the public interest should not be confused with the indiscriminate disclosure of classified information. Professional journalism can contribute to national security not only through investigation and reporting, but also through responsible restraint when the publication of certain information could jeopardise ongoing operations or expose human sources. Such restraint, however, should be based on a concrete and reasonable assessment of the potential risks and harm, rather than on the automatic acceptance of every institutional claim of confidentiality.
Studies of national security secrecy address precisely this dilemma as a question of balancing the need to protect sensitive information with the need for democratic transparency and accountability (Heide & Villeneuve, 2021:253). Therefore, it would be a mistake to treat secrecy and transparency as two entirely incompatible concepts. A functioning democratic state requires both: secrecy where it is objectively necessary to protect legitimate security interests, and transparency where information can be made public without compromising those interests. Heide and Villeneuve (2021) conceptualise the relationship between secrecy and transparency as a matter of balance, arguing that secrecy should be connected to a clearly defined purpose rather than treated as a general principle of governance(Heide & Villeneuve, 2021:240). This distinction is particularly important in the field of intelligence, where excessive secrecy can undermine democratic oversight, while excessive disclosure can compromise operational effectiveness. The challenge, therefore, is not to eliminate secrecy, but to ensure that it remains proportionate, legally justified, and subject to appropriate mechanisms of oversight.
Public responses to intelligence activities should ultimately contribute to strengthening democracy rather than undermining national security. State institutions should be sufficiently transparent to preserve public trust and accountability, while the media should perform their critical role without compromising national security interests. It is within this space that the battle for truth also takes place: not through the publication of every classified piece of information, but through society’s ability to distinguish facts from propaganda, information from disinformation, and justified secrecy from secrecy used as a means of avoiding accountability. For Kosovo, such an approach is particularly important. The resilience of the state depends not only on its capacity to identify and prevent security threats, but also on the ability of its institutions to communicate those threats to citizens in a credible, responsible, and in accordance with the law. In a security environment characterised by persistent external pressures and competing narratives, effective strategic communication is therefore an important component of national resilience. Consequently, the relationship between security institutions and the media should neither be perceived nor constructed around permanent confrontation. Rather, it should be based on a proper balance and coordination between transparency, accountability, and the protection of national interests. Each side has a distinct but complementary role: security institutions must protect sensitive information while remaining subject to democratic oversight, whereas the media must scrutinise the exercise of state power while exercising professional responsibility in matters that may have genuine security implications. Such a balance is essential for strengthening both national security and democratic governance.