The confrontation between Kosova and Serbia is not fought only through diplomacy, political statements, disputes in the north or the familiar cycle of public accusations between Prishtina and Belgrade. Beneath that visible confrontation exists another battlefield, quieter and potentially more consequential: intelligence.
This is a war without uniforms, press conferences or television cameras. It is fought through sources, contacts, information, recruitment, surveillance and influence. Its objective is not necessarily to produce an immediate political effect. Intelligence operations are designed to accumulate knowledge, penetrate institutions, identify vulnerabilities and establish networks that can remain useful for years.
The cases that have emerged in Kosova in recent years suggest that Serbia has not abandoned this method. Quite the opposite. The repeated appearance of Serbia’s Security Information Agency (BIA), in espionage investigations and convictions points to a continuing effort to develop sources and collect information inside Kosova. What is changing is not necessarily the existence of the threat, but Kosova’s ability to detect it.
For years, Serbia has had the advantage of established intelligence structures, institutional continuity and extensive knowledge of Kosova’s political, social and security environment. Kosova, as a younger state, has had to build its counterintelligence capacity while simultaneously confronting a neighboring state that has never fully accepted Kosova’s independence and continues to regard Kosova as a matter of strategic national interest. That makes intelligence collection more than a criminal phenomenon. It is part of the broader contest between two states with fundamentally incompatible political objectives.
The arrest of Fehim Sali on August 13, 2026, provides the latest illustration of this confrontation. Sali was arrested at the Merdar border crossing in an operation involving the Kosova Intelligence Agency (AKI), the Kosova Police and the Special Prosecution Office. According to the prosecution, he is suspected of having maintained prolonged cooperation with BIA and contact with a BIA official identified as Zelimir Matović.
The allegations go beyond the simple transfer of information. According to the prosecution, Sali allegedly provided information about Kosova’s political situation, identified officials of the KIA and photographed some of them. He is also alleged to have provided information about other individuals and proposed some as potential targets for contact and recruitment by BIA.
If established, this would illustrate a familiar intelligence model: collecting information, map relationships, identify vulnerabilities and then search for additional sources. That is precisely what makes the case politically and strategically significant.
A foreign intelligence service does not need to penetrate the highest levels of government to acquire useful intelligence. A person with access to a particular institution, community or network can provide information that becomes valuable when combined with information from other sources. The objective is not necessarily to find one person who knows everything. It is to construct a broader picture from multiple people and multiple fragments of information. According to the prosecution, that mechanism is suspected in the Sali case.
Authorities seized approximately 39,500 euro, 500 Serbian dinar and four mobile phones during a search of his home. The prosecution has linked some of the money to the alleged espionage activity. The significance of the electronic devices, however, could extend beyond the individual case if investigators establish contacts and communications that reveal a broader network. Sali’s background is also relevant from a counterintelligence perspective. He is a teacher within the Serbian education system in Kosova and has previously served on the Consultative Council for Communities.
Kosova has seen a series of espionage investigations involving individuals with very different backgrounds and access to different types of information. The common element in several of the most significant cases has been the alleged or established connection to BIA.
Bedri Shabani and Muharrem Qerimi are facing espionage charges in cases linked to BIA. Their criminal responsibility has not been established by a final judgment. According to the indictment, however, the information allegedly sought included material concerning the Kosova Liberation Army (KLA), its members and wartime events, as well as information related to Kosova’s security institutions. That is revealing in itself.
For Serbian intelligence, the information value of Kosova does not begin and end with current political developments. The past remains an intelligence resource. Former KLA members, wartime structures, security officials, witnesses, institutional relationships and community networks can all provide information that helps Belgrade understand Kosova’s political and security environment.
The case of Fatmir Sheholli adds another layer. Sheholli was arrested in 2025 on suspicion of espionage, and prosecutors have alleged that he collected information concerning institutions, property and business activities while acting under the direction of a BIA official. The prosecution has also alleged that some of the information was subsequently disseminated through online media. The significance of such allegations goes beyond traditional espionage.
The case of Jelena Djukanović demonstrates another potential vulnerability: international organizations. Djukanović, a former OSCE employee in Kosova, was sentenced by the Basic Court in Prishtina in April 2026 to six years in prison for espionage. According to the prosecution, she had obtained and passed sensitive information to Aleksandar Vlajić, who had previously been convicted of espionage and was identified by prosecutors as a BIA resident agent.
The case matters because international organizations operating in Kosova occupy a unique position. Their personnel interact with government institutions, security structures, political actors, civil society and different communities. Information acquired through such access can be valuable even when it is not formally classified.
Vlajić’s case is particularly significant because it provides one of the clearest publicly documented examples of the alleged operational role of a BIA-linked source inside Kosova. He was sentenced in 2025 to five years in prison for espionage and pleaded guilty.
The importance of the case goes beyond his individual conviction. His name subsequently appeared in the Djukanović investigation, illustrating how one exposed source can potentially lead investigators toward other individuals and relationships. This is the point at which counterintelligence becomes more consequential than ordinary law enforcement.
The case of Bojan Jevtić illustrates why Kosova’s security institutions themselves represent an important target. Jevtić, a former Kosova Police lieutenant and former chief of operations at the Dheu i Bardhë border crossing, was sentenced in May 2026 to six years in prison and fined 2,000 euro for espionage and illegal possession of a weapon. He pleaded guilty. According to reporting on the case, he had been accused of transmitting confidential police information and operational plans.
The case of Hysri Selimi illustrates yet another dimension. Selimi was sentenced in June 2026 to six years in prison for espionage on behalf of BIA. According to the prosecution, the information allegedly collected included material concerning former KLA members, wartime events, radicalized individuals and Kosova citizens who had travelled to Syria. This demonstrates how broad the intelligence requirements of a foreign service can be. Political information, security information, wartime history, extremist networks and community relationships can all become pieces of the same strategic picture.
The repeated emergence of BIA in multiple espionage investigations and convictions demonstrates that Serbia’s intelligence interest in Kosova is not an isolated event and cannot be reduced to a handful of unrelated individuals acting independently.
Belgrade’s relationship with Kosova is not simply a diplomatic dispute over borders or recognition. Serbia has institutional, political and security structures that continue to treat Kosova as a core national issue. In such an environment, intelligence collection is a logical instrument of state policy.
Information about Kosova’s institutions, security structures, political actors, former KLA members, international organizations, communities and internal vulnerabilities has strategic value for Belgrade. The purpose of intelligence is to know the target better than the target knows itself. That means understanding not only what institutions officially say, but how they actually operate; not only who holds office, but who influences decisions; not only what communities publicly communicate, but where their internal divisions and relationships lie.
The visible confrontation between Prishtina and Belgrade can change from one political crisis to another. Intelligence structures operate on a different timeline. They can spend years cultivating contacts, collecting information and waiting for opportunities.
The most important development is not the number of people arrested. It is the fact that suspected intelligence relationships are increasingly being detected, investigated and, in several cases, converted into convictions. That suggests an evolution in Kosova’s counterintelligence capabilities.
The state is becoming better at connecting intelligence indicators with investigative evidence. Security institutions are increasingly working together. Prosecutors are pursuing cases that previously might have remained within the intelligence sphere and never reached the public.
Every exposed operation may represent a success for Kosova, but it can also indicate how much effort Serbia has invested in developing intelligence access inside the country. The strategic response therefore cannot be limited to arrests after the fact. Kosova needs a counter-intelligence system capable of detecting recruitment attempts before they become established networks, protecting sensitive institutions from penetration, identifying unusual financial and communication patterns, strengthening personnel security and systematically mapping foreign intelligence activity.
Kosova’s challenge is particularly acute because it faces a neighboring state that has both the institutional capacity and strategic motivation to collect intelligence about it. But Kosova also has an advantage that should not be underestimated: every successful counterintelligence operation reduces the operational space available to the foreign service.
Serbia is attempting to maintain visibility, access and influence inside a state whose independence it continues to reject. Kosova is attempting to build institutions capable of protecting that independence not only politically, but operationally.
The Sali case is now another test of Kosova’s ability to move from detection to disruption. If the allegations against him are substantiated, the value of the investigation will not be limited to proving the conduct of one individual. Its greater significance will lie in determining whether the alleged relationship with BIA formed part of a wider effort to collect information, identify targets and establish additional sources. That is where Kosova’s counterintelligence capability will ultimately be measured.
Serbia will continue to have an intelligence interest in Kosova. That reality is unlikely to change as long as Belgrade continues to regard Prishtina as a core national question. The question is whether Serbia can continue to operate its intelligence networks in Kosova with the same freedom and secrecy. The emerging answer is increasingly clear: it is becoming harder. /The Balkan Report/
Discover more from The Balkan Report
Subscribe to get the latest posts sent to your email.