The day after Vladimir Putin and Aleksandar Vučić put foreign interference in Serbia's election on the record, Vučić went on state television with "first information" about outsiders, insiders and election-night unrest. Drizan Shala asks the question a security professional asks first: who briefed him?
By Drizan Shala, Security Desk | 28 September 2026
Aleksandar Vučić said on Sunday that Serbia had received information about outsiders working with people inside its own state apparatus to manufacture an incident on election night. Twenty-four hours earlier, at Serbia's request, he had spoken to Vladimir Putin about that election and about foreign interference in it. Before asking what Vučić meant to achieve by saying this, there is a question a security professional asks first. Who briefed him?
The words, from his last interview as president on RTS. The state had received first information that some from outside would work with people from here, even from the state apparatus, to create some kind of scandal (prve informacije da će neki spolja da rade sa nekim ljudima odavde, čak iz državnog aparata). Then he offered an example: whether they might fire into the air, so that it becomes a pretext for unrest (da li da pucaju u vazduh, pa da to bude razlog za nemire). Asked whether he meant election night, he confirmed it. Our services, he said, will uncover it and do their job.
Read as a disclosure rather than a campaign line, that has a precise shape. The information, as he described it, was specific on two points: a foreign component and collaborators inside the Serbian state. The gunfire was the example Vučić supplied publicly; he did not say it formed part of the information received. He attributed the knowledge to the state and assigned the response to its services.
Ivana Stradner of the Foundation for Defense of Democracies had pointed at the security channel the day before. Asked by Radio Free Europe about the Putin call, she said Russian and Serbian security and intelligence structures have had developed contacts and cooperation for years, and that this is why the elections should not be forgotten (Ruske i srpske bezbednosne obaveštajne strukture godinama imaju razvijene kontakte i saradnju. I zato ne treba zaboraviti izbore); Moscow, she added, had spoken publicly of alleged Western attempts at a colour revolution in Serbia. Put that beside Sunday's disclosure and the false-flag question becomes unavoidable: an incident described in advance, with a foreign component and people inside the state apparatus already assigned their roles.
The Kremlin published its readout of the call on Saturday 26 September. The call was made on Serbia's initiative. Vučić briefed Putin on preparations for the early parliamentary election. Both sides, the readout says, stressed the unacceptability of external interference in electoral processes (С обеих сторон подчеркнута недопустимость внешнего вмешательства в электоральные процессы). It does not say what information, if any, changed hands. It records that the subject was on the table with Putin the day before Vučić put it on television.
The Russian side has been building this file in the open. On 15 September 2025 the SVR published a statement calling the Serbian unrest largely a product of subversive activity by the European Union and its member states. The next day, in Tokyo, Vučić thanked the SVR for its information, called it one of the most powerful services in the world, and said Serbian services would make further contact with it. On 2 October 2025 Putin told the Valdai forum that he agreed with Vučić and that the special services confirmed it: certain Western centres were attempting to organise a colour revolution, in this case in Serbia. In December 2023, on the night of the city-hall protest, then prime minister Ana Brnabić thanked Russian security services on air for information they had held and shared with Serbian colleagues; Serbian state organs, she added, had passed it to Western partners, who dismissed it as Russian disinformation. The alleged foreign hand behind Serbian unrest is identified in Moscow and announced in Belgrade.
Which service produced Sunday's information: BIA, VBA, VOA, the police? Was it Serbian-originated, Russian-originated, or liaison reporting? Vučić said "first information", the vocabulary of a reporting chain, not of rumour. A reporting chain has a source and an assessed reliability.
Taken at his word, Vučić described a counterintelligence matter: people inside the state apparatus working with a foreign actor to stage an incident during an election. Depending on the confidence of the source and whether the insiders have been identified, it can require access restrictions, surveillance, a prosecutorial referral, a session of the National Security Council, a briefing to the acting president. No such step has been publicly announced as of Monday morning. What has been announced is that, on his way out, Vučić pardoned 49 people, twelve of them the Novi Sad group, and said he did so despite the views of part of the commission and of the security services. Announcing that a suspected operation is known, and describing how it might unfold, can alert its subjects to what has been noticed, force them to change their tradecraft and compromise continuing collection. Those are normally reasons to control a disclosure tightly. Vučić made his on state television. If the information was too preliminary to produce any visible institutional response, the decision to broadcast it four weeks before the vote requires an explanation.
Either Serbia holds information about a foreign-linked operation involving people inside its own state, and its outgoing president chose to announce it before the services had resolved it. Or Vučić used the vocabulary and authority of the services to place an election-night threat before the electorate, one day after he and Putin jointly put external interference in Serbia's election on the record. Both are national-security events. Vučić supplied both horns himself.
