Kosovo's charging papers now describe a Serbian service that sponsored an ISIS fighter, recruited inside the mosques, circulated a script for a radicalized Kosovo, and paid for the broadcast. The threat Belgrade markets to the West is the threat Kosovo's charging papers show its own service manufacturing.
By Drizan Shala | 26 August 2026
Among the 20,914 photographs investigators pulled from a phone seized in Prishtina last October, one carries the inscription "Top sekret 2." It is a Serbian language text, and it ends with a forecast: "Pas 20 viteve Kosova do të duket si Kandahar." After twenty years, Kosovo will look like Kandahar. Then, the text continues, the Western powers will change their minds about the country, and it will return under Serbian jurisdiction.
A forecast is a claim about the future. The indictment the Special Prosecution filed on 25 August, eighty pages, dated the day before, treats this one differently: as an exhibit in an espionage case, relevant, in the prosecution's words, to proving the defendant's contacts and activity in relation to the structures of Serbia's BIA. The defendant is Fatmir Sheholli, in pretrial detention since 9 October 2025, charged with espionage under Article 124, paragraph 3, in conjunction with Article 77 of the Criminal Code (Code No. 06/L-074), and with blackmail under Article 329, paragraph 2, in conjunction with the same provision. He is presumed innocent. What follows is the account given by the charging papers in his case and in the cases that preceded it, and the account has a subject larger than any defendant. Its subject is a project, run against the one fact about Kosovo that Belgrade's storyline cannot survive.
The fact
The fact is this. Kosovo is a Muslim majority society whose politics are secular and whose anchoring is Western. Its independence movement was led by a pacifist literature professor, its war was fought by a national movement in which religion played no organizing role, and its public square runs on a formula older than the state: the faith of Albanians has never governed their politics. This is the ground on which every corridor map, every per capita statistic, every civilizational warning out of Belgrade breaks apart. The antemurale story requires a rampart, and a rampart requires something on the other side of it. Kosovo declines to be that thing.
A storyline this invested does not simply absorb a fact that refutes it. Kosovo's counterintelligence docket, seven espionage cases tied to BIA recruitment in two years, four convictions, two of them final, figures Special Prosecutor Bekim Kodraliu gave RTK this month, has been assembling a different answer: when the fact would not cooperate, a service went to work on the fact. The Sheholli indictment is the third charging instrument to document a piece of that work. Read together, the three describe a production line.
The fighter
Start with the strongest plank, because it is the one written at full charging grain. The indictment against Hysri Selimi, filed last September, states that on 22 November 2015 he traveled to Syria through Istanbul to join the Islamic State "me mision të caktuar nga BIA," on a mission assigned by Serbia's security service. He remained inside the caliphate for nearly seven years, working in its wounded soldiers bureau, and after his repatriation in 2022 he resumed meetings with officers of BIA's counterterrorism directorate in Vranje, Niš and Bujanoc, reporting on mosques, imams, worshippers, and the families of those who had gone to Syria. He was convicted of espionage at first instance in June, six years.
In the files of Kosovo's prosecutors, the best documented journey from this country into ISIS was a tasking by the Serbian state. Belgrade spent a decade presenting Kosovo's foreign fighters as proof of what this society is. Per the charging papers, one of those fighters was Belgrade's.
And the same indictment names what the fighter was for. Its purpose clause states that his work also helped the BIA "të krijojë një narrativë të dëmshme për shtetësinë e Kosovës," to create a damaging narrative against Kosovo's statehood. Narrative production, charged as the operation's function, in the prosecution's own drafting.
The congregation
The second plank comes from the prosecution's detention filings on Fehim Sali, arrested at Merdare in August, with the indictment to follow. The dossier describes a long term BIA collaborator whose portfolio included identifying persons of the "Vehabi sect" and proposing them to the service as recruitment targets, alongside photographing Kosovo's intelligence officers and reporting on the politics of non majority communities. A service that recruits inside a religious milieu has stopped observing it and started acquiring positions in it, and a position, in tradecraft, exists to be used. The dossier shows Belgrade's service buying its way into the congregation it advertises to Europe as a menace.
The script
Then there is the text on the phone. Exhibit 17 of the Sheholli indictment, entered through a Kosovo Police report of 31 March 2026, is the photograph inscribed "Top sekret 2," a Serbian language document with a CONFIDENTIAL marking in its background. In the prosecution's characterization it describes a plan for making Kosovo a religiously radicalized state, and its content, quoted here at exhibit grain, reads as the project's design document. Mosques financed through "Islamic embassies in Belgrade" and sited for visibility, near highways, schools and shopping centers, doubled and tripled in the large villages. Madrasas extended across the whole country, with children and adults brought in from the places where, in the text's words, faith matters more than nation. The leaderships of the Islamic communities of Serbia, Macedonia, Bosnia and Kosovo described as "under our control," tasked with drawing in influential Albanians from sport, media, music and politics. Operatives delegated into the diaspora, run through embassies in Switzerland, Germany and Belgium, to split the wealthiest Albanians abroad, the ones who supported Rugova. And at home, an engineered atmosphere in which people feel foreign in their own state, so that part of the youth leaves and part turns to the faith, until year twenty and Kandahar, the West's change of heart, the return to Serbian jurisdiction, and a final clause in which the expulsion of Albanians is repeated toward Turkey, this time through religious leaders and favorable migration terms, with what the text calls Turkey's green light. Per the indictment, Sheholli sent this document on 5 August 2025 to a contact recorded as Viktor Makedonija; the file also finds him seeking its translation from Serbian into Albanian.
Authenticity is the court's work, and the trial will do it. What needs no authentication is what the document does and who moved it. A text that scripts the perception of an Islamized Kosovo performs its own instruction every time it changes hands: it installs the Kandahar image, it teaches its reader to distrust the Islamic Community's leadership as bought, it drives one wedge toward Turkey and another through the diaspora. And the file records the hands. Per the indictment, the document came to the phone from the director of a BIA directorate, left it toward a contact in August 2025, and was priced for translation into Albanian along the way. The service that supplied and circulated this text was running the method the text describes. That finding sits on the chain of custody, and the chain is the prosecution's evidence.
The broadcaster
Which leaves the question of how such product reaches an audience, and here the indictment descends to unit scale, with dates, sums and a parking lot. In late September 2025, per the file, Sheholli coordinated by phone with Bojan Dimić, identified in the indictment and confirmed by Kosovo's Intelligence Agency as director of BIA's Directorate Against Terrorism and International Organized Crime, on a delivery of materials, needed, Sheholli says on the intercept, by the 27th at the latest; the number 12 figures in the conversation, and the prosecution reads it as the date it was, election day. On 29 September, around two in the afternoon, he drove to Mitrovica's north and received, in the Technical School parking lot, a folder of audio recordings and transcripts of officials of the Ministry for Communities and Return, together with 5,000 euro. On 30 September he printed documents in Lakrishte, met the journalist Milaim Zeka in a restaurant parking lot in Emshir, and handed over 1,000 euro, the moment caught on a covert recording in five words, "Qe ku i ki qetu," here, you have them right here. He told Zeka the materials came from the German development agency GIZ. In his phone, Dimić's number was saved under "Gizi," also "Gazetari," also "Bojana," and on Viber as "BoJaN" with three Serbian flags; the materials traveled in his usage under the codes "turshi" and "kumbulla," pickles and plums. That evening the material aired. The same day Dimić asked, on an intercept the indictment quotes, "A e qiti Milaimi?" Did Milaim put it out? It went out that night, twelve days before the vote.
The indictment proposes Zeka as a witness, not a defendant, carries Sheholli's statement that the journalist knew nothing of the Dimić channel, and Zeka told Betimi për Drejtësi that he is hearing these claims for the first time, that the 1,000 euro paid for translation, and that Sheholli told him the materials were the German GIZ's. The detail that survives every version is the one that matters for this piece: the provenance wash worked, and in the recipient's own telling it is working still.
As for the target, the recordings were built to compromise the officials of Nenad Rashić, Srpska Lista's rival, and the dispositive names the achievement in the prosecution's words: the direct interference of a foreign intelligence service in an electoral process in the Republic of Kosovo. That targeting deserves its own examination another day, a service styling itself the Serb community's shield deploying kompromat against the community's dissenters. Here it serves as proof of function. The pipe that carried anti Rashić material into Kosovo's prime time is the same pipe, the same handler, the same asset, the same washing technique, that the file shows moving the Kandahar script. An operation was paying retail rates to program what Kosovo's public believes. The broadcast is simply the one delivery the cameras caught end to end.
The remainder
The phone held more. A 2001 State Security plan for compromising and recruiting a prisoner in Niš named Albin Kurti, sent, by the defendant's own account to prosecutors, from Dimić's number. Twenty two notebooks in two languages, with names, telephone numbers, operational data, financial calculations, surveillance notes on Albanian political figures, entries on critical infrastructure including the dam at Ujman (Gazivode). An archive, in other words, of which September was one shelf. And running underneath the entire file, the second production: an investigation open since August 2024, the parking lots on camera, the deadline calls on tape, the pattern of a counterintelligence practice that lets an operation document itself to court standard before the border arrest. The watchers had the production schedule before the audience had the broadcast.
The record now reads as follows. A service sponsored, per an indictment, the fighter. It recruited, per its own detention filings, inside the congregation. It supplied and circulated, per an indictment, the script. It financed and scheduled, per an indictment, the broadcast. Assembled, the files describe a state security service manufacturing the evidence of the extremism its state warns Europe about, and in the charged instance of the fighter, manufacturing the extremist himself. How far past the charged instances the engineering ran is now the court's to measure.
The method itself is older than any of these files, and it has a literature. Services have manufactured the threats they were chartered to fight since the Okhrana ran its provocateurs, and the technique survives because it pays twice, once in the threat's propaganda value and once in the budget and license the threat justifies. What Kosovo's docket adds to the literature is rarer than the method: the paper. Provocation operations are inferred from their beneficiaries far more often than they are caught in charging instruments with payment ladders and contact aliases attached.
The direction of the effort no longer waits on a verdict. For ten years Belgrade demanded that the world audit Kosovo's mosques. Kosovo audited the auditor, and found it, per the charging papers, paying for the programming.
There is a practical consequence for the readers these dossiers were built to persuade. Every submission Belgrade makes about Kosovo's radicalization now arrives carrying a provenance question of its own government's manufacture, and the officials who receive the next one are entitled, on the strength of these files, to ask it first.
Kandahar, in the exhibit's final lines, was to arrive on schedule, at year twenty, so that the West would change its mind. Those lines entered the file as evidence. Read as the file presents them, they are a work order, and the work has been interrupted.
Read also: INSIDE THE THREAT
Drizan Shala is a Kosovar security researcher and doctoral candidate at the University of Sarajevo. He writes on defense, private security, and the security architecture of the Western Balkans.
