The confrontation between Kosovo and Serbia does not take place only through diplomacy, in the north of the country, or in the political statements of leaders. One of the most important, yet least visible, fronts is intelligence.
There are no protests, press conferences, or cameras there. Instead, there are covert contacts, human sources, information gathered on the ground, the identification of individuals with access to sensitive data, and attempts to build networks that can operate for long periods without being detected.
Cases from recent years show that this activity has not disappeared. On the contrary, it continues. But something else is changing. Kosovo’s institutions are increasingly succeeding in detecting such activity and taking cases through to the justice system.
The latest arrest of Fehim Sali on August 13 is the newest example and perhaps one of the most significant cases for understanding how such an operation can function.
Sali was arrested at the Merdare border crossing in a joint operation involving the Kosovo Intelligence Agency (KIA), Kosovo Police, and the Special Prosecution Office. The Basic Court in Pristina subsequently ordered one month of pre-trial detention. He is suspected of having cooperated with Serbia’s BIA intelligence service for an extended period and of maintaining contact with one of its officials, identified as Zelimir Matović.
But what makes the case particularly significant is not simply the alleged transfer of information.
According to the prosecution file, Sali allegedly provided information about the political situation in Kosovo, identified officials of the Kosovo Intelligence Agency, and photographed some of them. The prosecution also alleges that he provided information about other individuals and proposed some of them as potential targets for contact and recruitment by the BIA.
If these allegations are proven in court, the case would not simply concern an individual collecting information for a foreign intelligence service. It would point to a much broader effort involving the identification of targets, establishing contacts, and potentially expanding a network of sources inside Kosovo.
This is what makes counterintelligence so important.
An intelligence service does not need to obtain every piece of information directly from the highest levels of government. It often looks for people who have access to specific information, connections to important individuals, or opportunities to identify other people who could potentially be recruited.
According to the prosecution, precisely such a mechanism is suspected in Sali’s case.
During a search of his home, approximately €39,500, 500 Serbian dinars, and four mobile phones were seized. The prosecution also says that some of the money is linked to his alleged espionage activities.
Furthermore, Sali’s profile makes the case significant from an intelligence perspective.
He is a teacher in the Serbian education system in Kosovo and previously served on the Consultative Council for Communities within the Presidency of Kosovo. This does not in itself prove any unlawful activity, but it shows how an individual can, over the years, build a network of contacts across different areas of public and institutional life.
And this is where the latest case connects to a series of other cases.
Bedri Shabani and Muharrem Qerimi are two Kosovo citizens facing espionage charges in connection with the BIA. Both have pleaded not guilty, and proceedings against them are ongoing, meaning their criminal responsibility cannot be considered proven.
However, the indictment itself is significant in understanding the type of information allegedly of interest to the Serbian intelligence service.
Shabani’s case is linked, according to the indictment, to information concerning the Kosovo Liberation Army (KLA), its members and commanders, while Qerimi, who previously served in the Kosovo Police, is also charged with espionage.
This illustrates an important element of intelligence warfare. Valuable information is not limited to what is happening today.
For an intelligence service, historical information, security structures, former members of institutions, social networks, and people with access to particular communities can all have operational value.
The case of Fatmir Sheholli also falls into this category. Since 2025, he has been investigated on suspicion of espionage and his pre-trial detention has been extended. Here too, a distinction must be made between suspicion and guilt established by a court judgment.
Then there are cases that have already reached another stage: convictions.
In April of this year, the Basic Court in Pristina sentenced Jelena Gjukanović, a former OSCE employee, to six years in prison for espionage on behalf of the BIA.
According to the judgment, she was found guilty of cooperating with the Serbian intelligence service and passing sensitive information related to Kosovo.
In another case, Hysri Selimi was sentenced to six years in prison for espionage on behalf of the BIA. According to publicly available information about the case, the information allegedly passed on concerned, among other things, religious radicalization in Kosovo, former KLA members, and individuals who had traveled to join the Islamic State organization.
Bojan Jevtić, a former Kosovo Police lieutenant, was sentenced to six years in prison and fined €2,000 for espionage on behalf of Serbia, as well as illegal possession of a weapon. He had pleaded guilty.
In another case, Aleksandar Vlajić was sentenced to five years in prison for espionage and fined €1,000 for illegal possession of a weapon. He had also pleaded guilty to the charges.
This reveals a much more interesting pattern than simply a list of names.
The profiles are different. The information is different. The individuals’ positions are different. But in several convicted cases and in others still under investigation, the name of the BIA repeatedly appears.
This does not prove that all of these individuals were part of a single network. There is no publicly available evidence that would allow such a conclusion.
But it is enough to support another conclusion: the Serbian intelligence service’s interest in establishing and using sources inside Kosovo is not an isolated phenomenon.
And this is precisely where the greatest success of Kosovo’s counterintelligence efforts lies.
A foreign intelligence service can have sources in a country for years. It can use them to collect political, security, or social information. It can attempt to identify new individuals and expand its network.
But once one link is exposed, the risk is not limited to losing that individual.
Contacts, methods of communication, targets, recruitment methods, and the structure of the operation may also be exposed.
Therefore, the arrest of a suspected agent can have much greater value than the arrest itself.
In Sali’s case, for example, the prosecution alleges that the investigation identified not only his contacts with the BIA, but also the way in which he allegedly collected information and identified other individuals.
The four phones seized from him could be particularly important to the investigation precisely because their contents may help uncover contacts and communications.
This takes the fight against espionage to another level.
It is no longer enough to ask: Who is the spy?
The more important questions are: Who recruited him? What information were they interested in? Who did he communicate with? And who else may have been a target of the same operation?
If Kosovo’s institutions manage to answer these questions, a Serbian intelligence operation could turn into an operational setback for the BIA.
This is also why the recent series of cases should be viewed from a broader perspective.
Kosovo cannot eliminate espionage. No democratic state can do so. Foreign intelligence services will continue to seek information and sources in countries they consider strategically important.
But a state can do something else: increase the cost of espionage and reduce the space in which foreign intelligence services can operate.
The cases of arrests, investigations, and convictions show that Kosovo is developing such capabilities.
Instead of suspected BIA activity remaining in the shadows, it is increasingly ending up in investigative files, courtrooms, and judgments.
This is particularly important for a relatively young state facing a neighbor with well-established intelligence structures that considers Kosovo a matter of direct national interest.
In this confrontation, Kosovo cannot afford to rely solely on political responses.
It needs professional counterintelligence, information-sharing between institutions, protection of sensitive sources, and, above all, evidence capable of standing up in court.
The case of Fehim Sali is another test in this regard.
He has not been convicted of espionage, and every allegation against him must be proven through judicial proceedings. But the way the case was uncovered, investigated, and brought before the courts shows that Kosovo’s institutions are attempting to target not only the individual, but also the mechanism through which a foreign intelligence service may seek to collect information and establish new sources.
In the end, this is the battle that cannot be seen.
The public sees only the arrests.
But behind them lies a much longer struggle: surveillance, analysis, identification of contacts, verification of suspicions, and the building of evidence.
And if the recent cases are indicative of a broader trend, the message is clear. Serbia may continue attempting to establish sources in Kosovo, but the space for keeping those sources hidden is becoming increasingly narrow.
In intelligence warfare, that may be the most important victory of all: not claiming that espionage does not exist, but being able to detect it before a network becomes consolidated.
