On September 22, 2026, Albania's head of the State Intelligence Service was placed under house arrest. The evidence: 508 encrypted Signal messages sent to a wanted businessman, nine printed pages of classified intelligence diagrams found in his vehicle — and a government digital infrastructure worth up to €1.5 billion that allegedly ran as a criminal enterprise. This is one of the most consequential data governance failures in European memory.
The scandal that erupted in Albania on September 22, 2026 has every element of a political thriller: a spy chief, a fugitive businessman, hundreds of encrypted messages, printed intelligence diagrams found in a car, and allegations that the agency responsible for Albania's entire digital public infrastructure — citizen data, government systems, the e-Albania platform — was being run as a procurement fraud operation connected to organized crime.
On that date, Albania's Special Court Against Corruption and Organized Crime, acting on a request from the anti-corruption prosecution service SPAK, ordered the house arrest and immediate suspension from office of Vlora Hyseni, director of Albania's State Intelligence Service, SHISH. Her alleged involvement with the AKSHI corruption scandal potentially marks the most serious crisis over national security in the country's history. Prime Minister Edi Rama announced her removal the same day. She was not in Albania when the order was issued.
The case at the center of it all — the AKSHI public procurement scandal — had been building since December 2025. Prosecutors state that intercepted communications, digital recordings, and financial trails provide compelling evidence that lucrative contracts were deliberately steered toward predetermined companies. In April 2026, SPAK seized around 52 properties and several bank accounts with a combined value of around 40 million euros. What was already one of Albania's largest corruption investigations became something far more serious when the evidence trail reached the director of the country's intelligence service.
The AKSHI procurement fraud. AKSHI — Albania's National Agency for Information Society — manages the e-Albania platform, government IT infrastructure, and processes sensitive data on Albanian citizens. SPAK alleges that its director and deputy steered 19 procurement procedures worth approximately €59 million to a criminal network led by businessmen Ergys Agasi and Ermal Beqiraj. Competing companies were allegedly coerced into withdrawing legal appeals. Payments from the government budget to implicated companies continued even after the investigation was publicly announced.
The SHISH connection. After Agasi's phone was decrypted, investigators found over 500 communications with SHISH director Hyseni via the Signal app, carried out from late June until Agasi's arrest on August 26. Some communications contain information about Hyseni's official meetings and movements, including meetings with the Prime Minister and the Police Director. Nine pages of printed diagrams resembling classified SHISH intelligence material were found in Agasi's car. Hyseni denies providing Agasi with classified material and says he was a SHISH collaborator or source.
The digital infrastructure dimension. The case therefore puts two sensitive areas of state power — public digital infrastructure and national intelligence — within the same criminal investigation. AKSHI hosts citizen data and government systems. SHISH protects national security. The alleged overlap between the two in a criminal procurement network is precisely what makes this one of the most consequential governance failures in the region.
The evidence that brought down Albania's intelligence chief was entirely digital — and its recovery illustrates every principle that governs digital evidence in serious investigations, whether they involve national security or corporate litigation. Agasi's phone was encrypted. It was decrypted after his arrest. The 508 Signal messages it contained — messages on a platform specifically designed to delete communications — were recovered and are now at the center of the case against Hyseni.
This is the same dynamic we described in Issue 19 of this newsletter, when the Lively v. Baldoni case established that switching to Signal when litigation is foreseeable is a preservation failure rather than a security strategy. The Albania case illustrates the same principle at the level of a national security investigation: encrypted messaging apps do not make communications disappear from legal proceedings. They make the communications that survive on the other party's device the central evidence — because those are the ones the sender believed were protected.
The nine printed pages of classified intelligence diagrams found in Agasi's car are equally instructive from an evidence standpoint. Printed documents are physical evidence. They can be authenticated. They can be matched to their digital originals. Their presence in a specific vehicle at a specific time establishes a chain of custody that is as damaging as any digital log. Hyseni's denial that she provided those materials to Agasi does not make the printed pages disappear from the evidence record. It makes explaining their presence in his car the central challenge of her defense.
Agasi used Signal. His phone was decrypted. 508 messages survived. The platform that was supposed to protect the communications became the evidence trail that ended a spy chief's career.
The AKSHI case is, at its core, a data governance and information security failure of the most consequential kind. AKSHI manages Albania's e-Albania platform — the digital portal through which citizens access government services. It manages government IT systems. It processes sensitive data on the entire Albanian population. And according to SPAK's investigation, it was simultaneously being operated as a criminal procurement enterprise, with €59 million in contracts allegedly steered to a criminal network through coercion and organized corruption.
For organizations that think about information governance in a corporate context, the AKSHI case is an extreme version of a familiar problem: what happens when the institution responsible for the integrity of sensitive data is itself compromised? In a corporate setting, this might be the IT department that controls access logs while also covering its own tracks. In the Albanian context, it is the national digital infrastructure agency allegedly in partnership with organized crime — and now linked to the intelligence service that was supposed to be independent of both.
The investigation's digital evidence methodology is worth noting. Prosecutors state that intercepted communications, digital recordings, and financial trails provide compelling evidence. Those three categories — communications, recordings, and financial trails — are the same three categories that drive corporate eDiscovery in complex fraud and corruption matters. The scale is different. The institutional context is different. The evidence methodology is identical.
The Albania AKSHI–SHISH case is a national security story. It is also, in its evidence structure, a recognizable eDiscovery story: encrypted communications recovered from a decrypted device, financial trails traced through seized accounts, physical documents found in a vehicle establishing a chain of custody, and an institution whose internal communications about its own conduct became the evidence of its corruption.
At Sovereign Discovery, we work with organizations that face the corporate equivalent of these dynamics — not intelligence agencies, but companies where the people responsible for information governance are also the subjects of the investigation. The lesson from Albania is one we apply in every matter: the institution that controls the evidence is not a neutral party. Its communications, its access logs, and its decisions about what to preserve and what to allow to disappear are themselves among the most consequential documents in any serious investigation.
Albania's intelligence chief used Signal. The fugitive's phone was decrypted. Five hundred and eight messages survived. Nine pages of printed classified diagrams were photographed in a car. A special court issued a house arrest order. The director of the country's spy service was removed from office the same day.
The case is still unfolding. But its evidence architecture is already complete — built from the same three pillars that drive every serious investigation involving digital communications: what was said, what was recorded, and where the money went. Those three questions do not care about institutional rank, about national security classifications, or about which app the communications were sent through. They find the evidence. The Albania case is simply the most dramatic recent proof.