Parliament Wide Open — Albania OSINT Audit

Diella frontend sourceThe Vue/Quasar SPA we pulled: 229 KB JS bundle, HTML shell, plus the August 2026 live snapshot. No backend in the tree.

Download ZIP (342 KB) View src Browse files GitHub OSINT report

Campaign Statistics

A two-phase OSINT investigation — passive reconnaissance in January 2026, followed by active API enumeration and data collection on February 25, 2026 — targeting Albanian government digital infrastructure produced the following findings. The complete archive includes data sourced from unauthenticated APIs, public datasets, open government portals, and publicly disclosed breaches.

Crown Jewels — Citizen Data Exposure

Beyond the Parliament API, this archive contains the largest aggregation of Albanian citizen records ever documented, sourced from disclosed government breaches, open data portals, and unauthenticated endpoints. Public parliamentary files are hosted on ODINT and can be opened below. Raw breach dumps of private citizens stay restricted.

What’s Included in the 31 GB Archive:

Government & Citizen Data Exposures

• 910,000 voter records (April 2021 breach) — Names, national IDs, phone numbers, voting centers, employers, political affiliations
• 637,138 salary records (December 2021 breach) — Names, IDs, salaries, employers; represents 22% of Albania’s entire population
• 100,000+ police suspect database (October 2022) — Photos, ID numbers, names, dates of birth, nationality
• Police Chief personal data — 47 pages border crossing records with timestamp, location, identity
• Interior Minister email mailbox — Full correspondence and governmental communications
• Defense Minister email mailbox — Full correspondence and governmental communications
• Prime Minister Edi Rama correspondence — Citizen communications and governmental records
• Intelligence Agency (SHISH) employee directory — Names, emails, phone numbers of intelligence personnel
• 236 Parliament Members complete PII — Names, DOBs, birthplaces, official emails, party affiliation, photos, social media links

Parliamentary Documents & Government Records

• 30,000+ Parliamentary PDFs — Legislative acts, parliamentary resolutions, laws, interpellations
• 20,610 Images (JPEG, JPG, JFIF, PNG) — Legislative documentation, parliamentary session photos
• 32,627 PDFs from Parliament archive
• 2,500+ Office documents (DOC, DOCX, XLS, XLSX) — Budgets, salary spreadsheets, benefits records
• MP Salary Spreadsheets (PAGA DEPUTETE) — Monthly records 2018–2020
• MP Benefits Records (PERFITIME DEPUTETE) — Comprehensive benefits data
• Albanian Parliament Budget Expenditure Tables — Public reserve fund data
• FOIA Request & Response Logs — 2018–2021 transparency requests
• Lobbyist Registry (Regjistri elektronik i Lobisteve) — Complete lobbying disclosures
• Albanian Constitution, Electoral Code, Deputy Status Law — Full legislative texts
• Parliamentary Annual Reports — 2013–2019
• Government Open Data Datasets — Treasury records, business registries, health centers, official statistics

Technical Intelligence & Infrastructure

• AKSHI Infrastructure enumeration — 110+ subdomains, tech stack, IP addresses, service configurations
• Diella AI backend URLs & endpoints — Azure Static Apps endpoints, Application Insights keys
• 7 unauthenticated Parliament API endpoints — Full OData backend enumeration
• 59 Open Data Portal endpoints — Government data services API spec
• 832 Albanian .gov.al domains — Complete enumeration
• Certificate Transparency logs — HTTPS certificate enumeration
• Full exposure analysis — What is currently accessible, what is protected, infrastructure mapping

Active Threats & Foreign Operations

• Iranian Cyberattacks Documentation — Ongoing HomeLand Justice Telegram channel (13.6k+ members), data distribution
• justicehomeland.ru/.org active websites — Claims of exfiltration, data redistribution
• Attribution evidence & incident timeline — Complete documentation of cyber operations

Investigation & Methodology Documentation

• Complete OSINT findings & analysis — All replicable by passive techniques
• Full audit trail — How each dataset was discovered, what endpoints returned it, verification of access
• Technical reports for each major finding — Parliament API, AKSHI corruption, Diella analysis, Open Data Portal
• Data collection methodology — Completely passive OSINT; no credentials tested, no vulnerabilities exploited

Context: Albania’s Ambitious Digital State

Albania has spent the last decade building one of Eastern Europe’s most ambitious digital government infrastructures. The National Agency for Information Society — AKSHI (Agjencia Kombëtare e Shoqërisë së Informacionit) — manages a network connecting 220 government institutions, hosts 380 government websites, powers 600+ electronic services for citizens, and maintains a dedicated CSIRT for cybersecurity operations. Albania was ranked 14th globally in the GovTech Maturity Index 2025 and received UN recognition as a model for digital transformation.

The country is also a NATO member actively pursuing EU membership, with a target accession date of 2030. Brussels has consistently identified corruption as the primary obstacle. Albania’s response, in September 2025, was to appoint the world’s first AI minister.

Diella — named from the Albanian word for “sun” — is an AI system developed by AKSHI using Microsoft Azure and OpenAI. Prime Minister Edi Rama appointed her as Minister of State for Artificial Intelligence with a stated mission: “Public tenders will be 100 percent free of corruption.” In October 2025, Rama announced Diella was “pregnant with 83 digital assistants” that would be assigned to each ruling-party Member of Parliament to monitor legislative sessions.

“The agency that built Albania’s anti-corruption AI was itself a criminal enterprise. Its director general and deputy were arrested three months after Diella’s appointment, charged with operating a structured criminal group to manipulate government tenders.”

The Story

This investigation began in January 2026 as passive reconnaissance: mapping AKSHI and Diella’s infrastructure, identifying subdomains via certificate transparency, probing public-facing systems. The initial conclusion was straightforward — Albanian government infrastructure was, by regional standards, well-secured. WAFs on the main domains, WordPress API requiring authentication, no exposed credentials in Diella’s frontend JavaScript bundle.

The assessment changed completely in February 2026. When enumeration turned to the Albanian Parliament — the institution Diella’s 83 AI “children” were supposed to monitor — a different picture emerged. The Parliament (parlament.al) serves a React single-page application that, on the surface, appeared to be a dead end: it returns HTTP 200 for all paths, a classic SPA catch-all. But the main JavaScript bundle told a different story.

Pulling the 355 KB JS bundle and running string extraction revealed a hardcoded API base URL: https://kuvendiapi.azurewebsites.net/api. Further extraction from minified webpack variables produced seven OData entity names. Every endpoint responded to unauthenticated GET requests. No tokens, no rate limiting, no access controls of any kind.

The Albanian Parliament’s entire backend API was wide open.

The irony runs deep. AKSHI’s Director General Mirlinda Karçanaj and her deputy were arrested in December 2025 — just three months after Diella’s appointment — charged with running a structured criminal group inside the very agency that built the AI anti-corruption minister. SPAK (Albania’s Special Anti-Corruption Structure) identified 12 tender procedures that had been systematically manipulated. The Parliament API had been open since at least January 2022. And Diella — integrated into the e-Albania platform, with access to 36,000+ government documents — saw none of it.

Critical Finding 1 — Albanian Parliament: Unauthenticated API

Open API Endpoints

MP PII Exposed — 236 Records

Each of the 236 member-of-parliament records in the /anetaret response contains the following personally identifiable information:

• Full legal name (first name, father’s name, surname)
• Date of birth and place of birth
• Official email address (@parlament.al)
• Political party affiliation and electoral district
• Profile photo URL (hosted on Azure Blob Storage)
• Social media links (Facebook, Twitter/X, LinkedIn)
• Active / inactive parliamentary status

This constitutes a complete, structured dossier on every person serving in the Albanian legislature — including personal identifiers, contact information, and political affiliations. The data was collected without any authentication or access control being bypassed.

Azure Blob Storage — 54,545 Public Documents

The /dokumentet endpoint returns a 30.2 MB JSON catalog listing every document in the parliamentary archive. Container listing on kuvendiwebfiles.blob.core.windows.net/webfiles/ is disabled — but every URL is directly enumerable through the API response, and all individual blobs have public read access enabled.

Among the documents recovered: MP salary spreadsheets (PAGA DEPUTETE) and MP benefits records (PERFITIME DEPUTETE) covering 2018–2020 on a monthly basis; the Lobbyist Registry (Regjistri elektronik i Lobisteve); FOIA request and response logs spanning 2018–2021; budget expenditure tables and public reserve fund data; the Albanian Constitution, Electoral Code, and Deputy Status Law; and parliamentary annual reports from 2013 through 2019.

The JavaScript bundle also contains a hardcoded internal API reference at http://134.0.63.165:5000/public — an internal IP address unreachable from the public internet, confirming additional backend infrastructure exists beyond what is publicly exposed.

Critical Finding 2 — AKSHI Corruption Scandal

The Irony in Numbers

Finding 3 — Diella AI Frontend Analysis

The technical security of Diella’s own frontend infrastructure is, in isolation, competent. Azure Static Web Apps, runtime-injected configuration, proper IAM via Keycloak, segmented internal infrastructure. But the security questions raised by Diella are not primarily technical: they are institutional. The agency that controls Diella’s training data, system access, and operational parameters was compromised by Iranian state hackers in 2022 and was operating as a criminal enterprise until December 2025. How was Diella built with data from compromised systems? Who monitored the anti-corruption AI while its creators were manipulating tenders?

Finding 4 — Open Data Portal

Datasets Available

Broader Albanian Government Scan

Seventeen Albanian government domains were probed during the February 2026 phase. The majority are hardened: Incapsula WAF, 403/404 responses, no accessible admin panels. A certificate transparency enumeration of the .gov.al domain space via crt.sh produced 832 domains and expanded AKSHI’s known subdomain count from 50 (January) to 110 (February), revealing Jira, Rancher, Wiki, and internal test environments — all behind internal-only DNS, not accessible from the public internet.

Four GIS portals were discovered through crt.sh enumeration: geoportal.asig.gov.al (national geoportal), instatgis.gov.al (statistics WebGIS), webgis.arrsh.gov.al (Road Authority), and webgis.atp.gov.al (Territorial Planning). None expose accessible GeoServer or WFS data endpoints — all are frontend-only applications.

Organizations with Compromises

Historical Context: A Decade of Exposure

The Parliament API exposure does not exist in isolation. Albania has been systematically compromised at every layer of its digital infrastructure for the past five years.

The Iranian state-sponsored group HomeLand Justice (MITRE ATT&CK C0038, attributed by FBI, CISA, NATO, and UK NCSC to Iran’s Ministry of Intelligence and Security) breached AKSHI by exploiting CVE-2019-0604 (Microsoft SharePoint). Initial access was established in May 2021 — fourteen months before the destructive attack launched in July 2022. During that window, CHIMNEYSWEEP infostealer exfiltrated data from the agency that would later build Albania’s AI minister.

Data Inventory

Total collection: 251 MB across 1,309 files, recovered from publicly accessible, unauthenticated endpoints and Azure Blob Storage URLs.

Complete 31 GB Archive — Download & Resources

The complete investigation archive—all 54,700+ files, 31 GB—is available for download and review. Additional resources and interactive tools are available below.

Full Archive Download

Interactive Tools & Viewers

Data Manifests & Catalogs