Parliament Wide Open

Campaign Statistics

A two-phase OSINT investigation — passive reconnaissance in January 2026, followed by active API enumeration and data collection on February 25, 2026 — targeting Albanian government digital infrastructure produced the following findings.

Context: Albania’s Ambitious Digital State

Albania has spent the last decade building one of Eastern Europe’s most ambitious digital government infrastructures. The National Agency for Information Society — AKSHI (Agjencia Kombëtare e Shoqërisë së Informacionit) — manages a network connecting 220 government institutions, hosts 380 government websites, powers 600+ electronic services for citizens, and maintains a dedicated CSIRT for cybersecurity operations. Albania was ranked 14th globally in the GovTech Maturity Index 2025 and received UN recognition as a model for digital transformation.

The country is also a NATO member actively pursuing EU membership, with a target accession date of 2030. Brussels has consistently identified corruption as the primary obstacle. Albania’s response, in September 2025, was to appoint the world’s first AI minister.

Diella — named from the Albanian word for “sun” — is an AI system developed by AKSHI using Microsoft Azure and OpenAI. Prime Minister Edi Rama appointed her as Minister of State for Artificial Intelligence with a stated mission: “Public tenders will be 100 percent free of corruption.” In October 2025, Rama announced Diella was “pregnant with 83 digital assistants” that would be assigned to each ruling-party Member of Parliament to monitor legislative sessions.

“The agency that built Albania’s anti-corruption AI was itself a criminal enterprise. Its director general and deputy were arrested three months after Diella’s appointment, charged with operating a structured criminal group to manipulate government tenders.”

The Story

This investigation began in January 2026 as passive reconnaissance: mapping AKSHI and Diella’s infrastructure, identifying subdomains via certificate transparency, probing public-facing systems. The initial conclusion was straightforward — Albanian government infrastructure was, by regional standards, well-secured. WAFs on the main domains, WordPress API requiring authentication, no exposed credentials in Diella’s frontend JavaScript bundle.

The assessment changed completely in February 2026. When enumeration turned to the Albanian Parliament — the institution Diella’s 83 AI “children” were supposed to monitor — a different picture emerged. The Parliament (parlament.al) serves a React single-page application that, on the surface, appeared to be a dead end: it returns HTTP 200 for all paths, a classic SPA catch-all. But the main JavaScript bundle told a different story.

Pulling the 355 KB JS bundle and running string extraction revealed a hardcoded API base URL: https://kuvendiapi.azurewebsites.net/api. Further extraction from minified webpack variables produced seven OData entity names. Every endpoint responded to unauthenticated GET requests. No tokens, no rate limiting, no access controls of any kind.

The Albanian Parliament’s entire backend API was wide open.

The irony runs deep. AKSHI’s Director General Mirlinda Karçanaj and her deputy were arrested in December 2025 — just three months after Diella’s appointment — charged with running a structured criminal group inside the very agency that built the AI anti-corruption minister. SPAK (Albania’s Special Anti-Corruption Structure) identified 12 tender procedures that had been systematically manipulated. The Parliament API had been open since at least January 2022. And Diella — integrated into the e-Albania platform, with access to 36,000+ government documents — saw none of it.

Critical Finding 1 — Albanian Parliament: Unauthenticated API

Open API Endpoints

MP PII Exposed — 236 Records

Each of the 236 member-of-parliament records in the /anetaret response contains the following personally identifiable information:

• Full legal name (first name, father’s name, surname)
• Date of birth and place of birth
• Official email address (@parlament.al)
• Political party affiliation and electoral district
• Profile photo URL (hosted on Azure Blob Storage)
• Social media links (Facebook, Twitter/X, LinkedIn)
• Active / inactive parliamentary status

This constitutes a complete, structured dossier on every person serving in the Albanian legislature — including personal identifiers, contact information, and political affiliations. The data was collected without any authentication or access control being bypassed.

Azure Blob Storage — 54,545 Public Documents

The /dokumentet endpoint returns a 30.2 MB JSON catalog listing every document in the parliamentary archive. Container listing on kuvendiwebfiles.blob.core.windows.net/webfiles/ is disabled — but every URL is directly enumerable through the API response, and all individual blobs have public read access enabled.

Among the documents recovered: MP salary spreadsheets (PAGA DEPUTETE) and MP benefits records (PERFITIME DEPUTETE) covering 2018–2020 on a monthly basis; the Lobbyist Registry (Regjistri elektronik i Lobisteve); FOIA request and response logs spanning 2018–2021; budget expenditure tables and public reserve fund data; the Albanian Constitution, Electoral Code, and Deputy Status Law; and parliamentary annual reports from 2013 through 2019.

The JavaScript bundle also contains a hardcoded internal API reference at http://134.0.63.165:5000/public — an internal IP address unreachable from the public internet, confirming additional backend infrastructure exists beyond what is publicly exposed.

Critical Finding 2 — AKSHI Corruption Scandal

The Irony in Numbers

Finding 3 — Diella AI Frontend Analysis

The technical security of Diella’s own frontend infrastructure is, in isolation, competent. Azure Static Web Apps, runtime-injected configuration, proper IAM via Keycloak, segmented internal infrastructure. But the security questions raised by Diella are not primarily technical: they are institutional. The agency that controls Diella’s training data, system access, and operational parameters was compromised by Iranian state hackers in 2022 and was operating as a criminal enterprise until December 2025. How was Diella built with data from compromised systems? Who monitored the anti-corruption AI while its creators were manipulating tenders?

Finding 4 — Open Data Portal

Datasets Available

Broader Albanian Government Scan

Seventeen Albanian government domains were probed during the February 2026 phase. The majority are hardened: Incapsula WAF, 403/404 responses, no accessible admin panels. A certificate transparency enumeration of the .gov.al domain space via crt.sh produced 832 domains and expanded AKSHI’s known subdomain count from 50 (January) to 110 (February), revealing Jira, Rancher, Wiki, and internal test environments — all behind internal-only DNS, not accessible from the public internet.

Four GIS portals were discovered through crt.sh enumeration: geoportal.asig.gov.al (national geoportal), instatgis.gov.al (statistics WebGIS), webgis.arrsh.gov.al (Road Authority), and webgis.atp.gov.al (Territorial Planning). None expose accessible GeoServer or WFS data endpoints — all are frontend-only applications.

Organizations with Compromises

Historical Context: A Decade of Exposure

The Parliament API exposure does not exist in isolation. Albania has been systematically compromised at every layer of its digital infrastructure for the past five years.

The Iranian state-sponsored group HomeLand Justice (MITRE ATT&CK C0038, attributed by FBI, CISA, NATO, and UK NCSC to Iran’s Ministry of Intelligence and Security) breached AKSHI by exploiting CVE-2019-0604 (Microsoft SharePoint). Initial access was established in May 2021 — fourteen months before the destructive attack launched in July 2022. During that window, CHIMNEYSWEEP infostealer exfiltrated data from the agency that would later build Albania’s AI minister.

Data Inventory

Total collection: 251 MB across 1,309 files, recovered from publicly accessible, unauthenticated endpoints and Azure Blob Storage URLs.