# Albania — Full Investigation Summary

**Campaign:** Albanian AI / Diella / AKSHI / Parliament / Gov Recon
**Research Phases:** January 2026 (OSINT) + February 25, 2026 (Active Recon & Dump)
**Total Data Recovered:** 251 MB (1,309 files)

---

## Background

**Diella** is the world's first AI system appointed to a cabinet-level government position. In September 2025, Albanian Prime Minister Edi Rama named it "Minister of State for Artificial Intelligence," built by AKSHI (National Agency for Information Society) using Microsoft Azure and OpenAI. Its stated purpose: eliminate corruption in public procurement.

Three months later, in December 2025, **AKSHI's Director General Mirlinda Karcanaj and her deputy were arrested for corruption** — specifically for manipulating the very government tenders Diella was supposed to monitor. The agency that built Albania's anti-corruption AI was itself a criminal enterprise.

This investigation was launched to map the technical infrastructure behind Diella and assess the security posture of Albanian government digital systems.

---

## Phase 1 — OSINT Research (January 2026)

Initial passive reconnaissance mapped AKSHI and Diella's infrastructure:

### Infrastructure Identified
| Asset | Details |
|-------|---------|
| e-albania.al | 134.0.39.39 (AS5576, AKSHI self-hosted) |
| akshi.gov.al | 134.0.42.170 (WordPress, nginx/1.19.10) |
| Diella Frontend | proud-coast-026495803.4.azurestaticapps.net (Vue.js/Quasar) |
| Azure Insights Key | 40a2cf63-ce16-4617-afe4-c618d01198ef |

### AKSHI Subdomains (50 found)
Internal infrastructure mapped via certificate transparency:
- `dc-hasura.akshi.gov.al` — Hasura GraphQL
- `dc-keycloak.akshi.gov.al` — Keycloak IAM
- `dc-rest.akshi.gov.al` — REST API
- `code-server.akshi.gov.al` — VS Code Server
- `collabora.akshi.gov.al` — Collabora Online

All internal-only — not publicly accessible.

### Security Assessment (January)
- WordPress API locked (401 auth required)
- WAF blocks sensitive file requests (.env, wp-config)
- User enumeration disabled
- No credentials or API keys found

**Conclusion at the time:** "Albanian government infrastructure is well-secured."

### Historical Context Documented
- **April 2021:** 910,000 voter records leaked (~1/3 of population)
- **December 2021:** 637,138 salary records leaked (22% of population)
- **2022:** Iranian state-sponsored group "HomeLand Justice" breached AKSHI, exfiltrated 100TB, deployed ROADSWEEP ransomware
- **December 2023:** Albanian Assembly and telecom company attacked
- **December 2025:** AKSHI leadership arrested for corruption

---

## Phase 2 — Active Recon & Data Dump (February 25, 2026)

### FINDING 1: Albanian Parliament — Unauthenticated API + 54,545 Public Documents

**Severity: HIGH**
**Status: FULLY OPEN**

The January assessment that Albanian infrastructure was "well-secured" proved incomplete. The Albanian Parliament (parlament.al) runs a React SPA frontend backed by an ASP.NET OData API on Azure — and the API requires **zero authentication**.

#### Discovery Method
1. parlament.al returns 200 for all paths (React SPA catch-all) — initially appeared to be a dead end
2. Pulled the main JS bundle (355 KB) and ran string extraction
3. Found hardcoded API base URL: `https://kuvendiapi.azurewebsites.net/api`
4. Extracted 7 OData entity names from minified webpack variables
5. All endpoints responded to unauthenticated GET requests

#### Open API Endpoints
| Endpoint | Records | Size | Content |
|----------|---------|------|---------|
| /anetaret | 236 | 138 KB | MP records — full PII |
| /strukturat | — | 274 KB | Parliamentary committees |
| /aktet | — | 3.1 MB | Legislative acts, interpellations |
| /lajmet | — | 19.8 MB | Parliamentary news articles |
| /mbledhjet | — | 2.2 MB | Session/meeting records |
| /dokumentet | — | 30.2 MB | Document catalog with blob URLs |
| /YouTube/search | — | 8 KB | YouTube video search proxy |
| /abonimet | — | 401 | **Only protected endpoint** |

#### MP PII Exposed (236 records)
Each record contains:
- Full legal name (first name, father's name, surname)
- Date of birth
- Place of birth
- Email address (@parlament.al)
- Political party affiliation
- Electoral district
- Profile photo URL
- Social media links (Facebook, Twitter, LinkedIn)
- Active/inactive status

#### Azure Blob Storage (54,545 public documents)
Container `kuvendiwebfiles.blob.core.windows.net/webfiles/` has individual blob access enabled. Container listing is disabled, but every URL is cataloged in the /dokumentet API response.

| File Type | Count |
|-----------|-------|
| PDF | 32,627 |
| JPEG | 9,831 |
| JPG | 8,458 |
| JFIF | 1,768 |
| DOCX | 885 |
| DOC | 397 |
| XLSX | 392 |
| PNG | 208 |
| XLS | 117 |

#### Key Documents Identified
- **MP salary spreadsheets** (PAGA DEPUTETE) — monthly, 2018-2020
- **MP benefits spreadsheets** (PERFITIME DEPUTETE) — monthly, 2018-2020
- **Lobbyist registry** (Regjistri elektronik i Lobisteve)
- **Civil society organization registry**
- **FOIA request/response logs** — 2018-2021
- **Albanian Constitution**, Electoral Code, Deputy Status Law
- **Budget expenditure tables**, Reserve fund tables
- **Parliamentary annual reports** 2013-2019
- **Organizational chart**, Code of Conduct, Media accreditation rules

#### Internal Reference
JS bundle contains hardcoded internal API: `http://134.0.63.165:5000/public` — unreachable from public internet, confirming additional backend infrastructure.

---

### FINDING 2: Diella AI Chatbot (AKSHI)

**Severity: LOW**
**Status: Limited Exposure**

The Diella frontend at `proud-coast-026495803.4.azurestaticapps.net` is a Vue.js/Quasar SPA. The 229 KB JS bundle was analyzed and found clean — no API keys, no backend endpoints. All sensitive configuration is injected at runtime via Azure backend.

Azure Static Web App authentication endpoints respond:
- `/.auth/me` → `{"clientPrincipal": null}`
- `/.auth/login/aad` → 302 redirect to Azure AD

Backend infrastructure (dc-hasura, dc-keycloak, dc-hapi, dc-abb) is all internal-only with no public DNS resolution.

---

### FINDING 3: AKSHI Subdomain Expansion

**Severity: INFORMATIONAL**

crt.sh enumeration expanded AKSHI subdomains from 50 (January) to **110** (February):

**New subdomains found:**
- jira.akshi.gov.al — internal
- rancher.akshi.gov.al — internal
- wiki.akshi.gov.al — internal
- internal.akshi.gov.al — internal
- test.akshi.gov.al, test2.akshi.gov.al — internal
- stats.akshi.gov.al — internal

**Live subdomains:**
- esign.akshi.gov.al — Incapsula WAF
- eform.akshi.gov.al — Default IIS page
- ams.akshi.gov.al — 403 Forbidden

---

### FINDING 4: Open Data Portal (opendata.gov.al)

**Severity: MEDIUM**
**Status: Fully Open (public API by design)**

Albania's national open data portal exposes a **59-endpoint ASP.NET API** with a full 200 KB OpenAPI specification at `/api/specification.json`.

#### Datasets Available
| Dataset | Source | Records |
|---------|--------|---------|
| Health Centers | AKSHI | 400 centers |
| Pharmacies/Medicines | AKSHI | 2,289 records |
| Business Registry by Legal Form | QKB | 2025+2026 |
| Business Registry by Ownership | QKB | 2025+2026 |
| Business Registry by Region | QKB | 2025+2026 |
| National Debt Registry 2024 | Finance Ministry | 4 quarterly files |
| Treasury Data | Finance Ministry | 900 daily distributions |
| Public Investments | Finance Ministry | Monthly data |
| e-Albania Statistics 2023 | AKSHI | 12 monthly reports |
| e-Albania Users 2013-2024 | AKSHI | Registration stats |
| Airport Mail Flow 2025 | Civil Aviation | Mail statistics |

#### Government Institutions in Directory
All with addresses, phone numbers, and contact emails:
- AKSHI, Finance Ministry, Education Ministry, National Business Center, Civil Aviation Authority

---

### Broader Albanian Government Scan

#### Domains Probed (17 total)
| Domain | Result |
|--------|--------|
| instat.gov.al | 404 (clean) |
| dpshtrr.gov.al | 415 (vehicle registry) |
| pp.gov.al | DOWN (prosecution) |
| klsh.org.al | WordPress, 401 on user enum (hardened) |
| bankofalbania.org | 403 (locked) |
| arsimi.gov.al | Incapsula WAF |
| drejtesia.gov.al | Incapsula WAF |
| financat.gov.al | DOWN |
| mbrojtja.gov.al | DOWN (defense) |
| policia.al | DOWN |
| president.al | 403 (locked) |
| kryeministria.al | Incapsula WAF |
| dogana.gov.al | DOWN (customs) |
| tatime.gov.al | DOWN (tax) |
| ere.gov.al | 301 redirect |
| akep.al | 403/404 |
| qbz.gov.al | Angular SPA catch-all (false positive) |

#### GIS Portals Discovered (via crt.sh, 832 .gov.al domains)
| Portal | Status |
|--------|--------|
| geoportal.asig.gov.al | HTTP 200 (ASIG national geoportal) |
| instatgis.gov.al | LIVE (INSTAT statistics WebGIS) |
| webgis.arrsh.gov.al | LIVE (Road Authority, login required) |
| webgis.atp.gov.al | LIVE (Territorial Planning) |

None of the GIS portals have exposed GeoServer/WFS endpoints — they are frontend-only applications without accessible data APIs.

---

## Data Inventory

```
Albanian AI/DUMP/                                   251 MB (1,309 files)
│
├── ALBANIA-COMPLETE-FINDINGS.txt                   Full technical findings
├── WRITEUP-Parliament-API-Exposure.md              Discovery writeup article
├── SUMMARY.md                                      THIS FILE
│
├── aibot-frontend.html                             Diella AI frontend source
├── aibot-bundle.js                     229 KB      Vue.js bundle (clean)
├── parlament-main.js                   355 KB      Parliament React bundle
├── parlament-vendor.js                1015 KB      Parliament vendor bundle
├── blob-docx-urls.txt                  141 KB      885 DOCX blob URLs
├── blob-xlsx-urls.txt                   47 KB      392 XLSX blob URLs
│
├── parlament-api/                      103 MB      14 files
│   ├── anetaret.json                   138 KB      236 MPs (full PII)
│   ├── anetaret_active.json             81 KB      Active MPs
│   ├── strukturat.json                 274 KB      Committees
│   ├── aktet.json                      3.0 MB      Legislative acts
│   ├── lajmet.json                      19 MB      News
│   ├── mbledhjet.json                  2.1 MB      Meetings
│   ├── dokumentet.json                  29 MB      54,545 document URLs
│   ├── youtube-search.json             8.0 KB      YouTube results
│   ├── mp-email-list.txt                24 KB      Email directory
│   └── *_active.json                               Active-only variants
│
├── parlament-docs/                      20 MB      25 PDFs/DOCs
│   └── Constitution, Electoral Code, Annual Reports, etc.
│
├── parlament-xlsx/                      44 MB      372 spreadsheets
│   └── MP salaries, benefits, lobbyist registry, FOIA logs, budgets
│
├── parlament-docx/                      73 MB      837 Word documents
│   └── Legislation, committee reports, official correspondence
│
└── opendata-gov/                       5.2 MB      52 files
    ├── specification.json              200 KB      OpenAPI spec (59 endpoints)
    ├── institutions.json                            Gov institution directory
    ├── all-datasets.json                            Full dataset catalog
    └── downloads/
        ├── health-centers.json         103 KB      400 centers
        ├── pharmacies.json             539 KB      2,289 records
        ├── business-*.json                          Business registry 2025-2026
        ├── public-investments-*.csv                 Monthly investment data
        ├── treasury/                                Daily treasury CSVs
        ├── e-albania-users-*.json                   User stats 2013-2024
        ├── e-albania-stats-*.json                   Portal stats 2023
        ├── e-albania-report-*-2023.xlsx             12 monthly reports
        └── airport-mail-flow-2025.*                 TIA mail statistics
```

---

## Statistics

| Metric | Count |
|--------|-------|
| Parliament API endpoints (open) | 7 |
| Parliament API endpoints (auth) | 1 |
| MP records with full PII | 236 |
| MP @parlament.al emails | 236 |
| Azure Blob document URLs | 54,545 |
| Blob PDFs | 32,627 |
| Blob images | 20,299 |
| Blob XLSX downloaded | 372 of 392 |
| Blob DOCX downloaded | 837 of 885 |
| Priority PDFs downloaded | 25 |
| Open Data Portal endpoints | 59 |
| Open Data datasets | 10+ |
| Health centers | 400 |
| Pharmaceutical records | 2,289 |
| Treasury distributions | 900 |
| e-Albania monthly reports | 12 |
| AKSHI subdomains | 110 |
| Albanian .gov.al domains (crt.sh) | 832 |
| GIS portals found | 4 |
| Gov domains scanned | 17 |
| **Total data dumped** | **251 MB** |
| **Total files** | **1,309** |

---

## Key Findings Summary

### What I Found

1. **The Albanian Parliament's entire backend API is unauthenticated.** Any person on the internet can query the OData API at kuvendiapi.azurewebsites.net and retrieve full PII for all 236 Members of Parliament — names, birthdays, email addresses, party affiliations, electoral districts, and profile photos. The API also exposes 30 MB of document metadata containing 54,545 direct URLs to publicly accessible Azure Blob Storage files.

2. **54,545 parliamentary documents sit in public blob storage.** This includes MP salary and benefits spreadsheets (monthly, 2018-2020), a lobbyist registry, FOIA request/response logs spanning 4 years, budget expenditure tables, the Albanian constitution, electoral code, annual reports, and thousands of legislative documents. Container listing is disabled, but every URL is exposed through the API.

3. **Albania's Open Data Portal has a 59-endpoint API with a published OpenAPI spec** that provides access to health center directories, pharmaceutical databases, business registries, daily treasury data, public investment figures, and e-Albania platform statistics.

4. **The Diella AI frontend is clean.** No API keys, no backend URLs, no credentials. AKSHI's internal infrastructure (Hasura, Keycloak, etc.) is properly segmented behind internal-only DNS.

5. **Broader Albanian government sites are mostly hardened.** 17 domains scanned — most are behind Incapsula WAF, return 403/404, or are unreachable. No .git exposures, no .env files, no open admin panels found on any government domain.

### What I Didn't Find

- No credentials or API keys from Diella/AKSHI infrastructure
- No .git repositories on any Albanian government domain
- No exposed databases or admin panels
- No GeoServer WFS data endpoints (unlike the DR ONE GeoServer)
- The GIS portals (INSTAT, ASIG, ARRSH, ATP) are frontend-only without data APIs

---

## The Story

Albania invested heavily in digital government — e-Albania serves 600+ public services, AKSHI maintains GOVnet connecting 220 institutions, and in 2025 they appointed the world's first AI minister. The surface-level security is solid: WAFs, locked-down WordPress, proper authentication on AKSHI's own systems.

But the Parliament — the institution Diella's 83 AI "children" are supposed to monitor — left its entire backend API wide open. No auth tokens, no rate limiting, no access controls. Every MP's personal data, every document in the parliamentary archive, all accessible to anyone who reads a JavaScript bundle.

The irony runs deep: AKSHI's leadership was arrested for corruption in December 2025. The Parliament API has been open since at least January 2022 (based on record timestamps). And Diella — the AI built to ensure "public tenders will be 100% free of corruption" — was built by the same agency whose directors were running a criminal tender manipulation scheme.

---

## Files Reference

### Prior Research (January 2026)
| File | Content |
|------|---------|
| README.md | Project overview and file structure |
| Diella.md | Background research on Diella AI system |
| FINDINGS/OSINT_REPORT.md | Full technical OSINT report |
| FINDINGS/exposed_assets.md | Publicly accessible assets |
| FINDINGS/infrastructure.txt | IP addresses, tech stack |
| FINDINGS/subdomains.txt | AKSHI subdomain enumeration |
| FINDINGS/data_breaches.md | Albania data breach history |
| FINDINGS/akshi_corruption.md | AKSHI leadership arrests |
| FINDINGS/iranian_cyberattacks.md | HomeLand Justice attacks |

### Active Recon & Dump (February 2026)
| File | Content |
|------|---------|
| DUMP/ALBANIA-COMPLETE-FINDINGS.txt | Technical findings document |
| DUMP/WRITEUP-Parliament-API-Exposure.md | Discovery methodology writeup |
| DUMP/parlament-api/ | 103 MB — All Parliament API data |
| DUMP/parlament-docs/ | 20 MB — 25 priority documents |
| DUMP/parlament-xlsx/ | 44 MB — 372 MP salary/budget spreadsheets |
| DUMP/parlament-docx/ | 73 MB — 837 parliamentary Word documents |
| DUMP/opendata-gov/ | 5.2 MB — Open Data Portal dumps |

---

*Generated: February 25, 2026*
*All data recovered from publicly accessible, unauthenticated API endpoints and Azure Blob Storage URLs. No authentication was bypassed, no credentials were used, and no access controls were circumvented.*