Edi Rama

Albanian authorities thwarted a second cyberattack over the weekend after Tirana, backed by the United States with pledges of support and fresh sanctions on Iran, severed all diplomatic ties with Tehran who it blames for the “sabotage”.

Meanwhile, hopes of reviving the 2015 nuclear deal continue to fade as leading European countries expressed ‘serious doubts’ about Iran’s intentions.

The latest attack in Albania comes just days after Prime Minister Edi Rama accused Iran of being behind a 15 July cyberattack that brought all government websites and digital citizens’ services offline and was described by Microsoft as “destructive.”

Albanian Prime Minister Edi Rama

He ordered all Iranian diplomats to leave the country within 24 hours, severing all diplomatic ties with immediate effect.

On Saturday, Rama said the country’s border management information system (TIMS) was under “another cyber-attack by the same aggressors”, taking to social media a day later to confirm systems were back up and running.

“Beyond the heavy feeling created by the penetration into these systems, just like when they break into a house and steal, the fact is that the aggression has not achieved its goal at all, no disappearance or serious data leak!” Rama wrote on Twitter on Sunday.

Those trying to use the TIMS system, which records every person who enters and exits the country, were confronted by a message stating, “Albania is still paying for the terrorist acts of the MEK cult in Durres; this game will continue.”

Albania is home to the MEK group (People’s Mojahedin Organisation of Iran), who were transferred to Albania from an Iraqi refugee camp in 2016.

The group was founded in 1965 and engaged in militant action against the Iranian government for decades before forging an alliance with Iraq and siding with them during the Iraq-Iran war.

MEK was previously designated as a terrorist organisation by the EU, Canada, US and Japan, but this was repealed. They were given protection in 2004 by the US government under the Geneva Convention.

They aim to overthrow the Iranian government, and some 1,000 members live in a closed, heavily guarded compound 40 kilometres outside Tirana.

However, some analysts say it is not just due to MEK that Albania is being targeted. Albania is staunchly pro-American, a member of NATO and is home to a NATO airbase and, potentially, a future, a NATO naval base.

In today’s edition of the Capitals, find out more about Nord Stream 1’s 10-day maintenance causing worry for German policymakers, the Uber Files naming French President Emmanuel Macron as helping Uber enter the French market, and so much more.

Be vigilant

Lawyer and politician Kreshnik Spahiu told Euronews Albania that the government should be vigilant against attacks as it is “in a direct war with Iran.”

“Albania must be very prepared militarily, even with the intelligence services, but also as a society in terms of other attacks that in the future will no longer be on the Internet and social networks, but we will have consequences and physical victims,” he said.

The US National Security Council has also reacted to the latest news of the attack, stating it supports Albania’s recovery efforts.

“The United States condemns the September 9th cyberattack against our NATO Ally, Albania. This malicious activity against Albania follows the July 15 cyberattack conducted by the Government of Iran. The U.S. government is supporting Albania’s efforts to mitigate and recover,” a statement on Twitter reads.

On Friday, the US government imposed sanctions on Iran’s Ministry of Intelligence and Security and its head, Esmail Khatib, .for cyber-related activities against the US and its allies following a Whitehouse pledging “further action.”

The Director of the Civil Aviation Authority, Maksim Et’hemaj, said the attack was sabotage and called for establishing a Crisis Coordination Committee.

“In civil aviation, what happened with the TIMS system is classified by the definition, sabotage. In such cases, in cases of sabotage, the civil aviation asks the local authorities to set up what is called the Crisis Coordination Committee,” he told Euronews Albania.

NATO and its head, Jens Stoltenberg, on Thursday (8 September) condemned the Iranian cyberattack on Albania, which saw the country cut ties with Tehran and demand all its diplomats to leave within 24 hours on Wednesday.

But it is not just Albania that has witnessed such attacks. Digital services in Kosovo and North Macedonia have also been targeted over the last few days, although it is not yet known who is behind them.

Troll farm

Meanwhile, the MEK, in March 2021, was accused by Facebook of running a troll farm out of their base in Albania.

In a statement published on their website, Facebook said they had investigated and disrupted a “long-running operation from Albania that targeted primarily Iran”

“The network violated our policy against foreign interference, which is coordinated inauthentic behaviour on behalf of a foreign entity,” they wrote in their in-depth report.

The latest escalation comes on the backdrop of increasingly bleak hopes for reviving the so-called 2015 Joint Comprehensive Plan of Action (JCPOA) deal that gave Iran sanctions relief in return for restricting its nuclear programme.

In 2018, then US president Donald Trump unilaterally withdrew from the accord and reimposed sanctions.

Momentum for the EU-mediated new deal that seemed to be there earlier this month appears to have since faded, with Germany, France and Britain on Saturday raising “serious doubts” in a tripartite statement about Iran’s sincerity in restoring the accord.

The European nations charged that Tehran “has chosen not to seize this critical diplomatic opportunity”, adding that “instead, Iran continues to escalate its nuclear programme way beyond any plausible civilian justification”. Iran’s foreign ministry criticised those comments as “unconstructive.”, AFP reported.

Meanwhile, Israeli Prime Minister Yair Lapid arrived in Germany Sunday to persuade Western powers to ditch the tattered deal altogether.

By Alice Taylor – EURACTIV – Sep 12, 2022 (updated: Sep 26, 2022)