Allegations of Data Breach Rock Albania: State Police IT Director Arrested

 On Tuesday, the Director of Information Technology (IT) at the Albanian State Police, Ervin Muço, was placed under "house arrest" after being suspected of meddling in the TIMS system last summer, which records the entry and exit of citizens from the country's borders. Muço's arrest coincides with the initiation of the parliamentary special investigative commission's work, set up at the opposition's request, precisely for the incident that led to Muço's arrest.

Allegations of Data Breach Rock Albania: State Police IT Director Arrested
 
The Tirana Prosecutor's Office, which commenced investigations following a report from police structures themselves, announced that the IT director is suspected of "Unauthorized Computer Access." The Prosecutor's statement explains that "on August 2, 2023, unauthorized access and export of data occurred in the State Police database by the Director of Technology and Information, Ervin Muço. The actions were carried out in the late hours of the night, where unauthorized individuals entered the building using another employee's personal PIN, who was not present, raising reasonable doubts about improper actions and in violation of the law."

The Prosecutor's Office revealed that investigations have expanded to interrogate all persons involved on the day of the incident, while further verification regarding director Muço has unveiled issues with his past. "It appears that on October 23, 2007, in Italy, he was reported responsible for criminal acts involving false documents by private individuals and the use of a fake ID. On September 9, 2008, Ervin Muço was notified of the decision to refuse the renewal of his residence permit by the police headquarters in Bari," reads the Tirana Prosecutor's Office statement.

Furthermore, it has been found that Muço "serves as an external advisor to the Director of the State Cadastre Agency, while also being the Director of the Department for Technology and Information at the State Police. The law on the state police prohibits secondary activities except for teaching. Muço did not declare this secondary activity in the application documents for the position of Director at the State Police."

Criminal proceedings for the incident were registered last September, and Muço has been under investigation. The Prosecutor initially received a referral from the Police Oversight Agency on August 8, followed by one from the General Police Directorate at the end of the same month. It remains unclear why Muço continued to perform his duties undisturbed, and only on Tuesday evening, following the arrest order against him, the Police announced his suspension from duty.

Coincidentally, the arrest order aligns with the commencement of the parliamentary special investigative commission's activity. The chairman of this commission, Democratic Party deputy Ervin Salianji, stated on Tuesday evening that "the arrest of the IT Director at the State Police, the first listed witness in the preliminary investigation plan of the investigative commission, Ervin Muço, is the first result of the commission's work on TIMS data and confirmation of the opposition's continuous allegations."

Last August, authorities attempted to downplay the incident. It gained attention after the Chargé d'Affaires at the US Embassy, Martin McDowell, "expressed US concern about the reported interference in the TIMS system at the State Police. He urged a swift and comprehensive investigation, emphasizing the importance of protecting sensitive data, including that of American citizens in Albania," according to a post by the US embassy about Mr. McDowell's meeting on August 17 with Interior Minister Taulant Balla. The latter, however, did not mention the TIMS issue in the press release regarding his conversation with the US diplomat.

A few days later, Prime Minister Edi Rama treated the case as a purely technical matter. "The internal investigation has been completed thoroughly, and there are no concerns. That serious incident did not happen because it couldn't have happened since in attempting to back up, it was found that there was no backup at all. So, it's an internal technical problem. They have their job, and in that job, they are monitored. The investigation was conducted so that this does not exist," stated Mr. Rama in a press conference on August 25.
Previous Post Next Post