THE NINE SHISH DIAGRAMS: WHAT ARE THEY, HOW ARE THEY PREPARED, AND WHAT INFORMATION MAY THEY CONTAIN? THE NINE SHISH DIAGRAMS: WHAT ARE THEY, HOW ARE THEY PREPARED, AND WHAT INFORMATION MAY THEY CONTAIN? By Flamur Buçpapaj

THE NINE SHISH DIAGRAMS: WHAT ARE THEY, HOW ARE THEY PREPARED, AND WHAT INFORMATION MAY THEY CONTAIN?
THE NINE SHISH DIAGRAMS: WHAT ARE THEY, HOW ARE THEY PREPARED, AND WHAT INFORMATION MAY THEY CONTAIN?
By Flamur Buçpapaj
The issue of the nine diagrams that, according to materials made public from the investigative file, were found in Ergys Agasi’s vehicle cannot be seriously addressed without first explaining what is meant by the term “information diagram” within an intelligence service.
According to public reports, on July 20, 2026, Agasi’s vehicle was seized and, during the search documented on July 22, nine large-format printouts were found containing diagrams with data similar to those produced by SHISH. These are facts reported from materials contained in the investigative file and, at this stage, do not constitute a final finding of a publicly available expert examination.
The word “diagram,” in its ordinary meaning, refers to a graphical representation of information. Within an intelligence service, such material may be used to present, in summarized form, connections, individuals, institutions, events, contacts, structures, risks, or relationships between different factors.
But one clarification is essential:
There is not enough publicly available evidence to state that the nine specific materials in the Agasi case contain precisely such information, that they are original SHISH documents, or that they carry a particular classification level.
This can only be established through expert examination and the complete investigative documentation.
VERIFIABLE FACTS: WHAT IS AN INFORMATION DIAGRAM?
In technical terms, a diagram is a way of presenting information in a structured and visual form.
Instead of presenting information across several pages of text, it can be arranged in a scheme such as:
individuals → institutions → contacts → events → connections → sources → assessments.
Such a scheme may use boxes, arrows, codes, dates, categories, and analytical notes.
This does not mean that every such diagram is a secret document.
Classification depends on the content, origin, classification level, and legal rules governing the handling of information.
SHISH itself states that it administers classified documentation and that its regulatory framework includes Law No. 10/2023 “On Classified Information.” The official SHISH website also publishes examples of documents that have been partially declassified, demonstrating that documents are identified through elements such as protocol number, date, number of pages, and classification level.
HYPOTHETICAL POSSIBILITY: HOW MIGHT AN INFORMATION DIAGRAM BE CREATED?
An information diagram may be prepared by an analyst after data from different sources have been collected and assessed.
At a general level, the process can be understood as follows:
FIRST – COLLECTION OF INFORMATION
Data related to the subject of the analysis are collected.
The role of SHISH is connected with the collection and analysis of information in the interests of national security. The official framework published by SHISH defines the institution’s mission and powers.
SECOND – VERIFICATION
Information should be assessed and, whenever possible, checked for accuracy and reliability.
In intelligence analysis, a distinction should be made between a verified fact, information obtained from a source, and an analytical assessment.
THIRD – CLASSIFICATION OF INFORMATION
Data that have a protected character are handled under the applicable classified-information regime.
FOURTH – ANALYSIS
The analyst connects different elements and attempts to identify relationships, patterns, developments, or risks.
FIFTH – GRAPHICAL PRESENTATION
The analyzed information may be presented in the form of a table, relationship map, chart, or diagram.
SIXTH – REPORTING
The material may be used as part of intelligence analysis.
This is a general description of how information may be structured and is not a description of SHISH’s classified internal procedures.
HYPOTHETICAL POSSIBILITY: WHAT INFORMATION MIGHT A DIAGRAM CONTAIN?
Depending on the subject of the analysis, an information diagram may summarize different categories of data.
1. INDIVIDUALS
Individuals connected to a specific matter may be presented.
But the appearance of a person’s name in a diagram does not automatically mean that the person is suspected of a criminal offense.
The person may be a subject of analysis, a contact, an official, a witness, an information source, or an individual connected to an event.
2. INSTITUTIONS
A diagram may show state institutions, organizations, companies, or other structures connected to the matter being analyzed.
3. RELATIONSHIPS AND CONNECTIONS
Arrows and graphical links may indicate relationships identified or analyzed among individuals, institutions, or events.
But a line in a diagram should not automatically be interpreted as evidence of a criminal relationship.
It is necessary to determine what meaning the author of the document assigned to that connection and what source it was based upon.
4. DATES AND EVENTS
A diagram may contain dates, meetings, events, or developments arranged chronologically.
This may make it easier for an analyst to understand the sequence of events.
5. OPERATIONAL INFORMATION
Depending on the nature of the document, it may also contain operational data.
This is an area requiring particular caution, because the working methods and sources of an intelligence service are not materials that can be interpreted or published without respecting the applicable legal framework.
6. ANALYTICAL ASSESSMENTS
A diagram is not necessarily merely a list of facts.
It may also contain an analyst’s assessments, possible connections, or analytical conclusions.
Therefore, it is extremely important to distinguish between:
a verified fact
and
information obtained from a source
and
an analyst’s assessment.
These do not have the same evidentiary weight.
WHAT MIGHT THE NINE DIAGRAMS IN THE AGASI CASE BE?
Without seeing the nine documents themselves and without having the conclusions of the expert examination, we cannot say with certainty what they contain.
We can only say that, if they are indeed materials produced by SHISH, their nature must be established.
The questions are:
Are they original SHISH documents?
Are they copies of SHISH documents?
Are they materials produced by another structure?
Are they working documents or official documents?
Are they classified?
Who prepared them?
Who printed them?
When were they printed?
From which system were they extracted?
Who had access to them?
Who delivered them?
For what purpose were they delivered?
Who was authorized to possess them?
These are far more important questions than the word “diagram” itself.
SHOULD THERE BE AN AUDIT OR AN INSPECTION?
Here an important distinction must be made.
This is not necessarily a financial audit.
If there is suspicion that SHISH information has left the institution, what is required is an institutional inspection and a review of information handling, accompanied by documentary examination and, where necessary, electronic forensic examination.
SHISH’s Transparency Program itself provides for an Inspector General responsible for conducting inspections of SHISH activities, with the authority to conduct controls and the duty to report violations of the law or serious problems and recommend corrective action.
Therefore, if the investigation establishes that the documents originated from SHISH, the institutional chain of custody and administration of the document should also be verified.
In other words:
who created it → who registered it → who classified it → who had access → who copied it → who printed it → who removed it → who delivered it → who possessed it.
This is what must be examined.
WHAT SHOULD THIS INSPECTION INCLUDE?
As appropriate, the following should be verified:
The origin of the document.
The protocol number and administrative registration.
The date of creation.
The author or structure that prepared it.
The classification level.
The copy number and its destination.
Who was authorized to view it.
Who was authorized to copy or print it.
From which electronic system it was extracted, if it has an electronic origin.
Who transported or delivered it.
Whether authorization existed to remove it from the institution.
Whether there were violations of security procedures.
This does not mean that these details should be made public. If the information is classified, the inspection itself must be conducted in compliance with the classified-information regime.
DOCUMENTARY EXPERT EXAMINATION IS ALSO NECESSARY
For the nine printouts, it must be determined whether they are authentic and whether they originated from SHISH.
Depending on the circumstances, the examination should consider:
the format and structure of the document;
identifying elements;
protocol numbers;
dates;
classification markings;
stamps and signatures, if any;
printing characteristics;
consistency with authentic institutional documents;
and, where there is an electronic origin, available technical data and metadata.
If it is established that the documents were extracted from an electronic system, consideration should also be given to a forensic examination aimed at determining traces of access, copying, or printing, to the extent that such data exist and can lawfully be obtained and administered.
THE CHAIN OF CUSTODY OF THE EVIDENCE
Another element that must not be overlooked is the chain of custody and administration of the evidence.
It should be documented:
where they were found → who seized them → who packaged them → who administered them → who examined them → where they were stored → who had access after the seizure.
This is important because every piece of evidence should have a documented history of its handling.
CAN A DIAGRAM REVEAL WHO IS A COLLABORATOR?
Not necessarily.
A diagram may present a person as a subject of information, a contact, a person connected to an event, or an element of an analysis.
The mere presence of a person’s name in a diagram cannot automatically lead to the conclusion that the person is a collaborator of SHISH.
The relevant documentation is required, and if an institutional relationship is alleged, the legal or factual basis that established that relationship must be identified.
This is why the question:
“Was Agasi a collaborator?”
is different from the question:
“Did Agasi have the right to possess nine documents alleged to have originated from SHISH?”
These are two different issues and require different evidence.
WHAT WOULD IT MEAN IF THE DIAGRAMS BELONG TO SHISH?
If expert examination confirms that the materials were produced by SHISH, their status must then be determined.
They could be:
working materials,
analytical materials,
parts of a file,
classified documents,
or authorized copies.
These categories cannot automatically be treated as equivalent.
SHISH states within its transparency framework that it administers classified documents and that documents may be identified by administrative information, including protocol number, date, pages, and classification level.
Therefore, even a printed copy must be examined according to the legal status of the information it contains and the manner in which it was created or extracted.
THE CONNECTION WITH THE DIRECTOR OF SHISH
The Director of SHISH is responsible for the institution’s activities, while the structure of SHISH and the powers of its leadership are determined by the legal framework and relevant acts. The official Transparency Program also provides for the role of the Inspector General in overseeing SHISH activities.
This does not mean that every material originating from an intelligence institution is automatically unlawful.
An intelligence service must exchange and use information in the performance of its duties.
However, if protected information was given to a person outside the institution, the legal question becomes:
Did the relevant authorization exist?
The answer must be based on evidence.
A MISTAKE THAT SHOULD NOT BE MADE
We should not reason as follows:
“Agasi had the diagrams, therefore he was a collaborator.”
Nor should we reason:
“Agasi was a collaborator, therefore he had the right to possess the diagrams.”
Both conclusions require evidence.
The proper analytical sequence should be:
DOCUMENT → ORIGIN → AUTHENTICITY → CLASSIFICATION → AUTHORIZATION → ACCESS → DELIVERY → POSSESSION → PURPOSE.
Only after these links have been verified can a legal conclusion be reached.
WHY ARE THE NINE DIAGRAMS IMPORTANT?
If the nine documents are all of the same nature and have the same origin, their number may be relevant to the investigation.
But here too, speculation should be avoided.
It should be determined:
Are they nine different documents?
Are they nine pages from the same file?
Do they have the same author?
Do they have the same classification level?
Do they have the same date?
Do they have protocol numbers?
Do they carry identifying marks of SHISH?
Do they correspond to documents existing in the institution’s archive or system?
Do they have the same format and structure?
Can traces of their creation or printing be identified?
These are the elements that may establish their origin.
WHAT IS MISSING FOR A COMPLETE CONCLUSION?
To move from assumption to a demonstrable conclusion, the public and competent authorities need, to the extent permitted by law, clarification of:
The nine documents themselves;
The seizure record;
The expert examination report;
Their classification status;
Protocol numbers and administrative traces;
Their electronic origin, if any;
The individuals or structures that had access;
Authorization for copying, printing, or removal;
The manner in which the documents left the institution, if this is established;
The chain of custody and administration of the evidence after seizure.
These are the links needed for a complete picture.
CONCLUSION
An information diagram is not simply a drawing.
In an intelligence context, it may be a condensed way of presenting collected and analyzed information: individuals, institutions, events, connections, chronological data, and analytical assessments.
But what the nine diagrams in the Agasi case actually contain cannot be established through speculation.
They require documentary examination and institutional verification.
If they are SHISH materials, then the central issue is not only what the diagrams show, but also:
who created them, who classified them, who had access, who copied them, who removed them, who delivered them, and under what authorization they ended up in the possession of a person outside the SHISH structure.
This is the heart of the matter.
Because SHISH has the duty to collect and analyze information in the interests of national security, while classified information and working methods must be protected in accordance with the law. SHISH itself publishes this framework and provides specific mechanisms for oversight and inspection of its activities.
And precisely for this reason, in a state governed by the rule of law:
secrecy must be protected, but procedure must also be respected.
The nine diagrams should not be judged by the name given to them.
They should be examined according to their origin, authenticity, content, classification, chain of possession, and authorization.
And if there has been a leak of protected information, the investigation should follow the matter to the specific link that made that leak possible.
Not through speculation.
Not through propaganda.
Not through prejudice.
But through evidence.