On September 13, 2018, I joined my Bellingcat colleagues on Slack to watch an interview that would kickstart one of our most extraordinary and bizarre investigations. Shortly after being identified as the two key suspects in the poisoning of the former Russian spy Sergei Skripal in Salisbury, the two Russians identified by British authorities were now on RT, speaking to its editor-in-chief Margarita Simonyan in a world exclusive interview.
The interview and subsequent investigations would ultimately, two years later, lead to the unravelling of the poisoning of Russian opposition figure Alexei Navalny by those with links to the Salisbury suspects.
The pair, who had travelled under the names ‘Alexander Petrov’ and ‘Ruslan Boshirov’, shared their tale with Simonyan. They were nothing more than innocent sports-nutrition salesmen, who had travelled to Salisbury to visit the cathedral, famous for, as they put it, its 123-metre spire.
The mood in the Bellingcat Slack could be described as somewhat cynical. Launched by myself in 2014, Bellingcat has become known for using online open source investigation to investigate a range of topics, from the downing of Malaysian Airlines Flight 17 in Eastern Ukraine, to investigations into war crimes in Syria. This had frequently exposed us to the lies, propaganda and disinformation presented by the Russian state and its media proxies, often targeting myself and Bellingcat as much as the topics we investigated, and this interview seemed no different.
It was not only the ridiculous story that raised our suspicions, but the fact we had already begun our own investigation into the background of the two Russian nationals. Even as they were telling their tale, our team had acquired documents that indicated that these men were in fact working for Russian intelligence organisations.
Details released by the UK authorities, along with information on the suspects’ flights back and forth from the UK around the time of the assassination attempt, allowed us to start digging into their identities. A day after the RT interview, we published our first investigation, using information gathered from a variety of unusual sources. In the past, Bellingcat had almost exclusively used online open source evidence – any information you can find freely online, from social media posts to satellite imagery on services such as Google Earth.
We discovered barely any trace of ‘Alexander Petrov’ and ‘Ruslan Boshirov’ anywhere online prior to their naming by British authorities. No details of the sports-nutrition company they worked for, no social media activity, no news articles, not even a stray photograph tagged by a friend or family member with their identity. They were, in effect, digital ghosts.
Prior to the RT interview, the Russian news site Fontanka reported that leaked passport data for Petrov and Boshirov showed their passport numbers were only three digits apart, an extremely unlikely possibility for two sports-nutrition salesmen. Their odd passport numbers and ghostly presence online seemed to indicate these two individuals were more than just humble salesmen with a passion for cathedrals.
Given the lack of open source information about the suspects we debated using the “nuclear option”, Russia’s vibrant black market for data. Russia, with its love of collecting data on its citizens and rampant corruption, has inadvertently become one of the most open societies in the world, with all kinds of data – from detailed phone records to passport registration documents – available for purchase through online data brokers. This is not something “cyber-experts” need to discover on obscure dark web sites, but are freely sold on Russian internet forums. Along with that data, masses of leaked Russian databases can be found from online and offline sources, including car registration data, house registrations, flight records, and much more.
Our lead investigator, Christo Grozev, has collected many of these leaked databases over the years, and those indicated that ‘Alexander Petrov’ and ‘Ruslan Boshirov’ had appeared on those databases out of nowhere, as if they were born full-grown adults. Using an online broker, we acquired passport registration documents for the two suspects, which revealed a number of oddities. Details of previous passports and identity documents were absent, something that was extremely unusual. The document was stamped with “Do not provide any information”, along with a phone number belonging to a telephone exchange with “zone of operation: Ministry of Defense of the Russian Federation”.
We also examined the same documents for the two passport numbers that were between the numbers of ‘Alexander Petrov’ and ‘Ruslan Boshirov’, which revealed the same oddities. It appears that passports had been issued in batches, all with these same unusual features.
This was only the beginning of the investigation. By October 2018, less than a month after the RT interview, we had revealed that ‘Alexander Petrov’ and ‘Ruslan Boshirov’ were Russian operatives Alexander Yevgeniyevich Mishkin and colonel Anatoliy Chepiga, both of whom worked for the military intelligence service GRU. Masses of information leaking from Russia had allowed us to piece together their real identities, and to identify them as recipients of the Hero of Russia award, the country’s highest honour, presented personally by president Vladimir Putin.
By examining phone records we were able to uncover a third individual, Denis Sergeev, as being involved with the Skripal assassination plot. Sergeev was a high ranking GRU officer who we established from travel records and his own detailed phone records, travelled to London around the time of the assassination attempt. We also found that he was involved in an earlier assassination plot in Bulgaria with another GRU team, again using a nerve agent.
As our team continued to investigate we uncovered more details of not only these plots, but the source of the nerve agents used in the assassination attempts. By late 2020, through the analysis of phone records and other data, we had discovered the source of the nerve agent used in these attacks. Russia’s Novichok program, supposedly shut down when the country joined the Chemical Weapons Convention, had in fact been secretly moved to other locations, with members of the original program moving together to these new sites. One of these sites claimed to be working on sports-nutrition, when in fact it was staffed with experts on the development and deployment of nerve agents. Perhaps this is the sort of sports-nutrition Mishkin and Chepiga referred to in their interview with RT.
After two years of investigation we thought we had exhausted the possibilities of exposing more Russian nerve agent based assassinations. The poisoning of Alexei Navalny in August 2020 would lead us to discover that it wasn’t only the GRU using Russia’s secret nerve agent program in assassinations.
Using the same techniques and sources, we were able to establish that a team of Russian intelligence operatives from the FSB had followed Navalny on over 30 trips since 2017, one of which was the trip where he fell ill after being exposed to Novichok. The team had been in contact with the same secret nerve agent labs that had been working with the GRU, and we now realised this wasn’t just about targeting opponents abroad, but those at home as well.
A week later, Navalny published a lengthy call with one of the team who attempted to assassinate him. Navalny posed as the assistant to a senior Russian government official, fooling the FSB team member into giving a full confession, and providing details such as the precise location the Novichok was applied – inside the inner seam of Navalny’s underpants.
Since then, Navalny has returned to Russia, where he was immediately arrested. Protests followed, as did our continued investigations into Russia’s secret nerve agent assassination program. We discovered that the FSB team involved with the Navalny assassination plot was doing more than just following Navalny. We identified three cases where the travels of the FSB team overlapped with the unusual deaths of three individuals, and in the future it seems certain we’ll discover more assassination attempts by this FSB kill squad.
Eliot Higgins is the founder ofBellingcatand author ofWe Are Bellingcat
This article was originally published by WIRED UK
