Skripal Suspects Confirmed as GRU Operatives: Prior European Operations Disclosed

In the previous part of a joint investigation, Bellingcat and The Insider – Russia established that:

• Alexander Petrov – a fake cover persona for a yet unidentified Russian individual – is not a civilian but linked to one of Russia’s security services. This assessment was based on an exhaustive analysis of “Petrov” passport dossier as obtained from the Russian central passport database.
• Petrov and Boshirov made last-minute travel plans to fly to the United Kingdom, which – coupled with the double-booking of return flights on two consecutive dates – makes the “tourism” explanation implausible.
• Petrov and Boshirov travelled on international passports that differed by 3 consecutive digits, making it implausible that they were civilians who obtained their passports through the regular, entropic passport application process available to Russian citizens.

Since the publication of the first part of this investigation, other media have followed suit with obtaining access to, and disclosing the passport file of “Ruslan Boshirov” – the second suspect in the Skripals poisoning. The leaked passport file extracts similarly displayed characteristics atypical of a civilian person’ passport. Bellingcat can confirm the authenticity of the leaked passport file of “Boshirov”, and that it contains all three markings that helped identify “Petrov” as a security-service asset: “Top Secret” annotations, a blank biographical page referring to a secret attached letter, a “do not provide information” stamp, and issuing authority unit 770001, exclusively used for state VIPs and intelligence officers. In addition, “Boshirov” also has no recorded history prior to the issuance of his domestic ID passport in 2010 (2009 in “Petrov”’s case)

GRU Officers

Bellingcat and the Insider can confirm definitively that both “Alexander Petrov” and “Ruslan Boshirov” are active GRU officers. This conclusion is based both on objective data and on discussions with confidential Russian sources familiar with the identity of at least one of the two persons.

A Numbers Game

As we wrote in the first part of this investigation. “Alexander Petrov”’s passport file contained a stamp with the marking “Do not provide data”, followed by a cryptic number. The same stamp – and the same number – appeared in “Boshirov”’s dossier.

Following the publication of part 1, Novaya Gazeta hypothesized that the number sequence may be a telephone number that belongs – based on comparing number pattern – to the Russian Ministry of Defense. In addition, at least two reporters were able to call that number and speak to someone confirming this is a Ministry of Defense line.

Bellingcat and the Insider have obtained documents proving that the number on the suspects’ stamps indeed is identical to a telephone number that belongs to the Ministry of Defense, and is located at Khoroshevskoe Chausse – where the Headquarters of the GRU is based.

In a centralized database called “Unified State Telephone Directory of the Moscow Region”, dated 2012, the telephone number from the dossier stamps – 1957966, preceded by the Moscow prefix 495 – is found to belong to a telephone exchange with “zone of operation: Ministry of Defense of the Russian Federation”

Additionally,  many listed telephone numbers in the Moscow telephone database that start with 1957*** have addresses located at Khoroshevskoe Chausse, such as the Ministry of Defense-owned magazine “Foreign Military Review”. The only military unit at or near Khoroshevskoe Chausse is the headquarters of the GRU.

However, it’s two other numbers that provide the most corroborative link between the two Skripal suspects and the GRU.  It’s their international passport numbers.

As discussed in the previous installment, the two suspects’ international-travel passports were not recorded in their passport files – which is atypical for the Russian passport dossier system. This suggests the passports were issued by a special agency that does not report to the centralized registrar of government-issued ID’s, commonly known in Russia as the “FMS database”.  Such a “disconnect” would be logical if this agency issues covert international passports under cover identities.

A “special issuing agency” would explain also the proximity of the passport numbers between the two suspects – only 3 intervening digits (as one would assume that Russian, internationally active secret-service agents are a finite, relatively small number).

Bellingcat and the Insider have previously investigated and reported on a different GRU officer who also traveled under a cover persona and passport. This was the case of Col. Eduard Shishmakov, a former Russian Military Attaché in Warsaw expelled by Poland in 2014 for espionage. Col. Shishmakov, using an undercover (albeit not very creative) persona and passport in the name of Eduard Shirokov, travelled to Serbia in October 2016 to supervise – as alleged by the Montenegro special prosecutor – a failed coup against the pro-Western government in Podgorica. In a previous report, the Insider identified that Col. Shirokov wired funds to a co-conspirator in Serbia via Western Union, using the address of the GRU headquarters as the “Sender” address.

Bellingcat compared the passport number on Col. Shishmakov’s cover-identity passport, with the numbers of the (cover-identity) passports of “Petrov” and “Boshirov”. The numbers were from the same batch, with only 26 intervening passport numbers between “Petrov”’s (654341297), and “Shirokov”’s (654341323) number. “Shirokov”’s passport was issued in August 2016, implying that Petrov’s and Boshirov’s passports were issued by the same special authority earlier that year. Indeed, as we will see in their international itinerary below, they start travelling in early April 2016, suggesting that only 26 passports were issued by this special authority between April and August 2016.

There can be little doubt that both Shishmakov/Shirokov, and “Petrov”/”Boshirov” acquired their cover passports under the same, restricted procedure – and in the same batch of sequence numbers – available to secret service officers. As Shishmakov’s link to GRU has been established incontrovertibly before, it is unlikely that “Petrov” and “Boshirov” are assets of a different Russian intelligence service, especially in light of the MoD telephone numbers marked on their passport dossiers.

GRU TOURS

Bellingcat and the Insider have obtained “Petrov”‘s and “Boshirov”s border crossing data for a number of countries in Europe and Asia, for the period of validity of their international passports (mid-2016 through today). Their globe-trotting, unpredictably meandering itinerary is at times reminiscent of characters out of Mission Impossible, yet a focus on the countries of Western Europe is clearly visible.

The two operatives’ international globe-hopping on their newly issued passport start on April 8th 2016, when “Petrov” (or Petrov and Boshirov, as our investigation tracked only Petrov’s passport data) drives to Minsk, the capital of Belarus, to fly out from there to Amsterdam. He arrives in the Netherlands two days after the hotly disputed referendum on Ukraine’s EU accession, and flies back to Moscow 10 days later.

The second trip Petrov takes up is perplexing.  On July 11^th 2016, he crosses the border from Russia into Kazakhstan by bus, and reports to Kazakh border authorities “Beijing” as his final destination. It is uncertain as to how he planned to reach the capital of China, given the more than 5000 km between the border-crossing point and Beijing. It is possible that he gave that destination as a decoy, or that he planned to ride to Astana and then take a plane to China. Whatever his plans were, we lose track of him for the next 15 days, when he shows up again on a flight back to Moscow – from Israel’s Tel-Aviv.

Two months later, Petrov takes a trip to Amsterdam, and from there flies to London – this appears to be his – or their – first trip to the United Kingdom, where less than two years later they will be suspected of smearing Novichok on the door handle of a former colleague. It is not certain how much time he spent in the UK, but the total Netherlands-UK trip lasted just under a week

Petrov’s next trip is again to Amsterdam – two months after returning from London. This time he stays in Europe 12 days, and returns to Moscow on a flight from Paris at the end of November.

Petrov’s next trip is on February 28^th 2017, and it is – once again – to the United Kingdom. He stays there for 6 days, and returns, sinisterly, on March 4^th – the same day they will poison Sergey Skripal and his daughter a year later.

Between September 2017 and February 2018, Petrov makes five trips to France and Switzerland, usually landing in Paris and returning from Geneva. The last trip is the longest – he spends two weeks in Europe, between January 23 and February 6^th, and flies into – and back from – Geneva.

The next trip is their last to Europe – on March 2nd 2018 they both land at Gatwick, having purchased their tickets the previous evening – on the day before Sergey Skripal’s daughter would arrive in London.

Netherlands Arrests?

A source in a Western European law-enforcement agency informed Bellingcat that Petrov and Boshirov were arrested on the territory of the Netherlands. No information was provided as to the time and context of such arrests. European media have previously reported arrests and deportation of two unidentified Russian spies on Dutch soil; leaked police information linked the arrests with attempts by the two to smuggle hacking equipment to Switzerland, with the goal to infiltrate the Spiez laboratory.  The Spiez lab worked on investigating the chemical attacks in Syria, and later on determining the poisoning agent in the Skripal case.

Even though the media outlets that broke this story reported that the incident took place in the spring of 2018, they acknowledged that the exact time was unknown. Bellingcat and the Insider will continue to investigate whether the hypothetical arrest of “Petrov” and “Boshirov” on Dutch soil did take place as reported, and if so, whether such arrest was linked to the reported arrests of two spies in the Netherlands.