FSB's Magnificent Seven: New Links between Berlin and Istanbul Assassinations

• On 23 August 2019, Zelimkhan Khangoshvili, a Georgian asylum-seeker of Chechen origin, was assassinated on his way back from Friday mosque service in a park near Berlin’s Kleiner Tiergarten. The killer had been captured by German police after running away from the murder scene on a bicycle, and after two teenagers saw him dispose of his wig and clothes and silencer into the Spree river. He has been in custody since, and has claimed innocence.
  
• In our previous joint investigations with Der Spiegel and The Insider (Russia), we identified the killer – who traveled under the fake identity of Vadim Sokolov, 49 – as Vadim Krasikov, 54. We found that Krasikov had a prior criminal history that involved at least two contract killings: in Karelia in 2007, and in Moscow in 2013. For those murders he been wanted by Russian authorities on an Interpol Red Notice – until it was suddenly dropped in 2015.
  
• We ultimately uncovered that the assassination was planned and organized by Russia’s FSB, the state security agency. The preparation for the murder was supervised directly by senior members of a veteran foundation of former Spetsnaz Officers from the elite FSB Vympel unit. However, we were able to prove that FSB was directly involved in the planning and support of the operation, as we could geolocate the killer’s repeated presence at FSB Spetznaz training facilities in the months before he made his trip, under a government-issued cover identity, to Germany in August 2019.
• Ten months after the murder, on 18 June 2020 the German General Prosecution filed an official indictment against Vadim Krasikov. The indictment names the Russian government as the party that contracted Krasikov for the murder of Zelimkhan Khangoshvili. The indictment also names a potential accomplice to the murder, who is named as Roman D, a suspected cover name.

An investigation by Bellingcat, The Insider and Der Spiegel has confirmed the existence of a second Russian national who traveled from Russia to the European Union in the eve of the assassination, using the fake identity of Roman Davydov, born in 1981. Significant hallmarks of this cover identity overlap with the fake identity issued to Vadim Krasikov, implying that they were working as part of the same, or a closely-linked, government program.

Furthermore, based on passport number proximity search and intelligence data from Czechia cited in the German indictment, we were able to connect this person to a group of other Russian FSB-linked spies who in turn were connected to the murder of another Chechen national in Istanbul in 2015.

Our findings indicate that at least one, but more likely several more FSB operatives traveled to Germany to prepare and assist Khangoshvili’s assassination. These findings also strengthen the link of the Berlin murder to a previously reported “wanted list” of nineteen Soviet-born individuals, most of them of Chechen descent, which was shared by the FSB with German’s intelligence services in 2012.

“Roman Davydov”, photo from Slovak visa application.

Roman’s Holiday (or Roman who was built in a day)

On 29 July 2019, a travel agent holding a Russian travel passport in the name of Roman Davydov, born in St. Petersburg (then Leningrad) on 9 October 1981, showed up at the visa center of the Slovak General Consulate in St. Petersburg and requested a one-year multi-entry visa  for her client to the Schengen area. According to the client’s Russian visa application documents, he was a local native: he lived at Bogatirskiy Prospect 32, corpus 2 in St. Petersburg, and worked as a construction engineer at a local company. He was planning to visit Bratislava as a tourist, and had a booking for a flight to Vienna on the following day – 30 July, and a hotel booking for the mid-range Falkensteiner Hotel in downtown Bratislava where he would stay from 2 August onward. He was requesting a one-year, multi-entry visa, and he needed it urgently, as he was planning to fly the very next day.

In fact, none of this was true. The visa applicant in fact lived in Moscow under his real, different name. The exact residential address he had listed on the application did not exist – there is no corpus 2 at Bogatirskiy Prospect 32, and the people living at the only apartment number at this address matching his application address had never heard of him.

The man calling himself Roman Davydov was a digital newborn. A person with his name and birth date could not be found in thousands of leaked residential and passport databases of Russian residents consulted by Bellingcat. Roman Davydov had only just appeared in the Russian passport and tax database. In fact, the identity of Roman Davydov was created a mere eleven days prior to this visit to the Slovak consulate: his international passport was issued on 18 July 2019, in the Western Russian town of Bryansk. He was first registered in Russia’s tax registry on 23 July 2019 – at the age of 39. The letter from his employer which he had to submit to the consulate was from a company that had been in restructuring for several years prior, and had submitted zero-employee payroll tax files since 2016. Also, “Davydov” had no real plans to visit Slovakia.

Excerpt from open-source corporate registry, showing the company ZAO RUST, in reorganization, only had one employee as of beginning and end of 2019.

None of these data gaps were noticed by the Slovak consulate, and his multi-entry visa was issued – albeit with a 2 day delay, allowing him unrestricted travel rights to 45 counties in Europe, Latin America and Asia.

“Roman Davydov” was not the only person who, on that day, filed an application at an EU consulate in Russia seeking to travel under a fake identity. On that same day, 29 July 2019, a travel agent – from the same company, this time represening “Vadim Sokolov”, 49, walked into the French consulate in Moscow and requested a multi-entry Schengen visa for his client.  Like “Davydov”, “Sokolov” was also a digital newborn, with a travel passport issued in Bryansk on the same date ten days earlier.

The passports of “Davydov” and “Sokolov” were only 35 digits apart from one another, showing that these personas were manufactured at the same time. Both of them had been entered into the tax registry on the same date, on 23 July 2019. Even more, both had produced employment letters from the same St. Petersburg company: ZAO “RUST”, where they both worked as “construction engineers” (the CEO of this company initially told us he had never heard of Vadim Sokolov, and when confronted with the fact that both Sokolov and Davydov had submitted employment letters signed by him, he said “this is nonsense” and hung up).

“Vadim Sokolov”, despite, too, being a digital newborn working for an empty shell of a company, similarly received a multi-entry visa from French consulate. He would be arrested by German police three weeks later, just after he fatally shot Khangoshvili in Berlin. “Roman Davydov” is, to the best of our knowledge, currently back in Russia.

The Road Trip

“Roman Davydov”‘s role in preparing the Berlin murder is still unclear, yet his fake identity, the multiple documentary overlaps with “Sokolov”, and his prior link to a murder of another Chechen were sufficient for the German prosecutor to name him as a person of interest in Vadim Krasikov’s indictment. His true identity has not yet been uncovered.

Our investigation into border crossing records (based on data from a whistle-blower with access to Russia’s centralized border database) show that a person with this name and birthday crossed the Russian border only twice: once on 3 August 2019, when he crossed by car the Belarus – Polish border at the Bruzgi (Grodno) checkpoint, and again 4 days later when he crossed back from Poland into Belarus at the same place (there is no controlled border between Russia and Belarus). There is no information about his movements once he entered Poland, which is part of the Schengen area and has no hard borders with Germany. Assuming his destination had been Berlin, this would have been an 8-9 hour drive from the Belarus-Polish border. He would have thus have had not more than two-and-a-half days in Berlin – not long enough for reconnaissance and trailing of the target, but sufficient for delivering or procuring locally the equipment needed for the assassination, as well as the murder weapon. The killer had arrived from Warsaw to Berlin in the afternoon of 22 August, and the assassination took place just before noon the next day – not enough for Krasikov to source his tools on his own. He would have needed to obtain a bicycle. According to the indictment, a high-end e-scooter that is not sold in Germany had also been found parked along the killer’s escape route (a resident had observed it be deployed and locked in place a day before the murder). The assassination was carried out with a modified Glock 26, which has been traced to an Estonian owner who had reported it stolen.

There is no question that Krasikov had help in his task, the only question that remains is how much of this help “Davydov” had been responsible for.

The border crossing records included the license plate of the car “Davydov” drove. Using an open-source Telegram bot that provides car details and ownership data, we found that the car was a blue Infinity Q50 and belonged to a Russian car-leasing company. We contacted the company but received no response as to who had used the car in August 2019.

The Infiniti Case

The Infiniti Q50 used by “Roman Davydov”, photo from a traffic camera (December 2019)

Using publicly accessible data from traffic violations combined with leaked data from Moscow’s pervasive traffic surveillance systems, we were able to reconstruct key moments of the “Davydov”s car movements in the days before and after his trip. These times and locations allowed us to match them against known movements of Vadim Krasikov in the days before he left Russia on 17 August 2019, which we reconstructed based on his cell phone metadata.

The most frequent overlaps occur in the area of one of Krasikov’s known residences, near Osennaya Street. Several times during July 2019, the Infiniti car is captured near his apartment, where it stays for no longer half an hour before moving on. In many cases, Krasikov’s phone also moves away from his home at the same time, suggesting a pick-up along “Davydov”‘s way.

Notably, on the way back from the Belarus border on 8 August 2019, “Davydov”‘s car drives straight to Krasikov’s location, where it arrives at 6:05 pm. It moves on at 6:30. Krasikov’s phone is last geo-located to his home at 5:25pm when he receives a text message from an anonymous SMS gateway. Following this overlap, likely a pick-up, Krasikov’s phone is switched off for four full days, until 12 August 2019. The last spotted location for the Infiniti that evening is on the road towards Balashikha a town outside Moscow. Balashikha is the location of a FSB Spetznaz training facility where Krasikov’s telephone was geolocated for long periods of time during July and August, thus our working assumption is that “Davydov” drove him there for pre-mission training or organizing.

“Davydov”‘s car can be spotted moving between Moscow and Balashikha several times in the following few days. On 14 August – three days before the trip – Krasikov’s phone is again switched off for the day. On this date Davydov makes his last trips to and back from Balashikha. Below, further corroboration of this trip can be found through a speeding ticket (accessible through an open, state Russian database) issued at 4:44pm on 14 August 2019 to “Davydov”‘s Infiniti car in Balashikha.

Speeding record from the road from Balashikha to Moscow at 4:44 pm on 14 August.

Two Murders in Istanbul

While “Davydov”‘s exact role in the Berlin assassination is not yet determined, there is little doubt that he was involved in its planning, and that he met with Krasikov on many occasions. His car’s movements, while not as precise as mobile phone metadata, show that he visited areas where Vympel Foundation facilities and where Spetsnaz training grounds were located, in Balashikha and near the town of Orekhovo-Zuyevo on a regular basis. German investigators have also found evidence, cited in the indictment, that “Davydov”, along with another unnamed person, made a booking for a hotel in Chamonix, in the French Alps, starting on 26 August 2019 (thus, after the murder). Border crossing data show, however, that he did not travel after his return on 8 August, thus this trip may have been part of an aborted, unrelated operation.

An even more direct implication for his role in the assassination may come from another murder, four years earlier. On 1 November 2015, Abdulvakhid Edilgeriev, starting his car outside his apartment in an Istanbul suburb with his young niece sitting next to him, saw a white car speeding towards them and ramming his car from behind, locking him in. Edilgeriev pushed his niece to the floor just before one of the assassins shot through the car window – and missed. Edilgeriev was able to get out of his car and ran, but one of this chasers caught up with him and shot him in the back. He was found dead with five pistol shots into his body and knife wounds to his neck.

There were some similarities and some differences between the two targets. Like Khangoshvili, Edilgeriev had taken part in the Chechen-Russian wars, launching attacks on Russian Spetznaz forces while hidden in the Caucasus mountains. Like Khangoshvili, he had also spent some time in Ukraine, and had even fought against the Russian proxy army in Donbas. Like Khangoshvili, his name was also on a wanted list of nineteen ethnic Chechens whom the FSB had shared with German authorities in 2012. At least five names from that blacklist have been assassinated since, with Khangoshvili being the latest.

Unlike Khangoshvili, who was a Chechen nationalist, Edilgeriev had become a radicalized Islamist, a key figure in the Caucasus Emirate, and had even fought alongside Al-Nusra / Al-Qaeda forces in Syria.  He was also reported to be a site administrator of an Islamist website, Kavkaz Center, which is banned in Russia.

Whatever the Russian state’s motivation for Edilgeriev’s assassination may have been, it was not casually planned. Turkish police reported that at least three Russians had been involved in the murder. The white car had been rented 20 days before the assassination by a Russian citizen traveling under the name Aleksandr Nasyrov, who had arrived to Istanbul on 11 September 2015, and rented one other car – both of which were left parked in a parking lot in the western province of Yalova. He stayed alone in a hotel in Istanbul and left back for Russia on 16 September 2015.

Two other Russians – traveling as Aleksandr Smirnov and Yury Anisimov –  stayed in Yalova at the same time, 11-13 September 2015. From there they moved on to Istanbul and stayed in the tourist district in separate hotels, on 14 and 16 September 2015. Turkish police had found security cam footage showing that Nasyrov met with Smirnov and Anisimov close to their hotels.

None of these Russians were detained on the heels of the assassination two weeks later, and it is assumed they were only in Turkey to prepare for the mission, while other operatives made the hit on 1 November. However, the two Russians – Smirnov and Anisimov – returned to Istanbul half a year later, and were arrested shortly after their arrival, on 6 April 2016. Turkish police said they had returned to plot a further assassination. Following the detente in Russia-Turkey’s relationship in 2017, they were released to Russia in November 2017, under the ostensible pretext of an exchange for two Crimean Tatar leaders.

Using the names released by Turkish authorities, we were able to track down, in leaked air travel databases, the itinerary of the three Russians in 2014 and 2015. We discovered that all three had traveled under passports issued in a sequential batch of numbers. Their October 2015 trip to Turkey had not been their first one. All three had previously traveled to Istanbul in the early morning of 10 December 2014 – Smirnov and Anisimov on a joint flight, and Nasyrov on a different flight from a different Moscow airport. Later that day, a Uzbek cleric opposed to the government of Uzbekistan, Abdullah Bukhari, was shot in the back as he tried to enter the madrassah.

Security camera footage from the moment of the murder of Abdullah Bukhari

A 2016 BBC investigation reported that a Turkish special forces veteran had shared with the reporter in early 2014 that he had been approached by a middle-man who said he had been trained by the FSB and was looking for contract killers of a list of fifteen people residing in Turkey, which the FSB wanted dead. The alleged budget per person was $300,000, and Bukhari, the Uzbek, had been on the list along with Chechen names. While there is no direct link between Bukhari’s activities and Russian national interests, security experts have suggested that this murder may have been part of a “barter” arrangement between the Kremlin and Tashkent.

The Magnificent Seven

The names used by the three Russians for their Istanbul trips were fake.

Like “Sokolov” and “Davydov”, no people with these names and birthday data exist in Russia, according to hundreds of leaked historical databases we consulted. Due to sloppy practices from Russia’s security services, we used their passport numbers as “seed” for further research, and were able to find four more names of non-existent personas – all from the same passport batch of sequential digits. What is more, six of the seven had traveled, together or immediately following one another, to Prague in July and August 2015, with the earliest arrival on 20 July and the latest departure on 5 August 2015. Five of them overlapped on one day only – 23 July 2015.

Notably, one of the persons on this expanded list – and the first of the group who traveled to Prague on 20 July 2015 – was called Roman Nikolaev, born on 22 December 1980. This Roman had a different last name and birth date than “Roman Davydov”. However, his passport photo was the same as the one in “Davydov”‘s visa documents. Due to the partial nature of the leaked travel databases, we have not yet determined if Roman Nikolaev, a.k.a Davydov, traveled to Istanbul later that year.

At least one other person from the list of seven undercover operatives was also linked to Khangoshvili’s assassination. Krasikov’s phone records show that “Andrey Mitrakov”, born 1970, was one of the most frequent callers to Krasikov’s telephone number in the months before his trip to Berlin.

At least two of the members of the FSB’s seven fictitious personas traveled under their cover identity within Russia, as well – with trips taken to Crimea in 2014 and 2015. The passport numbers used for the cover identity of these two operatives is also from a sequential series – and it belongs to the same batch from which Col. Igor Egorov, a high-ranking member of the Vympel Spetsnaz team, traveled under the fake identity of “Igor Semenov”. Col. Egorov, who has been implicated in plotting the murder of a Chechen opposition figure living in Ukraine, is a frequent traveler to Germany, and was in Germany in July 2019, a month before the Kleiner Tiergarten murder. It is not known if Egorov himself played a role in the preparation for Khangoshvili’s assassination.

This passport sequence linkage between FSB’s Col. Egorov and members of the “magnificent seven”, at least two of whom had a direct linkage to the Berlin murder, provides yet another piece of evidence for the FSB’s connection to Khangovshvili’s assassination.

The Red Herrings

Yet another parallel begs to be drawn between the Berlin assassination and the Istanbul 2015 hit job.  In both cases, there appeared to be false leaks of information about the detained suspects, in each case – steering both investigators and the general public away from the Russian security services and closer to organized crime.  The Russian interest in such decception was self-evident, as political repercussions can be eliminated or minimized in case of crime-driven assassinations.

Soon after the arrest of “Aleksandr Smirnov” and ” Yury Anisimov” in April 2016, and in the wake of its briefly soured relations with Russia following the Russian fighter-jet downing, Turkey’s paraded the “Russian spies”  photographs in local media, while prosecutors sought a 37-year jail term for their crime.

“Smirnov” and “Anisimov”, screen grabs from security cameras given by Turkish prosecutors to the media

А Russian media outlet, Rosbalt, known for its excellent sources within the FSB, was quick to identify Aleksandr Smirnov as Valid Lurakhmaev, a notorious Chechen criminal wanted by several countries, including – technically until today – by Russia. Indeed, “Smirnov”‘s photograph bears a visible resemblance to Lurakhmaev’s photograph posted on the Interpol red notice list.

The narrative that the Istanbul assassin is a Chechen crime figure and not a Russian spy became the accepted truth, not only by global media but also by foreign governments, with France requesting Turkey for access to “Validol”, as Lurakhnaev was widely known, for interrogation in connection with the poison-plant murder of Russian emigre and whistle-blower Alexander Pereplichny in 2012.

However, our investigation has shown that Lurakhmaev and “Aleksandr Smirnov” are not the same person. In addition to the nine-year age difference between Lurakhmaev and “Smirnov” – too large for a credible “cover identity” – a facial comparison using Microsoft’s Azure face verification tool shows that they are different people.

A control comparison, made between “Smirnov”‘s image from this airport camera screen grab and another image of the same Russian made at the time of his exchange in 2017, proves that the mismatch conclusion was robust and was not the result of the particular angle of the airport photograph.

Coincidentally or not, following the arrest of “Vadim Sokolov” in Berlin, and our initial publication showing links to Russian security services, Bellingcat and other international media received an anonymous “tip” claiming insider knowledge that the assassin was a former low-level policeman who had been jailed over ten years ago on charges of assisting a contract killing. While Bellingcat and our partners did not publish this assertion – and was able to establish via similar facial comparison that the the Berlin killer is not the same person, the false lead – intentional or not – again led to publications misidentifying the Berlin killer.

Relevance of findings

The new findings are important in several aspects. First, as expected, they corroborate the involvement of more than one person in the assassination operation. In fact, if the Istanbul experience is an indication of a modus operandi, it could be expected that a team of at least 5 people, traveling on a staggered schedule, may have been involved in the planning. This staggered method would also be consistent with the modus operandi of assassination teams from Russia’s GRU.

Second, the findings confirm the direct link between the “kill team” and the FSB. While in earlier investigations we had estimated as implausible the hypothesis of non-involvement by the FSB, the use of the same passport series for confirmed, senior FSB officers such as Col. Igor Egorov, and members of the “Magnificent Seven” remove any remaining doubt.

The findings also point to a likely strategic leaking of false and misleading “tips” about the identity of captured undercover operatives, in order the deflect attention from the security services. International media operations are one destination of such targeted false leaks, but law enforcement officials are likely to also be targeted.

Last, our findings have important implications for the structural vulnerabilities of the European visa issuance system. Previously we have reported on the abuse by Russian secret services – as well as by organized crime – of the possibility to travel throughout Europe under fake identities due to the reliance on “official documents” issued by Russian companies or authorities, and the continued acceptance of non-biometric passports. However, for the first time this report identifies the use of two different fake identities by the same person: “Roman Davydov” and “Roman Nikolaev”, born on different dates. Both of these personas were able to obtain Schengen visas, despite the fact that, in theory at least, the biometric data obtained during visa applications should have made such incidents impossible.