World's Most Wanted Man Jan Marsalek Located in Belarus; Data Points to Russian Intel Links

It can safely be assumed that Jan Marsalek is currently one of the most hunted-for persons on earth. The company he oversaw operationally, Germany’s Wirecard, collapsed overnight last month after auditors brought attention to a nearly 2 billion Euro gaping hole in its balance sheet. The hole was the result of the recognition that cash of the same amount – which was thought to be sitting in third-party trustee bank accounts in the East Asia – a coding and processing hub for Wirecard – was in fact not there. The 40-year-old Austrian citizen Jan Marsalek, COO of Wirecard since 2010, was in charge of the company’s Asian operations.

On 18 June 2020 the management team – including Jan Marsalek was fired. He told his colleagues that he was going to the Philippines to chase and find the missing billions, in order to prove his innocence. Later that day he went missing as well. While airline bookings and immigration records showed he had made his way to Manila on the 23 June and left onward to China, an investigation by the Philippine’s authorities found that that the trip had been a red herring, and immigration records had been forged on his behalf. Since then, Jan Marsalek has been wanted by German and Austrian authorities on charges of fraud and embezzlement.

Bellingcat, in collaboration with its investigative partners Der Spiegel and the Insider, have now established the location to which Marsalek fled just hours after his sacking – the capital of the Belarus, Minsk. In addition, Russian immigration records and data kept by Russia’s FSB suggest that Russia’s security service had a long-standing interest in Marsalek, who used a number of different passports – including a third-country diplomatic passport – to visit Russia dozens of times in the last 15 years. At least on one occasion – in 2017 – Russia’s security services are likely to have had a lengthy interaction with Marsalek in Moscow.

What is known so far:

• On the 25th of June 2020 Germany’s fin-tech giant, Wirecard, filed for insolvency, after a $2 billion hole was uncovered in its balance sheets. The revelation led to the arrest and indictment of the company’s CEO Dr. Markus Braun on charges of false accounting and market manipulation. The downfall of Wirecard comes after an investigative series in The Financial Times questioning the company’s spectacular rise and pointing to accounting and business irregularities in its Asian operations. Wirecard’s second-in-command, the COO Jan Marsalek – in charge of its Asia presence – was nowhere to be found. An international warrant has been issued for his arrest, but as FT reported, reasons for avoiding arrest may go far beyond the accounting scandal.
• Jan Marsalek is now a person of interest to three western intelligence agencies, over suspicion of links to Russian intelligence.
• Since 2015, he has pursued projects in Libya – including investing in the Libya Cement Company, and has engaged with Russian advisors and European officials to discuss plans for ‘humanitarian reconstruction in Libya’ – seen by observers as a plan to establish a mercenary force to protect commercial interests in the war driven country. Marsalek’s adviser in the Libyan initiative was the Russian Andrey Chuprygin – a Russian Arab-world expert whom western intelligence services believe is a former GRU senior officer, maintaining close ties with the intelligence community.
  
• Marsalek collaborated with the Austrian-Russian Friendship Society. The organization received classified documents from Marsalek apparently obtained from Austria’s interior ministry and security service BVT. He also passed classified information and provided geopolitical advice to the country’s far-right populist party, the FPÖ.
  
• In 2017 Jan Marsalek also reportedly boasted in a private meeting about a trip he had made to the ruins of Palmyra, in Syria, as a guest of the Russian military shortly after its recapture from ISIS. In 2018, he also disclosed to business partners in London four highly sensitive, classified reports from the Organization for the Prohibition of Chemical Weapons in the wake of Skripals poisoning in Salisbury. He also claimed to have the full formula of Novichok, the military-grade poison that was used by GRU in the Skripals case.
  

To Russia With Love

According to immigration data reviewed by Bellingcat, Marsalek was a frequent visitor of Russia, with over 60 trips to the country in the last 10 years. His immigration dossier numbers 597 pages, much more than any foreigner’s file we have come across in over five years of investigations.

His initial trip was back in 2004, but after a six-year gap, he resumed visiting the country in 2010 when he joined the management board of Wirecard. His trips accelerated in 2014, when he traveled to Moscow 10 times, usually flying in and out within a day. The next year he traveled 7 times, again usually staying less than 24 hours in Moscow, with the exception of a one-week visit in February 2015 to Kazan, the capital of the Republic of Tatarstan.

2016 saw Marsalek’s trips to Russia surge, with a total of 16 flights. Unlike previous years when he used commercial flights, in 2016 and later he flew using chartered business jets. The destinations also diversified; with flights directly from various European and Asian capitals into St. Petersburg, Nizhny Novgorod and, again, Kazan. His longest trip in 2016 lasted 3 days, the shortest was a day-trip. One particular trip stands out for its party-like country-hopping nature: on 29 September 2016 Marsalek flew in from Munich to Moscow at 1:55 am, only to depart for Athens at 7:58 that same morning. The next day he flew back from Greece – this time into St. Petersburg, where he stayed only 5-and-half hours, before taking off back to Greece – but this time to the vacation island of Santorini. He changed three different private jets during this wind-whirl of a trip.

Marsalek’s 2016 trip schedule shows a near-monthly pattern of visits; usually on weekdays and typically very short.

Whatever kept bringing Marsalek to Russia in 2015 and 2016 must have caught up with him in 2017. After 4 trips in early in the year – as usual, each no longer than a day or two – Wirecard’s COO flew back from Munich to Moscow on 9 September 2017, but did not leave until a week later. In fact, he was not allowed to leave even when he attempted to: immigration records show that on the morning of 15 September, at 8:05 his attempt to leave the country using a private business jet was denied by FSB’s border service. It is not clear what caused the detention, but it appears that his initially booked jet had to be let go without Marsalek.

At 17:35 that afternoon, Marsalek did leave Russia after all, using a different private jet. This was the last time Wirecard’s boss would visit Russia. Or at least, the last time using his Austrian passport.

The Man with the Many Faces and Passports

Jan Marsalek’s Russian immigration dossier is the most unusual one we have reviewed, and not simply due to it sprawling over hundreds of pages. It also contains an unusual array of different passports – all tied to the same person, and to his visits to Russia.

Marsalek traveled to Russia on 6 different Austrian passports – not unusual given the stretch of time and the fact that Austria allows ownership of several passports, while disallowing dual citizenship. However, in addition to passports of his native country he appears to have flown in on other, less obvious identity documents too. Notably, all of his trips under these other documents have been purged from the border-crossing database – which is different than the migration dossier database.

Three passport photos from Marsalek’s Austrian passports

For instance, Marsalek’s migration file contains references to additional 3 passports – issued in his name by an unnamed country – the numbers of which do not appear in the border crossing database. The numbers are also inconsistent with the Austrian passport numbering conventions (they contain numbers only, while Austrian passport numbers begin with a letter).

More mysterious yet is his use of a diplomatic passport issued, again, by an unnamed state. This diplomatic passport – with number DA0000051 – is described in the migration file as a “diplomatic passport issued to a non-citizen”. Few countries – and no European state – issue diplomatic passports to non-citizens. In the few countries where this is practiced, such passports may be legally issued to that country’s honorary consuls, or they can be illegally sold. The numbering of this particular passport also implies a relatively small pool of diplomats.

Notably in a chat exchange with an ex-colleague several days after his disappearance, as reported by Handelsblatt, Marsalek made an opaque reference to possibly being an honorary consul. He has also been reported to have boasted about having “passports from multiple countries.”

One hard piece of evidence that the border crossing data for Marsalek is far from complete comes namely from the reference, in the migration file, to the diplomatic passport. The issuance date of this passport is listed as 20.12.2018, with a validity of five years. This “start” date is after any of the trips listed in the border registry.

A Person of Interest to FSB

A third database we consulted shows traces of a particular interest Russia’s main security agency, FSB, showed in Jan Marsalek movements. This is an internal FSB database used for tracking persons of interest, primarily for law enforcement purposes. It contains basic data such as car ownership, residential addresses, passport numbers and travel data.

Typically, any foreigner who travels to Russia ends up in this database, but simply with a listing of the trips to Russia – including origin and destination, arrival/departure times, flight and passport numbers.  In Marsalek’s case, this data is expanded to include a number of flights that have no bearing on Russia. In fact, beginning 2015, the FSB apparently monitored and collated into a searchable database all of Jan Marsalek’s international trips (minus his intra-EU trips which, plausibly, were either out of reach to FSB, or too many to keep track of).

The monitored trips included frequent flights to Singapore (one of Wirecard’s Asian hubs was in the city-state), Istanbul (possibly as a transit hub) and Dubai – another business operations hub for Wirecard.

Jan Marsalek’s known international trips, collated from the FSB and the border-crossing databases

The motivation behind FSB’s interest in Marsalek’s globe-trotting is unclear. It began in 2015, when his trips to Russia accelerated. This may suggest either a working relationship began then – and he was monitored; or that he was tracked as a potential recruit. In the latter scenario, his apparent detention at Moscow airport in September 2017 may have been a turning-point, during which he may have been blackmailed through compromising material, or incentivized, into collaboration.  A third explanation for the monitoring may be preexisting collaboration between him and a competing security agency – such as the GRU – the international activities of which the FSB may have been interested in monitoring.

Whatever the motivation, it is apparent that to the FSB, Marsalek was more than a regular business and casual visitor. We have previously seen global monitoring of foreigners in this database only in one other case – that of a financial backer of the UK Brexit referendum in 2016.

Notably, the FSB data stopped tracking Marsalek’s movements at the end of 2018.

“Belarus – Easy to Love”

On 18 June 2020, Jan Marsalek found out that he was “extraordinarily suspended from Wirecard’s management board on a revocable basis until 30 June 2020″. Four days later he would be irrevocably fired, and named an official suspect with an arrest warrant by the German federal police.

However, Marsalek didn’t wait to get arrested. Upon learning of his suspension, he vanished off the face of the earth, leaving a slew of false leads and clues as to whether he may be hiding. He bought airplane tickets and had someone in the Philippines falsify immigration records to mislead investigators he was in Asia. In various post-disappearance chats with friends and former colleagues, he alluded that he is in an East Asian time-zone, or that he is sipping cocktails on a sunny island. However, it was one answer to an unexpected question that led us to his actual destination – and his likely whereabouts today. In a chat with a former colleague, reported by Handelsblatt, he was asked, sympathetically, if he was in a “politically stable environment”. Marsalek laughed this question off, saying “do not worry, the same people have been in power for the last 25 years”.

Very few jurisdictions around the world can boast this degree of stability. (Russia is not one of them, as Vladimir Putin came to power in 2000, i.e. 5 years short of his description). And while many rushed to seek his traces in African, Latin America or Asian regimes with longevity, we remembered of a bastion of stability that is much closer to Jan Marsalek’s home. In Belarus – only an hour’s flight from Germany – the same president, Aleksander Lukashenka, has been in power for the last 25 years (in fact, turning 26 years in 2 days).

Armed with this hypothesis, we reviewed border crossing records for Belarus (technically Belarus and Russia have a common external border, thus feeding records into a combined database).  We found one entry for Jan Marsalek: he was registered as having entered Belarus via a private jet in the first minutes of 19 June 2020.  According to border records, he never left the country after that.

This particular border record does not list the flight number nor the origin of the arriving plane. It simply notes “arrival on a single-use private plane”. This left us uncertain as to how, and via what country, Marsalek would have been able to land in Belarus.

To find out, we inspected several commercial airport arrival and departure databases, including FlighRadar, Flighstats and FlightAware. One of the databases listed all planes – commercial and private/chartered – that arrived to Minsk Airport in the month of June. On the 18 June 2020, only one private jet had landed: at 19:10 hrs local time. This jet – with its identity blocked at the request of the operator – had arrived from Estonia’s capital Tallinn. Two hours after it landed in Minsk – and, it can be assumed, cleared immigration and customs – the mysterious jet flew on to the Belarus town of Vytebsk.

Using time-replay function in FlightRadar, we were able to trace back the flight that arrived that evening from Tallinn, and established that a plane with the same characteristics – an Embraer 650 Legacy private jet – had arrived to Tallinn – from Austria’s town of Klagenfurt – at 16:19 local time. The jet had left Klagenfurt at 13:16.

Unless he used a helicopter, Marsalek would likely not have been able to reach Klagenfurt in time for the flight from his office in Aschheim, a town near Munich, where he did show up in the morning to attend a shareholder’s meeting and find out that he is being suspended.

Depending on when he left his office, he might have been able to take a connecting flight from Munich via Frankfurt to Tallinn.  Half an hour after the Embraer had left to the Baltic city, a Lufthansa flight LH882 left Frankfurt to Tallinn. It landed at 16:55, 25 minutes after the private jet had landed.

Less than 15 minutes after LH882 landed, the private jet took off from Tallinn again, this time in the direction of Minsk. While we do not have the passenger list of LH882, it is plausible that Marsalek flew in on that flight, and may have been shuttled to the waiting private jet upon arrival.

Left, Embraer flight from Klagenfurt to Tallinn. Right, onward flight Tallinn to Minsk.

However, for this connection to be possible, Marsalek would have had to leave his office no later than 10:15 am, to make it in time to Munich airport.  Alternative ways to make the connection in Tallinn would have be a different private jet to Tallin and a change over to the Embraer there, or the use of an altogether different jet which was somehow invisible to commercial airport data aggregators.

We identified the company that operates the Embraer jet – a Vienna-based charter-jet leasing company. We contacted a telephone number left as a contact point for this particular airplane, and a person speaking English with an Eastern European accent told us that he was not aware of a Mr. Marsalek and advised us to contact the company’s sales department for further questions.

Given that immigration data for Jan Marsalek from Philippines had been fabricated, it would be a legitimate question if there a risk that the border-crossing data from Belarus and Russia might also be tampered with, to create a further false lead. While this is technically possible, FSB has complete control over the Russian border service, and thus over the centralized Russia-Belarus border database. Therefore, any manipulation of data would have to be done at the behest of, or at least with the consent of, the FSB. If this were to happen, this would indicate a direct collaboration between Jan Marsalek and the FSB – which would, ironically, arguably be an even more newsworthy story than locating Marsalek in Belarus.