the home of online investigations

You can support the work of Bellingcat by donating through the following link:

A Ferrari for a 13-Year-Old Boy: OSINT Methods in a Ukrainian Corruption Investigation

January 27, 2016

By Aric Toler

Translations: Русский

On January 23, the 112 Ukraine television channel aired an investigation into a former Ukrainian prosecutor who, among other things, reportedly purchased a Ferrari for his 13-year old son. This former prosecutor, Aleksandr Nikolayevich Bondarenko (Oleksandr Mikolayovich in Ukrainian), was appointed during the years of Viktor Yanukovych’s presidency in Ukraine, and was lustrated in late 2014. Bellingcat provided support to the investigators of 112 Ukraine, led by Julia Makarenko, in researching the lustrated ex-prosecutor via open source intelligence (OSINT). In conjunction with a wide-ranging use of open source research methods, 112 Ukraine used traditional investigative journalism to follow up leads. Much like a previous Bellingcat post on OSINT methods used by Aleksey Navalny’s FBK group, this post will explore the open source research techniques employed by Makarenko and her team at 112 Ukraine in their investigation of the assets of the seemingly corrupt ex-prosecutor and how this research can complement traditional investigative methods used in newsrooms across the world.

The subject

The subject for the investigation is Aleksandr Bondarenko and his assets. As seen on the Ukrainian Ministry of Justice’s lustration website, Bondarenko was subject to lustration in late 2014 and is described as an employee of the general prosecutor of Ukraine. His job duties included, among other things, combating corruption and crime in the transportation department of the general prosecutor’s office.

Lustration

Official declaration of lustration of Aleksandr Bondarenko from the Ukrainian government.

While Aleksandr Bondarenko himself does not maintain any detectable online presence, his actions did leave a footprint, along with the social media profiles of his family members.

The Ferrari

The investigation was triggered by an very obvious clue: a shiny, red Ferrari outside of the Monacco (Монако) restaurant in central Kyiv. The photograph was taken in October 2014 and provided by an anonymous tip to the television station, providing an opportunity to employ OSINT in conjunction with traditional investigative journalism.

The Ferrari

The Ferrari in question, parked outside of the Monacco restaurant in Kyiv

112 Ukraine used geolocation to confirm the location of the Ferrari in question. On Wikimapia, a reference photograph for Monacco provides sufficient details to match to the Ferrari photograph:

monacco ferrari_marked

Thus, the 112 Ukraine investigators were able to confirm that the Ferrari was indeed in Kyiv, at approximately 50.4562668, 30.5128017.

Red Ferraris are not a common sight in Kyiv, and some online research revealed some interesting information for the 112 Ukraine journalists. Another Ferrari with the exact same color scheme was photographed elsewhere in 2015 on the Auto Gespot site (archive), with the license plate ZAKHAR (ЗАХАР)–the name of Aleksandr Bondarenko’s 13-year old son who, according to the anonymous tip that spurred the investigation, received the Ferrari as a gift. The Ferrari evidently underwent a Mansory modification, making it even rarer and more identifiable on the streets of Kyiv.

The same Ferrari photographed in Kyiv in 2015, with Bondarenko's son's name on the license plate.

The same Ferrari photographed in Kyiv in 2015, with Bondarenko’s son’s name on the license plate.

ferrari_zakhar2

Further investigation reveals that a Ferrari with the same color scheme and Mansory modifications crashed in Kyiv in 2012. A few stories were written at the time about it, and a video surfaced on RuTube showing the aftermath of the damaged car:

Screenshot from a video showing a Ferrari with Mansori modifications crashed in Kyiv, 2012

Screenshot from a video showing a Ferrari with Mansory modifications crashed in Kyiv, 2012

While this open source research alone cannot confirm a link between the crashed 2012 Ferrari and the 2015 Bondarenko Ferrari, 112 Ukraine followed up by conferring with an automotive body expert, who examined the damages and repairs to determine that the Ferraris from 2012 and 2015 are indeed the same.

The Rolex and Maldives

112 Ukraine was able to obtain the 2013 financial declarations of Aleksandr Bondarenko, revealing that his official salary is about 300,000 UAH per year (approximately $37,500 before Euromaidan, $19,000 when Bondarenko was lustrated). While this is a quite respectable salary for a government official in Ukraine, it cannot explain the expensive lifestyle that his family maintained. Suspiciously, Bondarenko claimed that his family makes almost a million UAH per year (approximately $125,000 pre-Maidan, $63,000 during lustration), even though 112 Ukraine was not able to find any evidence that Bondarenko’s wife, Karina, held any employment, let alone would bringing home more than double Aleksandr’s declared income. Open source research revealed further information about the luxury goods disproportionate with the declared income of the Bondarenko family.

While Aleksnadr does not maintain an online presence, his wife Karina actively uses Odnoklassniki (OK), a popular Russian-language social network site. She has deleted her OK profile since the 112 Ukraine investigation aired, but archived copies still exist via Archive.is. Many of the photographs that she posted on her profile show her wearing luxury watches, allowing 112 Ukraine to match it against various luxury brands until a match was found. A match was found for one of these watches, revealing that it is a Rolex from the Cosmograph Daytona series.

112_watch

This open source research finding was confirmed by a timepiece expert, who was interviewed during the television program. He valued the watch, assuming it is not a counterfeit, to be at least $37,000–approximately the same as Aleksandr’s declared salary.

Karina also posted numerous vacation photographs on her OK page, spurring 112 Ukraine to geolocate the vacation destination, and consequently find out an average price for such a vacation. One image on the OK profile was particularly useful: a snapshot of a resort island from a small airplane, posted in October 2014.

maldives

The island has a few particular features that could be seen from a satellite map: at least two long docks on the ends of the island, including numerous branches on the one visible on the far right, a handful of buildings on the left part of the island, and another island towards the top of the frame. The Maldives is one of the most popular vacation destinations for Russians and Ukrainians, so it was a logical place to start searching. However, there are hundreds of islands throughout the atolls, with dozens of lavish resorts scattered throughout, leading to a tedious Google Earth search for the right slice of paradise resembling Karina’s picture. After a few days, the 112 Ukraine investigators found a matching island–Rangalifinolhu, located at 3.617005, 72.715106.

12-18-2015 8-20-37 PM

Comparison of Karina’s photo with Google Earth, from the same perspective.

With a confirmed geolocation in hand, 112 Ukraine was able to confer with a travel agent to determine a flight to the Maldives runs around $6,000 for two people–about a third of Aleksandr Bondarenko’s declared salary when he was lustrated.

The house

Lastly, open source research led 112 Ukraine to the Bondarenko’s most expensive asset: a large house with somewhere under a half-acre of land. Looking through Karina Bondarenko’s photographs on Odnoklassniki, it becomes clear that the family has a house somewhere in a suburban residential development, judging by the modern design of the house, the spacious property, and the neighboring house’s similar architectural style.

Photograph on Karina Bondarenko's Odnoklassniki account, showing the main house (right) and a smaller structure behind her, along with a distinctive fence.

Photograph on Karina Bondarenko’s Odnoklassniki account, showing the main house (right) and a smaller structure behind her, along with a distinctive fence.

112 Ukraine accessed the public directory of property ownership in Ukraine (semi-open source, as full access is only available by providing identifying information as a Ukrainian citizen) to search listings for Aleksandr Bondarenko. This search revealed that Bondarenko became the owner of about 0.16 hectares (0.4 acres) of land in the Kyiv suburb of Vishinka in September 2015. However, there is no exact address provided.

Public listing of Bondarenko's ownership of about 0.16 hectares in a Kyiv suburb.

Public listing of Bondarenko’s ownership of about 0.16 hectares in a Kyiv suburb.

After knowing the layout of the property and the orientation of the paths, trees, fence, and structures from Karina Bondarenko’s photographs, it was now a matter of geolocating the house through brute force, just like finding the correct island in the Maldives. Eventually, 112 Ukraine managed to find what seemed to be the same property as seen in the social media photographs, located at 50.296711, 30.667546. The journalists at 112 Ukraine visited this location, flew a drone over the house, and confirmed that it is indeed the same as the one seen in Karina’s photographs. The security guards at the house were not receptive to the journalists’ arrival, and denied that Bondarenko owned the property.
112_drone

Conclusions

This investigation from 112 Ukraine (with assistance from Bellingcat) exemplifies how open source research and verification can provide leads for on-the-ground investigative journalism. Their journalists used geolocation, public directory searches, message board posts, social media, and other open source resources to complement their traditional journalistic methodology of knocking on doors, conducting interviews, and working off of anonymous tips. In sum, they were able to discover, locate, and then calculate the wealth currently held by the lustrated ex-prosecutor Aleksandr Bondarenko. He owns numerous vehicles outside of the Ferrari, including a 2013 F-Type Jaguar, a 2008 BMW 740i, and a Land Cruiser driven by Bondarenko suspiciously registered to his mother-in-law. As reflected in both the open source evidence and investigative research, Bondarenko’s vehicles, property, and luxury goods far are disproportionate to his and his family’s declared income.

Aric Toler

Aric Toler started volunteering for Bellingcat in 2014 and has been on staff since 2015. He currently heads up Bellingcat's training efforts and its Eastern Europe/Eurasia research.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

25 Comments

  1. Mad Dog

    Serving the people, keeping their interests at heart by showing them what they should aim for, fondly caring for his precious son and his lovely wife, a true patriot, loving father and husband. So, where’s the problem….eh?

    Reply
  2. stranger

    Indeed, a great example what people can accomplish if they serve their country and follow their bosses. They show the aim and example for others. When bosses change a lustration is needed. Lustration is very important to provide social elevators and give the others a hope to achieve the same.

    Reply
    • John Zenwirt

      “Lustration is the process of making something clear or pure, usually by means of a propitiatory offering. It is also the purge of government officials once affiliated with the Communist system in Central and Eastern Europe.”

      Wiki…

      Reply
  3. stranger

    And while all the world is touched by the particular examples of implacable fight against corruption, where the corruption inevitably wins, but people change. The oldest Avia Design Bureau, the corporation Antonov is closed and dismantled into pieces joined the defence industry. Antonov was the famous bureau designed and produced in collaboration with Russia the largest cargo plane in the world An-255 Mria. While all relations with Russia are being torn, the hi tech industries are doomed to shrink if not close. With the free flow of consumer goods from EU w/o customs protection, the only way to support international trade ballance would be the agriculture. But even if the standards of the agro produce are increased up to EU levels, EU is still not happy to remove their limits and still keeps very strict quotas. IMF loans may help maybe for a couple of years, then IMF may be forgiven it’s loans. That is almost as sad as Russian ecomonic prospective. May be look for oil, or sell out property stolen by Yanukovich? I’ve heard he had a golden bread loaf and golden toilet, would it be enough? Somebody tell that it is not true, please.

    Reply
  4. stranger

    They cleared the government from the people worked during Yanukovich. Poroshenko himself worked in Yanukovich government as a minister, but he was brought out of the lustration law, by the requirement to work at least one year to be eligible to lustration. The cleaning and fresh people would be good. But, firstly behind attempts to solve political aims, it didn’t reach all corrupted officials, and secondly over time the new people would became even more corrupted. Saakhashvily has been constantly talking about corruption, Bayden blamed in corruption. Nothing changed. Was it worth to break up? Good luck of course.

    Reply
  5. John Zenwirt

    Stranger,why would it be so great if all Ukraine was somehow part of Russia…? Not full annexation, but something Putin wants, like being part of Putin’s Eurasian empire…

    B/c corruption in Russia is terrible, on an international par with Nigeria’s corruption…

    So, how do you get rid of corruption, in joining a very corrupt Russian system of operating…?

    Reply
    • stranger

      The trade turnover between Russia and Ukraine at the maximum was 50bil USD in 2011, now it’s dropped 3 times down to 6bil for the first half of 2015 (like 12-15 per year).
      http://www.ved.gov.ru/exportcountries/ua/ua_ru_relations/ua_ru_trade/
      The structure of export from Ukraine to Russia was mostly machines and equipment 32%, produce from metals 22%, chemistry produce 13% – high processing level goods. The industries tightly integrated from soviet times were air, space, rocket engines, machinery, chemistry, military, nuclear power, science. Usually too obsolete and incompatible to sell that to EU, but quite compatible and demanded in exUSSR.
      I believe EU proposed an association (a trade union, not even close to joining EU) to Ukraine, just after the alternative trade union between Russia, Belarus, Kazakhstan and supposedly Ukraine was announced. The text of EU association was almost not discussed publically and hardly many people even understand what exactly was proposed under the label of ‘euro-integration’. Particularly there were strict quotas for agriculture there.
      Putin said if the customs’ borders are opened between Ukraine and EU, Russia would need to close borders with Ukraine to avoid reexport from EU, he also said EU didn’t invite Russia to this discussion.
      Yanukovich wanted to sit at the two chairs and until the very last moment hesitated and didn’t decide would he go here or there. As a result at the very last moment he and his government postponed the highly popular, if not populistic, prepared for a long time in mass media, association with EU. At the very last moment he also received a 3bil USD loan from Putin as a first trench. The new Ukrainian government calls it a ‘bribery’ to Yanukoivich and that’s why is not going to return. IMF closed eyes on that actually Ukrainian default and changed it’s policies to be able to credit defaulted countries.
      That caused Maydan, then annexation of Crimea and then already deliberate cutting everything off from the Ukraine side as ‘sanctions’ and ‘don’t support an aggressor’ and from Russian side as the response to the open customs with EU and ‘contra sanctions’ etc.
      The question now is what Ukraine is going to propose EU to support the trade balance and keep their currency from devaluation. The similar processes in Baltic countries led to closing of all tech industries, mass emigration to more wealthy north European countries, etc.
      That’s why the association was controversial, and needed an open discussion, but not a revolution. Saying abstractly that Ukraine wants to leave totalitaristic Russia and go to free Europe, in practice may turn out to be not so idealistic and not so beneficial financially. May be in decades, provided the Ukraine hasn’t lost the course.
      Corruption was a problem of Yanukovich, I’m sure is still a biggest problem in Ukraine, as well as it exists in Russia. Compared to that tectonic changes it is not the greatest problem, perhaps, at least a different problem.
      I may be wrong, please verify.

      Reply
  6. John Zenwirt

    NATO should get Western Ukraine to join us in our full military systems.

    The Donbass, we don’t want this dis-functional part of something…the Russians can have the Donbass, we’ll just cut a deal w/uSSr…

    Reply
  7. Mad Dog

    Corruption is very hard to root out, but sadly, Russia just continues on as before. Ukraine has a good chance to get past that era and with some pretty smart people, smart enough to sell some good stuff to the Russkies, there is a chance they can do well in the EU. Too early to tell, but the sooner the better. Russia just corrupts everything it touches. Ukraine has a chance to bring its agro sector into line with EU standards, similar to what can be done in the aero industry. In a way, the break away portions can have all of that industry since it is mostly worn vestiges of Soviet policy.

    Reply
    • stranger

      Ukrainians are talented people as well as Russians : ) and east Ukrainian regions have been the areas where the science and high tech industries are concentrated. A global shift to EU would mean the reconstruction of all industries. The shift to the Agro sector would probably lead to the death of all tech. And EU doesn’t want a competition in this area, if I’m right to understand, their own agro sector is subsidized in EU, and strict quotas exist.

      Reply
  8. Vasily

    “While this open source research alone cannot confirm a link between the crashed 2012 Ferrari and the 2015 Bondarenko Ferrari, 112 Ukraine followed up by conferring with an automotive body expert, who examined the damages and repairs to determine that the Ferraris from 2012 and 2015 are indeed the same.”

    It’s impossible to say that without physical evidence. Can you clarify how “expert” was able to make such conclusion ? AFAIK only VIN and other serial numbers can guarantee that the car is the same.

    Glad to see that OSINT works out well. Corruption must be eliminated.
    Well done, guys!

    Reply
    • Randy Dread

      yeah that’s right, i used to work in the car industry.

      you need VIN’s to confirm it’s the same vehicle because VIN’s are on the vehicle chassis and are very hard to fake.

      anything else is bollocks and nonsense. but typical of this site.

      Reply
      • Aric Toler

        Read/watch the original 112 report — they did confirm it. And you spend a ton of time on this site for being so dismissive of it.

        Reply
        • stranger

          Excuse me, but I’ve read the 112ua report (in Russian) and watched their video (I don’t understand everything in Ukrainian, but it’s more or less clear). They never said anything on VIN, registration details or specialists who worked on this particular car. They invited an anonymous ‘expert’ who said literally it was a Mansory tuning and a very rare car (only 2 for the whole Ukraine). They assumed that it was the same car crashed earlier. The picture of the crashed car looked like Mansory indeed, but the car in question did not, it had a different front bumper. Based on that they concluded that the car was restored by ‘individual project’. They didn’t assume it was just a different car.
          May be I missed it, where did they say they checked the car registration info?

          Reply
        • stranger

          But regardless of the accident (I don’t even understand how it is logically related to this story, just to distract attention maybe), they decided that the car belongs to the son of the former Ukrainian official (a prosecutor) based only on the following ‘evidences’:
          – somebody on the internet anonymously commented under the picture of a similar car, that it was presented to a son of an official on a birthday party and the guy at the back where one can hardly see the face, looks like the official. There is no original web site, no cashed version, just a screenshot shown in the video.
          – the official’s wife placed her picture on the social media with the flag of ferrary at a pile of 4 tires next to a restaurant. They said it was a ferrary-theme birthday party and assumed the ferrary was granted there.
          – there was the other picture of ferrary with the same specific front bumper and the registration plate ‘Zakhar’ spotted at a different place, different time. They said it belongs to the official’s son, because his name is also ‘Zakhar’.
          That is it. There were no any court and trial. No, I quite believe he was corrupted, just would not associate the corruption only with Yanukovich, corruption is more persistent decease.

          Reply
  9. Mad Dog

    Really? This kind of proof is done all the time by police forces around the world, especially in hit and run cases. No one knows the VIN of the culprit, yet proof of the act is found by using the same techniques. Randy at his discrediting best and now we know he is an automotive expert among other things. Bullocks is basically the general concept behind most of Randy’s postings here.

    Reply
    • Vasily

      Cars have plates that allows you to identify car easily. It’s enough to know that, because using the plate on another car is illegal in any country IMHO. Police usually find witnesse(s), video and sometimes they do expertise to confirm that the car would receive such damage in the accident. At least, in hit and run cases you don’t need to find car itself. You have to find driver. What i’m asking is “What technique was used ?”

      Quote:
      “While this open source research alone cannot confirm a link between the crashed 2012 Ferrari and the 2015 Bondarenko”

      Conclusion. You can’t identify car by photo.

      “112 Ukraine followed up by conferring with an automotive body expert, who examined the damages and repairs to determine that the Ferraris from 2012 and 2015 are indeed the same.”

      Did he see the car itself ?
      If not, what did make him to make such conclusion ? Did he see some parts that are looking newer than the others ?
      If yes, could we receive more detailed explanations what has been found and how ?

      Reply
      • Aric Toler

        Vasily,

        They followed up with registration details and conferred with people from repair shops who worked on the car itself. There are additional details in the actual 112 video report (linked at the beginning of the report).

        Reply
        • Vasily

          Thanks a lot! Original source has more details. I wonder why bellingcat didn’t mention that Zahar’s car has special front bumper design..

          Reply
          • Aric Toler

            Matter of space, mostly. Was just recapping the investigation and didn’t include every detail. But good eye, that is a nice detail.

Leave a Reply

  • (will not be published)

You can support the work of Bellingcat by donating through the following link:

TRUST IN JOURNALISM - IMPRESS