the home of online investigations

You can support the work of Bellingcat by donating through the following link:

Skripal Suspects Confirmed as GRU Operatives: Prior European Operations Disclosed

September 20, 2018

By Bellingcat Investigation Team

Translations: Русский

In the previous part of a joint investigation, Bellingcat and The Insider – Russia established that:

  • Alexander Petrov – a fake cover persona for a yet unidentified Russian individual – is not a civilian but linked to one of Russia’s security services. This assessment was based on an exhaustive analysis of “Petrov” passport dossier as obtained from the Russian central passport database.
  • Petrov and Boshirov made last-minute travel plans to fly to the United Kingdom, which – coupled with the double-booking of return flights on two consecutive dates – makes the “tourism” explanation implausible.
  • Petrov and Boshirov travelled on international passports that differed by 3 consecutive digits, making it implausible that they were civilians who obtained their passports through the regular, entropic passport application process available to Russian citizens.

Since the publication of the first part of this investigation, other media have followed suit with obtaining access to, and disclosing the passport file of “Ruslan Boshirov” – the second suspect in the Skripals poisoning. The leaked passport file extracts similarly displayed characteristics atypical of a civilian person’ passport. Bellingcat can confirm the authenticity of the leaked passport file of “Boshirov”, and that it contains all three markings that helped identify “Petrov” as a security-service asset: “Top Secret” annotations, a blank biographical page referring to a secret attached letter, a “do not provide information” stamp, and issuing authority unit 770001, exclusively used for state VIPs and intelligence officers. In addition, “Boshirov” also has no recorded history prior to the issuance of his domestic ID passport in 2010 (2009 in “Petrov”’s case)

 

GRU Officers

Bellingcat and the Insider can confirm definitively that both “Alexander Petrov” and “Ruslan Boshirov” are active GRU officers. This conclusion is based both on objective data and on discussions with confidential Russian sources familiar with the identity of at least one of the two persons.

A Numbers Game

As we wrote in the first part of this investigation. “Alexander Petrov”’s passport file contained a stamp with the marking “Do not provide data”, followed by a cryptic number. The same stamp – and the same number – appeared in “Boshirov”’s dossier.

Following the publication of part 1, Novaya Gazeta hypothesized that the number sequence may be a telephone number that belongs – based on comparing number pattern – to the Russian Ministry of Defense. In addition, at least two reporters were able to call that number and speak to someone confirming this is a Ministry of Defense line.

Bellingcat and the Insider have obtained documents proving that the number on the suspects’ stamps indeed is identical to a telephone number that belongs to the Ministry of Defense, and is located at Khoroshevskoe Chausse – where the Headquarters of the GRU is based.

In a centralized database called “Unified State Telephone Directory of the Moscow Region”, dated 2012, the telephone number from the dossier stamps – 1957966, preceded by the Moscow prefix 495 – is found to belong to a telephone exchange with “zone of operation: Ministry of Defense of the Russian Federation”

 

Additionally,  many listed telephone numbers in the Moscow telephone database that start with 1957*** have addresses located at Khoroshevskoe Chausse, such as the Ministry of Defense-owned magazine “Foreign Military Review”. The only military unit at or near Khoroshevskoe Chausse is the headquarters of the GRU.

However, it’s two other numbers that provide the most corroborative link between the two Skripal suspects and the GRU.  It’s their international passport numbers.

As discussed in the previous installment, the two suspects’ international-travel passports were not recorded in their passport files – which is atypical for the Russian passport dossier system. This suggests the passports were issued by a special agency that does not report to the centralized registrar of government-issued ID’s, commonly known in Russia as the “FMS database”.  Such a “disconnect” would be logical if this agency issues covert international passports under cover identities.

A “special issuing agency” would explain also the proximity of the passport numbers between the two suspects – only 3 intervening digits (as one would assume that Russian, internationally active secret-service agents are a finite, relatively small number).

Bellingcat and the Insider have previously investigated and reported on a different GRU officer who also traveled under a cover persona and passport. This was the case of Col. Eduard Shishmakov, a former Russian Military Attaché in Warsaw expelled by Poland in 2014 for espionage. Col. Shishmakov, using an undercover (albeit not very creative) persona and passport in the name of Eduard Shirokov, travelled to Serbia in October 2016 to supervise – as alleged by the Montenegro special prosecutor – a failed coup against the pro-Western government in Podgorica. In a previous report, the Insider identified that Col. Shirokov wired funds to a co-conspirator in Serbia via Western Union, using the address of the GRU headquarters as the “Sender” address.

Bellingcat compared the passport number on Col. Shishmakov’s cover-identity passport, with the numbers of the (cover-identity) passports of “Petrov” and “Boshirov”. The numbers were from the same batch, with only 26 intervening passport numbers between “Petrov”’s (654341297), and “Shirokov”’s (654341323) number. “Shirokov”’s passport was issued in August 2016, implying that Petrov’s and Boshirov’s passports were issued by the same special authority earlier that year. Indeed, as we will see in their international itinerary below, they start travelling in early April 2016, suggesting that only 26 passports were issued by this special authority between April and August 2016.

There can be little doubt that both Shishmakov/Shirokov, and “Petrov”/”Boshirov” acquired their cover passports under the same, restricted procedure – and in the same batch of sequence numbers – available to secret service officers. As Shishmakov’s link to GRU has been established incontrovertibly before, it is unlikely that “Petrov” and “Boshirov” are assets of a different Russian intelligence service, especially in light of the MoD telephone numbers marked on their passport dossiers.

 

GRU TOURS

Bellingcat and the Insider have obtained “Petrov”‘s and “Boshirov”s border crossing data for a number of countries in Europe and Asia, for the period of validity of their international passports (mid-2016 through today). Their globe-trotting, unpredictably meandering itinerary is at times reminiscent of characters out of Mission Impossible, yet a focus on the countries of Western Europe is clearly visible.

 

The two operatives’ international globe-hopping on their newly issued passport start on April 8th 2016, when “Petrov” (or Petrov and Boshirov, as our investigation tracked only Petrov’s passport data) drives to Minsk, the capital of Belarus, to fly out from there to Amsterdam. He arrives in the Netherlands two days after the hotly disputed referendum on Ukraine’s EU accession, and flies back to Moscow 10 days later.

The second trip Petrov takes up is perplexing.  On July 11th 2016, he crosses the border from Russia into Kazakhstan by bus, and reports to Kazakh border authorities “Beijing” as his final destination. It is uncertain as to how he planned to reach the capital of China, given the more than 5000 km between the border-crossing point and Beijing. It is possible that he gave that destination as a decoy, or that he planned to ride to Astana and then take a plane to China. Whatever his plans were, we lose track of him for the next 15 days, when he shows up again on a flight back to Moscow – from Israel’s Tel-Aviv.

Two months later, Petrov takes a trip to Amsterdam, and from there flies to London – this appears to be his – or their – first trip to the United Kingdom, where less than two years later they will be suspected of smearing Novichok on the door handle of a former colleague. It is not certain how much time he spent in the UK, but the total Netherlands-UK trip lasted just under a week

Petrov’s next trip is again to Amsterdam – two months after returning from London. This time he stays in Europe 12 days, and returns to Moscow on a flight from Paris at the end of November.

Petrov’s next trip is on February 28th 2017, and it is – once again – to the United Kingdom. He stays there for 6 days, and returns, sinisterly, on March 4th – the same day they will poison Sergey Skripal and his daughter a year later.

Between September 2017 and February 2018, Petrov makes five trips to France and Switzerland, usually landing in Paris and returning from Geneva. The last trip is the longest – he spends two weeks in Europe, between January 23 and February 6th, and flies into – and back from – Geneva.

The next trip is their last to Europe – on March 2nd 2018 they both land at Gatwick, having purchased their tickets the previous evening – on the day before Sergey Skripal’s daughter would arrive in London.

Netherlands Arrests?

A source in a Western European law-enforcement agency informed Bellingcat that Petrov and Boshirov were arrested on the territory of the Netherlands. No information was provided as to the time and context of such arrests. European media have previously reported arrests and deportation of two unidentified Russian spies on Dutch soil; leaked police information linked the arrests with attempts by the two to smuggle hacking equipment to Switzerland, with the goal to infiltrate the Spiez laboratory.  The Spiez lab worked on investigating the chemical attacks in Syria, and later on determining the poisoning agent in the Skripal case.

Even though the media outlets that broke this story reported that the incident took place in the spring of 2018, they acknowledged that the exact time was unknown. Bellingcat and the Insider will continue to investigate whether the hypothetical arrest of “Petrov” and “Boshirov” on Dutch soil did take place as reported, and if so, whether such arrest was linked to the reported arrests of two spies in the Netherlands.

 

Bellingcat Investigation Team

The Bellingcat Investigation Team is an award winning group of volunteers and full time investigators who make up the core of the Bellingcat's investigative efforts.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

218 Comments

    • Chris

      Are you a Russia. Troll by any chance? “Run by government”… care to elaborate a little or shill we just take your word that some mystery ‘government’ runs the site.. ?

      Reply
  1. Vladimir

    Fake news all of it I tell you….(mike still on) “you stupid buggers….why didn’t you travel with a balaclava on your heads……I will dock you two pigs and a goat each……now get out of my sight, pair of wankers…..are we still connected? ahhh shitt, another fine mess you got me into Don. Hehe!

    Reply
  2. ant

    “leaked police information linked the arrests with attempts by the two to smuggle hacking equipment to Switzerland, with the goal to infiltrate the Spiez laboratory”
    do you know in detail which equipment was that?

    Reply
  3. Michael Antony

    You have produced some evidence the two Salisbury “tourists” may have been GRU agents. Your huge leap of logic is to assume they attempted to kill the Skripals. How anyone arriving at 11.48 on Sunday in Salisbury can smear novichok on a door handle before 9.15 (when the Skripals left the house never to return) is something you fail utterly to explain. Nor could they have done it the day before without the Skripals falling ill overnight. A far more likely scenario is that these men were part of a plot to get Sergei Skripal out of the UK to Russia, where he could have sold the GRU all he knew about the Steele dossier he worked on with his MI6 handler Pablo Miller (resident of Salisbury) and his boss Christopher Steele at Orbis Business Intelligence. That dossier had become crucial to the war party in Washington and exposing it as fake would have been a major blow to that war party, which MI6 is part of. The two GRU men may have brought a false passport for Sergei to travel on to escape the clutches of MI6. The sudden decision to come to Salisbury may have come from Yulia not being able to take the false passport with her at the last moment, or some other indication MI6 might have rumbled them. Unfortunately, despite the GRU men’s intervention, MI6 carried out its plan to neutralize the Skripals and stop them leaving or ever talking to the media again. MI6’s first attempt may have been to send Yulia a poisoned perfume bottle as a birthday present (birthday 13 days later) but since Sergei was suspicious and threw it in the rubbish they had to spray them in town and then concoct this door-handle story, which is totally unconvincing.

    Reply
    • Lord_Humungus

      It is incredible how trolls or conspiracy theorists try to spread misinformation regarding every little crease of this story:

      1. They weren’t secret agents
      2. They may were gay tourists
      3. They may were trying to save the Skripals from the MI6
      4. They may were working for the USA
      … and the list goes on…

      The evidence are astounding that there is involvement, and that these guys were certainly no citizens at all but GRU agents known by the Russian Presidency, and that they were located at the place of the attack. Your hypothesis “Michael Antony” is pure rubbish similar to the misinformation a troll would spread.

      These three articles on Skripal case, besides proving bellingcat excellence on open-source investigation, showcase the mess of this crime syndicate, the Russian agencies are.

      Reply
      • wayne

        please provide the evidence you speak of, the british government have not provided any and their story so implausible that the brothers Grimm could have written it.

        Reply
        • Herp Derp

          Hey Wayne, if you want to do Russian trolling, let me give you some pro-tips.

          1) dont use an obvious, generic American name.
          2) actually speaking proper English will help as well.

          Reply
    • Badara

      Reading your post says you know lot why these russians agents came to salisbury. You sound like a very bad spinner agent. You think the MI6 will try to kill or neutralize the Skripals only when the tourist Petrov and Boshirov arrived in Salisbury? After all the years he lived in UK? They were waiting for years to get two Skripals with one stone. You people will never let Russians to live in dignity and respect with such callaious mentality. No wonder you neutralize all good russians in politics. A fine nation with wealth to be the most advance, economic, technological, democratic and civilized nation turned to police state by your kind. Very sad. I wonder how many people these two criminal heros of yours has killed in Russian and outside russian secretly?

      Reply
      • Michael Antony

        Why would the GRU want to “get the two Skripals with one stone”, as you put it? The fact Yulia was targeted in Britain is the very proof that MI6 was responsible. The GRU could have got her any time they wanted in Russia where she lives — knocking her over in a street accent with no questions asked. And why would they want to target her at all, if the motive was revenge for betrayal? She betrayed nobody. MI6 however had an excellent motive — she was the go-between with the GRU helping to plan Sergei’s escape from the UK. They had to get them both at the same time so she couldn’t tell the world that Sergei was planning to re-defect back to Russia. If MI6 has nothing to hide, why don’t they let the Skripals speak to the press, instead of getting Yulia to parrot a script they’ve forced her to say?

        Reply
  4. Michael Antony

    This site apparently refuses to publish any comments that call this story in question. Notably, that even if these were GRU men, there is no evidence they tried to poison the Skripals (which they couldn’t have done before 9.15 that morning when the Skripals left the house, since they arrived in Salisbury at 11.48.) The far more likely scenario is that these men were helping Sergei Skripal escape from MI6’s clutches back to Russia, where he could sell all he knew about the fake Steele dossier he worked on. The men were delivering a false passport for Sergei to travel on when MI6 unfortunately got to him first.

    Reply
    • wayne

      refusing to post my response calling into question this story too. screen shotting everything and compiling a dossier on how social media, investigative journalism and the intelligence services are all acting like the stasi.

      Reply
      • Mike

        Maybe they are smart enough to figure out that you are trying to spread discord? Russia is well known for the trash it posts on Twitter.

        Reply
    • wayne

      refusing to post my response calling into question this story too. screen shotting everything and compiling a dossier on how social media, investigative journalism and the intelligence services are all acting like the stasi.

      Reply
    • RoboJ1M

      I doubt that very much.
      I suspect you were being rude and offensive.
      I bet if you state what you think happened and why, we’ll all be able to read it.
      Replay to my comment, we’ll see what you got.

      They were not there to save, there were assassins.
      There was chemical residue in the hotel they stayed at overnight.
      I bet the only evidence you have that “disproves” this is “the British are lying”

      Once again, Russia and Putin have been caught red handed.
      He can’t afford to back down so the two outcomes are:
      1) Swinging sanctions cause the russian economy to fail even more.
      2) Putin starts a war to distract his poor people
      3) World War III

      Reply
    • Rupert Paget

      Hi Michael Antony. If I can read your comment how can the site ‘refuse(s) to publish any comments that call this story into question’?

      Reply
  5. Serge

    You are mistaken in translation.
    “…zone of operation: Ministry of Defense of the Russian Federation”.

    “МО РФ” translates as Moscow region, not “Ministry of Defense”
    If you know the Russian language, “Зона действия АТС” is mostly territorial, not departmental.
    Although the automatic translator translates the “МО РФ” as a Ministry of Defense. )))

    Reply
    • zeebs

      Serg, I suspect the translation Ministry of Defense Russian Federation is correct. The alternative that you suggest is Moscow Region or (Moskovskaya Oblast in Russian). It is conceivable that Moskovskaya Oblast could be abbreviated as MO RF in cyrillic script. However the oblasts does not contain the areas of Begovaya and Polezhavskaya mentioned on the telephone number change form. These areas are in Moscow City – a separate legal entity from Moscow Oblast. In addition the abbreviation is contained in a section headed “information about the possible operator of connection services”. it would seem to me that the Ministry of Defense would logically want to keep strict control over its telecoms. So it is logical to conclude that the Ministry of Defense translation is correct.

      Reply
  6. Serg

    The house of the Skripal family. Second floor, there is a camera, to the right of the drain. Scotland Yard, where is the video from her, why are you embarrassed?

    Reply
  7. Terry Jones

    The Russians aren’t as smart as they think they are…. the proof will be the impending sanctions imposed by the UK and its allies…. suck it up Putin

    Reply
      • Patmur

        I tend to agree that the current ridiculous imposition of sanctions here, there and everywhere (not just on Russia) is entirely counter-productive. Instead there should be strict and permanent restrictions on people from outside a fairly defined list of friendly western countries attending universities, educational and research establishments. In addition there should be strict controls on the ability of companies (particularly state-associated ones) to take over western companies for the purpose of intellectual property theft.

        Reply
  8. wayne

    One day your anonymous intelligence sources will reveal themselves, until then one can only assume this is just another part of the western information war being waged against a sovereign state illegally. How is the search for Iraqi wmd’s going, or the liberation of Libya, or please explain how ISIS keep cropping up in US military bases and occupied countries. Until i see ANY evidence all you do is lie to promote war and murder. vile human being and state stooge.

    Reply
  9. wayne

    so is bellingcat hacking russian government databases? i think some reports to the police are in order.

    Reply

Leave a Reply

  • (will not be published)

You can support the work of Bellingcat by donating through the following link:

TRUST IN JOURNALISM - IMPRESS