the home of online investigations

You can support the work of Bellingcat by donating through the following link:

Skripal Suspects Confirmed as GRU Operatives: Prior European Operations Disclosed

September 20, 2018

By Bellingcat Investigation Team

Translations: Русский

In the previous part of a joint investigation, Bellingcat and The Insider – Russia established that:

  • Alexander Petrov – a fake cover persona for a yet unidentified Russian individual – is not a civilian but linked to one of Russia’s security services. This assessment was based on an exhaustive analysis of “Petrov” passport dossier as obtained from the Russian central passport database.
  • Petrov and Boshirov made last-minute travel plans to fly to the United Kingdom, which – coupled with the double-booking of return flights on two consecutive dates – makes the “tourism” explanation implausible.
  • Petrov and Boshirov travelled on international passports that differed by 3 consecutive digits, making it implausible that they were civilians who obtained their passports through the regular, entropic passport application process available to Russian citizens.

Since the publication of the first part of this investigation, other media have followed suit with obtaining access to, and disclosing the passport file of “Ruslan Boshirov” – the second suspect in the Skripals poisoning. The leaked passport file extracts similarly displayed characteristics atypical of a civilian person’ passport. Bellingcat can confirm the authenticity of the leaked passport file of “Boshirov”, and that it contains all three markings that helped identify “Petrov” as a security-service asset: “Top Secret” annotations, a blank biographical page referring to a secret attached letter, a “do not provide information” stamp, and issuing authority unit 770001, exclusively used for state VIPs and intelligence officers. In addition, “Boshirov” also has no recorded history prior to the issuance of his domestic ID passport in 2010 (2009 in “Petrov”’s case)

 

GRU Officers

Bellingcat and the Insider can confirm definitively that both “Alexander Petrov” and “Ruslan Boshirov” are active GRU officers. This conclusion is based both on objective data and on discussions with confidential Russian sources familiar with the identity of at least one of the two persons.

A Numbers Game

As we wrote in the first part of this investigation. “Alexander Petrov”’s passport file contained a stamp with the marking “Do not provide data”, followed by a cryptic number. The same stamp – and the same number – appeared in “Boshirov”’s dossier.

Following the publication of part 1, Novaya Gazeta hypothesized that the number sequence may be a telephone number that belongs – based on comparing number pattern – to the Russian Ministry of Defense. In addition, at least two reporters were able to call that number and speak to someone confirming this is a Ministry of Defense line.

Bellingcat and the Insider have obtained documents proving that the number on the suspects’ stamps indeed is identical to a telephone number that belongs to the Ministry of Defense, and is located at Khoroshevskoe Chausse – where the Headquarters of the GRU is based.

In a centralized database called “Unified State Telephone Directory of the Moscow Region”, dated 2012, the telephone number from the dossier stamps – 1957966, preceded by the Moscow prefix 495 – is found to belong to a telephone exchange with “zone of operation: Ministry of Defense of the Russian Federation”

 

Additionally,  many listed telephone numbers in the Moscow telephone database that start with 1957*** have addresses located at Khoroshevskoe Chausse, such as the Ministry of Defense-owned magazine “Foreign Military Review”. The only military unit at or near Khoroshevskoe Chausse is the headquarters of the GRU.

However, it’s two other numbers that provide the most corroborative link between the two Skripal suspects and the GRU.  It’s their international passport numbers.

As discussed in the previous installment, the two suspects’ international-travel passports were not recorded in their passport files – which is atypical for the Russian passport dossier system. This suggests the passports were issued by a special agency that does not report to the centralized registrar of government-issued ID’s, commonly known in Russia as the “FMS database”.  Such a “disconnect” would be logical if this agency issues covert international passports under cover identities.

A “special issuing agency” would explain also the proximity of the passport numbers between the two suspects – only 3 intervening digits (as one would assume that Russian, internationally active secret-service agents are a finite, relatively small number).

Bellingcat and the Insider have previously investigated and reported on a different GRU officer who also traveled under a cover persona and passport. This was the case of Col. Eduard Shishmakov, a former Russian Military Attaché in Warsaw expelled by Poland in 2014 for espionage. Col. Shishmakov, using an undercover (albeit not very creative) persona and passport in the name of Eduard Shirokov, travelled to Serbia in October 2016 to supervise – as alleged by the Montenegro special prosecutor – a failed coup against the pro-Western government in Podgorica. In a previous report, the Insider identified that Col. Shirokov wired funds to a co-conspirator in Serbia via Western Union, using the address of the GRU headquarters as the “Sender” address.

Bellingcat compared the passport number on Col. Shishmakov’s cover-identity passport, with the numbers of the (cover-identity) passports of “Petrov” and “Boshirov”. The numbers were from the same batch, with only 26 intervening passport numbers between “Petrov”’s (654341297), and “Shirokov”’s (654341323) number. “Shirokov”’s passport was issued in August 2016, implying that Petrov’s and Boshirov’s passports were issued by the same special authority earlier that year. Indeed, as we will see in their international itinerary below, they start travelling in early April 2016, suggesting that only 26 passports were issued by this special authority between April and August 2016.

There can be little doubt that both Shishmakov/Shirokov, and “Petrov”/”Boshirov” acquired their cover passports under the same, restricted procedure – and in the same batch of sequence numbers – available to secret service officers. As Shishmakov’s link to GRU has been established incontrovertibly before, it is unlikely that “Petrov” and “Boshirov” are assets of a different Russian intelligence service, especially in light of the MoD telephone numbers marked on their passport dossiers.

 

GRU TOURS

Bellingcat and the Insider have obtained “Petrov”‘s and “Boshirov”s border crossing data for a number of countries in Europe and Asia, for the period of validity of their international passports (mid-2016 through today). Their globe-trotting, unpredictably meandering itinerary is at times reminiscent of characters out of Mission Impossible, yet a focus on the countries of Western Europe is clearly visible.

 

The two operatives’ international globe-hopping on their newly issued passport start on April 8th 2016, when “Petrov” (or Petrov and Boshirov, as our investigation tracked only Petrov’s passport data) drives to Minsk, the capital of Belarus, to fly out from there to Amsterdam. He arrives in the Netherlands two days after the hotly disputed referendum on Ukraine’s EU accession, and flies back to Moscow 10 days later.

The second trip Petrov takes up is perplexing.  On July 11th 2016, he crosses the border from Russia into Kazakhstan by bus, and reports to Kazakh border authorities “Beijing” as his final destination. It is uncertain as to how he planned to reach the capital of China, given the more than 5000 km between the border-crossing point and Beijing. It is possible that he gave that destination as a decoy, or that he planned to ride to Astana and then take a plane to China. Whatever his plans were, we lose track of him for the next 15 days, when he shows up again on a flight back to Moscow – from Israel’s Tel-Aviv.

Two months later, Petrov takes a trip to Amsterdam, and from there flies to London – this appears to be his – or their – first trip to the United Kingdom, where less than two years later they will be suspected of smearing Novichok on the door handle of a former colleague. It is not certain how much time he spent in the UK, but the total Netherlands-UK trip lasted just under a week

Petrov’s next trip is again to Amsterdam – two months after returning from London. This time he stays in Europe 12 days, and returns to Moscow on a flight from Paris at the end of November.

Petrov’s next trip is on February 28th 2017, and it is – once again – to the United Kingdom. He stays there for 6 days, and returns, sinisterly, on March 4th – the same day they will poison Sergey Skripal and his daughter a year later.

Between September 2017 and February 2018, Petrov makes five trips to France and Switzerland, usually landing in Paris and returning from Geneva. The last trip is the longest – he spends two weeks in Europe, between January 23 and February 6th, and flies into – and back from – Geneva.

The next trip is their last to Europe – on March 2nd 2018 they both land at Gatwick, having purchased their tickets the previous evening – on the day before Sergey Skripal’s daughter would arrive in London.

Netherlands Arrests?

A source in a Western European law-enforcement agency informed Bellingcat that Petrov and Boshirov were arrested on the territory of the Netherlands. No information was provided as to the time and context of such arrests. European media have previously reported arrests and deportation of two unidentified Russian spies on Dutch soil; leaked police information linked the arrests with attempts by the two to smuggle hacking equipment to Switzerland, with the goal to infiltrate the Spiez laboratory.  The Spiez lab worked on investigating the chemical attacks in Syria, and later on determining the poisoning agent in the Skripal case.

Even though the media outlets that broke this story reported that the incident took place in the spring of 2018, they acknowledged that the exact time was unknown. Bellingcat and the Insider will continue to investigate whether the hypothetical arrest of “Petrov” and “Boshirov” on Dutch soil did take place as reported, and if so, whether such arrest was linked to the reported arrests of two spies in the Netherlands.

 

Bellingcat Investigation Team

The Bellingcat Investigation Team is an award winning group of volunteers and full time investigators who make up the core of the Bellingcat's investigative efforts.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

217 Comments

  1. A J COLEMAN

    As a former Warmonger having marched out of India and later North Korea I can only reflect on how ridiculous is the nonsense that all are spouting about the so called poisoning event in Salisbury.
    M May wasted money, government wasted time. An insignificant event. How many Syrian’s and children ,Iraqi and Palestinian people all Semites were KILLED by American, British and Jewish bombs while this propaganda was spread by all and others. Who did what for an old dodgy spy and why.
    In my day we in MI 6 would have let the old bugger do a parachute drop with a faulty chute over the Atlantic. Forget about the boys.
    Britain, Europe ,Putin, Russia and the rest do not need more war. Nor does Trump.

    Reply
    • Badara

      Anyone with your mentality will not even be a security guard in UK let alone work at MI6. You are fitting in KGB or GRU paid in vodka to destroy democracy in Russia.

      Reply
  2. gojam

    It appears to follow from this article that western intelligence agencies can identify active GRU agents who have travelled to the west by their passport numbers. It stands to reason that any passport number that is close to that of “Petrov” and ”Boshirov” are GRU agents and by simply cross referencing these details with information obtained at passport controls in and out of western countries, western intelligence would be able effectively track the movements of GRU agents in the West.

    Reply
  3. Badara

    Anyone with your mentality will not even be a security guard in UK let alone work at MI6. You are fitting in KGB or GRU paid in vodka to destroy democracy in Russia.

    Reply
  4. Lone Wolf

    Seems that Russian Pasport Service is a part of GRU!
    Untill there people are not restricted to enter in REAL Europe they will continue with their dirty tricks!

    Reply
  5. Richard

    Your a fraudster, times are changing, people are waking up, no wonder your a darling to the establishment finding pathetic false excuses so the war machine grinds on, utter crap mate and not many of the masses believe it, sorry, find a job you can actually do instead of being useless.

    Reply
    • Patmur

      Just because people don’t agree with the continual interference by the US, UK and other western elites in the Middle East (and former Yugoslavia too) does not mean that Russia is some kind of model state. It isn’t! It is a lawless state. The current situation where Russia uses the internet to present itself as a morally pure paragon in opposition to the so-called decadent and corrupt Europe and America is nothing new. The Russians have always compensated for their failure to develop a prosperous society for their people by declaring themselves to have a pure and untainted society , they did it under the Tsars, again under the Communists and now again under Putin.

      Reply
  6. Mike

    Remember that some of the comments on here will be from Russian operatives spreading misinformation and conspiracy theories. This is a very common theme on Twitter and other online platforms.

    Reply
  7. Sam

    Reading the posts here, I am amazed at the illogical naivety of readers. Of course there will be gaps in the evidence, of course there will be questions still to be answered, but the essence of this case is very clear, and pretty well set out in the article. Why is it necessary for some comments to be so insulting. If you dont agree – dont visit the site !

    Reply
  8. katherina

    I TRIED CONTACTED WITH YOU BUT POLISH INTELLIGENCE SERVICES FROM EDINBURGH WITH THE BASE IN HERRIOT WATT UNIVERSITY CAMPUS – LUX COMPANY WHO IS A PILLOW FOR THEIR NOT LEGAL ACTION IN THE TERRITORY OF UNITED KINGDOM HACKING PUBLIC LIBRARY .
    I WANT MENTIONED THAT RUSSIAN SPY VISITING LUX COMPANY A FEW MONTH AGO …I CLEARLY RECOGNIZING ONE FROM THEIR.
    I INVITING YOU TO READ MY FACEBOOK katherinamarthamika@gmail.com
    or google.com.ALL MY POST ABOUT “RUSSIAN” ARE PUBLIC

    Reply
    • Jeroen

      How many businessmen, compagnies, traders from Amsterdam, Bern, London, Paris, Frankfurt, Geneva, Minsk, Tel Aviv have come forward to confirm they actualy have done some nutrition, health or sports business with these two gentlemen?
      Anyone confirmed even a single one yet?

      Reply
  9. Jeroen

    These gentlemen told Margarita they “could not remember exactly” when they visited Switzerland on their business trips.
    Apart from that one time they visited Geneva for tourism because it was “so close to the Mount Blanc”.

    Who helps these men a bit to fix their recollections?

    Nobody remembers providing them advise on nutrition?
    Buying vitamines?
    Health coaching?
    Sports?
    Dehydration?
    Not even shipping vitamines to Moskva?
    How come?

    Reply
    • katherina

      NOT INTERESTED MYSELF COMPANY FROM EUROPE.I M ONLY INTERESTING
      IN “LUX” COMPANY FROM POLAND .
      THEY STARTED HIRE SPACE FROM HERIOT WATT UNIVERSITY IN AUTUMN 2012
      BEST REGARDS & I inviting you to reading my posts
      katherina martha mika

      Reply

Leave a Reply

  • (will not be published)

You can support the work of Bellingcat by donating through the following link:

TRUST IN JOURNALISM - IMPRESS