the home of online investigations

You can support the work of Bellingcat by donating through the following link:

The Search for Denis Sergeev: Photographing a Ghost

February 21, 2019

By Bellingcat Investigation Team

Translations: Русский

In the previous part of this report, Bellingcat and its investigative partners The Insider (Russia) and Respekt (Czechia) identified Denis Sergeev, the GRU officer who was present in the UK during the poisoning of the Skripals in March 2018, and was also in Bulgaria during the poisoning, with similar symptoms, of a Bulgarian arms dealer in April 2015.

Following the report, Bulgarian authorities have announced that in October 2018 they re-opened investigations into the 2015 poisoning incident, and that they are now working in close cooperation with British police. In the meantime BBC Russia contacted by telephone Denis Sergeev’s wife, who denied her husband was a GRU officer but declined to answer what his actual job was. She told reporters that her husband would decide whether he wishes to speak to the press, after which she has not been reachable at the telephone number. As of press time, a different person was answering her phone, who claimed not to know the Sergeevs’.

Additional Details from Denis Sergeev’s Biography

Following our initial identification report, BBC Russia reported that it had discovered a person bearing the same full name and birth date as Denis Sergeev on a cached webpage of the 1990 graduating class of the Ekaterinburg Military School. Bellingcat can confirm that this was indeed the same Denis Sergeev, who studied in the two-year cadet-prepping institution. A comprehensive search in Russian databases has shown that there does not exist a second person with the same full name and birth date.

Bellingcat has established that as of 1999, Sergeev had a rank of captain and was serving as commander of the first paratroopers’ company at the 108th Air Assault Regiment. This unit is based in Novorossiisk, on Russia’s Black Sea coast, and played a key role in fighting in Dagestan in the summer of 1999, as well as in the second Chechen war in 2000-2001. In the early morning of August 13 1999 Denis Sergeev was wounded in the first minutes of an attempt to recapture the Alilen Mount in Dagestan from Chechen fighters. Sergeev, alongside other officers, received a state award for this battle.

Denis Sergeev in 1999. Screen grab from a documentary on the battle for Alilen

The Impossible Search for “Fedotov”

The search for the identity of the third Skripal suspect “Fedotov” was markedly more difficult than that for the other two suspects, “Boshirov” and “Petrov”. The reason for this, on one side, was the fact that British authorities released no information about – and crucially, no photographs of – the third suspect. On the other side, after Bellingcat’s initial identifications of Col. Chepiga and Col. Mishkin, the Russian authorities apparently took unprecedented measures to purge any traces of this person’s existence. Ironically, Bellingcat was able to witness this clean-up operation in real time, as data on this person that was originally available in online databases at the start of the investigation (in October 2018), became incrementally purged over the subsequent few months, with the person completely vanishing from all state-run registers by early 2019.

The initial existence of a likely third suspect traveling under the name “Sergey Fedotov” was first reported by the Russian website Fontanka, whose reporters first noticed that a person with a passport number pattern similar to that of “Petrov” and “Boshirov” traveled on a different Aeroflot flight to London on the same day as the main two suspects.

Bellingcat then obtained the passenger records for the 2 March 2018 flights from Moscow to London that had been reviewed by Fontanka, and identified the person, whose passport number different by the two last digits from those of the main suspects previously identified by us as decorated GRU officers. Indeed, “Sergey Fedotov” had flown into London on a flight several hours before “Boshoriv” and “Petrov”, landing at Heathrow, while they would land at Gatwick airport later that same day.

We then obtained travel data for this person for the period 2011-2018. To re-create his travel itinerary we used three sources of data: border crossing data (both in Russia and other countries) provided by whistle-blowers, PNR data (reflecting airline bookings) that was temporarily exposed though a vulnerability in an airline booking systems, and a Russian passenger-monitoring system used by the police to track Russian citizens, to which we received access also via (different) whistle-blowers. The data sources were independent of each other, and mutually validated the travel records.

Different data sources had various advantages and disadvantages. PNR data, for example, provided more granular steps for each flight, such as times of preliminary booking, purchase, cancellations, check-in and no-show events. This allowed us to establish that “Fedotov” skipped his booked flights from London to Moscow after the Skripals poisoning, and from Sofia to Moscow after the Gebrev poisoning. On the other hand, police-monitoring data informed us of his train and car travels inside the country, and also provided information of other passengers who booked flights along with him – exposing names of other likely GRU operatives. Border-crossing data, while limited to international air-travel only, was also the only data source that turned out to be immune to deletions as part of the Russian authorities’ cover-up measures.

Sergey Fedotov: Real or Fictional?

The passenger manifest for the Moscow-London flight provided a first and last (family) name and a date of birth. At this point, we were not certain if these belonged to a real person or were cover credentials. We knew from our prior research into “Boshirov” and “Petrov” that typically, GRU would create a parallel documentary trace for the cover identity, including passports, address registrations, and even employment histories (all of these are needed, among others, in order to ensure credible applications for visas).

Knowing this, we first searched for “Sergey Fedotov” born on 17 September 1973 through hundreds of Russian residential, automobile ownership, tax ID and credit history databases that have been leaked onto the internet over the past 20 years and that we have consolidated in the last 3 years. There, we found four possible matches. One of them was registered to a Moscow address: his full name was Sergey Vyacheslavovich Fedotov. This person’s entries in the databases displayed certain unusual characteristics. For example, Moscow residential databases listed his place of birth as Apushka, a small village in the Ryazan region north-east of Russia. However, no entry for such a person existed in old residential databases of the Ryazan region. Also, “Fedotov” was shown as employed by a company called “Business-Courier”, which had existed on paper between 2004 and 2008 and had apparently never traded. Crucially, these databases showed “Fedotov”s registered address, but when Bellingcat acquired the ownership records for this apartment, they showed a different family – also bearing the Fedotov name – as owners. Neither of these owners could be identified as having a family member named Sergey Fedotov and born in 1973. Our attempts to reach this family were futile, as all four listed numbers for them had been disconnected.

At this point in the investigation, at the end of October 2018, we obtained Moscow’s Sergey Fedotov’s passport file from a whistle-blower with access to the centralized police travel-tracking database. It validated our suspicions that this was a cover identity: his latest passport was issued by the same 770001 passport desk that was known to issue passports to GRU officers and foreign-born VIP citizens, and it was issued due to “unusability of the previous passport” – the same reason given for the issuance of Petrov and Boshirov’s cover passports. Importantly, the previous passport – which was listed as issued in the Ryazan region – had a number that did not show up in the Ryazan databases. These peculiarities as a whole convinced us that Sergey Fedotov was a cover identity.

The Quest for a Photograph

The next step in the investigation was to obtain a photograph of the “cover” persona, which would be used to search for the real individual and prove that they are the same person. Unlike the case of the other two suspects, no published photographs of Fedotov existed, nor was he interviewed on RT.

At this point, in December 2018, Bellingcat requested a copy of Fedotov’s domestic passport from a source with access to RosPassport, the central passport database. The source reported that no passport records exist for Sergey Fedotov. This information contradicted both the police tracking database which had provided full details of Fedotov’s passport, as well as telephone registration records which also contained his passport details. To ensure that this was not human error, Bellingcat requested a second source with access to verify the absence of passport data; this source confirmed and presented us with a screenshot of the “no results” search menu. The only logical conclusion was that Russian authorities had purged the cover persona Sergey Fedotov from the central passport database.

With no access to a passport photo from Russian databases, Bellingcat approached many sources at border-crossing authorities in the various countries where “Fedotov” traveled to, as well as hotels at which Bellingcat’s investigation partners had identified he had stayed. After long persuasion, one of these prospective sources provided Bellingcat with a photograph from a scan of Fedotov’s international passport.

Finding The Real Person behind Fedotov

Based on our experience from prior identifications of GRU officers, we knew that cover identities fell into two broad categories: minimal-change (i.e. only last name, and sometimes patronymic, are changed, leaving date of birth and general region of origin unaltered, as in the cases of Mishkin, Shishmakov, Moiseev), or full make-over (i.e. change of both name and birth data, as in the case of Chepiga/Boshirov). We started the search by testing the minimum-change hypothesis. However, a search in hundreds of residential databases for a “Sergey Vyacheslavovich” with birthdate of 17 September 1973 led to no likely candidates.

As a second step, we tested for only “Sergey” with the same birthdate. This resulted in a large pool of targets, but none of them displayed immediate signs of links to GRU. Last, we decided to search only for people with a patronymic “Vyacheslavovich”, and birthdate 17 September 1973. In our initial search with these criteria in a 2012 Moscow residential database, we found 15 hits, but one of them was of special interest. This person had a listed residential address at Narodnoe Opolchenie 50, which is the location of the dormitory of GRU’s Military Diplomatic Academy. This was Denis Vyacheslavovich Sergeev, born in Kazakhstan, and having a passport issued in Novorossiisk in 2000. Databases of different vintage showed that he, along with his wife and daughter, had been registered as residing at this address no later than 2006, and were still registered at that address in 2012.

Denis Sergeev in a Russian database, showing his date of birth and his military unit’s address. The database has an error with his patronymic, which should be Vyacheslavovich, not Vyacheslav.

The links between Denis Sergeev and GRU were not restricted to his family’s residence at the dormitory of the GRU “Conservatory”. In certain databases his address was listed as Military Unit 22177, which is in fact the military number of the Conservatory. From leaked domestic travel databases, we obtained domestic travel records for Sergeev (he appears not to have traveled internationally under his real identity). On several train trips between Moscow and St. Petersburg, Sergeev traveled on joint bookings with other people, who were registered as residing, or having their cars registered at Khoroshevskoye Shosse 76A, the headquarters of GRU. One companion train passenger had been previously seen by Bellingcat as listed among the people authorized to drive a car owned by Vladimir Moiseev, the GRU officer identified by us as the person behind the persona Vladimir Popov, under which he is on the Interpol red notice list in connection with the abortive Montenegro coup in 2016. This same person, in turn, had traveled multiple times between Moscow and Krasnodar, where the base of the private Wagner military company is, in joint bookings with persons identified as Wagner mercenaries.  Bellingcat has previously reported that Wagner mercenaries had international passports from the same series used for GRU undercover passports, and that seniоr GRU officers frequently travel to Krasnodar’s Pashkovsky airport, sometimes on flights on which known mercenaries are also flying.

Another person who traveled on joint train bookings with Denis Sergeev was also found on 4 different joint airline bookings with Eduard Shishmakov, the GRU officer expelled by Poland in 2014, and also on the Interpol wanted list for his role in the Montenegro coup. The two flew together from Moscow to and from Rostov airport in late 2012; at that time Shishmakov was formally serving as Russia’s deputy military attache in Poland.

To establish conclusively that Sergeev is in fact “Fedotov”, we needed to obtain a photograph of Sergeev and compare it to the already obtained “Fedotov” passport photo. However, this turned out to be nearly impossible.

Concerted cover-up Efforts by the Russian State

While we could find multiple references to Denis Sergeev in offline, aged databases from 2018 and earlier, it appeared that no such person existed in current, online state-run registries. Initially, Bellingcat tried to obtain a photo of Denis Fedotov via several sources with access to the traffic police (GIBBD) database. All sources reported that no such person exists among licensed drivers in Russia. This did not make sense, given that we had already obtained records of Sergeev’s own car, and had also verified that he was listed as an authorized driver for his daughter’s car.  In addition, we had obtained the number and date of issuance of Sergeev’s initial driving license from an offline database.

 

Database entry with Sergeev’s address shown as Military Unit 22177, and with the number and issuance date of his driver’s license

Our hypothesis that Denis Sergeev had been purged from state-run databases – including the passport database – was confirmed via a simple experiment. As we had his domestic passport number from previously obtained documents (including the October 2018 police tracking database record), we tried to obtain Sergeev’s unique tax identifying number via a web tool run by Russia’s tax authority. The tool returned no results. We then tried to obtain the tax number for the other two suspects in the Skripal case. They, too, had vanished from the tax system. Other known GRU officers, whom we had identified previously but who had not been linked to the Skripal case, could still be found using this same tool. Data for the cover identities “Fedotov”, “Petrov” and “Boshirov” had also disappeared from this onlne database.

We then attempted to find traffic fine violations for Denis Sergeev’s car using a web-tool run by the traffic police. We had the exact registration details of Sergeev’s Nissan X Trail, however the online tool informed us that no such car exists.

Last, we checked if travel records for “Fedotov” for the period 2015-2018 were still present in the police travel tracking database (we had previously obtained such records in October 2018). As of February 2019, no such travel records existed in the system. It became evident that the Russian state had implemented a full sweep of data relating to both the real and undercover identities of Sergeev and his other colleagues linked to the Skripal case.

While impeding our ability to find a photo match between Sergeev and Fedotov, this finding gave us the idea to look for other GRU officers who might be linked to the Skripal poisoning, in which case we could expect their data to not be available via the online tax tool. Indeed, we have identified one such additional GRU officer. This officer, notably, traveled to Bulgaria two weeks before Sergeev’s trip which coincided with the poisoning of the Bulgarian arms trader. Bellingcat and its partner publications are currently analysing whether this may be a fourth suspect in the Skripal case.

Alternative Photo Match

While reconstructing Denis Sergeev’s background prior to his studies at the Military Diplomatic Academy, we sought for a person with this name among the most likely recruiting grounds for that institution – Spetsnaz and air-attack paratrooper units, especially ones with actual hands-on military experience. We were able to find a reference to a Capt. Denis Sergeev in a book about the Dagestan events in 1999 described earlier. We also discovered several witness descriptions of the battle in which Capt. Sergeev was wounded, while his commander was killed. One of the references was in an article about a documentary film on the battle in Dagestan.

We found this documentary which was filmed shortly after the events, and saw that Capt. Sergeev was interviewed on camera in several segments. While there were certain similarities between the person in the documentary and the recent photograph from “Fedotov”‘s passport, we could not be certain that this was the same person, especially given the low resolution of the photo and the nearly 20 years between the two events.

Bellingcat then requested a forensic analysis of the similarities between the persons on the passport photo, on one hand, and the screen-grab from the 1999 documentary, on the other. Prof. Hasan Ugail from the Center for Visual Computing at the University of Bradford supervised the analysis, which was conducted using a state of the art deep machine-learning algorithm trained on millions of human faces. The algorithm provides 100% matching accuracy in one to one face comparison tests of known identities. The test provided a match of 78.2%, while a match >70% is sufficient to conclude identity match of the persons.

Further details of the underlying academic work can be found in A. Elmahmudi and H. Ugail, Experiments on deep face recognition using partial faces, in Cyberworlds 2018, IEEE, doi: 10.1109/CW.2018.00071, (2018)

Conclusion

This two-part report identified a third suspect in the Skripals poisoning case, who may also be a suspect in the poisoning of Bulgarian arms manufacturer and trader Emilian Gebrev in April 2015. Sergeev’s undercover travels as “Fedotov” are extensive, and overlap with certain important political events in Europe. His long career profile suggests he is not a mid-rank operative or support personnel for overseas operations, but more likely serves in a supervising function. Further investigations are needed into the purpose of his rich travel history, especially in locations such as Spain, Turkey, Czechia and Tadjikistan.

A key discovery in this report was the unprecedented purge of all traces of both the cover and real persons linked to the Skripal case from public registers in Russia. Such cleansing, which took place after Bellingcat’s initial identification of GRU officers “Boshirov” and “Petrov”, cannot realistically be undertaken without the direct involvement of the Russian state. The only plausible explanation for this data purge is curbing further investigation into the Skripal (and possibly, the Gebrev) incidents, both by media and by foreign law enforcement agencies.

In the course of this investigation, we found that GRU undercover officers assigned to different operations often overlap, with the total number identified by Bellingcat not exceeding 10, many of which overlapping between, for instance, the Montenegro and Skripal operations, as well as other joint operations whose purpose is yet to be identified. This implies that there is a limited elite team of internationally trained operatives that are recycled among various projects.

Bellingcat Investigation Team

The Bellingcat Investigation Team is an award winning group of volunteers and full time investigators who make up the core of the Bellingcat's investigative efforts.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

30 Comments

  1. andalusian saracen

    congratulation….but knowing the clustred nature of the russian state we should also congratulate the russian security service who’s helping you

    Reply
    • moist_towel

      Yeah publishing this information is completely aligned with their interest, how did I not see it before.

      Reply
  2. Eximus Jackson Flaxon Wackson

    Hopefully this doesn’t burn sources within the Russian passport database group

    Reply
  3. Jack

    would be interesting to do the same investigation into the spring 2014 exfil op of yanokovych, no?

    Reply
  4. OD

    Elmahmudi and H. Ugail, Experiments on deep face recognition using partial faces, in Cyberworlds 2018, IEEE, doi: 10.1109/CW.2018.00071, (2018)

    Abstract— Face recognition is a very current subject of great interest in the area of visual computing. In the past, numerous face
    recognition and authentication approaches have been proposed, though the great majority of them use full frontal faces both for
    training machine learning algorithms and for measuring the recognition rates. In this paper, we discuss some novel experiments to
    test the performance of machine learning, especially the performance of deep learning, using partial faces as training and
    recognition cues. Thus, this study sharply differs from the common approaches of using the full face for recognition tasks. In
    particular, we study the rate of recognition subject to the various parts of the face such as the eyes, mouth, nose and the forehead.
    In this study, we use a convolutional neural network based architecture along with the pre-trained VGG-Face model to extract
    features for training. We then use two classifiers namely the cosine similarity and the linear support vector machine to test the
    recognition rates. We ran our experiments on the Brazilian FEI dataset consisting of 200 subjects. Our results show that the cheek
    of the face has the lowest recognition rate with 15% while the (top, bottom and right) half and the 3/4 of the face have near 100%
    recognition rates.

    Reply
  5. okhotnik

    Great work … except.

    The facial recognition does not take into account the broken nose from the young Russian Army officer. When men age, noses do not become smaller and correct themselves.

    However, I have to admit there is a possibility GRU medical department fixed this (now senior) officer’s nose to make him less obvious for future international operations.

    Reply
  6. Konstantin

    For those who want to listen to Capt. Denis Sergeev in the Youtube video linked above:

    35:37 to 36:57
    1:16:03 to 1:16:47
    1:21:00 to 1:21:14
    1:22:04 to 1:23:16
    1:24:03 to 1:27:19
    1:30:15 to 1:33:28

    Reply
  7. Smarter

    Bellingcat is like a young child who desperately needs the approval of mother. “Look! Look at what I can do!” this child shouts. Only a child would provide the opposition with a detailed map of how to counter all of the investigative techniques which made this identification possible. Good work, young child. Are you happy now?

    Reply
  8. Tracey Thakore

    Yet again, another slant in the Sergei Skripal affair, focusing on an officer who was present in the United Kingdom in the March of 2018, but this time with the angle of a Bulgarian arms dealer in April 2015.
    What exactly is the continual obsession with focusing on Russians who may have been nothing more than linked by the fact that they are Russian?
    The only point to note is that you seem to imply a link to a Bulgarian arms dealer.
    Why don’t you spend more time investigating, what seems to me, to be a major avenue for further research.
    The link to an arms dealer has not been reported before.
    The story of the Salisbury incident has run and run, with the main emphasis on the Russians and their whereabouts, without anyone questioning the whys, the who’s, the hows and the reasons for?
    Why where they left “slumped “on a park bench? What is the means by which they were contaminated? Why Sergei Skripal and his daughter? Is it the fact he is Russian or the fact he passes information on the British? Or is it the location of something that another Government would be interested in?
    Now ask yourself a simple question, what do criminals need arms for?

    Reply

Leave a Reply

  • (will not be published)

You can support the work of Bellingcat by donating through the following link:

TRUST IN JOURNALISM - IMPRESS