the home of online investigations

The Search for Denis Sergeev: Photographing a Ghost

February 21, 2019

By Bellingcat Investigation Team

Translations: Русский

In the previous part of this report, Bellingcat and its investigative partners The Insider (Russia) and Respekt (Czechia) identified Denis Sergeev, the GRU officer who was present in the UK during the poisoning of the Skripals in March 2018, and was also in Bulgaria during the poisoning, with similar symptoms, of a Bulgarian arms dealer in April 2015.

Following the report, Bulgarian authorities have announced that in October 2018 they re-opened investigations into the 2015 poisoning incident, and that they are now working in close cooperation with British police. In the meantime BBC Russia contacted by telephone Denis Sergeev’s wife, who denied her husband was a GRU officer but declined to answer what his actual job was. She told reporters that her husband would decide whether he wishes to speak to the press, after which she has not been reachable at the telephone number. As of press time, a different person was answering her phone, who claimed not to know the Sergeevs’.

Additional Details from Denis Sergeev’s Biography

Following our initial identification report, BBC Russia reported that it had discovered a person bearing the same full name and birth date as Denis Sergeev on a cached webpage of the 1990 graduating class of the Ekaterinburg Military School. Bellingcat can confirm that this was indeed the same Denis Sergeev, who studied in the two-year cadet-prepping institution. A comprehensive search in Russian databases has shown that there does not exist a second person with the same full name and birth date.

Bellingcat has established that as of 1999, Sergeev had a rank of captain and was serving as commander of the first paratroopers’ company at the 108th Air Assault Regiment. This unit is based in Novorossiisk, on Russia’s Black Sea coast, and played a key role in fighting in Dagestan in the summer of 1999, as well as in the second Chechen war in 2000-2001. In the early morning of August 13 1999 Denis Sergeev was wounded in the first minutes of an attempt to recapture the Alilen Mount in Dagestan from Chechen fighters. Sergeev, alongside other officers, received a state award for this battle.

Denis Sergeev in 1999. Screen grab from a documentary on the battle for Alilen

The Impossible Search for “Fedotov”

The search for the identity of the third Skripal suspect “Fedotov” was markedly more difficult than that for the other two suspects, “Boshirov” and “Petrov”. The reason for this, on one side, was the fact that British authorities released no information about – and crucially, no photographs of – the third suspect. On the other side, after Bellingcat’s initial identifications of Col. Chepiga and Col. Mishkin, the Russian authorities apparently took unprecedented measures to purge any traces of this person’s existence. Ironically, Bellingcat was able to witness this clean-up operation in real time, as data on this person that was originally available in online databases at the start of the investigation (in October 2018), became incrementally purged over the subsequent few months, with the person completely vanishing from all state-run registers by early 2019.

The initial existence of a likely third suspect traveling under the name “Sergey Fedotov” was first reported by the Russian website Fontanka, whose reporters first noticed that a person with a passport number pattern similar to that of “Petrov” and “Boshirov” traveled on a different Aeroflot flight to London on the same day as the main two suspects.

Bellingcat then obtained the passenger records for the 2 March 2018 flights from Moscow to London that had been reviewed by Fontanka, and identified the person, whose passport number different by the two last digits from those of the main suspects previously identified by us as decorated GRU officers. Indeed, “Sergey Fedotov” had flown into London on a flight several hours before “Boshoriv” and “Petrov”, landing at Heathrow, while they would land at Gatwick airport later that same day.

We then obtained travel data for this person for the period 2011-2018. To re-create his travel itinerary we used three sources of data: border crossing data (both in Russia and other countries) provided by whistle-blowers, PNR data (reflecting airline bookings) that was temporarily exposed though a vulnerability in an airline booking systems, and a Russian passenger-monitoring system used by the police to track Russian citizens, to which we received access also via (different) whistle-blowers. The data sources were independent of each other, and mutually validated the travel records.

Different data sources had various advantages and disadvantages. PNR data, for example, provided more granular steps for each flight, such as times of preliminary booking, purchase, cancellations, check-in and no-show events. This allowed us to establish that “Fedotov” skipped his booked flights from London to Moscow after the Skripals poisoning, and from Sofia to Moscow after the Gebrev poisoning. On the other hand, police-monitoring data informed us of his train and car travels inside the country, and also provided information of other passengers who booked flights along with him – exposing names of other likely GRU operatives. Border-crossing data, while limited to international air-travel only, was also the only data source that turned out to be immune to deletions as part of the Russian authorities’ cover-up measures.

Sergey Fedotov: Real or Fictional?

The passenger manifest for the Moscow-London flight provided a first and last (family) name and a date of birth. At this point, we were not certain if these belonged to a real person or were cover credentials. We knew from our prior research into “Boshirov” and “Petrov” that typically, GRU would create a parallel documentary trace for the cover identity, including passports, address registrations, and even employment histories (all of these are needed, among others, in order to ensure credible applications for visas).

Knowing this, we first searched for “Sergey Fedotov” born on 17 September 1973 through hundreds of Russian residential, automobile ownership, tax ID and credit history databases that have been leaked onto the internet over the past 20 years and that we have consolidated in the last 3 years. There, we found four possible matches. One of them was registered to a Moscow address: his full name was Sergey Vyacheslavovich Fedotov. This person’s entries in the databases displayed certain unusual characteristics. For example, Moscow residential databases listed his place of birth as Apushka, a small village in the Ryazan region north-east of Russia. However, no entry for such a person existed in old residential databases of the Ryazan region. Also, “Fedotov” was shown as employed by a company called “Business-Courier”, which had existed on paper between 2004 and 2008 and had apparently never traded. Crucially, these databases showed “Fedotov”s registered address, but when Bellingcat acquired the ownership records for this apartment, they showed a different family – also bearing the Fedotov name – as owners. Neither of these owners could be identified as having a family member named Sergey Fedotov and born in 1973. Our attempts to reach this family were futile, as all four listed numbers for them had been disconnected.

At this point in the investigation, at the end of October 2018, we obtained Moscow’s Sergey Fedotov’s passport file from a whistle-blower with access to the centralized police travel-tracking database. It validated our suspicions that this was a cover identity: his latest passport was issued by the same 770001 passport desk that was known to issue passports to GRU officers and foreign-born VIP citizens, and it was issued due to “unusability of the previous passport” – the same reason given for the issuance of Petrov and Boshirov’s cover passports. Importantly, the previous passport – which was listed as issued in the Ryazan region – had a number that did not show up in the Ryazan databases. These peculiarities as a whole convinced us that Sergey Fedotov was a cover identity.

The Quest for a Photograph

The next step in the investigation was to obtain a photograph of the “cover” persona, which would be used to search for the real individual and prove that they are the same person. Unlike the case of the other two suspects, no published photographs of Fedotov existed, nor was he interviewed on RT.

At this point, in December 2018, Bellingcat requested a copy of Fedotov’s domestic passport from a source with access to RosPassport, the central passport database. The source reported that no passport records exist for Sergey Fedotov. This information contradicted both the police tracking database which had provided full details of Fedotov’s passport, as well as telephone registration records which also contained his passport details. To ensure that this was not human error, Bellingcat requested a second source with access to verify the absence of passport data; this source confirmed and presented us with a screenshot of the “no results” search menu. The only logical conclusion was that Russian authorities had purged the cover persona Sergey Fedotov from the central passport database.

With no access to a passport photo from Russian databases, Bellingcat approached many sources at border-crossing authorities in the various countries where “Fedotov” traveled to, as well as hotels at which Bellingcat’s investigation partners had identified he had stayed. After long persuasion, one of these prospective sources provided Bellingcat with a photograph from a scan of Fedotov’s international passport.

Finding The Real Person behind Fedotov

Based on our experience from prior identifications of GRU officers, we knew that cover identities fell into two broad categories: minimal-change (i.e. only last name, and sometimes patronymic, are changed, leaving date of birth and general region of origin unaltered, as in the cases of Mishkin, Shishmakov, Moiseev), or full make-over (i.e. change of both name and birth data, as in the case of Chepiga/Boshirov). We started the search by testing the minimum-change hypothesis. However, a search in hundreds of residential databases for a “Sergey Vyacheslavovich” with birthdate of 17 September 1973 led to no likely candidates.

As a second step, we tested for only “Sergey” with the same birthdate. This resulted in a large pool of targets, but none of them displayed immediate signs of links to GRU. Last, we decided to search only for people with a patronymic “Vyacheslavovich”, and birthdate 17 September 1973. In our initial search with these criteria in a 2012 Moscow residential database, we found 15 hits, but one of them was of special interest. This person had a listed residential address at Narodnoe Opolchenie 50, which is the location of the dormitory of GRU’s Military Diplomatic Academy. This was Denis Vyacheslavovich Sergeev, born in Kazakhstan, and having a passport issued in Novorossiisk in 2000. Databases of different vintage showed that he, along with his wife and daughter, had been registered as residing at this address no later than 2006, and were still registered at that address in 2012.

Denis Sergeev in a Russian database, showing his date of birth and his military unit’s address. The database has an error with his patronymic, which should be Vyacheslavovich, not Vyacheslav.

The links between Denis Sergeev and GRU were not restricted to his family’s residence at the dormitory of the GRU “Conservatory”. In certain databases his address was listed as Military Unit 22177, which is in fact the military number of the Conservatory. From leaked domestic travel databases, we obtained domestic travel records for Sergeev (he appears not to have traveled internationally under his real identity). On several train trips between Moscow and St. Petersburg, Sergeev traveled on joint bookings with other people, who were registered as residing, or having their cars registered at Khoroshevskoye Shosse 76A, the headquarters of GRU. One companion train passenger had been previously seen by Bellingcat as listed among the people authorized to drive a car owned by Vladimir Moiseev, the GRU officer identified by us as the person behind the persona Vladimir Popov, under which he is on the Interpol red notice list in connection with the abortive Montenegro coup in 2016. This same person, in turn, had traveled multiple times between Moscow and Krasnodar, where the base of the private Wagner military company is, in joint bookings with persons identified as Wagner mercenaries.  Bellingcat has previously reported that Wagner mercenaries had international passports from the same series used for GRU undercover passports, and that seniоr GRU officers frequently travel to Krasnodar’s Pashkovsky airport, sometimes on flights on which known mercenaries are also flying.

Another person who traveled on joint train bookings with Denis Sergeev was also found on 4 different joint airline bookings with Eduard Shishmakov, the GRU officer expelled by Poland in 2014, and also on the Interpol wanted list for his role in the Montenegro coup. The two flew together from Moscow to and from Rostov airport in late 2012; at that time Shishmakov was formally serving as Russia’s deputy military attache in Poland.

To establish conclusively that Sergeev is in fact “Fedotov”, we needed to obtain a photograph of Sergeev and compare it to the already obtained “Fedotov” passport photo. However, this turned out to be nearly impossible.

Concerted cover-up Efforts by the Russian State

While we could find multiple references to Denis Sergeev in offline, aged databases from 2018 and earlier, it appeared that no such person existed in current, online state-run registries. Initially, Bellingcat tried to obtain a photo of Denis Fedotov via several sources with access to the traffic police (GIBBD) database. All sources reported that no such person exists among licensed drivers in Russia. This did not make sense, given that we had already obtained records of Sergeev’s own car, and had also verified that he was listed as an authorized driver for his daughter’s car.  In addition, we had obtained the number and date of issuance of Sergeev’s initial driving license from an offline database.

 

Database entry with Sergeev’s address shown as Military Unit 22177, and with the number and issuance date of his driver’s license

Our hypothesis that Denis Sergeev had been purged from state-run databases – including the passport database – was confirmed via a simple experiment. As we had his domestic passport number from previously obtained documents (including the October 2018 police tracking database record), we tried to obtain Sergeev’s unique tax identifying number via a web tool run by Russia’s tax authority. The tool returned no results. We then tried to obtain the tax number for the other two suspects in the Skripal case. They, too, had vanished from the tax system. Other known GRU officers, whom we had identified previously but who had not been linked to the Skripal case, could still be found using this same tool. Data for the cover identities “Fedotov”, “Petrov” and “Boshirov” had also disappeared from this onlne database.

We then attempted to find traffic fine violations for Denis Sergeev’s car using a web-tool run by the traffic police. We had the exact registration details of Sergeev’s Nissan X Trail, however the online tool informed us that no such car exists.

Last, we checked if travel records for “Fedotov” for the period 2015-2018 were still present in the police travel tracking database (we had previously obtained such records in October 2018). As of February 2019, no such travel records existed in the system. It became evident that the Russian state had implemented a full sweep of data relating to both the real and undercover identities of Sergeev and his other colleagues linked to the Skripal case.

While impeding our ability to find a photo match between Sergeev and Fedotov, this finding gave us the idea to look for other GRU officers who might be linked to the Skripal poisoning, in which case we could expect their data to not be available via the online tax tool. Indeed, we have identified one such additional GRU officer. This officer, notably, traveled to Bulgaria two weeks before Sergeev’s trip which coincided with the poisoning of the Bulgarian arms trader. Bellingcat and its partner publications are currently analysing whether this may be a fourth suspect in the Skripal case.

Alternative Photo Match

While reconstructing Denis Sergeev’s background prior to his studies at the Military Diplomatic Academy, we sought for a person with this name among the most likely recruiting grounds for that institution – Spetsnaz and air-attack paratrooper units, especially ones with actual hands-on military experience. We were able to find a reference to a Capt. Denis Sergeev in a book about the Dagestan events in 1999 described earlier. We also discovered several witness descriptions of the battle in which Capt. Sergeev was wounded, while his commander was killed. One of the references was in an article about a documentary film on the battle in Dagestan.

We found this documentary which was filmed shortly after the events, and saw that Capt. Sergeev was interviewed on camera in several segments. While there were certain similarities between the person in the documentary and the recent photograph from “Fedotov”‘s passport, we could not be certain that this was the same person, especially given the low resolution of the photo and the nearly 20 years between the two events.

Bellingcat then requested a forensic analysis of the similarities between the persons on the passport photo, on one hand, and the screen-grab from the 1999 documentary, on the other. Prof. Hasan Ugail from the Center for Visual Computing at the University of Bradford supervised the analysis, which was conducted using a state of the art deep machine-learning algorithm trained on millions of human faces. The algorithm provides 100% matching accuracy in one to one face comparison tests of known identities. The test provided a match of 78.2%, while a match >70% is sufficient to conclude identity match of the persons.

Further details of the underlying academic work can be found in A. Elmahmudi and H. Ugail, Experiments on deep face recognition using partial faces, in Cyberworlds 2018, IEEE, doi: 10.1109/CW.2018.00071, (2018)

Conclusion

This two-part report identified a third suspect in the Skripals poisoning case, who may also be a suspect in the poisoning of Bulgarian arms manufacturer and trader Emilian Gebrev in April 2015. Sergeev’s undercover travels as “Fedotov” are extensive, and overlap with certain important political events in Europe. His long career profile suggests he is not a mid-rank operative or support personnel for overseas operations, but more likely serves in a supervising function. Further investigations are needed into the purpose of his rich travel history, especially in locations such as Spain, Turkey, Czechia and Tadjikistan.

A key discovery in this report was the unprecedented purge of all traces of both the cover and real persons linked to the Skripal case from public registers in Russia. Such cleansing, which took place after Bellingcat’s initial identification of GRU officers “Boshirov” and “Petrov”, cannot realistically be undertaken without the direct involvement of the Russian state. The only plausible explanation for this data purge is curbing further investigation into the Skripal (and possibly, the Gebrev) incidents, both by media and by foreign law enforcement agencies.

In the course of this investigation, we found that GRU undercover officers assigned to different operations often overlap, with the total number identified by Bellingcat not exceeding 10, many of which overlapping between, for instance, the Montenegro and Skripal operations, as well as other joint operations whose purpose is yet to be identified. This implies that there is a limited elite team of internationally trained operatives that are recycled among various projects.

Bellingcat Investigation Team

The Bellingcat Investigation Team is an award winning group of volunteers and full time investigators who make up the core of the Bellingcat's investigative efforts.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

Support Bellingcat

You can support the work of Bellingcat by donating through the below link:

29 Comments

    • Graham Yuill

      I stated in my investigative dossier CASE FOR THE DEVIL ‘ (see YouTube) according to a hghly trusted and well-placed airline source, it has come to light that GRU intelligence agents have in the past boarded international Aeroflot flights (they initially practised using domestic flights) mainly from its hub at Sheremetyevo airport, wearing hyper-realistic face-masks without the deception being noticed.’ That’s why intelligence agencies are struggling to identify some GRU agents who travel abroad. Look into this as you will be chasing your tail.

      Reply
      • moist_towel

        I used to work there and you are completely right my dude. I can confirm I saw one of the dude’s face slipping like it was being peeled off. Shoulda used gorrilla glue instead of the offbrand crap amirite?! Or it could just be the fact that he was insulting my family with his looks so I clawed at him. Anyway, I’m not an expert, but the nerve ‘gas’ used (deception, it is actually a viscous liquid) was proven in peer-reviewed articles to be ancient rosicrucian holograms conjured up by the sacrifice of certain small forest animals. Check out the full remastered truth (and many more exciting things!) at nudecelebsforfree.tk otherwise you wil most certainly be going on a wild duck chase like we all did with benghazi. research tower 7 vote jill stein 2019 peace out

        Reply
  1. Rob

    Very impressive detective work, Bellingcat. Amazing you could still find this guy with so little information to start with.

    Also, I find it ironic that the Russian state purging the info on these guys actually is further vindication of your findings. You got them good.

    Thank you for your amazing work. Respect !

    Reply
  2. kraaiiii

    well apparently the fixed his broken, nose, chin, jaw line and damage lip or something, and fatten his face up, this must be the worse facial match ever.

    Or Russia has the best plastic surgery

    I now understand why the all the images are blurred 🙂

    Reply
      • kraaiiii

        attack the argument not the person, congratulation you’re the troll here

        hell even the earlobes don’t match

        and again

        ”between the person in the documentary and the recent photograph from “Fedotov”‘s passport, we could not be certain that this was the same person, especially given the low resolution of the photo and the nearly 20 years between the two events.”

        Reply
        • Servus

          Oh “kraaiii”, your thirst for knowledge can be satisfied !

          What your quote says is that comparing the two photos with a “naked eye” is difficult, but we humans can be assisted by AI computer algorithms.
          The next few lines after this quote explore this possibility but maybe the bridge between the two omitted some pedagogical steps.

          There are some face characteristics called “biometric invariants” things that don’t change depending on images’ lighting or even subjects’ age, like say distance between the eyes in proportion to the face’s length (I’m making it up just to make a point, there is a vast literature in this subject). The AI face comparison algorithms find these invariants and thus are capable of high reliability comparison between the two photos.

          Please read few more sentences after your quote from the article, I promise, it’s worth it.

          You may also look at:
          https://scholar.google.com/scholar?q=invariants+face+properties&hl=en&as_sdt=0&as_vis=1&oi=scholart

          Reply
  3. furoley

    Congrats! You hit Russia in its weakest spot – the lack of endurance and integrity. They might be winning in a single flash action, in the random spark, random attack, but they will always lose against time and constant force and systematic approach.

    Remember, this country lives day by day with crazy swing in politics, media directions, and constitution being re-writen almost daily like Facebook comments. Nobody can do long term business here no matter how hard they would try. So they will always lose against any effort that last year’s, against any integrity exceeding their own.

    Time is working against them like against any inadequacy.

    Reply
  4. concerned citizen

    “We then attempted to find traffic fine violations for Denis Sergeev’s car using a web-tool run by the traffic police. We had the exact registration details of Sergeev’s Nissan X Trail, however the online tool informed us that no such car exists.”

    Well first of all the web tool doesn’t work. Just sticks on refresh.

    Second of all, I’m not really understanding why there would be a web tool where any member of the public can look up a car registration number and get information about fines against that vehicle. What’s the purpose of that? Or is bellingcat just making it up? No way to check, because whatever the tool is, it doesn’t work.

    Third, why would a tool for ‘checking traffic fines’ tell you if a vehicle exists or not?

    This isn’t credible. In the US or UK the general public can’t ‘run plates’ via a website. Only the police can do it. I don’t think Russia will be any different.

    Reply
  5. concerned citizen

    Oh and even on the mysteriously blurry photo with the added pattern, you can see that the eyebrows just aren’t the same as the actual Capt. Sergeev.

    Guess that’s why on this occasion bellingcat had to use this Professor Ugail guy, rather than one of the many free face matching online tools.

    Reply
    • Servus

      ..while waiting for really competent people to stop laughing and fancy answering:

      “It doesn’t work and it doesn’t/shouldn’t even exist” – did we hear it before ?
      *Well first of all the web tool doesn’t work. Just sticks on refresh.*
      *why there would be a web tool *
      You have simply stated that you cant make it work or you use browser that this tool is not designed for or that tool is buggy. What’s new ? Lots of web applications have issues that intelligent people find ways compensate for.

      “I’m not really understanding why there would be a web tool ” – here you simply express irritation over your own ignorance, hardly fault of Bell?gcats.

      Funny variation on old theme “if it even existed it does not work”
      *No way to check, because whatever the tool is, it doesn’t work.*

      *Third, why would a tool for ‘checking traffic fines’ tell you if a vehicle exists or not?* – lets be clear, the tool should not exist and it does not work anyway, so why this interest in it’s not working functionality ? Maybe it does not work in ways that you are ignorant about ?

      “This isn’t credible. In the US or UK the general public can’t ‘run plates’ via a website. Only the police can do it. I don’t think Russia will be any different.”

      Well, this would not the most important differer between Russia and very different world of Western countries.

      How about mean life expectance
      United Kingdom80.96 years


      United States of America
      78.69 years


      Russia
      71.59 years

      Reply
    • Servus

      .. while waiting for really competent people to stop laughing and fancy answering:

      “It doesn’t work and it doesn’t/shouldn’t even exist” – did we hear it before ?
      *Well first of all the web tool doesn’t work. Just sticks on refresh.*
      *why there would be a web tool *
      You have simply stated that you cant make it work or you use browser that this tool is not designed for or that tool is buggy. What’s new ? Lots of web applications have issues that intelligent people find ways to compensate for.

      “I’m not really understanding why there would be a web tool ” – here you simply express irritation over your own ignorance, hardly fault of Bell?gcats.

      Funny variation on old theme “if it even existed it does not work”
      *No way to check, because whatever the tool is, it doesn’t work.*

      *Third, why would a tool for ‘checking traffic fines’ tell you if a vehicle exists or not?* – lets be clear, the tool should not exist and it does not work anyway, so why this interest in it’s not working functionality ? Maybe it does not work in the ways that you are ignorant about ?

      “This isn’t credible. In the US or UK the general public can’t ‘run plates’ via a website. Only the police can do it. I don’t think Russia will be any different.”

      Well, this would not the most important difference between Russia and very different world of Western countries.

      How about mean men life expectancy ?
      United Kingdom 79.20 years (13.7 years difference)
      ‌United States of America 76.10 years (10.6 years difference)
      ‌Russia men 65.5 years

      *Oh and even on the mysteriously blurry photo with the added pattern, you can see that the eyebrows just aren’t the same as the actual Capt. Sergeev.*

      – So you confirm it’s captain Sergeev, thanks, invalidates your objections though…
      Anyway, the photos have different lightings and there are few years between them, look up following photo gallery, and the ladies nose, depending on lighting, can be small, big, very big, crooked…Portrait lighting is an art in itself.

      https://www.google.com/search?q=margaret+thatcher+portrait

      Keep it coming, good laugh is always welcome.

      Reply
    • kraaiiii

      if it only was the eyebrows, the really clutching on straws here

      i says it all

      ”between the person in the documentary and the recent photograph from “Fedotov”‘s passport, we could not be certain that this was the same person, especially given the low resolution of the photo and the nearly 20 years between the two events.”

      Reply
  6. concerned citizen

    “– So you confirm it’s captain Sergeev, thanks, invalidates your objections though…”.

    Obviously ONE of the photos is Captain Sergeev. The problem is the other photo, claimed to also be him, doesn’t really look like him.

    That’s why bellingcat had to dredge up an obscure professor from an obscure university to fit a square peg into a round hole.

    Reply
  7. Servus

    RE: Concerned citizen (of RF ?)

    “Obviously ONE of the photos is Captain Sergeev. ” Thank you, you may sit down.

    ..and, quite few professors of obscure universities are Nobel prize winners…and some even Russians .-)))

    Reply

Leave a Reply

  • (will not be published)