the home of online investigations

Suspected Assassin In The Berlin Killing Used Fake Identity Documents

August 30, 2019

By Bellingcat Investigation Team

What we know so far

Last Friday, 23 August 2019, Zelimkhan Khangoshvili, a Georgian citizen living in Germany, was assassinated in downtown Berlin while having lunch on the way to a mosque for Friday prayer. Khangoshvili was assassinated with three bullets, two of them fired at close range at his head. The killer, who was hiding in the nearby bushes, rushed toward the victim on an electric bike and shot the victim — once in the shoulder and twice in the head — using a 9mm Glock 26 with an attached silencer. After speeding away from the crime scene for a few hundred meters along the Spree river, the assassin stopped and jettisoned the electric bike, a plastic bag with the murder weapon, and a wig he was using, into the river. In doing so he was observed by two teenagers who alerted the police. Their tips lead to the killer being caught a few minutes later, just as he was disappearing into a crowd of tourists – now sporting a clean-shaven head, a mustachioed face, a pink t-shirt, and a touristy pouch holding his passport and some cash suspended from his neck.

Media has reported that the suspect, who has so far been publicly referred to as Vadim S, 49, initially travelled by air from Moscow to Paris on a French-issued visa, before crossing into Germany six days before the murder. He has reportedly denied any involvement in the murder and has requested to meet Russian consular officials.

The victim was an ethnically Chechen Georgian citizen who had long been on the list of Moscow’s declared enemies. Having volunteered to fight against the central Russian armed forces in the second Chechen war in 1999-2002, he continued supporting Chechen separatists while based in his native Pankisi Valley in Georgia in the ensuing years. He also recruited and armed a volunteer unit to fight against Russia’s war in Georgia in 2008, although there is no evidence that his unit ever saw action before the war had ended. In 2012, Khangoshvili reportedly played the important role of mediator during the Lapota incident, when a group of armed Chechens took several people hostage in a remote mountain region of Georgia. Despite no evidence of Khangoshvili espousing Islamist ideology or supporting Islamist causes, Russia has repeatedly branded him as an Islamic terrorist threat. While fighting alongside Islamists during the early stage of the Second Chechen War, Khangoshvili was later known to be close to Aslan Maskhadov, the former Chechen president (killed in 2005) who was known as a moderate and nationalist rather than an Islamist.

At the time of his murder, Khangoshvili was awaiting the outcome of his appeal to deportation proceedings in Germany, where he sought political asylum with his family, having been the object of two assassination attempts in Georgia (the last one in May 2015 when he was shot in Tbilisi), and having received multiple threats while temporarily seeking refuge in Ukraine. Russia has officially disowned any link to the assassination attempts.

Photos posted on Khangoshvili’s Facebook profile. The left image was taken during the Second Chechen War and shows him together with Aslan Maskhadov, the last president of a de facto independent Chechnya

A joint investigation between Bellingcat, the German newspaper Der Spiegel, and The Insider (Russia), has established that the assassin travelled to Berlin via France under a validly issued, non-biometric Russian passport in the name of Vadim Andreevich Sokolov, born in August 1970. Despite the fact that he used a legitimate passport, we have determined that no such person exists in Russia’s sprawling, comprehensive national citizen database. In addition, no trace of such a person exists in a trove of hundreds of leaked residential databases, previously obtained and aggregated by Bellingcat. This discovery makes Russia’s claims that the killer is not connected to the Russian state implausible, as no person in Russia is in a position to obtain a valid Russian passport under a fake identity without the involvement of the state bureaucratic and security apparatus.

In addition, we have identified that the address given by the killer in his visa application as his residence in St. Petersburg does not exist. This glaring inconsistency, and the generally blank digital and data footprint of the Russian “ghost traveler” raises serious questions as to how and why he was able to obtain a multi-entry Schengen visa issued by the French consulate in Moscow.

A Phantom Tourist

Using the passport data from Sokolov’s visa application papers submitted in Russia and obtained by our team, we sought to identify the presence of this person in various Russian live and offline databases. We verified via two separate sources with direct access to the Russian Passport database that no person with the name Vadim Andreevich Sokolov and the birthdate used in his passport exists in that database.

Photograph of Vadim A. Sokolov from his visa application papers

The Russian Passport database is a centralized, comprehensive database containing residential address and passport data of all Russian citizens — including the full history of prior personal identity documents — maintained by Russia’s Ministry of Interior. Likewise, no presence of this person was found in another police-maintained database that tracks domestic and international travel of all Russian citizens, nor in the traffic police’s database of driving license owners. We have also searched hundreds of previously leaked offline passport, residential-address, insurance and employment databases, including ones with data as recent as 2018, and have found no evidence of a person with such personal data.

At the same time, for this man to have travelled via airplane from Moscow to Paris on an ordinary passport, he would have had to go through passport control, where his passport would have been scanned and automatically checked against the Russian Passport database. Any inconsistency — such as a missing record in that database — would have triggered the border officer’s alarm system, and the person would not have been authorized to proceed. There can be only two feasible scenarios that explain this inconsistency: either “Vadim Sokolov” was known to border officials as an undercover operative, and they were instructed to let him proceed, or alternatively, at the time of the trip — that is, on 31 July 2019 — Sokolov was still in the Russia Passport database.

Both scenarios are technically possible. The Russian immigration (border-control) system is supervised by the Federal Security Service (FSB), thus special arrangements could have been made for “Sokolov” to bypass the routine airport verification procedure, especially if the operative was FSB-linked.

Equally possible, and more consistent with prior practice, would be the second scenario, in which a cover identity was fully created for “Sokolov” — including a database entry in the Russian passport system — but was purged from Russian government databases shortly after news of the arrest in Berlin broke. In the case of Skripal-linked GRU officers previously identified by Bellingcat, the three undercover GRU operatives originally had dual presence in the Russia Passport database: both under their real and under their cover identity. Shortly after their public outing by Bellingcat, however, both their undercover and their true identities (including their immediate family members data) were purged from the Russian Passport and other government-run databases, creating several “ghost” families with no passport, residential ownership, or even tax information (in fact, apartments previously confirmed by us as owned by Col. Chepiga and Col. Mishkin, the main Skripal suspects, are now listed as owned by “the Russian state”).

Whether the first or the second scenario was used in the case of “Sokolov” might provide a clue as to which of the two main, and often competing, security services are linked to this brazen assassination operation. As outlined below, both agencies, the FSB and the GRU, would have felt entitled to pursue such an extrajudicial killing, albeit for different reasons.

What is certain, however, is that the cover identity behind “Vadim Sokolov” was created very recently, and was most likely custom-made for the specific operation in Berlin. This can be inferred from the absence of any digital footprint on this identity in previously leaked databases (for comparison, both “Boshirov” and “Petrov” — the cover identities behind the Skripal suspects — did show up in older offline databases). This conclusion is also consistent with the unusually recent date of issuance for “Sokolov”’s passport – 18 July 2019, only ten days before the planned trip. We have also verified — via sources with access to non-Russian airline booking databases — that a person with this name and birth date has not traveled to any European destination in the past 6 years, nor has obtained visas to any Schengen states. All of this implies either an ad-hoc operation following newly obtained information on the target’s whereabouts, or the use of a “single-use”, non-staff assassin. As discussed below, this latter hypothesis may prove true due to the certain peculiarities regarding the man now in German custody.

Passport Clues

In previous investigations, Bellingcat has identified batches of sequential passport numbers issued to GRU officers in different years. The passport number used for Sokolov’s passport cannot be matched against these batches, as it was issued only in July 2019, and we have no empirical data of other GRU officers with fresh passports. However these batches were all issued by the same Moscow “central” unit of the Federal Migration Service (now integrated into the Ministry of Interior) that apparently issued “Sokolov”s passport.

“Sokolov”’s number is also like the other GRU officers’ passports in another way: it is a passport of the “old” type — i.e. without embedded biometrical data. While in 2009 Russia introduced biometric passports, and they are the default choice when applying for a new travel document, “old-style” passports are issued upon request, usually in emergency situations when the applicant has no time to wait for the fingerprint encryption and printing process. All internationally active GRU officers identified by us thus far (numbering more than 20) and “Sokolov” opted for the old-style “paper” passport, most likely due to the risk of a clash between the undercover persona’s fingerprints with pre-existing fingerprint data of the real person. In “Sokolov”’s case, this may also have been the reason, or it may have been the unavoidable consequence of a rushed operation, as the lead time to receive a biometric passport is at least one week.

An Express Visa For a Ghost

Our joint investigating team was able to obtain most of the suspect’s passport data from a source with access to visa-linked documents submitted by “Vadim Sokolov” in Russia. The document shows that the suspect applied for an express visa at the French consulate in Moscow on 29 July 2019 — just 11 days after he received his non-biometric passport. He requested a multi-entry, 6-month visa, that would provide him with unlimited reentry access to any of the 26 countries of the Schengen area. Unusually, and boldly, he indicated that his planned date of travel is 30 July 2019 — literally the day after his visa application date. In addition, he indicated that he planned to stay in France for the maximum permitted 90-day period during his six-month visa, stating that he plans to travel in and out of France until 25 January 2020.

Despite such bold aspirations — the requested visa duration and reentry terms are the maximum that can be issued to a first time traveler, and the lead time to travel is unusually short — “Sokolov” had little to show in terms of a traceable background in Russia. His passport showed he was born in the Siberian city of Irkursk, but he indicated his place of residence as “Alpiyskaya Street 37” in Saint Petersburg. There is no “Alpiyskaya Street” in St. Petersburg, although there is an “Alpiyskiy Pereulok” (Alpiysky Lane), and at number 37 of that lane there are 3 upscale residential apartment building clusters, each cluster with a separate sub-address (corpus 1, 2 or 3) that would typically be stated in when providing an address.

Photograph of one of the three apartment-block clusters located at Alpiyskiy Lane in St. Petersburg as seen in Yandex Maps

The only place in the vicinity of St. Petersburg that does have an actual “Alpiyskaya Street” is a nearby town named Kudrovo, just outside the city limits. However, there is no number 37 on that street either.

Satellite view of Alpiyska Street in Kudrovo showing all house numbers

In his application, the suspect also listed his occupation as “senior company employee”, although the document reviewed by the investigating team did not contain the name of the company he claimed to be employed by. It is not clear if he provided the name of the company to the French consulate.

As a point of contact in France — which is a mandatory requirement for visa applicants from Russia — the suspect listed the name of the mid-range Practic hotel in Paris. As of press time, we have been unable to receive feedback from the hotel management as to whether they were in contact or aware of this person, or whether he used the hotel as an intended place of residence during his trip into France. A hotel receptionist, upon being shown a photograph of the suspect, said they had not seen this person at the hotel.

Given that the suspect does not have any digital or data footprint in Russia, listed an incomplete or false address and employment data, had a freshly issued passport, and had not travelled to Europe at least since 2013, it is puzzling that the French Ministry of Foreign Affairs, ultimately in charge of deciding on visa requests, decided to honour the application in full and issued the multi-entry visa with no detailed review and no waiting period. Bellingcat has previously reported on the nominally draconian, but empirically porous visa application system for Western Europe that has enabled Russian spies with fake identities and no data footprint to obtain multi-entry visas and unrestricted European travel for almost a decade.

An Unusual Suspect

The report on the detained suspect, according to German security sources interviewed by our joint team, describe him as 176 cm tall and weighing 86 kg. Notably, the report also states the suspect has three tattoos on his body: a crown and a panther on his upper left arm, and a snake on the lower right arm.

Vadim A. Sokolov, left an original image obtained in the course of the investigation, right a version of the same image with digital removed beard

The presence of tattoos on an assassin’s body is unusual in the context of a Russian security service operation. Russian security services do not permit their staff officers to thus decorate themselves. This suggests that the suspect is not a staff officer, or that he was permitted to have tattoos as part of a long-term embedded undercover operation. One possible explanation might be that the suspect was a former convict who was coopted by one of the secret services, as the style of the described tattoos is consistent with a special and severely “regulated” body decoration nomenclature known as “prison tattoos”. However, without further information or images of the tattoos — such as whether they are in monochrome or color — it would be impossible to assess if the suspect’s body art is of the “prison tattoo” variety.

It is not unprecedented for the Russian security services to resort to freelancers or even ex-convicts as assassins, as shown by at least two recent examples of (attempted) extraterritorial killings in Ukraine. In one case, an FSB-handled former drug-enforcement officer who had been indicted on corruption charges was sent to Ukraine to organize a car-bomb assassination of a member of Ukrainian military intelligence. In another, a Ukrainian prison official was recruited by Russia’s GRU to assassinate a former Ukrainian artillery officer who had advised Georgian military forces during the 2008 Russia-Georgian war. However, it would be a precedent for a Russian security service to use a freelancer in Western Europe.

Who Gave the Orders?

The complex past of the victim leads to possibilities that he may have been assassinated in an operation led by either of the FSB, the GRU or even Ramzan Kadyrov’s own security apparatus. Due to his involvement in the Russo-Chechen war, and the more recent qualification as an “Islamic threat”, he would have been in the cross-hairs of the FSB capture or kill list.

On the other hand, his involvement in the war and his support for Georgians in the Russian-Georgian war, would have made him a revenge-assassination target for the GRU, as paralleled by other assassinations of former armed-conflict adversaries from Russia’s near-abroad – which, in the eyes of the Russian military, is tantamount to treason. Separately, his Chechen background, and the fact that he sided with Aslan Mashadov during the Chechen war, would have pitted Khangoshvili against Ramzan Kadyrov’s clique.

Indeed, most of the assassinations of ethnic Chechens overseas in the last 10 years has been perpetrated by Chechen emissaries acting in the name of Kadyrov, sometimes — as in the case with the June 2017 assassination attempt on Ukrainian citizen Amina Okueva (who did not survive a follow-up assassination attempt that same year) in Kyiv — traveling under cover, non-Chechen identities.

Whatever the answer is, the access to a valid, Moscow-issued passport, and the immediate and comprehensive purging of the any data linked to the cover identity “Vadim Sokolov” is a clear indication of the state involvement in this extraterritorial assassination, similar in brazenness and lack of plausible deniability to the Skripal case.

Bellingcat and its investigative partners will continue to investigate this story, seeking to identify the actual identity of the person traveling under the “Sokolov” persona.

Bellingcat Investigation Team

The Bellingcat Investigation Team is an award winning group of volunteers and full time investigators who make up the core of the Bellingcat's investigative efforts.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

Support Bellingcat

You can support the work of Bellingcat by donating through the below link:

66 Comments

  1. Phil Otayce

    Fascinating story, great work. Extra-judicial killings are grown so fashionable…Obama/Brennan were fond of them; Trump even more so. And Putin, well, we know his resume. Poor Chechnya…if Gorbacev could’ve held on a little longer, would it’ve been more like the Czech Republic today?

    Reply
  2. Ukrainian speaking Russian

    Can you just assume that there may be a possibility of just a criminal murder by some Russian mafia? Why do you think that in corrupt Russian system it’s impossible to buy foreign passport?
    I’m not protecting GRU or any other government service, just curious why the above assumption is not even considered.

    Reply
    • boris_k

      “Russian Mafia?” Are you still living in 1990ies years? After 2000-2003 there is no mafia in Russia except FSB. (GRU is, though formally independent secret service, de facto under the control of FSB as well.) A “corrupt” Russian officer who would issue a foreign passport without FSB agreement, might already order his own coffin.

      Reply
      • Ukrainian speaking Russian

        You’re so naive.
        > there is no mafia in Russia
        Are you living in paradise where pink ponies fly together with unicorns?
        Wake up, mafia was in Soviet Russia, in 90s and it’s not going anywhere now. Just check any recent thief in law news. There’re constant gunfights in Moscow and Saint Petersburg.

        Reply
        • N. Quirin

          The Russian mafia is subordinated to Russian secret services. And this is very useful for both sides.

          Reply
          • Ukrainian speaking Russian

            You can say the same for every mafia, not just Russian, but mafia stays mafia. I got the point of majority of commenters here: no need for any reasonable proofs – Russian secret services are always guilty, no matter what the case is.

  3. M

    one Islamic rebel less ..
    he was not an innocent dissident who had to flee from
    the country for standing on the street with catchy banners against a government

    Reply
    • Servus

      Expected twist by our friend Misha, the victim was not worth living and got what he deserved, even comrade Putin would say similar things about Mr Skripal.
      There is no doubt that bandits kill for a reason. The non-criminal part of the society does not accept these reasons nor the murder itself.

      Reply
  4. M

    Not Misha , not a male 🙂 and I am not from Russia

    back to the topic : the Germans did not consider him a freedom and democracy fighter because they did not grant him asylum – think about it.

    Reply
    • Servus

      Sorry Masha,

      So you think it’s OK to shoot a man on a street just because he did not get political asylum in Germany ? This twist is particularly disgusting.

      Reply
      • M

        extremists, terrorists, religious fanatics on a mission from Allah should be “knock on the head”

        Reply
        • Servus

          If I understand right you are simply an Islamist but of a different obidiance than the victim, the right one, or at least you sound like one,, may guess, the Kadyrov variation?

          Reply
          • lmao

            If we’re playing name-based ad hominem my caricature of you “service” is your name means you’re a “refugees welcome” variety German happy to be “serviced” by a bearded Hamburg cell type of salafi. 🤩

  5. M

    I’m an atheist and in my opinion, every religion taken too seriously, dogma blindness etc. is dangerous.

    PS Servus you have a sense of humor, dry wit but you also have a serious problem, downright obsession with spies and trolls 🙂

    Reply
    • Servus

      …wanting to kill all extremists does not make of you the moderate, rational person you probably think you are, but rather one of them, think about it.

      A human being was shot dead in Berlin by an agent of the Russian Federation, this is shocking and unacceptable.

      Reply
      • M

        ..if it was a murder commissioned by special services,
        if he was on the hit-list,
        if he was an enemy of Russia or Kadyrov – special agent could kill him ..
        but you now this is what the special services do 🙂 Mossad eliminates Israel’s real and alleged enemies ; CIA similarly and so on

        Reply
        • Servus

          … so why not let FSB have a piece of action and murder little now and then…. let’s be reasonable…. for the sale of symmetric hypocrisyies…

          And we have this assasination team, real professionals, so, it’s normal that they kill.

          Masha, these are standard arguments, nice that you know the classics, you just forgotten to add that ‘v amerikie’ they persecute Black people.

          Mossad’s or CIÀs or any others’ crimes don’t justify FSB ones.
          Cosi fan tutte – is not a valid argument.

          Reply
          • M

            Servus, this zealousness in combating a rotten enemy will not give you anything – you will not get engaged even in the traffic police not to mention the more serious services 🙂 you see Russian everywhere – probably also when shopping for groceries, also the Russian intelligence is spying on you. Cool down

          • Servus

            In my part of the world, people do things for the fun of it, difficult to understand, right? You see a conspiratorial purpusses around thus the ´projection’ about the services.
            …and I can’t help seeing logical errors in your argumentation ; your speciality is ´Non sequitur´,
            think about it Masha, this can drive mad people around you.

  6. maarten

    This is not an open source investigation.
    PNR data is not accessible for Bellingcat, only for secret services.

    Reply
    • Black Star

      It is. This and several previous Bellingcat articles have information taken from leaked Russian passport and other citizen registers. Apparently they are copied and sold by probably low level officials who have access them and who need a little extra money.

      Reply
  7. Tom Wonacott

    If I was a betting man, I would bet on Kadyrov being behind the assassination. The leader of Chechnya is a loose cannon and his government has been accused of torure amd murder of gays and dissidents. Imagine how he might feel about a Chechen traitor. Here is what he said to fellow Muslims in Dagestan about a border dispute (Chechen Leader Threatens to Break Fingers, Tear Out Tongues of Online Critics https://www.themoscowtimes.com/2019/06/13/chechen-leader-threatens-break-fingers-tear-tongues-online-critics-a65983):

    “……..“If you insult my blood, my race or my people, this is most significant for me. So keep your tongue and your fingers in check, otherwise we will break your fingers and we will tear out your tongue,” Kadyrov said. “You know me well, I love to keep my word.”……”

    The pleasant Kadyrov is an ally of Putin and has a free hand to rule with an iron fist in Chechnya.

    Reply
  8. Alex

    A lot of innocent people get killed by lunatics,Islamists,serial killers,for drug trade….etc Every day,in Europe. Young people who did nothing die for no reason
    . I don t Know background of this victim,but if somebody or some organisation gave order to eliminate him physically,there was probably a serious reason.as described he was not an angel and was close to islamist leaders .So,it s interesting invastigation but we all know that action services exist in every country to perform such (regrettable) act.The ideal world doesn t exist yet .

    Reply
  9. Jar

    Would be a scenario possible, that this person left RU with another valid passport and after landing in France pulled his “fresh” Sokolov passport and went through french immigration under this Sokolov identity?

    I never observed that immigration was asking for the boarding pass but I’m not sure, maybe they are checking the names of persons entering the country against the names of passengers provided by the airlines (?)

    Reply
    • Servus

      Not likely, it was not a Schengen flight, typically airlines check passengers’ visas because they will have to send back passengers with invalid visas or passports. He must have entered France as ‘Sokolov’ anyway.
      Leaving Russia with different passport would create an easy to detect discrepancy between passenger list and French entry records, with need to create yet another false identity, so highly unlikely.
      The murderer’s true identity will be known soon, just a question of time…

      My guess ‘Orlov’ . -))))

      Reply
      • N. Quirin

        What about possibility to proceed trough the Russian passport control with another passport (either ‘correct’ Russian or foreign)? In this case no discrepancy is created unless the airline checks which identity of the passenger was revealed at the passport control.

        Reply

Leave a Reply

  • (will not be published)