the home of online investigations

You can support the work of Bellingcat by donating through the following link:

Identifying The Berlin Bicycle Assassin Part 1 – From Moscow to Berlin

December 3, 2019

By Bellingcat Investigation Team

  • In its previous joint investigations with Spiegel, The Insider and Dossier Center, Bellingcat has reported that the person held by German authorities over the murder of Zelimkhan Khangoshvili in Berlin traveled from Moscow to Germany under a fake identity.
  • We established that the suspected assassin’s passport, issued under the name Vadim Sokolov, born 20 August 1970, was issued to a non-existing persona. We identified that the earliest reference to that identity in Russian registries was in September 2015 when this “person” received his first domestic passport, aged 45. “Vadim Sokolov” was assigned a tax identification number only in July 2019, days before applying for his Schengen visa on which he traveled to Paris, Warsaw, and then to Berlin.
  • We concluded that the issuance of valid domestic passport, tax ID and a international travel passport to a non-existing persona could not have happened without the direct involvement of the Russian state, and thus implicates Russian security services in the assassination in Berlin.
  • Spiegel reported on Tuesday that the Federal General Prosecutor Peter Frank has reached a conclusion that the Russian authorities likely ordered the Berlin murder. As a result, the Federal Prosecutor’s office is expected to take over the case from the Berlin investigative office in the next few days.
  • Spiegel also reports that the German authorities were able to identify the true identity of the killer through matching him to a Russian citizen previously wanted by the Russian state on an Interpol red notice, which however was later withdrawn. That person had been wanted over the murder of a Russian businessman in 2013.

Independently from the findings of the German authorities, our investigative team has independently verified that the real identity of the Berlin assassin who traveled under the fake identity of Vadim Sokolov is in fact Vadim Nikolaevich Krasikov. Vadim Krasikov was born on 10 August 1965, and not in 1970 as per his cover identity. In 19 June 2013, Krasikov was the key suspect in the murder a Russian businessman who had been the subject of several previous assassination attempts. The murder in Moscow was similar in many respects to the Berlin assassination – the killer had approached his target on a bicycle, had shot at him with a hand gun at close range, both in the back and in the head, and had left on his bike.

Russian authorities were able to identity the suspect using a description from an incidental witness, and video footage from parking lot security cameras that had captured the murder. In early 2014, Russia initiated a national and international search for the suspect – who they identified as Vadim Krasikov. An Interpol warrant was also issued by Moscow. However, just over a year later, in July 2015, the Interpol notice and national search warrants were withdrawn, implying that the suspect had been detained, or alternatively no longer a suspect in the crime. The criminal investigation into the Moscow murder itself has not been closed and no other suspects have been named.

Airline booking data reviewed by Bellingcat shows that a year after the termination of his search warrant, Krasikov resumed air travel across Russia, with multiple trips to occupied Crimea and even to a neighboring Central Asian country. This is further evidence that at that point in time Krasikov was no longer wanted by Russian authorities, who would have been aware of his travels, including border crossings.

In the meantime, nearly all records of the existence of the suspect Vadim Krasikov has been purged from Russian state databases. A criminal case file in his name does not exist in the central police database, despite multiple references to the crime and his role as a wanted suspect remain in archived databases reviewed by us. There are no current records of driver’s licenses held by this person while, again, older archived data sources show that he did own a car and had a driver’s permit. No entry exists for Krasikov in the social insurance contributions database. The only proof of his existence is a valid passport in his name in Russia’s central passport database.

Left, “Vadim Sokolov”‘s photograph from his Schengen visa application. Right, a colourised archived photograph from Vadim Krasikov’s driver’s license. Face comparison made with Microsoft’s Azure facial recognition software shows a match with a very high confidence factor.

The fact that Krasikov’s search warrant was silently withdrawn, the purging of data in relation to Krasikov – including to any criminal proceedings involving him – from current Russian databases, as well as the fabrication of a full set of parallel data for a non-existing persona confirms our earlier conclusion that the Berlin assassination was a state-sponsored act. The alternative hypothesis of an organized crime project is contradicted by a set of wide-ranging, consistent administrative interventions that could only be implemented by a state actor.

The Moscow Murder

In the wee hours of 19 June 2013, an entrepreneur from Russia’s North Caucuses republic Kabardino-Balkaria was parking his car at a lot near his Moscow apartment. Albert Nazranov, who owned a restaurant chain and the central marketplace in the region’s capital Nalchik, had been the target of several assassination attempts, including an improvised explosive device that went off during his morning run just eight months prior. Thus he became wary when a man wearing an unseasonable hat approached him on a bicycle just after he locked his car. Nazranov tried to preemptively attack the assailant, managed to push him off the bike and started running away. The cyclist, pulling out a Makarov gun, caught up with Nazranov, and after a short chase and an initial misfire, was able to fire five bullets into the victim, with one shot in the chest and another in the head, both at close range.

The murder was caught on the parking lot’s security cameras and was broadcast by several Russian TV channels later that day.

After an initial flurry of news coverage of the blatant bicycle murder in the summer of 2013, no further news of the investigation into the case found its way to Russian media. The last news reference to the murder quotes a law enforcement source who said that the murder was a contract killing and that police has launched a search for a “slim man of average height wearing a hat“.

Our review of previously leaked databases containing crime and search warrant data show that on 29 January 2014, Russian police launched a nation-wide search for Vadim Krasikov in relation to a murder committed on 19 June 2013. The measure sought by the police was “arrest”. The archived data also shows that the search warrant was terminated on 26 June 2015 via “circular decision 349/2015”. The record also shows that the information about the search termination was entered into IBD (an integrated database of the Russian police showing each resident’s prior criminal history, including initiation and termination of any criminal proceedings) on 15 July 2015.

Several sources with access to Russia’s IBD database have confirmed to us that as of this moment, no entry for Vadim Krasikov exists. The circular decision referenced in the archived data can also not be found. This is highly unusual and implies that his entry was purged post factum, as a record for Krasikov would need to exist in the IBD system even if he would have been fully exonerated, or his status of suspect had been reversed.

Shortly after the federal search warrant was issued by Russian police, Russia filed an international “red notice” search warrant with Interpol. Three European police sources from different countries have confirmed to us that an international arrest warrant was entered by Interpol’s Moscow office in 2014, but was revoked in 2015. The photograph submitted by Russia to Interpol in 2014 shows a definitive match to the face of the Berlin assassination suspect “Vadim Sokolov”.

Left, Vadim Krasikov’s photo as provided by Russian authorities to Interpol in 2014. Right, “Vadim Sokolov” visa application photo 2019

There has been no further public information on the status of investigation into the June 2013 Moscow murder. A search in Moscow court databases for the criminal case file listed in the initial (archived) Russian search notice does not yield any results.

Who is Vadim Krasikov

Vadim Nikolaevich Krasikov was born on 10 August 1965 in the town of Kenes-Tobe in the southernmost area of (then) Soviet Kazakhstan. In the 80s his family relocated to Buryatia, a mountanus region in Eastern Siberia, close to the border with Mongolia. In the late 80’s Krasikov got married and had two children before relocating to the southern Siberian city of Irkutsk.

He remarried and settled in a small town near Moscow in 2009. Bellingcat and its partners are still investigating his actual activities during the period prior to the Moscow murder, as well as his possible linkage to military or security services before or after the assassination in Moscow.

 

More details on Vadim Krasikov’s activities in the period between the 2013 murder and his re-emergence in Berlin in 2019, as well as details on the state support structure that enabled his trip to Berlin will be published in Part 2 of this investigation.

 

Legal Implications

The findings that the Russian state terminated domestic and international search warrants for Vadim Krasikov, and then facilitated the issuance of a new, false identity to the same person, provides further convincing evidence that the Russian state was involved in the planning and facilitation, if not gave the mandate for the assassination of a foreign citizen on German territory. Furthermore, Russia has failed to provide information on the actual identity of the suspect detained by German police following the murder, despite Germany’s request. It is implausible that Russian investigative authorities would have been unable to immediately identify the person based in the photographs and fingerprint data normally provided by the German authorities under mutual legal assistance procedures. Even if the suspect’s fingerprints had not been stored in Russia’s central database – which would improbably imply he was never captured before his warrant was revoked – a reverse face image search using Russia’s police comprehensive SORM system would have provided an immediate match. By all public accounts, Russia has failed to provide this information to the Berlin authorities.

If Germany’s Federal Prosecutor’s Office indeed takes over the case from the Berlin office, this would be a direct recognition that Germany’s investigative authorities no longer treat this crime as a regular criminal offense. Under German criminal procedure, such an escalation would be exceptional – under a procedure of besondere Bedeutung which would be applicable either in the case of terrorism or in the case of a state-actor involvement. Based on reports in the German press, the latter conclusion has been reached by the Federal Prosecutor.

In turn, a recognition of state involvement would result in an unprecedented case of Russian authorities being accused of carrying out an extraterritorial – and by definition political – assassination on German soil. From a legal and diplomatic context, this case would then be nearly identical to the Skripals/Sturgess novichok poisoning case last year, which resulted in mass expulsions of Russian diplomats from EU and partner NATO countries.

Given Germany’s more pragmatic and moderate position vis-a-vis Moscow, underpinned by joint energy projects, a firm reaction from Berlin including diplomatic and economic sanctions is more difficult to anticipate. Yet, for those same reasons, such reaction would have much larger geopolitical implications, both outside and within Russia.

Bellingcat Investigation Team

The Bellingcat Investigation Team is an award winning group of volunteers and full time investigators who make up the core of the Bellingcat's investigative efforts.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

37 Comments

  1. Sean Lamb

    While I have no opinion on the merits or otherwise of the underlying case, I will make a few observations.

    Firstly, Bellingcat’s case rests on the basis of information of datasets which they have no legal right to and which they are unable to confirm the complete integrity of. I imagine that if a fake news troll factory like Bellingcat based in Russia got hold of a Western country’s driver license, passport or tax record databases, we would have no hesitation on accusing them as cyber-criminals. Now Bellingcat might like to claim they are cyber-criminals in the same way Robin Hood was a criminal – robbing from the rich to give to the poor – I will leave to the individual reader to judge if such a defense is adequate.

    Secondly, as machine learning and big data techniques progress, these face matching techniques are increasingly open to abuse by unscrupulous intelligence agencies. For example suppose the intelligence agency X wants to blame a certain activity on Nation Y. Intelligence agency X has a pool of say 1000 agents or organised criminals that they can call on for active measures. They can then search large datasets like photos on facebook, VK and uploads to interpol for faces that give weak or moderate confidence matches with their pool of 1000 agents. Since the candidate databases (eg VK) have millions of users, then the chances of finding false-positive matches are extremely high. Intelligence Agency X can then carry out their active measure and then feed information to the authorities to make it look like Nation Y was responsible. It is perhaps hardly surprising – and completely in line with UK and USA tactics of projection – that the US politicians started suddenly shrilly accusing FaceApp of being a security risk in the aftermath of the Skripal debacle.

    Thirdly, in these face matching algorithms are of deeply uncertain specificity, particularly when considering the difficulties of matching photos decades apart (as for example the driver’s licence and the visa application seem to be) and of greatly varying quality of resolution. Moreover there are number of tricks that can be use to increase the probability of false positives – altering the resolution of the comparison photographs for example or subtly altering the dimensions of one of the photographs.

    This is what Bellingcat – possibly unconsciously – seem to have done with comparing the “Vadim Sokolov” and “Vadim Krasikov” photographs. Basically this photo is matching on the underlying bone architecture of the face only, if you have the option to stretch or compress one photo in one dimension you enhance your chances of getting a false positive identification. Now I do not accuse Bellingcat of altering the photo in this case, but they appear to have used the beard on one photo creating some uncertainty as to jaw line, to produce the best result possible.

    On “Vadim Krasikov” the area of comparison goes right down to the tip of the chin, whereas on “Vadim Solokov” the area of comparison seems much closer to the lower lip. In this way the software has been tricked into identifying two people with fairly obvious different facial bone structure as the same person.

    I am not saying Bellingcat did this deliberately, I just saying they lack any understanding of the limitations and pitfalls of facial identification and just kept altering the area of comparison until they got they answer they were convinced was correct.

    Reply
    • Jeroen

      You completely forgot that the German authorities identified the killer.

      You completely forgot the excellent work done by German and Russian journalists.

      But that is of no interest if your only goal in life is earning some money trying, but completely failing to, to bash at bellingcat, welcome in the group of failing “bellingcat-bashers”.

      Reply
    • Tomcat

      Your wordfall makes a foul play with you. I mean you are very interested person. On the other hand, you pretend not to know the history of Soviet secret services OGPU/NKVD-NKGB, MGB, and so on. Nothing is new in their approach, and traditions of ‘iron Felix’ are still alive.

      Reply
    • Servus

      Firstly – the databases
      “they are unable to confirm the complete integrity of” – this not needed, it’s enough that Bellingcat verifies integrity of the one record of interest, against other databases and even the archived older copies of the same database. And what is even more interesting, confirm modifications or corruptions of this particular record, as is the case of the criminals’ database. The Krasikov’s record should have never disappeared from there but it did.
      Information from stolen and leaked databases need to be corroborated and can not be trusted at face value, Bellingcat journalists did that. And, well, Krasikov was on the Interpol red list and some of these records are public, one can fined quite a few public Interpol search warrants for Russians.

      Secondly and Thirdly – reliability of the face matching software
      Strange that the match reliability assessment figure present in all Bellingcat matches escaped your sharp attention. It was always in the 70-80% region, in case of Skripal assasins, the independent confirmation came from relatives and neighbours that recognized their “heroes”. Krasikov matched the Interpol’s warrant’s other characteristics…. and other Russian databases confirmed a highly likely hypothesis of a professional murderer recruited for the GRU/FSB’s account.

      Four – the hidden chin.
      Well, of course the beard did not cause any problems for German police they could have just shave it off or measure the chin’s location.
      Your argument is bit funny :
      ” Now I do not accuse Bellingcat of altering the photo in this case,” but you go into explanations how the Bellingcat did it. A well know tactic of a smear and calumny, say something and deny it hoping that a some doubt will rest.

      Here is a precise description of the way calumny works:
      https://www.youtube.com/watch?v=DOov6f6EE4w

      So, these were today’s lamb chops, have a nice lunch !

      Reply
    • Brad

      Eye shape, mouth shape, nostril shape and the “Vulcan” eyebrows that only have an upwards rise but no downward (odd for someone with dark hair).
      Looks like a fairly good match to me just by looking at the guy, regardless of the software.

      Reply
    • Gerhard

      “Lamb,” if you spent half as much effort on actual research you may actually contribute to some good in the world. As it stands this babble just provides an excellent illustration of what Jeroen mentioned and Servus’s comment about calumny. These jobs do pay, but so do meter maids, repo men, and prostitutes. Russian apologists are even below these professions.

      Reply
  2. Seth Lion

    I see you’re working quite hard at damage control over there, Comrade Sean.

    Nobody’s buying it.

    Reply
  3. Jeroen

    Why is it Russia gives no information about one (once) international sought criminal and murderer, who is a Russian citizen, who is using a fake Russian identity, who is suspected of at least one other murder?

    This question should be adressed.

    All these “observations” mentioned above are just meant to distract readers from this and other important questions.

    Reply
  4. joe

    Excellent research. Bellingcat became one of the most interesting resources to get news from. Well done to all the volunteers doing the great job and revealing the truth about murderers from Mordor.

    Reply

Leave a Reply

  • (will not be published)

You can support the work of Bellingcat by donating through the following link:

TRUST IN JOURNALISM - IMPRESS