The unmasking of the Salisbury poisoning suspects by a new digital journalism outfit was an embarrassment for Putin – and evidence that Russian spies are not what they once were. By Luke Harding
In 2011 I was in Libya reporting on the civil war. Rebels backed by the US, the UK and France were advancing on the capital, Tripoli. The insurgents moved forward through bombed-out towns as Muammar Gaddafi’s forces retreated. Coastal cities in the west and east, oil refineries, Roman ruins and temples – all fell, one by one, as the regime lost ground.
These were dangerous times. In the town of Zawiyah I found locals celebrating victory in the main square. They were shooting in the air and doing wheelspins and skids in their cars and trucks. Gaddafi’s soldiers had left the previous night, fleeing down the road. I saw a small boy, maybe eight years old, stomping on a Gaddafi flag. “The city is ruined. No problem – we will rebuild it,” one local, Tariq Sadiq, told me.
The signs of battle were everywhere. The square’s four-star Zawiyah Jewel Hotel was a ruin. The lobby was filled with rubble. Mattresses where Gaddafi’s soldiers had slept lay strewn among crates containing mortar cases and empty plastic water bottles. The air crackled with jubilant gunfire.
The celebrations turned out to be premature. From their new positions, and without warning, Gaddafi’s army began shelling the square. I took shelter indoors. First one mortar, then six more. Each was a loud thunderclap, a sudden affirmative whomping, followed by puffs of black smoke.
At that moment, I wasn’t much interested in the types of munitions that were raining down. There was a simple urge: to escape. My role, as I saw it, was to tell the stories of those unwittingly caught up in conflict. I had brought to Libya the usual tools of a frontline correspondent: flak jacket, satellite phone and first-aid kit, carried in a rucksack.
A man named Eliot Higgins was following events in Libya, too – not from the front line, but from his home in the east Midlands. Specifically, from his sofa. It was a safer place to be – and, as it turned out, as good a perch as any from which to analyse the conflict, and to consider questions that, in the heat of battle, were interesting, but seemingly unanswerable. Questions such as: where did the rebels get their arms?
Higgins recalls growing up as a shy “nerd”. According to his brother Ross, Higgins was an obsessive gamer and early computer enthusiast. He liked Lego, played Pong on an antediluvian 1980s Atari and was a fan of Dungeons and Dragons. He spent hours immersed in the online roleplay game World of Warcraft, where participants pooled skills and collaborated across virtual borders. His instincts were completist: he wanted to finish and win the game. This would prove useful later on.
Higgins tried for a career in journalism and enrolled on a media studies course in Southampton. It didn’t work out, and he left without a degree. Next, he earned a living via a series of unlikely administrative jobs. One day Higgins logged on to the Guardian’s Middle East live blog. Libya was the centre of international attention. Higgins made his own contributions to the comment section of the Guardian blog, using the name Brown Moses – taken from a Frank Zappa song. The blog often featured videos uploaded by anti-regime fighters. There was fierce debate as to whether these images were authentic or bogus.
One such video showed a newly captured town. The rebels claimed it was Tiji, a sleepy settlement with a barracks that had been recently bombed by Nato jets, close to the border with Tunisia, and on the strategic main road leading to Tripoli. There was a mosque, a white road and a few little buildings with trees around them. The video showed a rebel-driven tank rolling noisily down a two-lane highway. There were utility poles.
Higgins used satellite images to see if he could identify the settlement and thereby win the discussion. The features were sufficiently distinctive for him to be able to prove he was correct: the town was Tiji. “I’m very argumentative,” he says. It was the first time he had used geolocation tools. He realised he could collect user-generated videos and later work out exactly where they had been filmed.
Shortly afterwards his first child was born. Higgins combined his new childcare duties with online research. Meanwhile, the uprisings in the Arab world spread. Soon Syria was at war, too.
What began as a way of scoring points over online adversaries evolved into something bigger. Smartphones with cameras, social media, Facebook, Twitter, Google Earth, Google street view, YouTube – the digital world was multiplying at an astonishing rate. This stuff was open-source: anyone could access it. By cross-checking video footage with existing photos and Google maps, it was possible to investigate what was going on in a faraway war zone.
These techniques offered interesting possibilities. Open-source journalism might be applied to the realm of justice and accountability. Sometimes soldiers filmed their own crimes – executions, for example, carried out on featureless terrain. If you could identify who and where, this could be evidence in a court of law. The shadow cast by a dead body was a strong indication of time of death.
At home, and surrounded by his daughter’s discarded toys, Higgins unearthed a number of scoops. He found weapons from Croatia in a video posted by a Syrian jihadist group. The weapons, it emerged, were from the Saudis. The New York Times picked up the story and put it on the front page – an indication of how armchair analysis could be as telling as dispatches from the ground.
Higgins documented the Syrian regime’s use of cluster bombs. He discovered that government soldiers were tossing DIY barrel bombs out of helicopters, and that rebels were fighting back around Aleppo with Chinese-made shoulder-launched missiles. His reputation spread. He launched a new investigative website: Bellingcat.
The idea was to consolidate pioneering online research techniques and to connect with a wider pool of international volunteers. In July 2014, three days after Bellingcat went live, a Malaysia Airlines passenger plane was blown out of the sky over Ukraine. Some 298 people – nearly 200 of them Dutch – died. The incident grew into Bellingcat’s first major investigation.
Higgins’s team discovered that the missile launcher had come from Russia’s 53rd anti-aircraft missile brigade, based in the city of Kursk. Video footage showed the launcher trundling across Russia as part of a military convoy. The system was filmed again by locals inside eastern Ukraine after MH17 was brought down, heading back to Russia with one of its missiles missing.
Bellingcat got bigger. One key figure was Christo Grozev, a fluent Russian-speaker and a Bulgarian from an anti-communist family. Grozev grew up in Plovdiv, Bulgaria’s second city; his father was fired from his job as a teacher for growing a hippie-style beard. Bellingcat joined forces with the Insider, an independent Russian news website run by Roman Dobrokhotov.
By summer 2018, the British police were confident they had identified the two Russian suspects who had tried to murder Sergei Skripal a few weeks earlier, in March. Skripal, a former officer with Russia’s GRU military spy agency, was poisoned in Salisbury, together with his daughter Yulia. The assassins’ names had not been made public. The hope was that they might travel to western countries where they could be arrested.
There were discussions inside the British government about what to do. One course was to demand their extradition – knowing Vladimir Putin would refuse, as he had with the killers of Alexander Litvinenko 11 years earlier. Another was to recognise that there was zero prospect of a criminal trial, and to publish concrete intelligence.
That September, prime minister Theresa May went with option two. She told the House of Commons that the two Russian assassins were Ruslan Boshirov and Alexander Petrov – adding that the police believed these names to be aliases. CCTV images from their trips to Salisbury were revealed. Also shown was the apparent murder weapon – a counterfeit perfume bottle containing the nerve agent novichok.
The new details were a boon for Bellingcat. During the next few weeks, its volunteers scurried all over the evidence. They would go on to inflict a series of humiliations on Russia’s GRU military intelligence spy agency that may have contributed to the fall of its chief, Igor Korobov.
In the 20th century, Soviet assassins were able to travel around Europe using fake passports. Their movements were seldom discovered. They may have been better, more professional spies – or lesser ones. It was an age before transparency.
The modern GRU was still using the old Soviet playbook when it came to covert operations such as the murder of enemies outside the country. These analogue plots now took place in a digital environment. GRU officers earned their spurs in the Soviet “near abroad” – in Tajikistan, Moldova or Ukraine, where there were few cameras to worry about, and not much of a CIA or other American presence.
Western Europe was different. Britain, in particular, was a counter-intelligence challenge. The UK had CCTV on every public corner – in railway stations, hotel lobbies and airports. Any passengers arriving on a flight from Moscow would be logged and filmed. A port-of-entry database was available to western security agencies.
Meanwhile, Russian markets sold CDs of mass official information: home addresses, car registrations, telephone directories and other bulk indexes. For £80 or so you could buy traffic police records. With the right contacts, and a modest cash payment, it was even possible to gain access to the national passport database.
Paradoxically, this low-level corruption made Russia one of the most open societies in the world. Corruption was the friend of investigative journalism, and the enemy of government–military secrets.
After the Metropolitan police published photos of Boshirov and Petrov, Bellingcat took up the hunt. It sought to unmask their real identities. The first step was to image search their photos via online search engines. This yielded nothing. They looked for telephone numbers associated with the two names. Nothing again.
And so the online investigators tried a deductive approach. They spoke to sources in Russia and asked where a GRU officer operating in western Europe was likely to have been trained. One answer was Siberia, and in particular the Far Eastern Military Command Academy in Khabarovsk, just across the Amur River from China. The men appeared to be in their late 30s or early 40s. This gave an approximate date of birth.
Yearbooks from the academy yielded no results, but a photo of a group of graduates taken in Chechnya looked promising. One of the soldiers – woolly hat, uniform, standing in front of anonymous, snow-covered hills – looked like Boshirov. The 2018 article said that academy students had gone on to become “heroes of Russia”, Moscow’s highest military award. Was it possible that Boshirov was among them?
The academy’s website included a photo of its memorial wall. In its centre was a gold statue of the Soviet marshal Konstantin Rokossovsky, one of several top commanders who led the Red Army to victory in the second world war. There was also a list of names, engraved in gold letters. Ten were “heroes of Russia”. Most had earned their accolade fighting against the Nazis, or in Afghanistan. But two of the names were more recent. An online list said only that the pair had received the honour “by decree of the Russian president”.
One was too old, but the other looked about right. His name was Anatoliy Chepiga. Bellingcat searched for further traces and soon the evidence piled up. At the age of 18, Chepiga had enrolled in the military academy, 25 miles from his home village near the Russia-China border. He graduated in 2001, and his brigade served three times in Chechnya. At some point between 2003 and 2010, he moved to Moscow and was trained at the GRU’s main academy, known as the Conservatory. In 2014, his brigade was deployed to Ukraine. It was there he earned his “hero of Russia” award – though what he did there was unknown. After that, Chepiga travelled frequently to western Europe and the UK.
The passport photo showed a younger version of the assassin wanted by the British authorities. Chepiga was Boshirov, and Boshirov was Chepiga.
Chepiga was married with a child. The first Skripal poisoner, then, was a father, a husband, a soldier and a would-be murderer. And a veteran of conflicts in Russia’s restive southern and western borderlands. But what about the second?
Identifying Petrov would prove a little more difficult.
Bellingcat revealed the identity of poisoner No 1 in a message on its website. Having unmasked one assassin, it seemed likely that Bellingcat would succeed in identifying Petrov, too. Sure enough, in late September I received an invitation to a press conference. It was to be held in an illustrious location: the Houses of Parliament, in an upstairs committee room, number nine. Its subject was Petrov’s real identity.
By the time I arrived, the room was full. I spotted a reporter from the New York Times, Ellen Barry, together with leading representatives from the British and US media. It was hard to escape the conclusion that power in journalism was shifting. It was moving away from established print titles and towards open-source innovators. The new hero of journalism was no longer a grizzled investigator burning shoe leather, à la All the President’s Men, but a pasty-looking kid in front of a MacBook Air.
Higgins and Grozev were there, as well as a Conservative MP, Bob Seely. I found a spot on a bench and sat down. The mood was expectant. Seely set the scene. He described Bellingcat as a “truly remarkable group of digital detectives”. Their success was due to an explosion of digital technology and a rise in digital activism, he said.
Grozev explained how Bellingcat had identified that Petrov’s real name was Alexander Mishkin. The search involved methods new and old. It found Mishkin in a car insurance database, as the owner of a Volvo XC90. The car was registered to the GRU’s Moscow headquarters at Khoroshevskoye Shosse. Next, they used Russian social media to get in touch with Mishkin’s student contemporaries. Did any of them remember him from their St Petersburg days?
Most didn’t answer. But two did. One said Mishkin had been in a different class – and that Russia’s security services had been in touch two weeks previously and instructed graduates not to divulge any information about Mishkin under any circumstances.
Lastly, the Insider dispatched a reporter to Mishkin’s home village. At least seven residents identified Mishkin from the photo produced by the British police. Mishkin’s grandmother – now in her 90s – wasn’t home. Her neighbours, however, said it was well known that Mishkin had received a “hero of Russia” award in connection with Ukraine.
Mishkin had an unusual profession for a travelling assassin: he was a doctor. The GRU had recruited him between 2007 and 2010 and given him his cover name. There was one last remarkable detail. Mishkin’s granny had a photo of her grandson receiving the award, residents said, and used to show it to them proudly while never letting it out of her grasp. The person congratulating Mishkin and shaking his hand was Vladimir Putin.
Chepiga and Mishkin’s world began to unravel even before Bellingcat outed them in parliament. Their photos – as Petrov and Boshirov – had been sprayed all over the place. This presented a dilemma for the GRU. One option was to hide the pair away for ever. Another was to instruct them to give a media interview.
Someone inside the Russian state decided to try this model. It may have been Putin, who used a conference in Vladivostok to urge them to come forward. Chepiga and Mishkin agreed (or, more probably, were told) to speak to RT’s editor-in-chief Margarita Simonyan. Simonyan was a trusted person and Russian media star – a leading apparatchik who sat on top of a global propaganda empire. Putin had given her an award for “objectivity” for RT’s coverage of Crimea. What could possibly go wrong?
As it turned out, everything. Chepiga and Mishkin’s joint interview on RT was a disaster. It was an unintentionally comic performance that made them and the GRU a laughing stock, not only among English-speaking countries, but across Russia, too. They were professional spies, and so lacked media experience.
They appeared nervous, shifty, under pressure, timorous, idiotic and craven. Unlike Putin – a grand master when it came to deceit – they were lousy liars. The pair insisted that they were not GRU officers, and that their real names were indeed Petrov and Boshirov. As for the curious events of Salisbury – well, these might be explained:
Simonyan: What were you doing there?
Petrov: Our friends have been suggesting for quite a long time that we visited this wonderful city.
Simonyan: Salisbury? A wonderful city?
Simonyan: What makes it so wonderful?
Boshirov: It’s a tourist city. They have a famous cathedral there, Salisbury Cathedral. It’s famous throughout Europe and, in fact, throughout the world, I think. It’s famous for its 123-metre spire, it’s famous for its clock. It’s one of the oldest working clocks in the world.
Chepiga/Boshirov’s knowledge of Salisbury seems to have been gleaned from a cursory reading of Russian Wikipedia. The cathedral spire is impressive – built in the 13th and 14th centuries, the tallest in Britain, octagonal, with flying buttresses and scissor arches, and praised by Sir Christopher Wren and Malcolm Muggeridge as a marvel. Still, it seemed unlikely this spire had drawn the two spies all the way from Moscow. How also to explain the fact that the Russians visited Salisbury twice?
Chepiga/Boshirov’s answer: there was heavy snowfall the weekend they arrived, which played havoc with transport connections and made them “wet”. So drenched, actually, that the pair said they were forced to abandon their sightseeing on day one, Saturday, and take refuge in the train station coffee shop. And to buy new dry shoes on London’s Oxford Street.
The pair said they came back the next day and admired the “beautiful English Gothic buildings”. Again they were compelled to return to London from Salisbury because of “heavy sleet”. Maybe they passed the Skripals’ house, maybe they didn’t, Chepiga/Boshirov said. He added: “I’d never heard of them before this nightmare started.”
As the interview goes forward, two things are evident. First, that Simonyan finds it hard not to snigger at the spies’ all-round uselessness and discomfort, especially when she asks why two grown men would share a room together. And second, that the GRU soldiers express zero sympathy for their victim. They are concerned for themselves:
Petrov: If they ever find the ones who did it, it’d be nice if they at least apologised to us.
Simonyan: Who? The poisoners?
Boshirov: No, the British … you have no idea what it’s done to our lives.
Petrov: Can’t even go and fill up your car in peace.
The dominant note is self-pity. They say they are frightened, uncertain what may happen tomorrow, and generally wretched, ever since their photos appeared in the media.
Petrov: One just wants to hide and sit it all out.
Boshirov: So that they get off our backs … we simply wish to be left alone.
Petrov: We’re sick and tired of all this.
And with that, the heroes of Russia vanish. They are not seen again.
Moscow officials did their best to fight back against these embarrassing revelations. They used familiar tactics – disdain, innuendo and ludicrous counter-claims. Beginning in October 2018, they purged Petrov, Boshirov and other officers from their internal systems.
The Russian envoy in London, Alexander Yakovenko, accused Britain’s spy agencies of poisoning the Skripals and then kidnapping them. He summoned the media to his Kensington embassy and expounded his theory in lengthy press conferences. The ambassador described Bellingcat as a branch of the “deep establishment” – a phrase that echoed Donald Trump’s attacks on the FBI. (This claim was based on a “feeling,” Yakovenko said.
Russia’s strategy was to paint Bellingcat as stooges and spies working for MI6. This was an old Soviet trope, deployed by the modern Kremlin against opposition critics at home. The geeks of Bellingcat weren’t secret operatives. Their methods were open. They were collaborative. And quick.
The attacks ignored a more interesting truth: that spying was no longer the monopoly of nation states. “Now it belongs to anyone who has the brains, the spunk and the technological ability,” Jonathan Eyal of the Royal United Services Institute, a security and defence thinktank, told the New York Times, adding, “We are witnessing a blurring of distinctions.”
It was becoming evident that, in the Skripal affair, Moscow had miscalculated. Despite Brexit, the UK still had allies. More than 20 western countries expelled Russian diplomats in solidarity. About 150 embassy-based spies, mostly GRU officers, were forced to pack their bags. This was a serious blow to Russia’s overseas espionage network. The GRU’s ability to collect intelligence and recruit agents was set back.
Ironically, the biggest clearout of Russian spies took place in the US. The Trump administration removed 60 Russian officials, including a dozen based at the UN in New York. It shut the consulate in Seattle, ending the Russian Federation’s diplomatic representation on the US west coast. Was this a sign that Trump – someone who had shown no great enthusiasm for confronting Moscow was finally getting tough?
It would seem not. According to the New York Times, Trump reacted sceptically to Britain’s request for punitive Russian expulsions. He viewed Skripal’s poisoning as “distasteful but within the bounds of espionage” and “part of legitimate spy games”. “Some officials said they thought that Mr Trump, who has frequently criticised ‘rats’ and other turncoats, had some sympathy for the Russian government’s going after someone viewed as a traitor,” the paper reported.
The GRU’s 2016 operation to interfere in the US election was a triumph. A few years later, however, the agency found itself in deep crisis. There were expulsions, indictments and staggering foreign mishaps. At home and abroad, Putin projected a strongman persona. Now he looked a little foolish. What had gone awry?
According to the defector Viktor Suvorov, the decline in GRU standards was part of something larger. Suvorov – real name Vladimir Rezun – is a former GRU officer who fled to the UK from Geneva in 1978.
I met Suvorov in London. It was December 2018, exactly a century after Lenin set up Moscow’s first military intelligence service, following a proposal from Trotsky. The GRU was in poor shape, he said. Sure, it still sent kill squads to Europe and engaged in hybrid warfare such as cyber-hacking. But it had failed to adapt to a 21st-century universe of total information.
Suvorov likened his old organisation’s failings to a nasty, cancer-like illness. It was eating up Russia’s entire body politic. This disease had affected spying, technology and rocket production, he told me. It explained the abysmal roads, the dying villages. The country was literally disintegrating. Suvorov used the word “raspad”: collapse or breakdown. The situation was akin to the Titanic, he said with the rich looking to flee in a lifeboat.
The glory days of the GRU were in the 30s and 40s, when its agents stole the US’s atomic secrets, Suvorov said. After the USSR’s demise, the organisation fared better than the rest of the country. In time, though, the service was destroyed. When Putin’s foreign policy turned aggressive and he needed covert-agent recruits, the GRU was rebuilt. But the quality was gone.
In Suvorov’s day, GRU officers were Moscow slicks with university degrees, unaccented foreign languages, and Soviet-posh manners. The most famous was Yevgeny Ivanov, a naval attache in London who, in 1961, had an affair with Christine Keeler, forcing the British war secretary, John Profumo (who had also slept with Keeler), to resign. Ivanov was handsome, clever, witty, hospitable and charming. By contrast, Suvorov claimed that Ivanov’s modern-day successors were poorly educated and provincial.
Suvorov said his former service had sunk into “idiotism”. Its generals were incompetent and greedy. As for Salisbury, this was a “chain of stupidity”, featuring not-very-professional assassins caught repeatedly on CCTV. “In my time this would not have been possible! Such idiots!” he told me.
Putin must have personally approved the novichok plot, Suvorov suggested, reasoning that, “Nobody would take responsibility without him.” Suvorov said the Russian embassy in London may have given logistical support, but wouldn’t have known the details. These probably restricted to 15 or 20 people, including a technical expert and a handful of top Kremlin officials. The two assassins belonged to a small group of “dirty” specialists. They would have killed before.
After Suvorov left the USSR, both the Russian state and the GRU sentenced him to death in absentia. The GRU would never forgive a traitor, even if a civilian government did, he said. The Salisbury attack was carried out – in his view – to deter GRU colleagues who might be contemplating defecting to America. “The GRU is saying to its own: ‘Boys, look at that!’” he said.
Was he sure the GRU poisoned Skripal? “Of course,” he replied.
Suvorov joined the GRU in 1970. Back then it was a bitter rival to the KGB. The KGB’s headquarters – the Lubyanka – was in the centre of Moscow and highly visible, reflecting the KGB’s mission to protect the regime from homegrown enemies. The GRU was lower-profile and “somewhere in the dark”, Suvorov said, which made the latest revelations all the more painful.
As the Russian investigative journalist Sergei Kanev put it to me: “Everything is open. It’s possible to follow everything. Where you go, whom you meet, where you work.” Kanev attributed the GRU’s setbacks to a variety of factors, including drunkenness, unprofessionalism and bardak – the Russian word for chaos. “The world is changing. They are doing everything like in Soviet times,” he said.
Who was to blame for this? Other than Putin, the most obvious person was Igor Korobov, the GRU’s top commander. That autumn, Korobov’s standing inside Russia’s elite fell sharply. According to Kanev, the Ministry of Defence was awash with rumours that the GRU was due for a clearout, with generals likely to be asked to leave. There was talk of “deep incompetence”, “boundless carelessness” and “morons”.
Kanev’s sources said Korobov was summoned to a personal meeting with Putin in mid-September. The colonel general set off from his apartment in an elite complex used for top-ranking officers on Starovolynskaya Street, next to Moscow’s Victory Park. We don’t know if the discussion with Putin was friendly, or a dressing down. On his way home, Korobov suddenly felt unwell. The story of the general’s illness swirled around the ministry, Kanev wrote.
True account or not, Putin failed to mention Korobov during a speech at Moscow’s military theatre to mark the GRU’s 100th anniversary. Instead he spoke of comrades who had died in battle. “As supreme commander in chief, I certainly know your, without exaggeration, unique capabilities, including in special operations,” Putin said. Korobov wasn’t among those invited to the gala ceremony.
Seemingly, Korobov’s errors had caused Putin to lose face. Later that November, Russia’s Ministry of Defence made a sad announcement: Korobov had passed away. He was 62. His death was due to a “long and serious illness”. Was he dead because he messed up? “Of course, it’s pure speculation,” Suvorov told me. “But everyone inside the GRU will understand 125% he was murdered.” He added: “Even if it was a natural death, people will say: ‘Come on!’ Nobody will believe. They know the nature of the organisation.”
All Rights Reserved for Guardian Faber