August 30, 2019
What we know so
far
Last Friday, 23
August 2019, Zelimkhan Khangoshvili, a Georgian citizen living in Germany, was
assassinated in downtown Berlin while having lunch on the way to a mosque for
Friday prayer. Khangoshvili was assassinated with three bullets, two of them
fired at close range at his head. The killer, who was hiding in the nearby bushes,
rushed toward the victim on an electric bike and shot the victim — once in the
shoulder and twice in the head — using a 9mm Glock 26 with an attached
silencer. After speeding away from the crime scene for a few hundred meters
along the Spree river, the assassin stopped and jettisoned the electric bike, a
plastic bag with the murder weapon, and a wig he was using, into the river. In
doing so he was observed by two teenagers who alerted the police. Their tips
lead to the killer being caught a few minutes later, just as he was
disappearing into a crowd of tourists – now sporting a clean-shaven head, a
mustachioed face, a pink t-shirt, and a touristy pouch holding his passport and
some cash suspended from his neck.
Media has
reported that the suspect, who has so far been publicly referred to as Vadim S,
49, initially travelled by air from Moscow to Paris on a French-issued visa,
before crossing into Germany six days before the murder. He has reportedly
denied any involvement in the murder and has requested to meet Russian consular
officials.
The victim was an
ethnically Chechen Georgian citizen who had long been on the list of Moscow’s
declared enemies. Having volunteered to fight against the central Russian armed
forces in the second Chechen war in 1999-2002, he continued supporting Chechen
separatists while based in his native Pankisi Valley in Georgia in the ensuing
years. He also recruited and armed a volunteer unit to fight against Russia’s
war in Georgia in 2008, although there is no evidence that his unit ever saw
action before the war had ended. In 2012, Khangoshvili reportedly played the important
role of mediator during the Lapota incident, when a group of armed Chechens
took several people hostage in a remote mountain region of Georgia. Despite no
evidence of Khangoshvili espousing Islamist ideology or supporting Islamist
causes, Russia has repeatedly branded him as an Islamic terrorist threat. While
fighting alongside Islamists during the early stage of the Second Chechen War,
Khangoshvili was later known to be close to Aslan Maskhadov, the former Chechen
president (killed in 2005) who was known as a moderate and nationalist rather
than an Islamist.
At the time of
his murder, Khangoshvili was awaiting the outcome of his appeal to deportation
proceedings in Germany, where he sought political asylum with his family,
having been the object of two assassination attempts in Georgia (the last one
in May 2015 when he was shot in Tbilisi), and having received
multiple threats while temporarily seeking refuge in Ukraine. Russia has
officially disowned any link to the assassination attempts.
A joint
investigation between Bellingcat, the German newspaper Der Spiegel, and The
Insider (Russia), has established that the assassin travelled to Berlin via
France under a validly issued, non-biometric Russian passport in the name of Vadim
Andreevich Sokolov, born in August 1970. Despite the fact that he used
a legitimate passport, we have determined that no such person exists in
Russia’s sprawling, comprehensive national citizen database. In addition, no
trace of such a person exists in a trove of hundreds of leaked residential
databases, previously obtained and aggregated by Bellingcat. This discovery
makes Russia’s claims that the killer is not connected to the Russian state
implausible, as no person in Russia is in a position to obtain a valid Russian
passport under a fake identity without the involvement of the state
bureaucratic and security apparatus.
In addition, we
have identified that the address given by the killer in his visa application as
his residence in St. Petersburg does not exist. This glaring inconsistency, and
the generally blank digital and data footprint of the Russian “ghost traveler”
raises serious questions as to how and why he was able to obtain a multi-entry
Schengen visa issued by the French consulate in Moscow.
A Phantom Tourist
Using the
passport data from Sokolov’s visa application papers submitted in Russia and
obtained by our team, we sought to identify the presence of this person in
various Russian live and offline databases. We verified via two separate
sources with direct access to the Russian Passport database that no
person with the name Vadim Andreevich Sokolov and the birthdate
used in his passport exists in that database.
The Russian
Passport database is a centralized, comprehensive database containing
residential address and passport data of all Russian citizens — including the
full history of prior personal identity documents — maintained by Russia’s Ministry
of Interior. Likewise, no presence of this person was found in another
police-maintained database that tracks domestic and international travel of all
Russian citizens, nor in the traffic police’s database of driving license
owners. We have also searched hundreds of previously leaked offline passport,
residential-address, insurance and employment databases, including ones with
data as recent as 2018, and have found no evidence of a person with such
personal data.
At the same time,
for this man to have travelled via airplane from Moscow to Paris on an ordinary
passport, he would have had to go through passport control, where his passport
would have been scanned and automatically checked against the Russian
Passport database. Any inconsistency — such as a missing record in
that database — would have triggered the border officer’s alarm system, and the
person would not have been authorized to proceed. There can be only two
feasible scenarios that explain this inconsistency: either “Vadim Sokolov” was
known to border officials as an undercover operative, and they were instructed
to let him proceed, or alternatively, at the time of the trip — that is, on 31
July 2019 — Sokolov was still in the Russia Passport database.
Both scenarios
are technically possible. The Russian immigration (border-control) system is
supervised by the Federal Security Service (FSB), thus special arrangements
could have been made for “Sokolov” to bypass the routine airport verification
procedure, especially if the operative was FSB-linked.
Equally possible,
and more consistent with prior practice, would be the second scenario, in which
a cover identity was fully created for “Sokolov” — including a database entry
in the Russian passport system — but was purged from Russian government
databases shortly after news of the arrest in Berlin broke. In the case of
Skripal-linked GRU officers previously identified by Bellingcat, the three
undercover GRU operatives originally had dual presence in the Russia Passport
database: both under their real and under their cover identity. Shortly after
their public outing by Bellingcat, however, both their undercover and their
true identities (including their immediate family members data) were purged
from the Russian Passport and other government-run databases,
creating several “ghost” families with no passport, residential ownership, or
even tax information (in fact, apartments previously confirmed by us as owned
by Col. Chepiga and Col. Mishkin, the main Skripal suspects, are now listed as
owned by “the Russian state”).
Whether the first
or the second scenario was used in the case of “Sokolov” might provide a clue
as to which of the two main, and often competing, security services are linked
to this brazen assassination operation. As outlined below, both agencies, the
FSB and the GRU, would have felt entitled to pursue such an extrajudicial
killing, albeit for different reasons.
What is certain,
however, is that the cover identity behind “Vadim Sokolov” was created very
recently, and was most likely custom-made for the specific operation in Berlin.
This can be inferred from the absence of any digital footprint on this identity
in previously leaked databases (for comparison, both “Boshirov” and “Petrov” —
the cover identities behind the Skripal suspects — did show up in older offline
databases). This conclusion is also consistent with the unusually recent date
of issuance for “Sokolov”’s passport – 18 July 2019, only ten days before the
planned trip. We have also verified — via sources with access to non-Russian
airline booking databases — that a person with this name and birth date has not
traveled to any European destination in the past 6 years, nor has obtained
visas to any Schengen states. All of this implies either an ad-hoc operation
following newly obtained information on the target’s whereabouts, or the use of
a “single-use”, non-staff assassin. As discussed below, this latter hypothesis
may prove true due to the certain peculiarities regarding the man now in German
custody.
Passport Clues
In previous
investigations, Bellingcat has identified batches of sequential passport
numbers issued to GRU officers in different years. The passport number used for
Sokolov’s passport cannot be matched against these batches, as it was issued
only in July 2019, and we have no empirical data of other GRU officers with
fresh passports. However these batches were all issued by the same Moscow
“central” unit of the Federal Migration Service (now integrated into the
Ministry of Interior) that apparently issued “Sokolov”s passport.
“Sokolov”’s
number is also like the other GRU officers’ passports in another way: it is a
passport of the “old” type — i.e. without embedded biometrical data. While in
2009 Russia introduced biometric passports, and they are the default choice
when applying for a new travel document, “old-style” passports are issued upon
request, usually in emergency situations when the applicant has no time to wait
for the fingerprint encryption and printing process. All internationally active
GRU officers identified by us thus far (numbering more than 20) and “Sokolov”
opted for the old-style “paper” passport, most likely due to the risk of a
clash between the undercover persona’s fingerprints with pre-existing
fingerprint data of the real person. In “Sokolov”’s case, this may also have
been the reason, or it may have been the unavoidable consequence of a rushed
operation, as the lead time to receive a biometric passport is at least one
week.
An Express Visa
For a Ghost
Our joint investigating
team was able to obtain most of the suspect’s passport data from a source with
access to visa-linked documents submitted by “Vadim Sokolov” in Russia. The
document shows that the suspect applied for an express visa at the French
consulate in Moscow on 29 July 2019 — just 11 days after he received his
non-biometric passport. He requested a multi-entry, 6-month visa, that would
provide him with unlimited reentry access to any of the 26 countries of the
Schengen area. Unusually, and boldly, he indicated that his planned date of
travel is 30 July 2019 — literally the day after his visa application date. In
addition, he indicated that he planned to stay in France for the maximum
permitted 90-day period during his six-month visa, stating that he plans to
travel in and out of France until 25 January 2020.
Despite such bold
aspirations — the requested visa duration and reentry terms are the maximum
that can be issued to a first time traveler, and the lead time to travel is
unusually short — “Sokolov” had little to show in terms of a traceable
background in Russia. His passport showed he was born in the Siberian city of
Irkursk, but he indicated his place of residence as “Alpiyskaya Street 37” in
Saint Petersburg. There is no “Alpiyskaya Street” in St. Petersburg, although
there is an “Alpiyskiy Pereulok” (Alpiysky Lane), and at number 37 of that lane
there are 3 upscale residential apartment building clusters, each cluster with
a separate sub-address (corpus 1, 2 or 3) that would typically be stated in when
providing an address.
The only place in
the vicinity of St. Petersburg that does have an actual “Alpiyskaya Street” is
a nearby town named Kudrovo, just outside the city limits. However, there is no number 37 on that street
either.
In his
application, the suspect also listed his occupation as “senior company
employee”, although the document reviewed by the investigating team did not
contain the name of the company he claimed to be employed by. It is not clear
if he provided the name of the company to the French consulate.
As a point of
contact in France — which is a mandatory requirement for visa applicants from
Russia — the suspect listed the name of the mid-range Practic hotel in Paris.
As of press time, we have been unable to receive feedback from the hotel
management as to whether they were in contact or aware of this person, or
whether he used the hotel as an intended place of residence during his trip
into France. A hotel receptionist, upon being shown a photograph of the
suspect, said they had not seen this person at the hotel.
Given that the
suspect does not have any digital or data footprint in Russia, listed an
incomplete or false address and employment data, had a freshly issued passport,
and had not travelled to Europe at least since 2013, it is puzzling that the
French Ministry of Foreign Affairs, ultimately in charge of deciding on visa
requests, decided to honour the application in full and issued the multi-entry
visa with no detailed review and no waiting period. Bellingcat has previously
reported on the nominally draconian, but empirically porous visa application
system for Western Europe that has enabled Russian spies with fake identities
and no data footprint to obtain multi-entry visas and unrestricted European
travel for almost a decade.
An Unusual
Suspect
The report on the
detained suspect, according to German security sources interviewed by our joint
team, describe him as 176 cm tall and weighing 86 kg. Notably, the report also
states the suspect has three tattoos on his body: a crown and a panther on his
upper left arm, and a snake on the lower right arm.
The presence of
tattoos on an assassin’s body is unusual in the context of a Russian security
service operation. Russian security services do not permit their staff officers
to thus decorate themselves. This suggests that the suspect is not a staff
officer, or that he was permitted to have tattoos as part of a long-term
embedded undercover operation. One possible explanation might be that the
suspect was a former convict who was coopted by one of the secret services, as
the style of the described tattoos is consistent with a special and severely
“regulated” body decoration nomenclature known as “prison tattoos”. However,
without further information or images of the tattoos — such as whether they are
in monochrome or color — it would be impossible to assess if the suspect’s body
art is of the “prison tattoo” variety.
It is not
unprecedented for the Russian security services to resort to freelancers or
even ex-convicts as assassins, as shown by at least two recent examples of
(attempted) extraterritorial killings in Ukraine. In one case, an FSB-handled
former drug-enforcement officer who had been indicted on corruption charges was
sent to Ukraine to organize a car-bomb assassination of a member of Ukrainian
military intelligence. In another, a Ukrainian prison official was recruited by
Russia’s GRU to assassinate a former Ukrainian artillery officer who had
advised Georgian military forces during the 2008 Russia-Georgian war. However,
it would be a precedent for a Russian security service to use a freelancer in Western
Europe.
Who Gave the
Orders?
The complex past
of the victim leads to possibilities that he may have been assassinated in an
operation led by either of the FSB, the GRU or even Ramzan Kadyrov’s own
security apparatus. Due to his involvement in the Russo-Chechen war, and the
more recent qualification as an “Islamic threat”, he would have been in the
cross-hairs of the FSB capture or kill list.
On the other
hand, his involvement in the war and his support for Georgians in the
Russian-Georgian war, would have made him a revenge-assassination target for
the GRU, as paralleled by other assassinations of former armed-conflict
adversaries from Russia’s near-abroad – which, in the eyes of the Russian
military, is tantamount to treason. Separately, his Chechen background, and the
fact that he sided with Aslan Mashadov during the Chechen war, would have
pitted Khangoshvili against Ramzan Kadyrov’s clique.
Indeed, most of
the assassinations of ethnic Chechens overseas in the last 10 years has been
perpetrated by Chechen emissaries acting in the name of Kadyrov, sometimes — as
in the case with the June 2017 assassination attempt on Ukrainian citizen
Amina Okueva (who did not survive a follow-up assassination attempt that same
year) in Kyiv — traveling under cover, non-Chechen identities.
Whatever the
answer is, the access to a valid, Moscow-issued passport, and the immediate and
comprehensive purging of the any data linked to the cover identity “Vadim
Sokolov” is a clear indication of the state involvement in this
extraterritorial assassination, similar in brazenness and lack of plausible
deniability to the Skripal case.
Bellingcat and
its investigative partners will continue to investigate this story, seeking to
identify the actual identity of the person traveling under the “Sokolov”
persona.
