Armchair Investigators at Front of British Inquiry Into Spy Poisoning

Image

Bellingcat’s founder, Eliot Higgins, left, and a researcher, Christo Grozev, spoke to reporters this week. The group’s work has jarred both the British and the Russians.CreditCreditJack Taylor/Getty Images

By Michael Schwirtz and Ellen Barry

Oct. 9, 2018

Inside a packed, heavily guarded room in the House of Commons, reporters gathered for an update on Tuesday about the suspects involved in the poisoning of a former Russian spy in Britain this year.

If the subject matter was unusual, so were the people doing the briefing.

They were not prosecutors or counterintelligence officers or even spokesmen from Downing Street. Rather, they were researchers from Bellingcat, an investigative group founded by Eliot Higgins, 39, a blogger who began by posting on a laptop from his apartment while babysitting his infant daughter.

Over the past month, Bellingcat has published a series of reports unmasking the Russian men who the British say traveled to Salisbury in March, poisoning a former spy, Sergei V. Skripal, and his daughter, Yulia.

The experience has been jarring for British officials — who, in some cases, seem to have learned of disclosures not long before the general public — and for Russian officials, who have expressed suspicion that Bellingcat is a front for Western spy agencies.

“This is a new frontier in terms of internet activism, or internet research,” said Jonathan Eyal, associate director of the Royal United Services Institute, a security and defense policy group. “What you witnessed in the House of Parliament is a blurring of distinctions: States are increasingly losing their monopoly over spying. Now it belongs to anyone who has the brains, the spunk and the technological ability.”

At Tuesday’s briefing, which was introduced by Bob Seely, a British member of Parliament, Bellingcat researchers gave out new details about Aleksandr E. Mishkin, whom the group identified on Monday as one of the two men who carried out the attack on Mr. Skripal in March.

The internet sleuths offered the sort of details rarely available from state officials, describing an increasingly risky game of cat-and-mouse with the Russian government.

When Bellingcat investigators mass-mailed queries to “hundreds and hundreds” of Dr. Mishkin’s medical school classmates, they said, the vast majority responded swiftly, saying they had never heard of him. But two alumni said they knew him. One added that “everybody from his department was contacted two weeks ago, and told not to disclose anything about him,” said Christo Grozev, who oversees Bellingcat’s Ukraine and Russia probes.

Russia took note, three days ago, when Bellingcat announced it would reveal Dr. Mishkin’s identity at the briefing Tuesday, Mr. Grozev said. Dr. Mishkin’s grandmother was told to leave her village abruptly, he said.

Bellingcat researchers gave out new details about a Russian military doctor named Aleksandr E. Mishkin, whom the group identified on Monday as one of the two men who carried out the attack in March.CreditLondon Metropolitan Police

But a reporter sent to the village found seven residents who would confirm his identity. His grandmother was so proud of Dr. Mishkin, a recipient of the prestigious Hero of the Russian Federation award, that she displayed a photograph of him receiving the award from President Vladimir V. Putin, neighbors told Bellingcat.

Bellingcat has previously avoided sending its Russia-based personnel on work that targets the Russian military intelligence service, known as the G.R.U., which he said “would be the part of the government that would be the most vengeful and the most dangerous.”

This time, “they insisted,” he said. “They really wanted to be part of it.”

Bellingcat has withheld some information its researchers felt could put their Russian colleagues in danger, Mr. Higgins said in an interview.

“The sources we’re using we’re trying to protect them,” Mr. Higgins said.

Bellingcat was founded in July 2014, three days before a surface-to-air missile blew a Malaysia Airlines passenger jet out of the sky over Ukraine, killing all 298 people on board. Russia and Ukraine, locked in conflict over a separatist Ukrainian region, blamed each other for the tragedy. Initially, Mr. Higgins said he approached his investigation “with an open mind.”

“Ukraine was not a conflict I was looking at and didn’t have a lot of knowledge of it,” he said.

Using videos and photos gathered online, he and a group of investigators were eventually able to identify the mobile launcher that fired the missile that struck the passenger jet and trace its movement from Russia into rebel-held Ukrainian territory in the period before the jet was downed.

The group has since identified two Russian military intelligence commanders possibly involved in overseeing the delivery of the missile launcher to Ukranian rebel territory.

A consortium of international investigators that includes prosecutors from the Netherlands and Malaysia and others has backed up many of Bellingcat’s findings, and at one point interviewed Mr. Higgins as a witness.

Mr. Higgins, who briefly worked as a payments officer at a women’s underwear company, first gained attention for his meticulous reporting on the war in Syria, blogging under the name Brown Moses. Bellingcat now has 10 full-time employees as well as about a dozen volunteers around the world, and it receives funding through a mix of grants from organizations like the Open Society Foundation and workshops where students pay $2,500 for a five-day crash course in open-source investigations.

The workshops draw a mix of journalists, government investigators and, sometimes, law enforcement officials. Mr. Higgins said he once had an intelligence officer make a recruiting pitch at one of his workshops, something he frowns upon.

“I’ve asked people not to recruit anyone to spy,” he said.

British authorities have so far refused to comment on Bellingcat’s investigation into the Skripal poisoning suspects, or reveal any new details about the case. The Russian government has claimed the two men were sports nutritionists who traveled to Mr. Skripal’s adopted hometown, Salisbury, England, on a snowy weekend in early March to admire its famous gothic cathedral.

Image

Bellingcat and its Russian partner, The Insider, uncovered the true identities of the two Russians charged with trying to kill the former spy Sergei V. Skripal.CreditWill Oliver/EPA, via Shutterstock

Russian authorities have made no secret of their contempt for Bellingcat.

Russia’s Foreign Ministry called Bellingcat’s revelations about the Russian hit men “criminal investigative activity,” and a senior Russian diplomat at the United Nations recently referred to its researchers as “boorish and arrogant uncouth goons.”

In a statement issued on Tuesday, Russia’s embassy in Britain said it would discuss the details revealed by Bellingcat only with the British authorities through official channels.

“If information continues to flow in the form of media leaks with references to anonymous sources and investigations by NGOs (even though they have obvious ties with secret services), this will only confirm that the British authorities have no intention to pursue investigation within the framework of international law,” the embassy statement said.

As part of its investigation into the Salisbury poisoning suspects, Bellingcat dipped into Russia’s vast market for stolen data. The first clues to the true identities of the two men came from passport data that could have come from a Russian government bureaucrat, who was either sympathetic to Bellingcat’s cause, or possibly paid off.

Asked about the motivations of such sources, Mr. Higgins said, “I’m pretty sure it’s mainly about the money,” though he insisted Bellingcat itself was not paying anyone for information.

Bellingcat’s disclosure of the identity of the first poisoning suspect, Col. Anatoly V. Chepiga, came just over a week before Dutch, English and American authorities unveiled details about an apparently botched operation by four other G.R.U. officers to hack into computers at the headquarters of the world’s chemical weapons watchdog.

Included among the materials published by investigators was an airport taxi receipt showing the men had been picked up outside a G.R.U. barracks, as well as a photo of a bag filled with empty Heineken beer cans the men apparently drank while on the job.

Researchers from Bellingcat immediately began analyzing the newly released information. Within hours they discovered the name of one of the outed G.R.U. officers in a database of car registrations.

The officer, Alexey Sergeyevich Morenets, had registered his Lada VAZ 21093, a cheap Russian-made sedan, to the address of the G.R.U.’s cyberwarfare department in the Moscow suburbs. By plugging in that address into the database, the researchers then discovered the names, passport numbers and birth dates of 305 people who had registered vehicles to the same location.

With a few keystrokes, Bellingcat researchers possibly gained access to data on dozens if not hundreds of G.R.U. officers whose personal information was available on an easily accessible database.

The finding revealed a “staggering amount of incompetence,” Mr. Higgins said.