Hunting the Hunters: New Digital Methodologies
Hunting the Hunters:
New Digital Methodologies of
Investigating Russian Spies and Security Service Officers
Aric Toler
@AricToler (Twitter / Telegram)
Russian Data Flowing Outward
Russian personal data is widely available either for free (indexed, leaked databases) and a relatively small fee (less than LexisNexis, sometimes only a few euros paid via an anonymous bot, like Amazon). This data is widely used by journalists, human resource departments (background checks), and even wives suspecting their husbands of infidelity.
This is compounded by frequent customer and user data leaks from major Russian platforms, like Vkontatkte, Yandex, and Mail.ru.
Facial Recognition
Navalny Timeline
August 14: Alexey Navalny arrives in Novosibirsk from Moscow
August 17: Navalny and his team go to Tomsk by car
August 19: Navalny poisoned [unknown time/method]
August 20: Navalny leaves on flight from Tomsk to Moscow, becomes sick on board, flight diverted to Omsk, where he is hospitalized.
August 22: Navalny allowed to leave to Berlin, arrives at Charite hospital.
Uncovering Navalny’s Poisoning
- Research Thread #1: Phone records of chemical weapon specialists who assisted Russian military intelligence (GRU) with the Skripal poisonings in 2018
- Research Thread #2: As we learned from previous investigations, security operatives will arrive a day or two in advance of an operation, and leave on the day of or day after an operation. Who had tickets matching Navalny’s itinerary in Novosibirsk and Tomsk, plus/minus one day on arrival and departure?
Research Thread #1: Phone records
- Who were the chemical weapon specialists involved with the Skripal poisonings talking to in the lead-up to Navalny’s poisoning?
- Collect phone numbers frequently contacted, and crossreference them to establish identities.
Telephone Numbers
Can use popular caller ID apps, like GetContact and TrueCaller, to identify real identity of these phone numbers. Available with free apps or easy-to-use Telegram bots.
Can also check to see where the number is registered in leaked databases, customer data
Research Thread #2: Flights
- There was one person who fit our parameters for flights that trailed Navalny, a man who flew into Novosibirsk on August 13 (one day before Navalny) and bought a ticket to fly out of Tomsk on August 21 (one day after Navalny).
- This person was named Alexey Andreevich Frolov (born 16 June 1980)
- Frolov’s Tomsk-Moscow ticket was booked with (i.e. purchased in the same transaction) two other men:
Vladimir Panyaev and Ivan Spiridonov.
Looking for a lead
Alexey Frolov and Ivan Spiridonov both have absolutely no history in any databases or sources we could find except for travel records.
- No taxpayer number (INN)
- No vehicle
- No residence
- No social media
- No phone number
- No address
Looking for a lead
Vladimir Panyaev was a real person, though. Running his phone number through the popular GetContact app reveals that someone listed him as “FSB Vladimir
Aleksandrovich Panyaev” in their phone’s contact book.
Lead: found!
- Further researching Panyaev’s travel records reveals that Panyaev previous travelled with Frolov to…
- Kaliningrad in July 2020 (Navalny was there)
- Chelyabinsk in April 2017 (Navalny was there)
- Astrakhan in April 2017 (Navalny was supposed to be there… except he was attacked the previous day and hospitalized)
Who is Frolov?
- One of Panyaev’s co-travelers on Navalny’s trail (September 2017, to Omsk) was Alexey Aleksandrovich Aleksandrov was born on 16 June 1981.
- Aleksandrov was registered as living at Michurinsky 25 – a residential building commonly used for those attending the FSB Academy, located down the road at Michurinsky 70.
- Aleksandrov’s personal details also seemed pretty familiar…
Who is Frolov?
Alexey Andreevich Frolov (born 16 June 1980)
Alexey Aleksandrovich Aleksandrov (born on 16 June 1981)
Who is Frolov?
Alexey Andreevich Frolov (born 16 June 1980)
Alexey Aleksandrovich Aleksandrov (born on 16 June 1981)
Aleksandrov’s wife’s maiden name? Frolova
Aleksandrov = Frolov
Aleksandrov did not book any travel from his home in Moscow before Navalny’s poisoning, while Frolov did.
Yet, metadata in Aleksandrov’s phone records revealed:
- August 14, when Navalny had arrived in Novosibirsk, Aleksandrov’s phone pinged a cell tower near the hotel where Navalny was staying.
- Aleksandrov later turns on his phone just after midnight on August 21, showing he was in Tomsk, near Navalny’s hotel just hours after the poisoning likely took place.