Key MH17 Figure Identified As Senior FSB Official: Colonel General Andrey Burlaka
In November 2019, the Dutch-led Joint Investigation Team (JIT) announced the broadening of its criminal investigation into the shoot-down of MH17 to encompass the role of individuals within Russia’s military and administrative hierarchy who enabled the tragedy. The JIT made public 23 telephone intercepts from the days before the shootdown, which appeared to prove the close involvement of Russian officials with fostering and funding the war in Eastern Ukraine — as well as directly coordinating with and providing substantial military support to ostensibly “independent” militants.
While some of the Russian officials heard in the intercepts were easily identifiable — such as the Russian president’s then-advisor Vladislav Surkov — others remained unknown to the JIT and to the general public. One key unknown person of interest had seemingly been in a crucial position to supervise the movement of weapons from Russia to Ukraine, and thus would have had to authorize the transfer of the Russian Buk missile launcher that shot the Malaysian airliner after crossing the border. The JIT appealed to witnesses and the public for help in identifying this official, who was only referred to in the calls as “Vladimir Ivanovich”.
We can now announce that our investigation team, in cooperation with our Russian colleagues from The Insider, and with additional reporting from Kevin Hall from McClatchy Newspapers (DC), has been able to identify the person of “Vladimir Ivanovich” as one of the top officials within Russia’s FSB security service: Colonel General Andrey Ivanovich Burlaka. This FSB general is the highest-ranking Russian official identified as a person of interest in the criminal investigation into the downing of MH17.
The November Call for Witnesses
In a press release and a video address on 14 November 2019, the JIT announced that it possessed evidence that in the months before the tragedy, the Russian Federation had exerted administrative, financial, and military control over the so-called Donetsk People’s Republic (a.k.a. the DNR), from the territory from which the Buk that shot down MH17 was launched. The statement specified that contacts between DNR and the Kremlin had intensified in the weeks and days before the shoot-down, with almost daily telephone contact between the self-declared republic’s leadership and their handlers in Russia. Communication mostly took place via secure telephones provided by the Russian FSB. From the context of the JIT statement, it appeared that encrypted communications had been intercepted by Ukraine’s secret service, and some of the calls were ultimately decrypted by the Joint Investigation Team.
The JIT explained the legal consequences of this new evidence. The indications of close ties between leaders of the DNR and Russian government officials, it said, raised questions about the latter’s involvement in the deployment of the Buk missile launcher from the 53rd Anti-Aircraft Missile Brigade in Kursk to the launch location in Ukraine near the town of Snizhne.
The Mysterious Vladimir Ivanovich
The phone intercepts published by JIT make frequent references to a certain “Vladimir Ivanovich”; a shadowy figure who, by the start of July 2014, was already in a crucial role supervising militant activities in Donbas and authorizing the flow of weapons across the border.
The earliest reference to Vladimir Ivanovich is in an intercepted conversation from 1 July 2014 between Alexander Borodai, DNR’s Russia-appointed “prime minister”, and Konstantin Malofeev, the Russian entrepreneur who employed Borodai and Igor Girkin, the “defense minister” of the DNR (and one of the four defendants at the MH17 trial in The Hague). At the time of the Crimea annexation, Malofeev provided funding and logistical help for the early stage of the military operations in the Donbas.
In this call, Borodai describes a turf-war between two groups of Russian militants: the “Bes” people and the militants under Girkin’s command (“Bes” is the military call sign of Igor Bezler, the self-styled “rebel commander” of Horlivka whom Bellingcat has identified as a GRU asset with a second, Russian, passport under the name “Igor Beregovoy“). In the call, Borodai tells Malofeev that “the operation’s commander, Vladimir Ivanovich, has given us a command to eliminate Bezler’s groups”. Malofeev asks Borodai if he has passed this info upstream. Borodai responds that he has informed “the office” (a standard reference to FSB) and it has authorized the operation, but that he had not yet managed to reach his boss. (From the context and the subsequent calls made by Borodai it appears that he refers to Surkov.)
From a number of other calls in the next days, it becomes clear that “Vladimir Ivanovich” was a high-ranking FSB official who, no later than the beginning of July 2014, had been given authority to supervise militants’ operations in Ukraine. His supervising role continued at least until the end of July, as can be established from a call on 31 July when Girkin complains that “Vladimir Ivanovich must give me tasks to fulfill and not go above my head to command my people.”
In another intercept from the morning of 16 July 2014, the day before MH17 was shot down, Borodai asks “Vladimir Ivanovich” if it is possible that Russian helicopters were attacking, or could engage, Ukrainian positions near Maryinka:
(…)
Borodai: Vladimir Ivanovich?
V.I.: Speaking.
Borodai:: Tell me, is it possible that our helicopters could be carrying out some raids? Good morning. I beg your pardon.
V.I: Good morning
Borodai: So, is it possible that our helicopters are carrying out raids near Maryinka? Ours?
V.I: [speaking to the side] Turn on the encryption!. (…)
Maryinka is a village that was, at the time, a frontline village near Donetsk, and although Russian Armed Forces were by then frequently conducting cross-border artillery strikes on Ukrainian positions, it seems unrealistic that Borodai believed that Russian helicopters would venture that deep into Ukrainian airspace. As such, it seems possible that he actually meant the similar-sounding village of Marinovka (Marynivka in Ukrainian) which marked the frontline south of Snizhne near the border with Russia. In fact, on that same morning, Borodai was captured in a video broadcast on a Russian TV channel while talking on the phone behind Igor Girkin, who was giving an interview from the battlefield near Marinovka (several hours later the town fell to separatist forces).
Borodai (behind Girkin) speaking on the phone on the morning of 16 July 2014 in a field 6.5 kilometers north of Marinovka and 3.3 kilometers south of the eventual Buk launch site. The camera is facing northeast, with the shadows of the armed men aligned towards the camera and roughly parallel with the path — indicating a west or northwest direction. Using SunCalc, we can estimate that a shadow in this direction was taken in the morning, at approximately 9-11am
Due to the encryption being turned on at the start of the call, it is not clear what “Vladimir Ivanovich” then said to Borodai, and if helicopter support was provided.
In an intercepted call between two separatist commanders from 16 July 2014, one of them tells the other that Russian Defense Minister Shoigu has determined “who gets what” and informs him that the procedure has been delegated to “an FSB guy based on Rostov”. The next morning, the second militant, who identifies himself as Sergey Vorobyov, phones “Vladimir Ivanovich” to request a list of “things we need”, and says that the request has been coordinated between the Russia-appointed Crimean prime minister Sergey Aksyonov and the chief of the FSB, Alexander Bortnikov.
From other calls made by Vorobyov, it becomes clear that needed items include arms, ammunition, night-vision equipment, and armored vehicles. In a follow-up call at 13:27:50 on the same day, it becomes clear that “Vladimir Ivanovich” does not authorize the complete list, but only a part of it. To this, Vorobyov tells “Vladimir Ivanovich” that his boss told him the latter is “the ultimate authority to provide help”, and that if there are questions about the items requested, “Vladimir Ivanovich” should contact Vladislav Surkov, as “he is the one giving us the tasks”. “Vladimir Ivanovich” counters that he receives instructions from his own boss on what equipment to provide.
Finally, another call between two Donbas-based militants from 16 July 2014 references “Vladimir Ivanovich” as a high-ranking commanding official who has just arrived from Moscow. From the context of the call, it becomes clear that in the chain of command “Vladimir Ivanovich” is above the highest-ranking commander in Donbas, and that at the time of the call he was in Eastern Ukraine or in Russia near the Ukraine border (it does not become clear where exactly).
Role Of Vladimir Ivanovich Per The Call To Witnesses
Based on the call intercepts as a whole, it becomes clear that “Vladimir Ivanovich” played a critical role in the chain of command between ostensibly local militants and the Russian government. At the end of June 2014, the Kremlin had began consolidating the disparate military formations fighting with Russian backing in Eastern Ukraine, and had streamlined the flow of weapons across the border. While previously both GRU and FSB had run their own proxy military groups in the Donbas and had furnished them with weapons independently — sometimes leading to infighting between the two groups — by early July, this process had been centralized under the FSB’s control. Vladimir Ivanovich had clearly been the FSB official to whom the curation of the flow of weapons across the border had been delegated.
Given such a crucial role, it would be impossible that a large cluster of military equipment — a Buk missile launcher and accompanying vehicles — would have been able to cross the border in the morning hours of 17 July without the direct authorization of “Vladimir Ivanovich”. As a consequence, “Vladimir Ivanovich” would have played a critical role in the chain of command for the deployment of the Buk installation in Ukraine, and thus also for the crime of shooting down MH17.
Vladimir Ivanovich Identified as Col. General Andrey Burlaka
We have identified “Vladimir Ivanovich” as Col. General Andrey Ivanovich Burlaka, who serves as Chief of the Operational Staff of the FSB’s Border Service, and is the first deputy to the head of the Border Service of FSB, who in turn is first deputy to the head of the FSB, Alexander Bortnikov. This makes Andrey Burlaka one of the senior-most officers in the FSB, two positions removed from the director, via his direct boss, army general Vladimir Kulishov. He held this same position at the time of the MH17 shoot-down.
Andrey Burlaka was born in 1965 in the small far-eastern town of Sovetskaya Gavan (Soviet Haven), just across from Japan on the coast of the Sea of Japan. In 1986, he graduated from the Border-service Institute in Moscow, and was then sent to serve as a border officer at the Soviet Union’s border with Afghanistan and Iran.
Following the collapse of the Soviet Union, Burlaka graduated from the FSB Academy in Moscow in 1995, and was then dispatched as a commander of regional border units at Russia’s pacific coastal border, and the Far-Eastern regional FSB border service in Khabarovsk. Prior to 2012, Andrey Burlaka was the Director of the Far-Eastern Border Service. In 2007 he was appointed by a presidential decree as the head of FSB’s coastal border service in the far-eastern region of Sakhalin, just north of Japan. He is mentioned as a recipient of a an award of the border service of the Union of Independent States from 2019.
Gen. Andrey Burlaka And His Role In The War In Ukraine
While there is no publicly available official information of Gen. Andrey Burlaka’s involvement in the Donbas war, travel data obtained by Bellingcat and a review of previously leaked or hacked correspondence corroborates the evidence from the intercepts published by JIT.
A review of Burlaka’s airplane travel in 2014 and 2015 shows that he frequently flew from Moscow to Rostov, to Crimea. and to Krasnodar — the three control centers for military operations against Ukraine. His trips also match with the timeline of known presences in Ukraine or near the Ukraine border that can be deduced from the intercepts. As an example, Andrey Burlaka arrived from Moscow to Rostov on the morning of 15 July 2014, and departed late in the evening of 18 July 2014, the day after MH17’s shootdown (the intercepts from 16 July 2014 refer to Vladimir Ivanovich as having just arrived from Moscow.).
An analysis of co-travelers and co-travelers-of-co-travelers of Andrey Burlaka (people who flew on joint airline bookings) has identified links to other FSB operatives known to have been involved in the invasion of Ukraine. For example, several of his co-travelers frequently traveled with General Sergey Beseda, head of the FSB’s 5th (information and international cooperation) department, who is under sanctions by the United States over his role in the Ukraine war.
In October 2015, a little-known blog site published what appeared to be leaked internal Russian FSB document drafts. These leaks have not been noticed and referenced by mainstream media. Among this cache are (alleged) drafts of reports on FSB active measures against Ukraine, including complex plans to plant Russian cyber operatives in service of Ukraine’s secret service in order to obtain an inside source.
One draft document included in these sets of leaks has a top-secret designation and appears to be authored by Lt. General Andrey Burlaka (which suggests he did not yet have the rank of col. general by then). The document is undated, but the pre-inserted month is July 2014. The document presents a request to FSB’s director Bortnikov to prepare exfiltration plans for an FSB asset working as a commander of a separatist unit and who allegedly had good contacts with Ukraine’s SBU. The letter requests the issuance of fake Russian identity papers to the asset known under the code name “Chapaev”.
It is impossible to independently authenticate these leaked documents, especially given that they are drafts and not official final copies. However, one of the leaked documents includes a comprehensive list of (allegedly) compromised Ukrainian military and flight-control email servers. We have validated the data in this document, and have confirmed that it includes (a) non-public data and (b) all the email accounts in that list exist and are linked/hosted on the mail servers listed. While this alone does not fully validate the authenticity of the leaks, it does boost their credibility.
Identification Process
Our initial search for the true identity of “Vladimir Ivanovich” started by reverse-searching the phone numbers used by “Vladimir Ivanovich” as listed by JIT. We searched the numbers in various telephone messengers, phone data sharing apps, Telegram bots, and leaked databases. One number listed by JIT showed up in the GetContact phone-sharing app as “Vladimir Ivanovich”:
The same number, when searched in a leaked, older version of the GetContact database (ran as a Telegram bot service), resulted in a secondary number for that same telephone number. When we searched for that second number in GetContact, we found it was listed as Vladimir Ivanovich Burlak.
We searched all available Russian databases for a person named Vladimir Ivanovich Burlak, but we discovered that the only person in an acceptable age group bearing such a name — a former Russian law-enforcement official — had died before 2014. Thus we assumed that “Burlak” may have been a code name rather than a family name.
We also could not find any matching person having the name and patronymic “Vladimir Ivanovich” among people who traveled to and from Rostov and Simferopol on dates on and around which we knew “Vladimir Ivanovich” might have traveled, based on the intercepts.
Following these steps, we searched all previously leaked email and document archives linked to the war in Ukraine for a reference to Vladimir Ivanovich. The only hit was in the Surkov Leaks and concerns a document from 13 May 2014 (apparently sent by Russian oligarch Konstantin Malofeev or one of his associates) to Surkov containing a list of candidates for the newly formed government of the DNR. At the end of the document, the author suggests asking the opinion of “Vladimir Ivanovich” about the commander of the DNR’s Vostok Battalion, Alexander Khodakovsky (a defector from Ukraine’s SBU).
As a last resort, we turned to a search within a database of hacked text messages from the mobile messenger Viber, which had been leaked and made public in 2015. The correspondence belonged to a man named Alexander Serov, from the staff of Denis Pushilin, the current head of the DNR and the speaker of the so-called DNR Parliament in the spring and summer of 2014. Serov’s Viber contains messages to a number of high-profile figures in the DNR, and, along with more mundane personal messages, reveals that he faked his own death in order to avoid alimony payments and start a new life in the Donbas. A detailed analysis of these leaks by Mark Krutov of RFE/RL can be read here.
Within this archive, we found a reference to a “Vladimir Ivanovich”, which Pushilin’s assistant described to a colleague as “a deputy chief of FSB, whose real name is in fact Andrey”.
The leaked messages can be found here, viewable in a spreadsheet program or on Google Sheets (RAR found here). Note that the filenames were unreadable for most machines with its encoding, and the filenames in this folder were changed to the interlocutor(s) in Cyrillic that is readable for most machines (e.g. “¦УTОTА¦¬¦-” changed to “Гюрза”). Thus, the files’ metadata may show that they were modified after 2015, but this is just from the filename modification, and the original files without this change can be found in the aforementioned RAR file.
The exchange in question took place on 8 November 2014. To a question from Pushilin’s aide Alexander Serov to Pushilin’s personal assistant Alisa Natalchenko about “who decides on the vacation plans” [of separatist militants and leaders], she explains that “we started investigating up the chain of command and found out it is some guy called Vladimir Ivanovich”.
Serov then adds his own understanding that, “He is also [known as] Andrey Ivanovich, and he is a deputy to the chief of FSB”.
Alisa Navalchenko concurs that that’s the same person, and adds that “during this week, he is said to be getting the job of director”. Serov however says that will not happen, insinuating inside knowledge that is not explained further.
This reference and description of Vladimir Ivanovich was compatible with what was known about the Vladimir Ivanovich from the JIT leaks. Therefore, on the hypothesis that this is the same person, we began a search for all deputies to the FSB director — and other senior officers near the top of FSB’s pyramid — that had the first name “Andrey” and the patronymic of “Ivanovich”. (A copy of this leaked conversation — original found in aforementioned links — can be viewed on Google Sheets here.)
We quickly stumbled upon a last name that we recognized from the earlier reverse phone look-up: Andrey Ivanovich Burlaka. The last name was off by one letter, but it could be explained by a shortening of the entry by the person typing the name into his phone, or by a misunderstanding of the last name (both Burlak and Burlaka are existing family names in Russia and Ukraine).
Given this strong hypothesis, we then set out to find a voice sample of Col. Gen. Andrey Burlaka, in order to compare the voice to that in the published intercept.
Update
following the publication of this report, in reviewing further Viber communications between Pushilin’s aides, we located an actual reference to the name “Burlaka” as the real last name of the FSB General known under the code name “Vladimir Ivanovich”. This chat takes place on 20 November 2014, 12 days after the first chat about Vladimir Ivanovich.
In this chat, Pushilin’s assistant Alisa Natalchenko asks Alexander Serov if he knows what Vladimir Ivanovich / Andrey Ivanoich’s last name is. She says she needs to find a photograph of him, and describes him by memory as having a round face, light-colored hair and a receding hairline, thus implying that she has met him in person.
Alexander Serov replies by guessing that he might be Alexander Ivanovich Zhdankov, or Andrey Ivanovich Bastrykin, both FSB Lt. Generals. Alisa Natalchenko tells him neither is the right one, and remembers that “the name of that one was something like Burlaka“.
The Hunt for Burlaka’s Voice
We quickly located a TV interview given by Col. Gen. Burlaka to a local Russian TV channel in Orenburg in January 2013. A subjective comparison of the voice and morph-linguistic speech characteristics between Andrey Burlaka and “Vladimir Ivanovich” resulted in a very convincing match between the two. The video below includes a sequential comparison of the two speakers.
At this point, we were certain that we had identified Vladimir Ivanovich correctly. The voice comparison, paired with all the other evidence we had gathered, was sufficient for a confident identification.
However, we wanted to double-check our findings with a forensic voice comparison. For that, we needed a longer speech segment. The net speech time from video interview was insufficient for a computerized forensic voice comparison. A minimum (net) speech of 60 seconds is required for a forensic match.
Our continued search for video events with Burlaka speaking on camera led to a dead end. There were several video reports with Burlaka speaking to an audience, but none contained his voice.
The breakthrough came when we decided to search for the origin of a photograph of Andrey Burlaka which had appeared in a post selling a TV set. We found the image with Yandex Image Search, which has shockingly good facial recognition algorithms. Fortuitously, the person selling his used TV had taken a snapshot at the exact time when Andrey Burlaka was speaking, straight to camera, on a TV program. The TV channel was discernible from the screenshot: a program on the Russian Defense Ministry channel, TV Zvezda.
Seeing this classified ad, we hypothesized that the seller would have taken a photograph of his TV set on the day or just before the day on which he would have uploaded the photos to the classified ads site (selling a TV set is not something one tends to plan long in advance). We saw that the specific classified ad was created on 1 June 2018.
Armed with this information, we then searched for all programs that were broadcast on TV Zvezda on 1 June 2018 and the days just preceding that date. We found a program that aired in the morning of 1 June 2018 whose title looked promising: it was the fourth episode in the documentary series “Border: Particular Conditions of Service”, a documentary dedicated to the 100th anniversary of the Russian border guard service.
On the 28th minute of this documentary, we found the exact screenshot that Maxim (the TV set seller) had snapped for his classified ad. And starting at that moment, we were able to capture a long segment of Burlaka’s speech on the hardships of protecting Russia’s borders, which netted much longer than the necessary sixty seconds.
We then submitted the captured audio to the National Center for Media Forensics at the University of Colorado Denver for a forensic voice comparison. Despite the poor quality and short duration of the telephone audio sample, the forensic result provided moderate support for the hypothesis that Col. General Burlaka and “Vladimir Ivanovich” are the same person. In the conclusion of Prof. Catalin Grigoras, Director of the Media Forensics Center, “the computerized comparison produced a likelihood ratio (LR) ≈ 94, which represents moderate support for the proposition that the questioned/unknown voice is that the of the person of interest rather than that of another person recorded in similar acoustic conditions”.
It should be noted that computerized (acoustic) voice comparison does not take into account phonemic and linguistic idiosyncrasies of speech. The idiosyncratic (phonemic, intonation, and linguistic) characteristics of the two speaker were so similar that, once taken into account, made the voice match conclusive.
As stated above, the forensic voice match was needed as an additional validation method, and not as the main identification method in this case. Based on a holistic analysis of the gathered evidence gathered, Bellingcat reached a conclusion that the FSB officer from the JIT intercepts known as “Vladimir Ivanovich” can be confidently identified as Col. General Andrey Ivanovich Burlaka.
