A Ferrari for a 13-Year-Old Boy: OSINT Methods in a Ukrainian Corruption Investigation

On January 23, the 112 Ukraine television channel aired an investigation into a former Ukrainian prosecutor who, among other things, reportedly purchased a Ferrari for his 13-year old son. This former prosecutor, Aleksandr Nikolayevich Bondarenko (Oleksandr Mikolayovich in Ukrainian), was appointed during the years of Viktor Yanukovych’s presidency in Ukraine, and was lustrated in late 2014. Bellingcat provided support to the investigators of 112 Ukraine, led by Julia Makarenko, in researching the lustrated ex-prosecutor via open source intelligence (OSINT). In conjunction with a wide-ranging use of open source research methods, 112 Ukraine used traditional investigative journalism to follow up leads. Much like a previous Bellingcat post on OSINT methods used by Aleksey Navalny’s FBK group, this post will explore the open source research techniques employed by Makarenko and her team at 112 Ukraine in their investigation of the assets of the seemingly corrupt ex-prosecutor and how this research can complement traditional investigative methods used in newsrooms across the world.

The subject

The subject for the investigation is Aleksandr Bondarenko and his assets. As seen on the Ukrainian Ministry of Justice’s lustration website, Bondarenko was subject to lustration in late 2014 and is described as an employee of the general prosecutor of Ukraine. His job duties included, among other things, combating corruption and crime in the transportation department of the general prosecutor’s office.

Official declaration of lustration of Aleksandr Bondarenko from the Ukrainian government.

While Aleksandr Bondarenko himself does not maintain any detectable online presence, his actions did leave a footprint, along with the social media profiles of his family members.

The Ferrari

The investigation was triggered by an very obvious clue: a shiny, red Ferrari outside of the Monacco (Монако) restaurant in central Kyiv. The photograph was taken in October 2014 and provided by an anonymous tip to the television station, providing an opportunity to employ OSINT in conjunction with traditional investigative journalism.

The Ferrari in question, parked outside of the Monacco restaurant in Kyiv

112 Ukraine used geolocation to confirm the location of the Ferrari in question. On Wikimapia, a reference photograph for Monacco provides sufficient details to match to the Ferrari photograph:

Thus, the 112 Ukraine investigators were able to confirm that the Ferrari was indeed in Kyiv, at approximately 50.4562668, 30.5128017.

Red Ferraris are not a common sight in Kyiv, and some online research revealed some interesting information for the 112 Ukraine journalists. Another Ferrari with the exact same color scheme was photographed elsewhere in 2015 on the Auto Gespot site (archive), with the license plate ZAKHAR (ЗАХАР)–the name of Aleksandr Bondarenko’s 13-year old son who, according to the anonymous tip that spurred the investigation, received the Ferrari as a gift. The Ferrari evidently underwent a Mansory modification, making it even rarer and more identifiable on the streets of Kyiv.

The same Ferrari photographed in Kyiv in 2015, with Bondarenko’s son’s name on the license plate.

Further investigation reveals that a Ferrari with the same color scheme and Mansory modifications crashed in Kyiv in 2012. A few stories were written at the time about it, and a video surfaced on RuTube showing the aftermath of the damaged car:

Screenshot from a video showing a Ferrari with Mansory modifications crashed in Kyiv, 2012

While this open source research alone cannot confirm a link between the crashed 2012 Ferrari and the 2015 Bondarenko Ferrari, 112 Ukraine followed up by conferring with an automotive body expert, who examined the damages and repairs to determine that the Ferraris from 2012 and 2015 are indeed the same.

The Rolex and Maldives

112 Ukraine was able to obtain the 2013 financial declarations of Aleksandr Bondarenko, revealing that his official salary is about 300,000 UAH per year (approximately $37,500 before Euromaidan, $19,000 when Bondarenko was lustrated). While this is a quite respectable salary for a government official in Ukraine, it cannot explain the expensive lifestyle that his family maintained. Suspiciously, Bondarenko claimed that his family makes almost a million UAH per year (approximately $125,000 pre-Maidan, $63,000 during lustration), even though 112 Ukraine was not able to find any evidence that Bondarenko’s wife, Karina, held any employment, let alone would bringing home more than double Aleksandr’s declared income. Open source research revealed further information about the luxury goods disproportionate with the declared income of the Bondarenko family.

While Aleksnadr does not maintain an online presence, his wife Karina actively uses Odnoklassniki (OK), a popular Russian-language social network site. She has deleted her OK profile since the 112 Ukraine investigation aired, but archived copies still exist via Archive.is. Many of the photographs that she posted on her profile show her wearing luxury watches, allowing 112 Ukraine to match it against various luxury brands until a match was found. A match was found for one of these watches, revealing that it is a Rolex from the Cosmograph Daytona series.

This open source research finding was confirmed by a timepiece expert, who was interviewed during the television program. He valued the watch, assuming it is not a counterfeit, to be at least $37,000–approximately the same as Aleksandr’s declared salary.

Karina also posted numerous vacation photographs on her OK page, spurring 112 Ukraine to geolocate the vacation destination, and consequently find out an average price for such a vacation. One image on the OK profile was particularly useful: a snapshot of a resort island from a small airplane, posted in October 2014.

The island has a few particular features that could be seen from a satellite map: at least two long docks on the ends of the island, including numerous branches on the one visible on the far right, a handful of buildings on the left part of the island, and another island towards the top of the frame. The Maldives is one of the most popular vacation destinations for Russians and Ukrainians, so it was a logical place to start searching. However, there are hundreds of islands throughout the atolls, with dozens of lavish resorts scattered throughout, leading to a tedious Google Earth search for the right slice of paradise resembling Karina’s picture. After a few days, the 112 Ukraine investigators found a matching island–Rangalifinolhu, located at 3.617005, 72.715106.

Comparison of Karina’s photo with Google Earth, from the same perspective.

With a confirmed geolocation in hand, 112 Ukraine was able to confer with a travel agent to determine a flight to the Maldives runs around $6,000 for two people–about a third of Aleksandr Bondarenko’s declared salary when he was lustrated.

The house

Lastly, open source research led 112 Ukraine to the Bondarenko’s most expensive asset: a large house with somewhere under a half-acre of land. Looking through Karina Bondarenko’s photographs on Odnoklassniki, it becomes clear that the family has a house somewhere in a suburban residential development, judging by the modern design of the house, the spacious property, and the neighboring house’s similar architectural style.

Photograph on Karina Bondarenko’s Odnoklassniki account, showing the main house (right) and a smaller structure behind her, along with a distinctive fence.

112 Ukraine accessed the public directory of property ownership in Ukraine (semi-open source, as full access is only available by providing identifying information as a Ukrainian citizen) to search listings for Aleksandr Bondarenko. This search revealed that Bondarenko became the owner of about 0.16 hectares (0.4 acres) of land in the Kyiv suburb of Vishinka in September 2015. However, there is no exact address provided.

Public listing of Bondarenko’s ownership of about 0.16 hectares in a Kyiv suburb.

After knowing the layout of the property and the orientation of the paths, trees, fence, and structures from Karina Bondarenko’s photographs, it was now a matter of geolocating the house through brute force, just like finding the correct island in the Maldives. Eventually, 112 Ukraine managed to find what seemed to be the same property as seen in the social media photographs, located at 50.296711, 30.667546. The journalists at 112 Ukraine visited this location, flew a drone over the house, and confirmed that it is indeed the same as the one seen in Karina’s photographs. The security guards at the house were not receptive to the journalists’ arrival, and denied that Bondarenko owned the property.

Conclusions

This investigation from 112 Ukraine (with assistance from Bellingcat) exemplifies how open source research and verification can provide leads for on-the-ground investigative journalism. Their journalists used geolocation, public directory searches, message board posts, social media, and other open source resources to complement their traditional journalistic methodology of knocking on doors, conducting interviews, and working off of anonymous tips. In sum, they were able to discover, locate, and then calculate the wealth currently held by the lustrated ex-prosecutor Aleksandr Bondarenko. He owns numerous vehicles outside of the Ferrari, including a 2013 F-Type Jaguar, a 2008 BMW 740i, and a Land Cruiser driven by Bondarenko suspiciously registered to his mother-in-law. As reflected in both the open source evidence and investigative research, Bondarenko’s vehicles, property, and luxury goods far are disproportionate to his and his family’s declared income.