The Search for Denis Sergeev: Photographing a Ghost

In the previous part of this report, Bellingcat and its investigative partners The Insider (Russia) and Respekt (Czechia) identified Denis Sergeev, the GRU officer who was present in the UK during the poisoning of the Skripals in March 2018, and was also in Bulgaria during the poisoning, with similar symptoms, of a Bulgarian arms dealer in April 2015.

Following the report, Bulgarian authorities have announced that in October 2018 they re-opened investigations into the 2015 poisoning incident, and that they are now working in close cooperation with British police. In the meantime BBC Russia contacted by telephone Denis Sergeev’s wife, who denied her husband was a GRU officer but declined to answer what his actual job was. She told reporters that her husband would decide whether he wishes to speak to the press, after which she has not been reachable at the telephone number. As of press time, a different person was answering her phone, who claimed not to know the Sergeevs’.

Additional Details from Denis Sergeev’s Biography

Following our initial identification report, BBC Russia reported that it had discovered a person bearing the same full name and birth date as Denis Sergeev on a cached webpage of the 1990 graduating class of the Ekaterinburg Military School. Bellingcat can confirm that this was indeed the same Denis Sergeev, who studied in the two-year cadet-prepping institution. A comprehensive search in Russian databases has shown that there does not exist a second person with the same full name and birth date.

Bellingcat has established that as of 1999, Sergeev had a rank of captain and was serving as commander of the first paratroopers’ company at the 108th Air Assault Regiment. This unit is based in Novorossiisk, on Russia’s Black Sea coast, and played a key role in fighting in Dagestan in the summer of 1999, as well as in the second Chechen war in 2000-2001. In the early morning of August 13 1999 Denis Sergeev was wounded in the first minutes of an attempt to recapture the Alilen Mount in Dagestan from Chechen fighters. Sergeev, alongside other officers, received a state award for this battle.

Denis Sergeev in 1999. Screen grab from a documentary on the battle for Alilen

The Impossible Search for “Fedotov”

The search for the identity of the third Skripal suspect “Fedotov” was markedly more difficult than that for the other two suspects, “Boshirov” and “Petrov”. The reason for this, on one side, was the fact that British authorities released no information about – and crucially, no photographs of – the third suspect. On the other side, after Bellingcat’s initial identifications of Col. Chepiga and Col. Mishkin, the Russian authorities apparently took unprecedented measures to purge any traces of this person’s existence. Ironically, Bellingcat was able to witness this clean-up operation in real time, as data on this person that was originally available in online databases at the start of the investigation (in October 2018), became incrementally purged over the subsequent few months, with the person completely vanishing from all state-run registers by early 2019.

The initial existence of a likely third suspect traveling under the name “Sergey Fedotov” was first reported by the Russian website Fontanka, whose reporters first noticed that a person with a passport number pattern similar to that of “Petrov” and “Boshirov” traveled on a different Aeroflot flight to London on the same day as the main two suspects.

Bellingcat then obtained the passenger records for the 2 March 2018 flights from Moscow to London that had been reviewed by Fontanka, and identified the person, whose passport number different by the two last digits from those of the main suspects previously identified by us as decorated GRU officers. Indeed, “Sergey Fedotov” had flown into London on a flight several hours before “Boshoriv” and “Petrov”, landing at Heathrow, while they would land at Gatwick airport later that same day.

We then obtained travel data for this person for the period 2011-2018. To re-create his travel itinerary we used three sources of data: border crossing data (both in Russia and other countries) provided by whistle-blowers, PNR data (reflecting airline bookings) that was temporarily exposed though a vulnerability in an airline booking systems, and a Russian passenger-monitoring system used by the police to track Russian citizens, to which we received access also via (different) whistle-blowers. The data sources were independent of each other, and mutually validated the travel records.

Different data sources had various advantages and disadvantages. PNR data, for example, provided more granular steps for each flight, such as times of preliminary booking, purchase, cancellations, check-in and no-show events. This allowed us to establish that “Fedotov” skipped his booked flights from London to Moscow after the Skripals poisoning, and from Sofia to Moscow after the Gebrev poisoning. On the other hand, police-monitoring data informed us of his train and car travels inside the country, and also provided information of other passengers who booked flights along with him – exposing names of other likely GRU operatives. Border-crossing data, while limited to international air-travel only, was also the only data source that turned out to be immune to deletions as part of the Russian authorities’ cover-up measures.

Sergey Fedotov: Real or Fictional?

The passenger manifest for the Moscow-London flight provided a first and last (family) name and a date of birth. At this point, we were not certain if these belonged to a real person or were cover credentials. We knew from our prior research into “Boshirov” and “Petrov” that typically, GRU would create a parallel documentary trace for the cover identity, including passports, address registrations, and even employment histories (all of these are needed, among others, in order to ensure credible applications for visas).

Knowing this, we first searched for “Sergey Fedotov” born on 17 September 1973 through hundreds of Russian residential, automobile ownership, tax ID and credit history databases that have been leaked onto the internet over the past 20 years and that we have consolidated in the last 3 years. There, we found four possible matches. One of them was registered to a Moscow address: his full name was Sergey Vyacheslavovich Fedotov. This person’s entries in the databases displayed certain unusual characteristics. For example, Moscow residential databases listed his place of birth as Apushka, a small village in the Ryazan region north-east of Russia. However, no entry for such a person existed in old residential databases of the Ryazan region. Also, “Fedotov” was shown as employed by a company called “Business-Courier”, which had existed on paper between 2004 and 2008 and had apparently never traded. Crucially, these databases showed “Fedotov”s registered address, but when Bellingcat acquired the ownership records for this apartment, they showed a different family – also bearing the Fedotov name – as owners. Neither of these owners could be identified as having a family member named Sergey Fedotov and born in 1973. Our attempts to reach this family were futile, as all four listed numbers for them had been disconnected.

At this point in the investigation, at the end of October 2018, we obtained Moscow’s Sergey Fedotov’s passport file from a whistle-blower with access to the centralized police travel-tracking database. It validated our suspicions that this was a cover identity: his latest passport was issued by the same 770001 passport desk that was known to issue passports to GRU officers and foreign-born VIP citizens, and it was issued due to “unusability of the previous passport” – the same reason given for the issuance of Petrov and Boshirov’s cover passports. Importantly, the previous passport – which was listed as issued in the Ryazan region – had a number that did not show up in the Ryazan databases. These peculiarities as a whole convinced us that Sergey Fedotov was a cover identity.

The Quest for a Photograph

The next step in the investigation was to obtain a photograph of the “cover” persona, which would be used to search for the real individual and prove that they are the same person. Unlike the case of the other two suspects, no published photographs of Fedotov existed, nor was he interviewed on RT.

At this point, in December 2018, Bellingcat requested a copy of Fedotov’s domestic passport from a source with access to RosPassport, the central passport database. The source reported that no passport records exist for Sergey Fedotov. This information contradicted both the police tracking database which had provided full details of Fedotov’s passport, as well as telephone registration records which also contained his passport details. To ensure that this was not human error, Bellingcat requested a second source with access to verify the absence of passport data; this source confirmed and presented us with a screenshot of the “no results” search menu. The only logical conclusion was that Russian authorities had purged the cover persona Sergey Fedotov from the central passport database.

With no access to a passport photo from Russian databases, Bellingcat approached many sources at border-crossing authorities in the various countries where “Fedotov” traveled to, as well as hotels at which Bellingcat’s investigation partners had identified he had stayed. After long persuasion, one of these prospective sources provided Bellingcat with a photograph from a scan of Fedotov’s international passport.

Finding The Real Person behind Fedotov

Based on our experience from prior identifications of GRU officers, we knew that cover identities fell into two broad categories: minimal-change (i.e. only last name, and sometimes patronymic, are changed, leaving date of birth and general region of origin unaltered, as in the cases of Mishkin, Shishmakov, Moiseev), or full make-over (i.e. change of both name and birth data, as in the case of Chepiga/Boshirov). We started the search by testing the minimum-change hypothesis. However, a search in hundreds of residential databases for a “Sergey Vyacheslavovich” with birthdate of 17 September 1973 led to no likely candidates.

As a second step, we tested for only “Sergey” with the same birthdate. This resulted in a large pool of targets, but none of them displayed immediate signs of links to GRU. Last, we decided to search only for people with a patronymic “Vyacheslavovich”, and birthdate 17 September 1973. In our initial search with these criteria in a 2012 Moscow residential database, we found 15 hits, but one of them was of special interest. This person had a listed residential address at Narodnoe Opolchenie 50, which is the location of the dormitory of GRU’s Military Diplomatic Academy. This was Denis Vyacheslavovich Sergeev, born in Kazakhstan, and having a passport issued in Novorossiisk in 2000. Databases of different vintage showed that he, along with his wife and daughter, had been registered as residing at this address no later than 2006, and were still registered at that address in 2012.

Denis Sergeev in a Russian database, showing his date of birth and his military unit’s address. The database has an error with his patronymic, which should be Vyacheslavovich, not Vyacheslav.

The links between Denis Sergeev and GRU were not restricted to his family’s residence at the dormitory of the GRU “Conservatory”. In certain databases his address was listed as Military Unit 22177, which is in fact the military number of the Conservatory. From leaked domestic travel databases, we obtained domestic travel records for Sergeev (he appears not to have traveled internationally under his real identity). On several train trips between Moscow and St. Petersburg, Sergeev traveled on joint bookings with other people, who were registered as residing, or having their cars registered at Khoroshevskoye Shosse 76A, the headquarters of GRU. One companion train passenger had been previously seen by Bellingcat as listed among the people authorized to drive a car owned by Vladimir Moiseev, the GRU officer identified by us as the person behind the persona Vladimir Popov, under which he is on the Interpol red notice list in connection with the abortive Montenegro coup in 2016. This same person, in turn, had traveled multiple times between Moscow and Krasnodar, where the base of the private Wagner military company is, in joint bookings with persons identified as Wagner mercenaries.  Bellingcat has previously reported that Wagner mercenaries had international passports from the same series used for GRU undercover passports, and that seniоr GRU officers frequently travel to Krasnodar’s Pashkovsky airport, sometimes on flights on which known mercenaries are also flying.

Another person who traveled on joint train bookings with Denis Sergeev was also found on 4 different joint airline bookings with Eduard Shishmakov, the GRU officer expelled by Poland in 2014, and also on the Interpol wanted list for his role in the Montenegro coup. The two flew together from Moscow to and from Rostov airport in late 2012; at that time Shishmakov was formally serving as Russia’s deputy military attache in Poland.

To establish conclusively that Sergeev is in fact “Fedotov”, we needed to obtain a photograph of Sergeev and compare it to the already obtained “Fedotov” passport photo. However, this turned out to be nearly impossible.

Concerted cover-up Efforts by the Russian State

While we could find multiple references to Denis Sergeev in offline, aged databases from 2018 and earlier, it appeared that no such person existed in current, online state-run registries. Initially, Bellingcat tried to obtain a photo of Denis Fedotov via several sources with access to the traffic police (GIBBD) database. All sources reported that no such person exists among licensed drivers in Russia. This did not make sense, given that we had already obtained records of Sergeev’s own car, and had also verified that he was listed as an authorized driver for his daughter’s car.  In addition, we had obtained the number and date of issuance of Sergeev’s initial driving license from an offline database.

Database entry with Sergeev’s address shown as Military Unit 22177, and with the number and issuance date of his driver’s license

Our hypothesis that Denis Sergeev had been purged from state-run databases – including the passport database – was confirmed via a simple experiment. As we had his domestic passport number from previously obtained documents (including the October 2018 police tracking database record), we tried to obtain Sergeev’s unique tax identifying number via a web tool run by Russia’s tax authority. The tool returned no results. We then tried to obtain the tax number for the other two suspects in the Skripal case. They, too, had vanished from the tax system. Other known GRU officers, whom we had identified previously but who had not been linked to the Skripal case, could still be found using this same tool. Data for the cover identities “Fedotov”, “Petrov” and “Boshirov” had also disappeared from this onlne database.

We then attempted to find traffic fine violations for Denis Sergeev’s car using a web-tool run by the traffic police. We had the exact registration details of Sergeev’s Nissan X Trail, however the online tool informed us that no such car exists.

Last, we checked if travel records for “Fedotov” for the period 2015-2018 were still present in the police travel tracking database (we had previously obtained such records in October 2018). As of February 2019, no such travel records existed in the system. It became evident that the Russian state had implemented a full sweep of data relating to both the real and undercover identities of Sergeev and his other colleagues linked to the Skripal case.

While impeding our ability to find a photo match between Sergeev and Fedotov, this finding gave us the idea to look for other GRU officers who might be linked to the Skripal poisoning, in which case we could expect their data to not be available via the online tax tool. Indeed, we have identified one such additional GRU officer. This officer, notably, traveled to Bulgaria two weeks before Sergeev’s trip which coincided with the poisoning of the Bulgarian arms trader. Bellingcat and its partner publications are currently analysing whether this may be a fourth suspect in the Skripal case.

Alternative Photo Match

While reconstructing Denis Sergeev’s background prior to his studies at the Military Diplomatic Academy, we sought for a person with this name among the most likely recruiting grounds for that institution – Spetsnaz and air-attack paratrooper units, especially ones with actual hands-on military experience. We were able to find a reference to a Capt. Denis Sergeev in a book about the Dagestan events in 1999 described earlier. We also discovered several witness descriptions of the battle in which Capt. Sergeev was wounded, while his commander was killed. One of the references was in an article about a documentary film on the battle in Dagestan.

We found this documentary which was filmed shortly after the events, and saw that Capt. Sergeev was interviewed on camera in several segments. While there were certain similarities between the person in the documentary and the recent photograph from “Fedotov”‘s passport, we could not be certain that this was the same person, especially given the low resolution of the photo and the nearly 20 years between the two events.

Bellingcat then requested a forensic analysis of the similarities between the persons on the passport photo, on one hand, and the screen-grab from the 1999 documentary, on the other. Prof. Hasan Ugail from the Center for Visual Computing at the University of Bradford supervised the analysis, which was conducted using a state of the art deep machine-learning algorithm trained on millions of human faces. The algorithm provides 100% matching accuracy in one to one face comparison tests of known identities. The test provided a match of 78.2%, while a match >70% is sufficient to conclude identity match of the persons.

Conclusion

This two-part report identified a third suspect in the Skripals poisoning case, who may also be a suspect in the poisoning of Bulgarian arms manufacturer and trader Emilian Gebrev in April 2015. Sergeev’s undercover travels as “Fedotov” are extensive, and overlap with certain important political events in Europe. His long career profile suggests he is not a mid-rank operative or support personnel for overseas operations, but more likely serves in a supervising function. Further investigations are needed into the purpose of his rich travel history, especially in locations such as Spain, Turkey, Czechia and Tadjikistan.

A key discovery in this report was the unprecedented purge of all traces of both the cover and real persons linked to the Skripal case from public registers in Russia. Such cleansing, which took place after Bellingcat’s initial identification of GRU officers “Boshirov” and “Petrov”, cannot realistically be undertaken without the direct involvement of the Russian state. The only plausible explanation for this data purge is curbing further investigation into the Skripal (and possibly, the Gebrev) incidents, both by media and by foreign law enforcement agencies.

In the course of this investigation, we found that GRU undercover officers assigned to different operations often overlap, with the total number identified by Bellingcat not exceeding 10, many of which overlapping between, for instance, the Montenegro and Skripal operations, as well as other joint operations whose purpose is yet to be identified. This implies that there is a limited elite team of internationally trained operatives that are recycled among various projects.