Yachtspotting: OSINT Methods in Navalny's Corruption Investigation

Translations:

Recently, Russian President Vladimir Putin’s press secretary, Dmitry Peskov, found himself embroiled in a scandal over his wristwatch, which was prominently displayed during his wedding to former Olympic ice dancer Tatiana Navka. Anti-corruption activist and Kremlin opponent Aleksey Navalny revealed that a watch worn by Peskov was worth upwards of $600,000, despite Peskov’s approximate annual salary of $147,000. On Monday, Navalny went a step further in his anti-corruption crusade against Putin’s press secretary.

Navalny received a tip from what he considers a reliable source that Peskov was renting out an expensive yacht well beyond his declared means for his honeymoon. According to this source (rumored to be socialite and television anchor Kseniya Sobchak), Peskov was spending his honeymoon with his wife, family, and close friends on this yacht, sailing to Sardinia, Naples, and Sicily.

By using open source research, Navalny and many of his followers investigated this claim, looking into the yacht “Maltese Falcon,” which is currently sailing across the Mediterranean Sea.  In August, this yacht costs 385,000 euros (approximately $426,000 USD) to rent per week, well outside of the press secretary’s salary—though it is unclear how well-off his bride is. If the figure of 385,000 euros/week does not capture the yacht’s expense, consider the fact that it is one of the 25 most expensive yachts ever built (in fact, the 2nd most expensive, per Max Seddon’s article at Buzzfeed) and includes a small submarine.

Peskov denied renting this yacht, telling the Russian news outlet RBC that he is at a hotel in Sicily and not at sea.

By following the research methodology of Navalny and his online supporters, it becomes easier to follow this convoluted story of corruption and scandal. In this article, the OSINT methods of Aleksey Navalny’ and his team of investigators (collectively referred to as just “Navalny,” for the sake of simplicity) and various subsequent Russian-language investigations posted on social media will be detailed, along with their potential in unearthing corruption in other contexts.

Navalny’s OSINT research methodology

The methods of Navalny are accessible to anyone reading this article, except for the initial tip that Navalny received from a still-unrevealed source to initiate the research.

  • The yacht’s website

A large portion of the research on the Maltese Falcon could be found on, simply enough, the website for the Maltese Falcon (http://symaltesefalcon.com). The website provides rates for the yacht, a wealth of photographs of both the interior and exterior (for comparison with social media uploads), and the vessel’s exact specifications.

rates

photos

However, the “Tracking” function on the site provides very outdated information—the last report sent into the website places the vessel off the coast of Turkey on July 25, 2015.

old_tracking

  • VesselFinder.com

The Vessel Finder website operates much like Flight Aware or Flightradar24 in that it provides continual updates on the coordinates of various sea vessels, including cargo ships, fishing vessels, and, of course, yachts.  By clicking the “Track” button on the Maltese Falcon’s entry on Vessel Finder, one can see the recent movements of the yacht across the Mediterranean.

navalny_map

  • Instagram

As anyone who has seen “Rich Kids of Instagram” can tell you, the 1% (or, 0.01%) love to show off what they have. This principle extends to the friends and families of wealthy bureaucrats and politicians. Navalny looked at the Instagram accounts of two people in particular: Peskov’s close friend Oleg Mitvol and Peskov’s step-daughter, Aleksandra.

Mitvol, as Navalny points out, has long been a close friend of Peskov. He has recently gained some fame as the photographer who captured the image of Peskov wearing the expensive watch that caused such a sensation. Mitvol posted a photograph of a yacht named “A,” owned by Andrey Melnichenko, Russia’s ninth richest man, and the yacht “Garcon.”

a

garcon

These photographs would not be notable if it were not for the fact that both of these yachts were at the same location as the yacht that Peskov supposedly rented out. Navalny proved this fact by studying the locations of the three yachts (“A,” “Maltese Falcon,” and “Garcon”) on Vessel Finder.

“A” and the Maltese Falcon were parked near one another on August 11, just off the coast of Capri:

two_yachts

On August 15, the Maltese Falcon and Garcon were next to one another. Shortly after each meeting, Mitvol posted photographs on Instagram of the yachts.

two_yachts2

Navalny’s accusation with this detective work is that Mitvol was with Peskov at his wedding (as we know from the watch picture) and that he accompanied Peskov for his honeymoon escapade on the Maltese Falcon, where he twice photographed the yachts that were parked next to the yacht.

While Navalny’s investigations into the intersecting yachts and Mitvol is interesting, it is not nearly as damning as the photographs posted by his (new) step-daughter, Aleksandra.  She posted a series of photographs during the week of Peskov’s honeymoon that have geotags for Sardinia:

sardinia

However, geotags can be inaccurate or forged. Navalny digs deeper, noticing the words embroidered onto a bathrobe worn by Aleksandra as she is standing on what appears to be a sea vessel:

bathrobe

The letters “–ALTES- FALC—“ are visible—clearly indicating the name of the yacht she is currently on, the Maltese Falcon.

In sum, Navalny’s research shows that Peskov’s close friend Oleg Mitvol, who was recently at his wedding, and step-daughter were both on the Maltese Falcon yacht during the honeymoon. However, Peskov himself is nowhere to be found, and there is no direct proof in Navalny’s research that Peskov—with his relatively paltry salary—paid for the yacht’s exorbitant rent. Mitvol has told the Russian news outlet Yod that he and extremely wealthy Swiss lawyer Dmitry Yakubovsky were on the boat, and that Peskov was not. Mitvol did not account for the presence of Peskov’s family members on the boat with him and Yakubovsky, or why the 15-year old step-daughter of Peskov would apparently be sailing across the Mediterranean alone with two men thrice her age.

The public’s OSINT research methodology

Navalny did an admirable job in his OSINT research, but Russian-speakers on Twitter and elsewhere carried the research into new waters. They utilized many of the same methods as Navalny, but expanded their reach, not to mention some other innovative OSINT tools. [ref]If you read Russian, or trust Google Translate, see this blog post recapping the findings of Russian-speaking open source investigators into the yacht.[/ref]

  • Gramfeed

Like Navalny, a small legion of Russian-speaking open source investigators and bloggers used Instagram to uncover evidence of the Maltese Falcon’s whereabouts and who was sailing it. Going further, public investigators used the service Gramfeed to search for photographs to geolocate the matching pictures from the Russian vacationers.

A photograph posted by Mitvol of a Sardinian cafe with the name“White” was easy to geolocate via Gramfeed, as the spot is quite photogenic:

whitecafe

By searching a likely location in Gramfeed, a photograph pops up from inside the café, showing the same chairs, bushes, and overall scene:

gramfeed

 

compare

  • Webcams

Not satisfied with old, static photos posted on Instagram, open source investigators found a publicly accessible webcam stream in Sardinia that showed the Maltese Falcon off the coast.

As detailed in this tweet from Euromaidan Press staff writer @ReggaeMortis1, the Maltese Falcon passed into view for a webcam in the port of Palau on August 16. And, luckily for the investigators looking into the matter, the webcam shot was saved and accessible on the following day.

webcam_shots
With some quick geolocation work, the location of the Maltese Falcon is confirmed to correspond with a vessel visible in a webcam shot:
maltese_cam
maltese_map
 A blogger under the alias @sgonch also found a publicly accessible webcam for the Hotel Cala di Volpe that captured the Maltese Falcon, leading to yet another geolocation of the yacht:
hotel1
hotel2
hotel3

    • YouTube

 

While Navalny rightly noted the presence of Peskov’s step-daughter on the Maltese Falcon, he did not notice another passenger: Peskov’s biological daughter Liza Peskova. Liza posted a selfie four days before Navalny’s article—during the timespan that Peskov was on his honeymoon and supposedly renting the yacht—in an unidentified location. Georgy Alburov, an aide to Navalny, looked through Liza’s Instagram and discovered two selfies taken on a sea vessel within the last week that have geotags off the coasts of Capri and Sicily:

As seen at 7:57 in the below YouTube video, the same door (with identifiable markings) that is visible in Liza’s selfie also seem to be visible in a tour of the Maltese Falcon’s interior.

liz_video_comp

The geotag on the photo placed her near Capri—the same spot that the Maltese Falcon was at according to its travel logs.

This research from the public provided solid proof that Mitvol, Peskov’s step-daughter Aleksandra, and his biological daughter Liza were all on the Maltese Falcon, off the coast of Capri and Sardinia, in mid-August. While the combined research from Navalny and his supporters is interesting, it still does not prove Peskov’s physical presence on the yacht, or any outright lie from him, as he claims he is in Sicily with his bride. However, the story does not end here, and further OSINT research revealed more wrinkles in the story.

On August 17, Tatiana Navka, Peskov’s bride, posted a photograph on Instagram showing the newlywed couple at a hotel in Taormina, Siciliy, with a caption that seemingly addresses Navalny and his investigators: “Don’t look for a black cat in a dark room. Especially when it’s not there!” This refutation and apparent proof that Peskov and Navka are truly in a Sicilian hotel, as he claimed, only added more fuel to the fire.

navka

  • Hair

This isn’t exactly a complex or reliable OSINT method; however, it is still worth noting for its originality. Navka’s Instagram image, showing the back of Peskov’s head while supposedly honeymooning in Sicily, caught the attention of Twitter user @Neiswestnij. As he noted, Peskov’s hair seems to have grown extremely fast over one week, as seen in comparing the hair length and shagginess from his wedding (top) and his honeymoon on week later (bottom):

Going a step further and delving into photographs of Peskov over the past year, the press secretary’s hair in June 2014 seems (again—this is far from an exact science) much shaggier and closer to the appearance of Navka’s recent photograph. The other twist in this theory is that the reason why the back of Peskov’s head, and not his face, was shown is because he shaved off his famous mustache in the summer of 2014, and it had regrown by over the past year. Thus, according to this logic, a frontal shot of Peskov would reveal that the picture is old.

  • Instagram

Back to Instagram, the most useful tool in this OSINT research. Keen-eyed open source investigators looked back into Navka’s Instagram photographs to find that she had truly been at the Taormina, Sicily hotel—56 weeks ago. The implication of this is that the Instagram picture from Navka with Peskov could have been taken a year ago, not during their honeymoon.

The OSINT research of Navalny and his supporters demonstrate the full range of possibilities and limitations of open source research. On one hand, Navalny was not able to definitively prove that the yacht was rented by Peskov, and he could not be physically located on the yacht. On the other hand, the open source research shows that there are some uncertainties regarding his claim of being at a Sicilian hotel with his bride, and that his close friends and daughter/step-daughter are indeed cruising across the Mediterranean in one of the world’s most expensive yachts. Despite some still unresolved questions, the OSINT methodologies of Navalny and Russian-speaking investigators provide a master class in exposing corruption. As we see, the clearest route to proving that a bureaucrat is living outside of his or her means is not always by investigating the bureaucrat directly, but by friends and family members who cannot resist showing off their wealthy lifestyle. [ref]For another excellent example of this type of investigation into corruption, see the OCCRP report, with assistance from Bellingcat contributor Iggy Ostanin, into the real estate of the Azerbaijani president’s family: https://www.occrp.org/freekhadijaismayilova/stories/the-mansion-on-the-heath.php [/ref]

Related articles