The film documents the amazing detective work that identifies the team of Russian spies who hunt and then tries to kill Navalny, as well as his recovery in Germany and his return to Russia, where he was immediately arrested.
I spoke with one of the investigators who uncovered the spies, Hristo Grozev – who works with the Bellingcat investigative team – about his methods, his new mission to document war crimes in Ukraine and his views on how journalistic ethics need to change in order to fights government corruption.
Catching Russian poisoners with digital breadcrumbs
WHAT’S IMPORTANT: In the documentary, you’ve collected all these parts – from phone numbers to car registrations and so on – to find out who poisoned Navalny. How did you and Bellingcat develop this investigation process? And what made you apply it specifically to Russia?
GROZEV: We started differently by simply collecting social publications in the context of the initial Russian invasion of Ukraine in 2014.
The first investigation that Bellingcat did by simply gathering available data from the Internet was the downing of (Malaysia Airlines) MH17 in July 2014.
There was a lot of public information at the time about Russian soldiers, Russian spies and so on and so forth – because they hadn’t caught up yet, so they kept a lot of digital footprints, social media, selfies in front of weapons that shoot down planes.
It was there that we somewhat perfected the art of reconstructing crime based on digital breadcrumbs. … But over time, something like the bad actors we were investigating, they started hiding their things better. … By 2016, it was no longer possible to find soldiers leaving status selfies on the Internet, because a new law was passed in Russia, for example, banning the use of mobile phones by secret services and soldiers.
So we had to develop a new way to get data on state crimes. We have found our way into this gray data market in Russia, which consists of many, many gigabytes of leaked databases, car registration databases, passport databases.
Most of them are available for free, completely free to download from torrent sites or from forums and the Internet.
And for some of them they are more relevant. In fact, you can buy the data through a broker, so we decided that in cases where we have a strong enough hypothesis that the government has committed the crime, we should probably abandon our ethical boundaries from using such data – as long as it can be verified, as long as not come from just one source, but is confirmed by at least two or three other data sources.
That’s how we develop it. And the first big case of using this approach was … the poisoning of Sergei and Julia Skripal in 2018 (in the UK), when we used this combination of open source and data purchased from the gray market in Russia to collect who it was the two poisoners. And it works amazing.
“Multilevel computer game” against the Russian government
WHAT’S IMPORTANT: You talked about how your tactics for using social media have become obsolete because the Russians have learned from them. Have you seen that they have learned from this use of data from the gray market?
GROZEV: Absolutely. This is what I best describe as a multi-level computer game. Every time we use one, of course, the Russian government learns and closes this gap, and then we have to outsmart them at the next stage.
For example, when we first learned that we could obtain personal data, passport files and residence files of Russian spies who go around and kill people, they closed the files on those people. Thus, each spy suddenly had a missing passport file in the central password database.
But this opened up a whole new way for us to identify spies, because we were just able to compare older versions of the database with newer versions. So this allowed us to find a bad group of spies that we didn’t even know existed before.
The Russian government realized that it might be a bad idea to hide them from us, so they reopened these files, but they just started poisoning the data. They started changing the photos of some of these people with similar-looking, human-like counterparts so as to confuse or embarrass us if we published a statement, but it’s about the wrong person. And then we will learn how to defeat him.
New journalism needs a new ethic
WHAT IMPORTANT: You talked about removing your ethical boundaries. Obviously, some of your tactics, such as paying bribes or using personal information, are not something that many Western journalists could do. Would you say that you have deviated from journalism or that the rules of journalism have changed?
GROZEV: Well, first everything changes. Therefore, the rules of journalism must change with changing times.
And it is not uncommon for journalism to investigate governments committing government-sanctioned crimes, but this is happening now. … With the paradigm of sovereign governments, other governments cannot investigate the Russian government … and the Russian government will not investigate itself because it intends to remain in power forever.
This is not a model that traditional journalism can properly investigate. This is not even a model that traditional law enforcement agencies can properly investigate.
I will give an example. When the British police requested, under an international agreement, the cooperation of the Russian government to provide evidence of exactly who these guys were hanging around Skripal’s house in 2018, they received completely fraudulent, false information from the Russian government. …
So the only way to oppose this as a journalist is to get information that the Russian government refuses to pass on. And if that’s the only way to get it, and if you can be sure that you can prove that it’s valid data and authentic data, I think journalists need to find the truth. And especially when law enforcement agencies refuse to reveal the truth out of respect for the sovereign system of respect for other governments.
The Russian government allows these investigations
WHAT IMPORTANT: You are Bulgarian and live in Austria. I’m here in the United States. Should we apply these methods to other non-Russian governments?
GROZEV: Well, of course. What is specific about the Russian government that makes it easier to do this kind of journalism there is that it has a combination of two qualities.
One is authoritarianism, which means that they like to collect data, comprehensive data, about … what they consider to be their subjects, and therefore there is a lot of centralized data.
And second, there is a lot of petty corruption … within the law enforcement system, and this data market is thriving. And petty corruption exists because it can survive an authoritarian government figure like Putin, because he has to allow these people to receive bribes and money.
This combination of qualities did not exist in every market. In China, for example, there is centralized, concentrated data, but there is no petty corruption that exists in Russia. But there you have whistleblowers who reveal this data, and you can get around corruption, but you still get a lot of access to centralized data.
And in other governments, there is simply more transparency in the data. There is the FOIA (Freedom of Information Act). I think it’s all about data trust. Unlike trusted sources. This is the main change in the way we do investigations. We just don’t believe in sources, as I said in the movie.
What reflects the Russian army
WHAT IMPORTANT: How has the process changed? As you headed to Ukraine, were you surprised by the evidence?
GROZEV: Well, first of all, every corrupt government is somewhat dysfunctional and lags behind just because there are different indicators of good governance.
So the Russian army is a reflection of the overall state of Russian society and government and is poorly managed. … Billions have been spent on creating sophisticated encrypted communications for Russia’s military.
But most of this money was stolen through corrupt concessions, and the result was that they did not have this functioning system. … That’s why they had to resort to the good old phones and they confiscated phones from the locals and used them for phone conversations with their bosses or relatives.
And all this is easily transparent for the Ukrainians and they shared all this with journalists – so yes, it is not unpredictable. It is shocking how incompetent they are. But this was expected because it is a reflection of 23 years of corrupt government.
How does Bellingcat help Ukraine?
WHAT IMPORTANT: How has your operation changed as a result of the war?
GROZEV: We had to make a very difficult choice … what is the best impact we can make with our skills in this war? And we could go in the direction of fighting misinformation or counting casualties among the armies on both sides.
But we thought the best impact would be to simply record and archive human rights violations and war crimes in real time, because we developed a method to do so in a way that preserves this evidence for use by the court. For judicial use. And we were afraid that every missed or delayed day would mean that a lot of that data would disappear.
So we do that – 95% of what Bellingcat does is just archive, register, verify data and give access to anyone who wants to prosecute these crimes.
Where should war crimes be prosecuted?
IMPORTANT: Ukraine is obviously under siege. The International Criminal Court is a vicious institution. What do you think would be the best place to prosecute war criminals?
GROZEV: I think that on the one hand, this should be a kind of global tribunal, and the principle of universal jurisdiction allows almost any country to prosecute crimes against humanity, no matter where they occur.
I really hope so. I was in The Hague (Wednesday) and …
Add Comment