GRU: Spies Without Borders

One of the unanswered questions lingering after the unmasking by investigative journalists from Bellingcat of the identities of suspects in the botched-up poisoning of Sergey and Yulia Skripal, is how two (or, likely, more) undercover GRU officers were able to obtain visas to travel to the UK. 

Securing a visa to the UK, as to most of EU destinations, is not a trivial procedure. A single-entry visitor visa is relatively straightforward to procure, it requires either an invitation from a UK resident or business, or a pre-arranged tourist trip.

To get a long-term, multi-entry visa, the kind the two GRU officers are reported to have used, a Russian applicant must go through many more hoops. The visa-seeker must make a convincing case for their need for multiple trips and present evidence for both their steady links to their home country, and their financial capability to sustain themselves in the UK over an extended period. 

The UK consular section makes a concerted effort to validate the data provided by applicants, and is known to reject applicants, even such with a prior multi-entry visa, once they discover an inconsistency in the “back story” presented by a would-be visitor. 

Yet, the non-existent personas “Boshirov” and “Petrov” were apparently able to secure multi-entry visas to the UK, as well as multi-entry Schengen visas, on which they both criss-crossed Europe, visiting the UK at least four times, and repeatedly travelling to at least 7 other EU countries in the period 2014-2018.

Hacking the UK Visa System

As Bellingcat investigators were working on the discovery of real identities of “Boshirov” and “Petrov”, Vadim Mitrofanov, a highly proficient Russian IT specialist awaiting a decision on his family’s asylum request, contacted us with what he thought was a piece of information relevant to the Skripal poisoning case.

Vadim told Bellingcat that two years earlier, in 2016, he had been working as chief technical officer at a company that is providing exclusive visa application processing services to consulates, including the UK consulates in Russia. 

The FSB had planned to use Vadim to try and breach the confidential information flow of visa applicants at the application processing company, as well as to compromise the actual visa issuance system at the British consulate. 

Outsourcing Data Is a Matter of Trust

Nearly a year after he was recruited by the FSB, Vadim arrived in the USA with his family on a visitor’s visa and applied for political asylum for his family and himself. The reason, laid out eloquently in a 10-page deposition to the US authorities, which Bellingcat and the Insider have reviewed, was that, having been forced to collaborate with the FSB, he had ultimately consciously sabotaged their work.

Vadim is a highly trained IT specialist; a graduate of a respectable Moscow engineering university. In 2015, he was working at the Beijing-based global headquarters of TLSContact, a leading provider of IT and logistical services to consulates. 

In short, the company was helping embassies of various countries process huge volumes of visa applications, leaving only the final decision-making, and visa issuance process, to the consulates themselves. In many countries the company is the exclusive outsourcing partner for the consulates of a number of EU countries.

Vadim’s job included designing computer systems in new locations as the company expanded its presence out into more and more countries. He also was also the company’s key specialist in the development of a portable and on-site biometric data collection.

He worked closely with the IT departments of visa sections of EU embassies. In late 2015, Vadim was transferred to the company’s Moscow branch. TLSContact’s Russian office was already providing near-exclusive visa application processing to the UK and Swiss consulates at that time, and it aimed to grow its market share further.

Thwarted Attempts to Escape 

Conscious that he had to play along with the FSB escalating requests, but uneasy with his own forced complicity in breaching the security of his employer, and of foreign embassies, Vadim devised a plan to extricate his family and himself from Russia.

Vadim’s story does not prove conclusively that FSB or any other security agency were successful in breaching the visa issuance system, and thus enabled GRU officers to travel in the UK repeatedly and ultimately conduct an alleged assassination attempt. However, it does indicate the application and methodical tenacity that were applied in trying to compromise the visa protocols. 

Such endeavors are not surprising given that security services need to ensure unimpeded access to various European locations. Absent an alternative explanation as to how these and other GRU officers were able to sneak through the multi-entry visa application filter, Vadim’s experience provides one possible answer. 

After all, Col. Chepiga and Col. Mishkin first traveled to the UK, and Switzerland several months after “Andrei’s initial query to Vadim about the feasibility of trace-free issuance of visas to the UK and Switzerland.

Bellingcat:

You Might Also Read:

What Is The GRU & Who Does It Hack?

Britain Plots Cyber Revenge On Russia For Novichok Poisonings:

 

 

« TalkTalk Hackers Jailed For Attack That Cost £77m
The Way You Walk Will Reveal Your Identity To Surveillance Technology »

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Cyber Security Service Supplier Directory

Cyber Security Service Supplier Directory

Free Access: Cyber Security Service Supplier Directory listing 5,000+ specialist service providers.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

DigitalStakeout

DigitalStakeout

A simple and cost-effective solution to monitor, investigate and analyze data from the web, social media and cyber sources to identify threats and make better security decisions.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Black Hat Briefings

Black Hat Briefings

The Black Hat Briefings are a series of highly technical information security conferences that bring together thought leaders from all facets of the infosec world.

Certification Magazine

Certification Magazine

Certification Magazine is an IT technical training and certification publication

Nuix

Nuix

Nuix specialise in extracting knowledge from unstructured data. Applications include Digital Forensics, Cybersecurity Intelligence, Information Governance, eDiscovery.

LockPath

LockPath

LockPath is a market leader in Governance, Risk Management & Compliance (GRC) and Information Security.

National Association of Software and Services Companies (NASSCOM)

National Association of Software and Services Companies (NASSCOM)

NASSCOM is a trade association of Indian Information Technology and Business Process Outsourcing industry. Areas of activity include cyber security.

SynerComm

SynerComm

SynerComm is an IT solution provider specializing in network and security infrastructure, enterprise mobility, remote access, wireless solutions, audit, pentesting and information assurance.

FifthDomain

FifthDomain

We are a specialist cyber security education and training company tackling the global cyber security skills shortage.

Olympus Sky

Olympus Sky

Olympus Sky has created a complete security system that is specifically designed to meet the challenges of IoT, including all of the deficiencies currently challenging Public Key Infrastructure.