WikiLeaks logo
The Global Intelligence Files,
files released so far...

The Global Intelligence Files

The Global Intelligence Files

On Monday February 27th, 2012, WikiLeaks began publishing The Global Intelligence Files, over five million e-mails from the Texas headquartered "global intelligence" company Stratfor. The e-mails date between July 2004 and late December 2011. They reveal the inner workings of a company that fronts as an intelligence publisher, but provides confidential intelligence services to large corporations, such as Bhopal's Dow Chemical Co., Lockheed Martin, Northrop Grumman, Raytheon and government agencies, including the US Department of Homeland Security, the US Marines and the US Defence Intelligence Agency. The emails show Stratfor's web of informers, pay-off structure, payment laundering techniques and psychological methods.

Re: FOR EDIT - SECURITY WEEKLY - Russian intelligence network taken down in US

Released on 2012-03-08 09:00 GMT

Email-ID 1768056
Date 2010-06-30 19:35:22
Ben West wrote:

Takedown of a Russian intelligence operation in the US

The United States Department of Justice announced June 28 that an
FBI counterintelligence investigation had resulted in the arrest of
ten individuals on June 27 suspected of acting as undeclared agents
of a foreign country - eight of the individuals were also accused of
money laundering. An eleventh individual named in the criminal
complaint was arrested in Cyprus on June 29 and has since posted
bail. Five of the defendants appeared before a federal magistrate in
the Southern District of New York US court in Manhattan on June 28.
Three others appeared in the Eastern District of Virginia US federal
court and two more in the US federal district court of
Massachusetts, in Boston.

The number of arrested suspects in this case makes this
counter-intelligence investigation one of the biggest in US history.
According to the criminal complaint the FBI had been investigating
some of these individuals as long as ten years - recording
conversations the suspects had in their home, intercepting radio
transmitted and electronic messages and conducting surveillance on
them both in and outside the United States. The case provides
contemporary proof that the classic tactics of intelligence
gathering and counter-intelligence measures are still being used by
the US and Russia..

Cast of Characters (according to details released in the criminal

Christopher Metsos

- Acted as intermediary between the Russian UN mission in
New York and Richard Murphy, Cynthia Murphy, Michael Zottoli and
Patricia Mills.

- He traveled to and from Canada

- Met with Richard Murphy at least four times between
February, 2001 and April, 2005 at a restaurant in New York

- First surveilled in 2001 in meetings with other suspects.

- Left the US June 17 and detained in Cyprus June 29.

Richard and Cynthia Murphy

- First surveilled by FBI in 2001 during meetings with

- Also met with the 3rd secretary in Russia's mission to the

- Communicated electronically with Moscow

- His safety box was searched in 2006 where agents
discovered a birth certificate claiming he was born in Philadelphia,
Pennsylvania. Local officials in Philidelphia claim to not have that
birth certificate on record.

- had electronic communications with Moscow

- Traveled to Moscow via Italy in February, 2010

Donald Heathfield and Tracey Foley

- FBI searched a safe deposit box listed under their names
in January, 2001

- Discover that Donald Heathfield's identity had been taken
from a deceased man by the same name in Canada

- Engaged in electronic communication with Moscow

- Foley traveled to Moscow via Paris in March, 2010

Michael Zottoli and Patricia Mills

- First FBI surveillance in June, 2004 during meeting with
Richard Murphy

- Also had electronic communication with Moscow

Vicky Pelaez and Juan Lazaro

- Surveilled meeting at a public park in an unidentified
South American country in January, 2000

- Evidence gathered against Pelaez was the first out of the
ten operatives

- Appeared to only communicate with a diplomat at the
Russian embassy in the unidentified South American country

- also had electronic communication with Moscow

Their Mission

The FBI says that some of the eleven alleged undeclared agents moved
to the United States as early as the 1990s, with some of the later
accused (such as Anna Chapman) not arriving to the US until 2009.
Nine of the suspects were provided with fake identities and even
fake childhood pictures and cover stories (all part of what is known
as a "legend") in order to establish themselves in the United State
under "deep cover" - Chapman and Semenko used their own, Russian
identitiy. The true nationality of the rest of the individuals is
unknown, but several passages in the criminal complaint indicated
that most of them were originally from Russia. Russia's Foreign
Intelligence Service (SVR) allegedly provided the suspects with bank
accounts, homes, cars and regular payments in order to provide
"long-term service" inside he United States and, in return, they
were supposed to "search [for] and develop ties in policymaking
circles in the US".

It is unclear exactly how successful the 11 accused individuals were
at finding and developing those ties. The criminal complaint accuses
the individuals of sending everything from information on the gold
market from a financier in New York (a contact that Moscow
apparently found as helpful, and encouraged further contacts with
the source) to seeking out potential college graduates headed for
jobs at the CIA. The criminal complaint outlines one recorded
conversation in which Lazaro tells Pelaez that his handlers were not
pleased with his reports because he wasn't attributing them
properly. Pelaez then advises Lazaro to "put down any politician"
(as in write the name of a US politician to attribute the
information to) in order to appease their handlers, indicating that
the alleged operatives did not always practice scrupulous tradecraft
in their work. Improperly identifynig sources in the field
ultimatley hampers the value of the information, since it cannot be
adequately assessed without knowing where it came form. If these
kinds of shortcuts were normaly taken by Pelaez, Lazaro and others,
then it would reduce their value to the SVR and the harm that they
may have potentially done to the US. The suspects were allegedly
instructed by their operators in the US and Russia to not pursue
high level government jobs, as their legends were not strong enough
to withstand a significant background investigation, but they were
certainly encouraged to make contact with high level government
officials to have a finger on the pulse of policymaking sentiment in


The criminal complaint alleges that the suspects used traditional
tradecraft of the clandestine services to communicate with each
other and send reports to their operators. The alleged operators
transmitted messages to Moscow containing their reports encrypted in
radiograms - short burst radio transmissions that appears as morse
code - invisible ink and met in third countries for payment and
briefings. They used brush passes (the act of quickly exchanging
materials discretely) flash meets (apparently innocuous, brief
encounters) to exchange information, equipment and to transfer
money. The complaint also gave examples of operatives using coded
phrases with each other and with their operators to confirm each
other's identities.

There were new twists, as well. Operatives used email to set up
electronic dead drops to transmit encrypted intelligence reports to
Moscow and several operatives were found to have similar computer
programs that used steganography (the practice of embedding
information in seemingly innocuous images) to encrypt messages.
Chapman and Semenko used private, wireless networks hosted by a
laptop programmed to only communicate with another specific laptop.
FBI agents claim to have identified such networks (and may have
intercepted the messages transmitted) temporarily set up while a
suspect and known Russian diplomat were in proximity together. These
meets occurred frequently and allowed operatives and their operators
to communicate covertly without actually being seen together.

The operations were largely run out of Russia's UN mission in New
York, meaning that when face-to-face meetings were required,
declared diplomats from the UN mission would do the job. They handed
off cash to Christopher Metsos on at least two occasions, who in
turn distributed the cash to various other operatives (which
provided the grounds for the charge of money laundering) but the
actual reports and information gathered from the field appears to
have gone directly to Russia, according to the criminal complaint.

It is important to note that the accused individuals were not
charged with espionage - the charge of acting as a non-declared
agent of a foreign state is less serious. The criminal complaint
never revealed that any of the eleven individuals received or
transmitted classified information. This doesn't mean that the
suspects weren't committing espionage (certainly investigators will
learn more about their activities during interrogation and during
preparation for the trial) but according to their original guidance
from Moscow, these individuals were tasked with establishing deep
cover. This means that the suspects were supposed to position
themselves so that they would gain access to valuable information
(and here it is important to point out that "valuable" is not
synonomous with "classified") through their established occupation
or social life. This allows agents to get access to what they want
without running unnessecary operational security risks to do so. Any
intelligence operation must balance operational security with the
need to gather intelligence. Too much security and the operative
isn't able to do anything, too aggressive of information collection
and the handlers risk losing an intelligence asset. The fact that
these people were deep cover means that the SVR had likely invested
quite a bit of time and money into cultivating and training these
people - likely well before they arrived in the US during the early
to mid 1990s. We can see that balance in this group of individuals.
They are certainly actively meeting with potential sources, sending
back reports to Moscow and interacting with declared Russian
diplomats in the US, all of which bring an inherent risk of being
caught. However, they certainly took security measures, too. There
is no evidence that they attempted to reach out to people that would
have fallen outside their natural professional and social circles,
which would have raised suspcion. In many ways, these individuals
acted more as recruiters, seeking out people with access to valuable
information, rather than agents trying to gain access to that
information first hand. However, it must be reiterated that all we
knnow now is based on what was released in the criminal complaint.
An investigation that lasted this long surely has stacks of evidence
(much of it likely classified) that wasn't included in the


However, the network of operatives was under heavy surveillance by
US counterintelligence agents. FBI agents in Boston, New York and
Washington DC maintained surveillance on the suspects over a ten
year period, employing its elite Special Surveillance Group to track
suspects in person; video and audio recorders in their homes and at
meeting places to record communications; searches at their homes and
of security deposit boxes at banks to search for sensitive
information; intercepted email and electronic communications; and
deployed undercover agents to entrap the suspects.

Counterintelligence operations don't start out of thin air. There
has to be a tip or a clue that puts investigators on the trail of a
suspected and (especially) undeclared foreign agent. As suggested by
interview with neighbors of the arrested suspects, none of them
displayed unusual behavior that would tip them off. All had deep
(yet not airtight) legends going back decades that allayed everyday
suspicion. The criminal complaint did not suggest how the US
government came to suspect these people of reporting back to the SVR
in Russia, however we noticed that the timing of the initiation of
these investigations coincides with the time period that a high
level SVR agent stationed at Russia's UN mission in New York began
passing information to the FBI. Sergei Tretyakov (who told his story
in the book "Comrade J" - an abbreviation of his SVR codename,
Comrade Jean), passed information on to the FBI from within the UN
mission from 1997 to 2000 before he defected to the US in October,
2000. According to the criminal complaint, seven of the eleven
suspects were connected to Russia's UN Mission. Though, evidence of
those connections did not come until 2004 and as late as 2010. The
timing of Tretyakov's cooperation with the US government and the
timing of the initiation of the investigations against the suspects
arrested this week suggests that Tretyakov may have been the
original source that tipped off the US government. So far, the
evidence is circumstantial - the timing and the location match up -
but Tretyakov, as the SVR operative at the UN mission, certainly
would have been in the position to know about the operations
involving most of the individuals arrested June 27.

Why now?

On the other end, the criminal complaint also does not clarify why
the eleven suspects were arrested when they were. Nothing in the
criminal complaint indicates why, after over ten years of
investigation, the FBI decided to arrest the suspects on June 27. It
is not unusual for investigations to be drawn out for years, as much
information on tradecraft and intent can be learned by watching
foreign intelligence agencies operate without knowing they are being
watched. as well as revealing additional contacts and having time to
learn more individuals in the network As long as the suspects aren't
posing an immediate risk to national security (and judging by the
criminal complaint, they were not) there is little reason for the US
to show their hand to Russia and end an intelligence gathering
operation of their own.

There has been supposition that Anna Chapman was a flight risk and
so the agents arrested her and the other in order to prevent them
from escaping the US. However, a number of the suspects left and
came back to the US multiple times - investigators appear not to
have been concerned with past comings and goings, and it isn't clear
why they would have been concerned about Anna leaving.

The timing of the arrests so soon after US president Obama met with
Russian president Medvedev also raises questions of political
motivations. Medvedev was in DC to talk with Obama as recently as
June 25 (when the criminal complaint was officially filed by the
FBI) in an attempt to patch over relations between the two
countries. Revelations of a network of undeclared foreign agents
attempting to spy on US activities has can have a very negative
affect on overall relations between two countries in the past. In
this case, officials from both countries made public statements
saying they hoped this doesn't damage ties. The timing raises the
question of political motivation; however there is not yet any
indication that the timing is related to political motivation.

Whatever the motivation, now that the FBI has these suspects in
custody, it will be able to interrogate them and likely gather even
more information on the operation. The charges for now don't include
espionage, but the FBI could very well be withholding this charge in
order to provide an incentive for the suspects to plea bargain. We
expect much more information on this unprecedented case to come out
in the following weeks and months - providing reams of information
on Russian clandestine operations and their targets in the US.

Ben West
Terrorism and Security Analyst
Cell: 512-750-9890