by Grey Hare Editor | Oct 4, 2018 | Articles
The GRU is on the Ropes
****Updated 1230 on 04 Oct 18*****
At one-minute past midnight on 4thOctober 2018 a statement came out from the British Government saying that the National Cyber Security Centre (NCSC) had “identified that a number of cyber actors widely known to have been conducting cyber-attacks around the world are, in fact, the GRU.”
The GRU is the Russian Military Intelligence organisation also known as the Main Intelligence Directorate who have been accused of being responsible for the assassination attempt on Sergei Skripal in Salisbury in March this year.
Since then, the British Prime Minister Teresa May has openly accused the GRU of their involvement in the attack, saying the two attackers, Alexander Petrov and Ruslan Boshirov had flown into Gatwick on 02 March and out of Heathrow on 04 March and these names were almost certainly pseudonyms.
The investigative journalism website Bellingcat went on to expose the real identity of the man who travelled under the name Ruslan Boshirov as Colonel Anatoliy Chepiga, a highly decorated GRU Officer who had received the Hero of the Russian Federation award in 2014.
In what Philip Ingram MBE a former British Colonel in British Military Intelligence believes is a swipe at the GRU the head of the Russian Foreign Intelligence Service, Sergey Naryshkin, when he said the Salisbury attack was “unprofessionally done.”
Almost sensing the GRU is ‘on the ropes’, openly outed for the Skripal attack, embarrassed by the ease with which investigative journalists with Bellingcat managed to expose serious flaws in the administration of their secret agents and expose the real identity of one of their highly decorated agents, linking him to Salisbury, for the first time, the UK authorities have come out fighting.
What is the GRU accused of this time?
The NCSC has attributed a number of recent attacks to the GRU. The October 2017, BadRabbit ransomware attack encrypted hard drives and rendered IT inoperable. This caused disruption including to the Kyiv metro, Odessa airport, but was almost an own goal as it also caused disruption at Russia’s central bank and two Russian media outlets. NCSC assess with high confidence that the GRU was almost certainly responsible.
In August 2017, confidential medical files relating to a number of international athletes, including the cyclist Sir Bradley Wiggins were released. WADA stated publicly that this data came from a hack of its Anti-Doping Administration and Management system. NCSC assess with high confidence that the GRU was almost certainly responsible.
In 2016, the Democratic National Committee (DNC) was hacked and documents were subsequently published online. NCSC assess with high confidence that the GRU was almost certainly responsible.
Of interest in July 2018 the team of special investigator Robert Mueller named 12 apparent GRU officers over the alleged hacking and leaking of Democratic party emails.
Between July and August 2015, multiple email accounts belonging to a small UK-based TV station were accessed and content stolen. NCSC assess with high confidence that the GRU was almost certainly responsible.
This is not the first time the GRU has been accused.
In June 2017 a destructive cyber attack targeted the Ukrainian financial, energy and government sectors but spread further affecting other European and Russian businesses. The UK Government attributed this attack to the GRU in February 2018. NCSC assess with high confidence that the GRU was almost certainly responsible.
In October 2017, VPNFILTER malware infected thousands of home and small business routers and network devices worldwide. The infection potentially allowed attackers to control infected devices, render them inoperable and intercept or block network traffic
In April 2018, the NCSC, FBI and Department for Homeland Security issued a joint Technical Alert about this activity by Russian state-sponsored actors.
The Foreign Secretary, Jeremy Hunt said:
“These cyber attacks serve no legitimate national security interest, instead impacting the ability of people around the world to go about their daily lives free from interference, and even their ability to enjoy sport.
“The GRU’s actions are reckless and indiscriminate: they try to undermine and interfere in elections in other countries; they are even prepared to damage Russian companies and Russian citizens. This pattern of behaviour demonstrates their desire to operate without regard to international law or established norms and to do so with a feeling of impunity and without consequences.
“Our message is clear: together with our allies, we will expose and respond to the GRU’s attempts to undermine international stability.”
The UK is not alone with accusing the GRU and last night the Australians came out to support the UK statement. Of note, the Australians are part of the 5 eyes community. This is an intelligence-sharing community of the US, UK, Canadians, Australians and New Zealand.
Timing is of interest as it is almost certainly a swipe at President Putin, waning him off interfering with the US midterm elections due on 6thNovember 2018.
The UK Prime Minister said in Parliament on 5 September 2018, the UK will work with our allies to shine a light on the activities of the GRU and expose their methods. Her dancing queen speech in Birmingham is turning into her Rocky Balboa attack on the GRU, for the first time she is taking the fight to the Russians.
The announcement this morning by the Major General Onno Eichelsheim from the Dutch MIVD intelligence service regarding the expulsion of 4 GRU agents who were targeting the OPCW in the Netherlands is significant in it shows the international community joining Teresa May in ‘the ring’ helping with the fight against the Russians in an unprecedented way. Of significance, what is being exposed are some very bad ‘drills’ by the GRU operatives and this reinforces Sergey Naryshkin comments that the Skripal attack was ‘unprofessionally done.’
Note: This blog is written by Philip Ingram MBE, a former Colonel in British Military Intelligence, who was based near Salisbury and has assessed Russian activity for many years. If you would like any further comment from Philip, please contact him by clicking HERE
by Grey Hare Editor | Sep 15, 2018 | Articles
GRU and Salisbury, a more complete account.
Background
It is not every day that a quiet little English city is caught in the grips of a story that would be a page-turner in any spy novel, where the readers would be sceptical that what was being written about could actually happen. Well, it did, with the tragic death of Dawn Sturgess and the hospitalisation of Charlie Rowley, Nick Bailey, Yulia Skripal and her father, the intended target of a nerve agent attack, former Russian GRU Colonel, Sergei Skripal.
I am someone who has commanded an intelligence unit with a capability to covertly monitor Russian national intelligence operations, has studied organic chemistry and nuclear science related to defence against chemical, biological, radiological and nuclear weapons, at both degree and master’s degree level. Having been a military intelligence officer and also a Colonel, I have the experience and knowledge of all aspects of the decision-making process leading up to the attack on Sergei Skripal, how it would be planned, executed and the actions the Russian government has taken since then. It is classic spy story stuff and I am pretty certain my assessments of what happened, why it happened, and more, are accurate.
Having been asked for my opinion on Salisbury by press outlets ranging from Japanese newspapers, to European, Canadian and Australian TV and radio, as well as the usual CNN, BBC, mainstream UK newspapers and bizarrely by several Russian broadcasters, I thought I would put the key points into one blog, bringing together the threads of my previous blogs. Please feel free to scroll back and read them.
Why Sergei Skripal?
The most important point to start with is the reason for the attack on Sergei Skripal. It was not done first and foremost to kill him. If that was the motivation then he would have been shot, stabbed or had a car accident. Sergei Skripal was a vehicle used to send a message to any Putin dissenters across the globe that he could get them anywhere, any time and in a horrible way. Prime Minister May hinted to this in an answer to a question after her statement in the House of Commons on 5thSep 2018.
The second reason was to stir a nationalistic fervour into his Presidential campaign domestically by having a reason to say the west was attacking poor Russia. Remember the attack happened exactly 14 days before the Russian Presidential election and opposition parties and oligarchs were becoming more threatening to Mr Putin’s position and his desire for an increased majority.
Sergei Skripal was chosen because Salisbury in next to DSTL Porton Down, the UK’s chemical defence laboratory and this allowed an element of plausible deniability where President Putin could claim that this was set up to undermine him in the eyes of the international community.
Of note, this is exactly the messaging that came out in the immediate aftermath of the attack. The Russians have a doctrine called маскировка (maskirovka) which is all about ‘masking’ or deception and is central to all they do. The Russian people have an unhealthy belief in conspiracy theories and that the west is out to get them no matter what and this played into President Putin’s domestic messaging.
How did Petrov and Boshirov do what they did?
Alexander Petrov and Ruslan Boshirov (almost certainly not their real names) are alleged to have carried out a nerve agent attack in Salisbury in March, which poisoned Sergei and Yulia Skripal and have been charged by the Crown Prosecution Service, resulting in an INTERPOL Red notice being issued alongside a European Arrest Warrant.
Assistant Commissioner Neil Basu from the MET police counter-terrorism unit, said the suspects were in the UK only briefly, flying in from Moscow on Friday 2ndMarch, staying for two nights at the City Stay Hotel on Bow Road in East London, and flew back to Moscow on Sunday 4thMarch, the day they carried out the attack on Sergei Skripal’s house.
The men took a train to Salisbury on Saturday 3rdMarch “for reconnaissance of the Salisbury area.” They then returned the next day to carry out the poisoning. The police said closed-circuit television recordings showed the men near Sergei Skripal’s house and have found minute traces of Novichok in their Bow Road hotel room. It is worth noting that big chunks of their time have not been accounted for.
Prime Minister May firmly stated that the two suspects belonged to the Russian military intelligence organisation, the GRU (or Main Intelligence Directorate). Her choice of words, clearly stating that they were GRU agents, after stating that their names were probably false, strongly suggests that the UK Intelligence agencies know their real identities and therefore links to the GRU.
How would this operation have been planned and executed?
Under a 2006 Russian Federation law, extrajudicial assassinations by agents of the Kremlin need be approved only by the Russian head of state, without reference to others and the GRU will keep an up to date list of those they believe should be targeted including Western spies, political dissenters and others.
Colonel General Igor Valentinovich Korobov, head of the GRU will be no stranger to President Putin, appointed in 2016 by him and made a Hero of the Russian Federation in 2017 he will be a regular advising President Putin on difficult and delicate matters such as Eastern Ukraine, Crimea, Syria and will almost certainly be someone President Putin will use for advice and options in dealing with concerns.
President Putin will have been concerned that his dealing with Alexei Navalny, the Russian opposition leader, ensuring his criminal conviction meant he couldn’t run against him, had stirred up further dissent but this time in more powerful and wealthy oligarchs who until then had remained silent. Putin will have asked Korobov to look at options to send dissenters a clear message.
Messaging is a clear tactic used by Russia and the Alexander Litvinenko case will have shown the GRU the wider messaging impact of using novel assassination methods. GRU scientists will have been trialling many different methods of assassination in their labs that resemble those of Q in the James Bond movies, including the use of nerve agents. The use of a Nerve Agent as an assassination method was demonstrated by 2 alleged North Korean women in Kuala Lumpur Airport in 2016 when Kim Jong Nam, half-brother to the North Korean leader Kim Jong Un, was assassinated with an agent identified as VX and the assassins remained safe. This methodology could have been Russian inspired as a ‘field trial’ as there are some unexplained links between Russia and North Korea!
Novichok, a more potent, safer to handle, less detectable and more persistent agent than VX, works in the same way. It poisons the nervous systems ‘off’ switch and is absorbed slowly through the skin. Immediate treatment is using Atropine and similar drugs widely available in any hospital A&E. Its slow action and dramatic effect was the perfect choice to send a message that this was from the Russians but with plausible deniability using маскировка (maskirovka) by choosing a target near to a Western chemical defence establishment. Hence why Sergei Skripal came to the fore.
Once he had been identified as the vehicle to be used to send the message, his electronic life will have been hacked as well as that of his daughter Yulia so they could be constantly watched and a pattern of life study carried out. The Foreign Intelligence Service (SVR) station in the Russian embassy in London will have been tasked to carry out a reconnaissance of Sergei Skripal to update national records and monitor his movements over at least a week-long period at the end of February. That report will have been passed to the GRU and formed the basis of Alexander Petrov and Ruslan Boshirov’s trip to Salisbury on 3rdMarch for them to confirm the detail prior to the assassination attempt trip on 4thMarch.
Prior to flying to the UK, Alexander Petrov and Ruslan Boshirov will have been practising the application of Novichok to a door handle and the removal of protective gloves with the live agent, they will have been learning how to administer the anti-nerve agent drug, Atropine, to themselves should they become accidentally contaminated. They will have been rehearsing their assassination attempt. They will likely have brought the Novichok, already sealed in the modified fake Nina Ricci ‘Premier Jour’ perfume bottle in a Russian chemical warfare laboratory, into the country in their hand luggage.
Their trip to Salisbury on 3rdMarch will have been to check aspects of the SVR pattern of life study and possibly get briefed by the SVR team themselves. So that they could return alone on 4thMarch and apply the deadly Novichok to Sergei Skripals front door.
After they applied the Novichok they will have removed their protective gloves but accidentally dropped the fake Nina Ricci ‘Premier Jour’ perfume bottle with a specially made poison applicator, as they put it back into its cover. Knowing just how deadly the substance was they left, hoping no one would find it. This act was simply a cock up. Their gloves and other contaminated items will have been put into a bin in Salisbury, taken to landfill by unwitting council workers the next day. It was that accidentally dropped bottle that Charlie Rowley found and took home to his girlfriend Dawn.
Putin and the GRU will have been surprised at the tenacity of the UK’s counter-terror police and Security Services investigation and the level of detail they have managed to ascertain. The public exposure of Alexander Petrov and Ruslan Boshirov and the strong indications that the UK Government knows their real identities has forced the Russians into what was an embarrassing interview with the Russian state-funded RT network.
The reason for the interview is not to appease the international community or provide a credible story but it is a standard tactic as part of the маскировка (maskirovka) campaign, this time aimed at the Russian domestic audience who are becoming wary of Putin’s performance. The Russians have a word, враньё(vranyo), which means to tell a lie without expecting to be believed. the lie is told purely to save face knowing they won’t be challenged. This tactic unsurprisingly was common practice in the Soviet era.
What are we missing?
However, there are subtilty’s in the investigation and what has been released and what hasn’t been released that allows what I will caveat as speculation, but argue it is informed speculation.
There has been just enough information, including CCTV stills shown to the general public to back the Crown Prosecution Service charges and the statement by the Prime Minister in the House of Commons. It is almost certain there is a lot more information not yet released.
There will be a lot more CCTV from both the Saturday 3rdMarch and Sun 4thMarch trips that will give a greater insight to Petrov and Boshirov’s movements around Salisbury that hasn’t been released. The police will have made an assessment as to what happened to the protective clothing, as a minimum, pairs of gloves Petrov and Boshirov would have worn to carry out the attack. These will be contaminated.
There is no statement as to where the fake Nina Ricci ‘Premier Jour’ perfume bottle was found by Charlie Rowley and how it remained unaccounted for, for so long. There is no statement to Petrov and Boshirov’s movements in London and how the Bow hotel was identified, or why traces of Novichok from a sealed container would have been found there? There has been no assessment as to the hours unaccounted for on both 3rdand 4thMarch as Petrov and Boshirov walked around Salisbury.
Why is this being kept from us? The basic answer is, we don’t need to know. I would speculate that the SVR team who carried out the pattern of life study on Sergei Skripal have possibly been identified by the UK intelligence agencies and there is a distinct possibility at least one of them lives in the Salisbury area. If that is the case, they will be running an operation to target individuals and turn them to become double agents for the UK. This I know sounds very James Bond like, but is the day to day role of counterintelligence officers in MI5 and Intelligence officers in MI6. I have seen these types of operation.
Who are the GRU?
They are Russia’s military intelligence service and one of three of Russia’s intelligence agencies whose activities often overlap – the others are the Federal Security Services (FSB) and the Foreign Intelligence Services (SVR). The FSB has a broader remit, including counter-terrorism, border control and domestic surveillance, but all the agencies are in competition for resources and funding.
The GRU came back in favour with Russia’s annexation of Crimea in 2014, activities in Eastern Ukraine and in Syria as they own a special forces element called the Spetsnaz. They also have historically been responsible for assassinations, espionage and cyber warfare around the world.
The GRU also have a direct-action special forces capability in their ranks called Spetsnaz GRU. It is individuals from these unite we have almost certainly seen in Crimea, Eastern Ukraine and in Syria.
What is Novichok?
Novichok (новичок meaning “newcomer” or “newbie”) are a series of organophosphate-based nerve agents. They were designed by the Russians in the 1970’s and 80’s as they sought to produce a binary chemical warfare agent whose constituent parts would fall out with the chemicals that were to be banned in the International Probation of Chemical Weapons Convention, that was in its diplomatic infancy at the time.
A binary device consists of two ‘safe’ compounds that when mixed together form the nerve agent but on their own are little or no danger. An organophosphate nerve agent is one that works on attacking the chemical switch inside every nerve cell in your body that turns the nerve cell off after being stimulated. That chemical switch is an enzyme called acetylcholinesterase and nerve agents to destroy the body’s ability to synthesise that enzyme.
Nerve agents fall into 3 persistence categories, non-persistent, eg Sarin (used by Assad in Syria), which has the consistency of petrol and evaporates relatively quickly; persistent agents eg Vx (used to assassinate Kim Jong Nam (Kim Jong Un’s half-brother) in Kuala Lumpur airport last year and has the consistency of engine oil; and very persistent such as Novichok that can be in a solid, powder or treacle level of consistency.
Aside from Sarin, the primary method of absorption for nerve agents into the body is through the skin, so it is unlikely that you would know that you have been contaminated with this the colourless, odourless substance until you start to exhibit symptoms.
The symptoms can build slowly for low exposure or come on rapidly for high dose exposure and include: Runny nose and eyes, small pupils or blurry vision, coughing, chest tightness, wheezing, or shortness of breath, nausea and vomiting, abdominal pain or diarrhoea, fatigue, headache, or sweating, muscle twitching or a seizure, leading to collapse, respiratory failure and death.
Nerve agents are designed to cause casualties first and foremost to overwhelm evacuation and medical facilities on the battlefield and to deny ground through a sort of chemical minefield.
What will happen next?
In reality very little – the sabre rattling will continue, if there is sufficient international support then the only way Putin can be hurt is by freezing the assets of his oligarch supporters and aiding Russian opposition parties; play them at their own game but do it within the international rule of law.
Will it happen? Unlikely, as the Russian influence into western governments is much greater than we realise. The Mueller enquiry in the US will expose some but closer to home the Nord Stream 2 gas pipeline providing Russian Gas to Germany shows the economic interdependence that politicians won’t want to destabilise.
President Putin is currently sitting behind his grand desk in Moscow, with a very large glass of the best vodka on ice, stroking a white cat on his knee, knowing he has won yet again.
Note: This blog is written by Philip Ingram MBE, a former British Army Intelligence Officer and Colonel, who was based near Salisbury in the past. If you would like any further comment from Philip, please contact him by clicking HERE
by Grey Hare Editor | Mar 14, 2018 | Articles
Novichock, what response would be appropriate for Russia?
by Philip Ingram MBE
With the Russians having failed to respond to Prime Minister Teresa Mays deadline to answer the simple question of “how this nerve agent came to be used” relating to the use of military grade Novichock in an attack on Sergei and Yulia Skripal that put Detective Sergeant Nick Bailey in intensive care on Sunday 8th March in Salisbury. How should she respond, what are her options, can she really punish Putin and Russia?
The first thing is to look at Putin’s probable motive for carrying out the attack. Recognise his motive and tailor responses to stop him doing what he set out to achieve.
I believe it is probable that President Putin wanted to do 3 things, the first and his most important is to send a very clear and horrific message to any of his political or business dissenters; he can get them anywhere and in the most horrific way. The second was a message to the West and the wider world, he can operate with impunity where and when he wants, as he has done in Crimea and Eastern Ukraine. The final is personal, as an ex-KGB man the continued existence of a GRU ‘traitor’ will have gnawed away at the very fabric of his soul.
This was a political attack rather than an assassination attempt; the means to achieve this political attack required the assassination attempt.
Teresa May could unilaterally carry out a number of things that have almost become routine when a rogue nation goes too far, and these include:
- Expel Russian diplomats and known intelligence agents, as was done after the poisoning of Alexander Litvinenko, the former FSB operative, in 2006 with polonium 210, a highly toxic radiological agent manufactured in a nuclear reactor.
- Increase economic sanctions as was done after the downing of MH17, the Malaysian Airliner shot down over Ukraine in 2014, the Russian annexation of Crimea and support for Rebels in Eastern Ukraine and freeze the financial assets of rich Russian oligarchs in the hope they will put pressure on Putin.
- Other ‘protest’ actions such as restrict Russians from coming to the UK through a visa ban, boycott the World Cup, remove the broadcasting license for Russian state-backed broadcast channels such as RT, restrict access to UK based websites from Russia or any number of other punitive options.
Will they work? The easiest way to answer that question is to look back in time and see if similar actions have worked before. The answer is a resounding no. The reason why is that they are not getting at the reasons why Putin probably ordered this attack.
If Teresa May resorts to any one or more of these options only she is in effect saying to Putin the doors of the UK are open for him to do what he wants, and he will!
What else could she do? A coordinated International response would have a greater effect by sending a clearer message. This doesn’t fall into NATO Article 5 territory of an attack on one nation meaning a military response from all.
The UK could ask NATO to invoke an Article 4 action where, “The Parties will consult together whenever, in the opinion of any of them, the territorial integrity, political independence or security of any of the Parties is threatened.” This is in effect what is being done but what is it likely to result in? A stiff letter? NATO members scolding the respective Russian Ambassadors in their countries? Will Putin be concerned? In a word NO!
She could try to get GCHQ to carry out cyber-attacks on Russia and these could hurt, but would likely result in tit for tat escalation and the impact on British businesses could be catastrophic, especially during the Brexit negotiations. The Russian control of the information war and use of social media as a weapon is significantly more advanced than anything the West has. It is extremely well explained in the book Alternative War by JJ Patrick and hours after Teresa May’s statement in Parliament threats erupted from the Russian Embassy on Twitter.
However, the UK intelligence services need to increase their Russian focused counterintelligence operations which became diluted after the end of the Cold War. They need to remove the ability for Russian (and other) foreign intelligence operatives to use the UK as a ‘playground for spooks’.
Putin is acting as the bully in the playground, he is confident, arrogant and is developing if it hasn’t already developed, a god complex where he believes everything he does is right, and he is untouchable. That is his Achilles heel!
Going back to why he carried out the attack in Salisbury with an agent he knows would be tracked back to Moscow, it is a clear message to his political and business dissenters across the globe, “get on side or else.” In his 2102 Election, Putin got 63.6% of the vote, his personality is such that he wants to maintain that percentage or grow it in this weekend’s election. If it goes down, he will feel his authority is being undermined and will likely be extremely angry.
So, what should be done to have an effect? I believe Teresa May must do 2 things. Identify a mechanism for hurting Russian State business. Something like a punitive transaction tax for all international currency transactions coming from Russia via the city of London. This would likely require emergency legislation and for it to be successful it would need cross-party unity. If she attempted this and it failed, Putin would be emboldened.
It is too late to have a political effect on the Russian Presidential elections this weekend. But we need to take a long-term view and if the UK identified some strong political opposition to Putin, offering a safe sanctuary in the UK with assistance to develop an effective campaign for the next elections would really worry Putin. However, any individual associated a campaign like that would be a priority target for further Skripal type attacks.
These measures would hit at Putin’s probable motive for his use of Novichock on the streets of the UK and the next step is the international community following suit. This is a real test of Prime Minister Teresa May’s domestic and international strength.
Note: This blog will be updated as new information is received. The current version was updated at 1000 on 14th March 2018 – if you would like any further comment from Philip, please contact him by clicking HERE
Recent Comments