by Grey Hare Editor | Jul 5, 2019 | Articles
With the latest embarrassment linked to Porton Down Philip Ingram MBE asks, the document find, was it the GRU?
At one-minute past midnight on 4thOctober 2018 a statement came out from the British Government saying that the National Cyber Security Centre (NCSC) had “identified that a number of cyber actors widely known to have been conducting cyber-attacks around the world are, in fact, the GRU.”
The GRU is the Russian Military Intelligence organisation also known as the Main Intelligence Directorate who have been accused of being responsible for the assassination attempt on Sergei Skripal in Salisbury in March last year and causing the death of Dawn Sturgess.
Colonel Anatoliy Chepiga and Colonel Dr Alexander Mishkin had flown into Gatwick on 02 March and out of Heathrow on 04 March 2018, having been seen in Salisbury on Saturday 03 and again on Sunday 04 March when Sergei Skripal was contaminated by Novichok being placed on the handle of the front door of his house.
Sergey Naryshkin, the head of the Russian Foreign Intelligence the SVR said in October,“Even if one assumes that some secret service was really given such a mission, the way it handled this case was very unprofessional.” Philip Ingram MBE a former Colonel in British Military Intelligence believes rather that his statement being a Russian denial of Salisbury, it was a swipe at the GRU. “There is no love lost between the GRU and the SVR especially when it comes to competing for resources and influence,” Ingram said.
Then in November 2018 Victor Korobov, the head of the GRU died at the age of 62 supposedly after a “long and difficult illness.” He had been on sick leave ever since a dressing down by President Putin after the expose of GRU activities in Salisbury, outside the OPCW in the NL and the Bellingcat revelations of wider GRU activities.
The one thing that clearly comes out of this is the GRU were bruised, bruised operationally and their ego was deflated. As an organisation they had something to prove, that something was they could still operate.
Since then we have heard of Wiltshire Council computers suffering a cyber attack (The GRU operate Russia’s cyber capability), Gatwick Airport suffered a cyber attack, a mysterious and large Russian flag was unveiled on scaffolding on Salisbury Cathedral, Gatwick Airport was closed for 36 hrs through drone incursions which both Philip Ingram and Sir Gerald Howarth, David Cameron’s international security minister, assessed could have been done by the Russians and now we have classified documents relating to staff at Porton Down being found in a recycling bin in North London.
One thing an intelligence professional will look for is a pattern, and there is a very clear pattern of activity aimed at embarrassing Wilts council and the people of Salisbury, Gatwick who had pictures of the GRU team arriving, Porton Down and through to all the UK Government. That pattern of activity points towards an intent.
The second question an intelligence professional asks is if they have the capability. That is easier to confirm. The GRU are responsible for Russia’s national cyber capability. The Bellingcat investigations have exposed their global travel carrying out operations. Philip Ingram believes even Salisbury will have a longer term focus as he highlighted in his blog https://greyharemedia.com/salisbury-sleepy-hollow-or-spooks-playground/.
Putting all of this together we have a strong possibility that the documents discovered by an individual in a recycling bin, reportedly from or related to Porton Down and passed to a national newspaper and not the police, were compromised and put there by a GRU team to embarrass Porton Down. Ingram’s spooks paradise blog looks even more credible!
Note: This blog is written by Philip Ingram MBE, a former British Army Intelligence Offficer who was based near Salisbury in the past. If you would like any further comment from Philip, please contact him by clicking HERE
by Grey Hare Editor | Mar 2, 2019 | Articles
Skripal and Salisbury an infamous combination
It is now a year since Colonel Dr Alexander Mishkin and Colonel Anatoliy Chepiga, traveling under the false identities of Alexander Petrov and Ruslan Boshirov, both members of the Russian Military Intelligence Service, the GRU, entered Britain through Gatwick airport. They had a deadly intent, kill the double agent who was living in the sleepy city of Salisbury, Sergei Skripal, using the deadly nerve agent Novichok.
Their mission was a simple one but had been carefully planned. Sergei Skripal’s daughter Yulia was landing at Heathrow airport to visit her father and be with him on what would have been her late brother Alexander’s birthday. Her emails and probably her phone, were being monitored by Russian intelligence and they would have known her arrangements in detail.
After checking into a cheap East End of London hotel Mishkin and Chepiga waited until the next morning to take the train to Salisbury from Waterloo, to carry out a final ‘close target recce’ of Sergei Skripal’s house in Christie Millar Road.
Their detailed movements in Salisbury that day have not been revealed completely but it is probably that, in their possession they had a detailed ‘pattern of life’ study on Sergei Skripal, possibly delivered to their hotel, so they knew his normal routine. They knew he left his house through the front door, not the side or back door, they knew he pulled it shut by the handle, not the door frame, they knew everything about him because others will have spent time watching him closely, studying his movements, reading his emails, listening into his phone conversations.
Mishkin and Chepiga’s trip to Salisbury on Saturday 3rdMarch 2018 would be to confirm the route to take to Sergei Skripal’s house from Salisbury Station, look for signs of him being watched by British Intelligence, confirm their escape plan and possibly meet with at least one member of the team that carried out the ‘pattern of life study,’ before returning to London.
Early on Sunday 4thMarch, Mishkin and Chepiga return to Salisbury with a fake Nina Ricci Premier Jour perfume bottle filled with deadly Novichok in Russia having replaced the cap with a special applicator that morning. On arrival in Salisbury they quickly retrace the route they checked out the day before and approached Sergei Skripals house to smear the deadly agent onto his front door.
Whilst it is possible it was dispensed directly from the modified perfume bottle the danger of ‘splash back’ would have meant putting it onto a wipe and smearing that onto the door handle would be safer; we don’t know if this is what they did. Both Mishkin and Chepiga will have been wearing protective gloves and it is probable that Mishkin carried self-injecting epi pens filled with a nerve agent antidote, atropine, just in case anything went wrong.
This is where their movements become a bit of a blur. At some point they will have taken their contaminated gloves off and disposed of them, that is probably the point they dropped the fake Nina Ricci Premier Jour perfume bottle and exactly where all of this happened is not known publicly yet, neither are the details of their movements around Salisbury before catching the train back to London and then to Heathrow. How and where they disposed of their contaminated gloves has never been mentioned and the fate of the fake Nina Ricci Premier Jour perfume is too well known when Charlie Rowley gave it to his girlfriend Dawn Sturgess on 30thJune 2018 and she sprayed its contents onto her skin, exposing herself to a lethal dose of Novichok.
Just after the attack on 15thMarch 2018, I asked the MET police who had taken over the investigation, what had happened to the items the ‘would be’ assassins had used and was met with silence, I published my concerns here: https://greyharemedia.com/clear-and-present-danger/and in the Sunday papers. Statements from Public Health England said the risk to the public was very low, Dawn Sturgess paid with her life months later.
The detail of where Charlie Rowley found the contaminated perfume bottle and when he found it are unclear. It is distinctly possible he found it in early March and put it in his bag, forgetting it was there until he unpacked after moving into new accommodation from a homeless shelter in June.
I now repeat my question, what happed to the gloves they will have worn? I suspect they were put in a local bin and the next day taken by the council to landfill so are now safely disposed of, but no one has said.
Why Sergei Skripal?
The most important point to start with is the reason for the attack on Sergei Skripal. It was not done first and foremost to kill him, it was assumed, given the deadly nature of Novichok, that he would die. However, if that were the sole motivation then he would have been shot, stabbed or had a car accident. Sergei Skripal was a vehicle used to send a message to any Putin dissenters across the globe that he could get them anywhere, any time and in a horrible way. Prime Minister May hinted to this in an answer to a question after her statement in the House of Commons on 5thSep 2018.
The second reason was to stir a nationalistic fervour into his Presidential campaign domestically by having a reason to say the west was attacking poor Russia. Remember the attack happened exactly 14 days before the Russian Presidential election and opposition parties and oligarchs were becoming more threatening to Mr Putin’s position and his desire for an increased majority.
Sergei Skripal was chosen because Salisbury in next to DSTL Porton Down, the UK’s chemical defence laboratory and this allowed an element of plausible deniability where President Putin could claim that this was set up to undermine him in the eyes of the international community.
Of note, this is exactly the messaging that came out in the immediate aftermath of the attack. The Russians have a doctrine called маскировка (maskirovka) which is all about ‘masking’ or deception and is central to all they do. The Russian people have an unhealthy belief in conspiracy theories and that the west is out to get them no matter what and this played into President Putin’s domestic messaging.
Putin and the GRU will have been surprised at the tenacity of the UK’s counter-terror police and Security Services investigation and the level of detail they have managed to ascertain. The public exposure of Mishkin and Chepiga by the investigative website Bellingcat will have severely embarrassed the GRU.
Sergei and Yulia Skripal will now be under the protection of MI5 and being held safely out of the public eye. They will be receiving further medical support for their physical and mental symptoms. Their futures will be being discussed with them and they are an integral part of any and all decisions about what happens next. For Yulia, a complete innocent who had a bright career and future, it must be particularly hard.
What are we missing?
We are missing detail what the police believe happened to other contaminated items, we are missing detail around the movements of Mishkin and Chepiga around Salisbury, very little footage from the city’s new £450,000 public space CCTV has been released, we are missing details of the team that will have carried out the pattern of life study, we are missing details of what Mishkin and Chepiga did in London.
However, we have to remember there is a politically sensitive, highly complex live murder investigation ongoing, so it is unlikely much of this detail will be released because we don’t need to know. A comment on the contaminated detritus to build further public confidence would be good however.
We have to recognise the huge effort the police, security service, ambulance, fire and rescue, NHS, military personnel, DSTL scientists, civilian security staff and council workers have put in to deal with every aspect of this ongoing spy story. If it were not for their professionalism and coordinated effort there would almost certainly be more deaths and much longer lasting consequences for Salisbury and its surrounds.
Note: This blog is written by Philip Ingram MBE, a former British Army Intelligence Officer and Colonel, who was based near Salisbury in the past. If you would like any further comment from Philip, please contact him by clicking HERE
by Grey Hare Editor | Jul 6, 2018 | Articles
Salisbury and Novichok the truth and myth
Updated 07/0718 1645 by request for additional information
As someone who commanded an intelligence unit with a capability for the covert surveillance of Russian intelligence operations, has studied organic chemistry related to defence against chemical and biological weapons at both degree and master’s degree level, I think I am qualified to do some analysis of detail that is coming out from the reporting of the Sergei and Yulia Skripal and subsequent incidents in Salisbury.
Also, having commented widely in the national and international press I thought I would put all my thoughts in one place.
What is Novichok?
Novichok (новичок meaning “newcomer” or “newbie”) are a series of organophosphate-based nerve agents. They were designed by the Russians in the 1970’s and 80’s as they sought to produce a binary chemical warfare agent whose constituent parts would fall out with the chemicals that were to be banned in the International Probation of Chemical Weapons Convention, that was in its diplomatic infancy at the time.
A binary device consists of two ‘safe’ compounds that when mixed together form the nerve agent but on their own are little or no danger. An organophosphate nerve agent is one that works on attacking the chemical switch inside every nerve cell in your body that turns the nerve cell off after being stimulated. That chemical switch is an enzyme called acetylcholinesterase and nerve agents destroy the body’s ability to synthesise that enzyme.
Nerve agents fall into 3 persistence categories, non-persistent, eg Sarin (used by Assad in Syria), which has the consistency of petrol and evaporates relatively quickly; persistent agents eg Vx (used to assassinate Kim Jong Nam (Kim Jong Un’s half-brother) in Kuala Lumpur airport last year and has the consistency of engine oil; and very persistent such as Novichok that can be in a solid, powder or treacle level of consistency.
Aside from Sarin, the primary method of absorption for nerve agents into the body is through the skin, so it is unlikely that you would know that you have been contaminated with this the colourless, odourless substance until you start to exhibit symptoms. The symptoms can build slowly for low exposure or come on rapidly for high dose exposure and include: Runny nose and eyes, small pupils or blurry vision, coughing, chest tightness, wheezing, or shortness of breath, nausea and vomiting, abdominal pain or diarrhoea, fatigue, headache, or sweating, muscle twitching or a seizure, leading to collapse, respiratory failure and death. Nerve agents are designed to cause casualties first and foremost to overwhelm evacuation and medical facilities on the battlefield and to deny ground through a sort of chemical minefield.
Why were the Skripals attacked?
Contrary to popular belief assassinating Sergei Skripal was not the main aim of his attack. Sergei Skripal was chosen because he lived in Salisbury and in President Putin’s eyes, was a legitimate target, more of which in a minute. The main reason for this attack, 14 days before the Russian Presidential election was to send a message to any Putin dissenters across the globe that he could get them anywhere, any time and in a horrible way. The second reason was to build a nationalistic strength call, into his campaign domestically.
Sergei Skripal was chosen because Salisbury in next to DSTL Porton Down, the UK’s chemical defence labs and this allowed an element of plausible deniability where President Putin could claim that this was set up to undermine him in the eyes of the international community, and that is exactly the messaging that came out in the immediate aftermath of the attack. The Russians have a doctrine called маскировка (maskirovka) which is all about this and is central to all they do.
The Russians also have an unhealthy belief in conspiracy theories and that the west is out to get them no matter what!
Was this a new attack or related to the Skripal attack?
This latest incident is almost 100% related to contaminated detritus left from the Skripal attack. Novichok has only ever been used once, and that was 4 months ago in Salisbury.
Looking at the timeline from probable contamination to hospitalisation my assumption for what happened would be: Dawn Sturgess in Queen Elizabeth Park touched some residual contamination on a bench, or spotted a syringe (or other object) in the hedge. Knowing children were in the park, she picked it up to put in a bin or dispose of later. She wouldn’t have noticed the colourless, odourless contaminant that had been transferred to her skin. The nerve agent will have started its path of adsorption through her skin and into her bloodstream. Initial symptoms would be minor, building over time and dependent on 2 factors, the amount she was exposed to and the absorption rate through her skin. Only when sufficient was absorbed would she collapse with classic nerve agent poisoning symptoms.
At some stage later, she touched her partner Charlie Rowley, possibly just held his hand. Some of the contaminant would have been transferred but a smaller dose than Dawn had been exposed to but his path to showing symptoms would have been the same. It is possible (I say possible, as there are other scenarios and this is pure hypothesis) that the dose Dawn was exposed to was extremely small and that is why it took time to build up to show symptoms of nerve agent poisoning and that smaller dose, combined with slower absorption is why it took several hours more for Charlie to exhibit symptoms.
If the reports suggesting they were known drug users are accurate, their drug habit could affect the absorption rate, symptoms and treatment they are receiving but I am not a medic and this borders on a speculative comment. Eventually, the nerve agent would build up to an LD50 level where 50% of people with that quantity in their body would die, the amounts we are talking about are extremely small, probably less than a grain of salt.
So, what was missed?
My Blog (https://greyharemedia.com/clear-and-present-danger/), ‘Is there a continuing clear and present danger?’ published on 15th March 2018 and quoted the following weekend in some of the national newspapers, outlined a continuing threat. That threat related to the would-be assassins.
The would-be assassins will have transported the Novichok in a container, they will have worn some form of protective clothing when they applied it and, unless this was left at the crime scene, they will have taken it away with them. That meant that there was Novichok contaminated item or items somewhere away from the immediate crime scene and possibly anywhere in the country.
I fully expected the police, if they had recovered these items, to make a statement like they do on murder-suicide cases along the lines of “we are not looking for anyone else in respect of this crime.” That type of statement didn’t come and I was concerned that this container and the protective clothing could have been discarded over a school fence, in a train station, in the local fast food restaurant, anywhere! I called the MET Police who refused to discuss it.
It seems that after the path the Skripals took that fateful evening had been checked and decontaminated, the threat from potential residual contamination was wished away and the police followed what I call the ostrich effect and hoped. Unfortunately for Charlie Rowley and Dawn Sturgess, that hope didn’t protect them.
In defence of the police and other security and emergency services.
Novichok is very, very, difficult to detect as it is designed to evade what is normal nerve agent detectors and whilst very persistent it will degrade, albeit very slowly, over time. It also requires you to come into direct contact with it to get contaminated. So, the chance of getting contaminated, even if the assassins gear was never found, was very low indeed. Maybe Charlie and Dawn should have bought a lottery ticket!
That difficulty in detecting means that swabs, samples, items found have to be sent to Porton Down for testing. Porton Down won’t have a high capacity testing capability, so it takes time to get through the hundreds or thousands of samples collected, a lot of time.
Is Public Health England right in their advice?
In a word, yes, the statistical chance of coming in contact with a contaminated object or area is very small but there is a chance! So they should have caveated their advice. The advice to wash clothes and wipe objects down with baby wipes is sound, it is a matter of chemistry for minute amounts of this substance.
What should be done?
The local council should set up a hotline and app to report discarded items as a specialist collection team sent to recover them quickly. This would be expensive but would leave Salisbury the cleanest city in the country and restore public and tourist confidence. It would be a lot less costly than another city close down!
The police have to find the container used and any protective clothing discarded by the would-be assassins – this is a very small needle in a very large haystack and doing it blindfolded with your arms tied behind your back. It is that easy!
Government scientists should be developing a method for testing for Novichok easily in the field. Of note, only today I was talking to one British Biotech company who have the solution to this problem, the issue is they are a research company and not manufacturers. They just need someone to rapidly develop what they know works, for the current threat. A challenge to the wider biotech world and government research laboratories, drop me a line if you want to know more, but I can’t put more out publicly, unfortunately.
Note: This blog is written by Philip Ingram MBE, a former British Army Intelligence Officer who was based near Salisbury in the past. If you would like any further comment from Philip, please contact him by clicking HERE
by Grey Hare Editor | Mar 7, 2018 | Articles
Sergei Skripal – was it an assassination?
by Philip Ingram MBE
Updated 08 Mar
As someone who commanded an intelligence unit with a capability for the covert surveillance of Russian intelligence operations, I think I am qualified to do some analysis of detail that is coming out from the reporting of the Sergei Skripal incident.
I will open this with a caveat, I am analysing press reporting which is already speculation heavy but there are enough ‘pointers’ to allow me to bring some informed comment to be brought out. The detail is likely to change, especially regarding the potential attack vector, however, the analysis should remain sound.
The two questions an intelligence analyst asks about any incident are; does the capability exist and is there an intent to use the capability? Often one exists without the other, the threat is therefore considered low. Where the two exist, the threat is considered credible.
The Russians have the capability to carry out remote assassinations overseas and within the UK using sophisticated ‘poisons’ and they are not fixed on one agent. Georgi Markov was assassinated in London in 1978 by a Soviet-trained Bulgarian secret service agent using ricin, a highly toxic, naturally occurring compound, it was embedded in a pellet fired from an umbrella. In 2006, Alexander Litvinenko an ex-KGB officer died after drinking green tea laced with polonium-210, a rare and potent radioactive isotope, again in London.
The symptoms reported in the Daily Mail and elsewhere are consistent with poisoning by an organophosphate-based nerve agent of which SARIN or GB has hit the press recently with its use in Syria by Russian backed Syrian forces. Last year the North Korean leaders’ half-brother Kim Jong-Nam was assassinated in Kuala Lumper Airport in Malaysia by another organophosphate-based nerve agent VX which is an abbreviation for “venomous agent X.” The Russians have access to very sophisticated nerve agents including GB and VX, that act within seconds. VX or a derivative would be a referred agent as it is less volatile and it being more potent than Sarin, it can have fatal effects in smaller doses absorbed through the skin.
Of course, there are many other similar compounds in the organophosphate and carbamate groups that can cause these symptoms. And with no confirmation of agent at the moment, the suggestion it could be novel or bespoke will remain. Caveating my comments that VX is possible and has been used before, scientists could have developed some other mycotoxin specifically for this type of assassination attempt. An issue is at least one of the first responders didn’t show symptoms till the next morning which is unusual for a nerve agent contamination but may not be immediately related.
Now the government have confirmed that a nerve agent was used it is worth having a look at some of the derivatives of the G series and V series that have been developed. I studied these as part of my first and masters degree courses, completing specialist projects on CBRNE threats, so again, I think I am qualified to do some analysis.
Nerve agents are compounds that have the capacity to inactivate the enzyme acetylcholinesterase which is there to ‘turn off’ a trigger signal in a nerve caused by acetylcholine. If you cant turn it off the nerve keeps firing. Some of the first agents to be developed were developed by the Nazi’s just before and during the second world war and were given the designator ‘G’ for German. The 3 most common are tabun (GA), sarin (GB), and soman (GD). The man credited with their development was Dr Gerhard Schrader who had been working on pesticides when he realised the power of what he had developed.
It was the British in1954 who first synthesized O-ethyl S-(2-diisopropylaminoethyl) methylphosphonothioate, the scientific name for what the Americans designated VX. The ‘V’ agents are at least 10 times more toxic than the most common ‘G’ agent, sarin (GB). One of the characteristics of the ‘V’ agents is that they were much less volatile than the ‘G’ agents and were therefore considered persistent agents, able to contaminate an area or individual for longer and not reliant on inhalation as much, their persistence and toxicity made skin absorption a significant exposure threat. There are other ‘V’ agents but much of the detail about them remains classified and they have code names like VE, V-gas, VG, and VM. Of note, V-gas is the Russian equivalent of VX and with VE, VG and VM are much rarer but act in a similar way. The world of chemical agents and especially nerve agents and mycotoxins is a complex, fascinating and frightening one, the rarer the agent used the easier it is to apportion blame once the substance has been identified as there are very few facilities across the globe with the sophisticated laboratories able to create and test new agents.
The Russians have the intent – Putin’s clear statements about what he thinks of those caught spying in a video that emerged in 2010 where he said, “Traitors will kick the bucket. trust me. These people betrayed their friends, their brothers in arms. Whatever they got in exchange for it, those 30 pieces of silver they were given, they will choke on them,” is a clear enough statement of intent. In addition, the Russian history of similar assassinations and the clear message it sends to those who may try to undermine Putin’s power base. From a personal perspective, Putin will likely see Sergei Skripal as a traitor no matter what.
What is slightly more frightening is it also sends a message to the international community and to the UK in particular that the Russians are willing to operate with impunity across the globe. This is consistent with their military actions in Syria and their increased military presence globally as well as statements regarding new nuclear capabilities and pictures of new conventional weapon systems.
When in October 2017, Robert Hannigan, the former head of GCHQ, described Russia’s use of cyber-attacks as “a new way” of waging war against the country’s enemies he forgot his readings of Sun Tzu the 6th century Chinese general, military strategist, and philosopher, arguably the greatest military tactician and strategic thinker ever, said in his book the Art of War, “All warfare is based on deception.” He also clearly forgot the Russian doctrine of маскировка (maskirovka) defined in the International Dictionary of Intelligence from 1990 as the Russian military intelligence (GRU) term for deception. Vladimir Putin would have “grown up” in an organisation where maskirovka was a normal part of everyday thinking and is part of their aggressive information operations doctrine.
The frightening analysis of Hannagan’s statement is that the UK intelligence services have taken their eye off the Russian threat. Resources monitoring it have been reallocated to the counter-terror threat whilst the Russians and other intelligence agencies have kept their numbers and activities at the same or greater levels in the Cold War. The UK has become an open playground for unmonitored espionage.
Putting all of this together, it is highly probable that this was a sanctioned assassination with a motivation to send a message to some of Putin’s opposition in the run-up to the Presidential Election and show ‘strength’ to his domestic audience as well as settle a score! Of course, it won’t be obvious that it was definitely Putin sanctioned as it is not unusual for Russian agencies to use plausibly deniable outlets for their “dirty work”. The BBC Series Mc Mafia had more than an element of truth running through its drama. The pictures of the extremely professional emergency services response show how credible the threat was and how all precautions were being taken. The fact that the investigation was quickly handed over from Wiltshire Constabulary to the MET suggests that the national implications were recognised quickly. I would assess that the agent used was a thickened version of one of the ‘V” group, possibly thickened V-gas but this is not based on any hard evidence.
Detailed analysis by DSTL Porton Down will be able to identify the cause and recommend the most appropriate medical treatments for Sergei Skripal and his daughter, as well as the others, affected as there can be long-term effects. Their luckiest break is that it happened only a short distance from Porton Down, one of the world’s leading chemical defence research centres. It is probable that whoever is ultimately responsible for this attack, they will have created a lot of false trails to generate an air of plausible deniability to act as a smokescreen. However, the authorities will know the culprits with some certainty.
Note: This blog will be updated as new information is received. The current version was updated at 2000 on 8th March 2018 – if you would like any further comment from Philip, please contact him by clicking HERE
Recent Comments