The Dismantling of a Russian Intelligence Operation
The Dismantling of a Suspected Russian Intelligence Operation
July 1, 2010 | 0856 GMT
<http://www.stratfor.com?fn=7816576328> Criminal Intent and Militant
Recommended External Links
431> District Court Criminal Complaint, Part 1
428> District Court Criminal Complaint, Part 2
STRATFOR is not responsible for the content of other Web sites.
By Fred Burton and Ben West
The U.S. Department of Justice announced June 28 that an FBI
counterintelligence investigation had resulted in the arrest on June 27 of
ian_spies?fn=6416631483> individuals suspected of acting as undeclared
agents of a foreign country, in this case, Russia. Eight of the individuals
were also accused of money laundering. On June 28, five of the defendants
appeared before a federal magistrate in U.S. District Court in Manhattan
while three others went before a federal magistrate in Alexandria, Va., and
two more went before a U.S. magistrate in Boston. An 11th person named in
the criminal complaint was arrested in Cyprus on June 29, posted bail and is
currently at large.
The number of arrested suspects in this case makes this counterintelligence
ctivities?fn=9116631458> of the biggest in U.S. history. According to the
criminal complaint, the FBI had been investigating some of these people for
as long as 10 years, recording conversations in their homes, intercepting
radio and electronic messages and conducting surveillance on them in and out
of the United States. The case suggests that the classic
tactics of intelligence gathering and counterintelligence are still being
used by Russia and the United States.
Cast of Characters
?fn=4416631475> The Dismantling of a Suspected Russian Intelligence
?fn=4416631475> (click here to enlarge image)
The following are the 11 individuals detained in the investigation, along
with summaries of their alleged activities listed in the criminal complaint:
* Claimed to originally be from Canada.
* Acted as an intermediary between the Russian mission to the United
Nations in New York and suspects Richard Murphy, Cynthia Murphy, Michael
Zottoli and Patricia Mills.
* Traveled to and from Canada.
* Met with Richard Murphy at least four times between February 2001
and April 2005 at a restaurant in New York.
* Was first surveilled in 2001 in meetings with other suspects.
* Left the United States on June 17 and was detained in Cyprus on June
29, but appears to have skipped bail.
Richard and Cynthia Murphy
* Claimed to be married and to be U.S. citizens.
* First surveilled by the FBI in 2001 during meetings with Mestos.
* Also met with the third secretary in the Russian mission to the
* Communicated electronically with Moscow.
* Richard Murphy's safe-deposit box was searched in 2006 and agents
found a birth certificate claiming he was born in Philadelphia; city
officials claim there is no such birth certificate on record.
* Engaged in electronic communications with Moscow.
* Traveled to Moscow via Italy in February 2010.
Donald Heathfield and Tracey Foley
* Claimed to be married and to be natives of Canada who are
naturalized U.S. citizens.
* FBI searched a safe-deposit box listed under their names in January
* FBI discovered that Donald Heathfield's identity had been taken from
a deceased child by the same name in Canada and found old photos of Foley
taken with Soviet film.
* Engaged in electronic communications with Moscow.
* Tracey Foley traveled to Moscow via Paris in March 2010.
Michael Zottoli and Patricia Mills
* Claimed to be married and to be a U.S. citizen (Zottoli) and a
Canadian citizen (Mills).
* First surveilled in June 2004 during a meeting with Richard Murphy.
* Engaged in electronic communications with Moscow.
Juan Lazaro and Vicky Pelaez
* Claimed to be married and to be a naturalized U.S. citizen born in
Peru (Pelaez) and a Peruvian citizen born in Uruguay (Lazaro).
* First surveilled at a meeting in a public park in an unidentified
South American country in January 2000.
* Evidence against Vicky Pelaez was the first gathered on the 11
* Lazaro appeared to communicate with a diplomat at the Russian
Embassy in an unidentified South American country.
* Engaged in electronic communications with Moscow.
* First surveillance mentioned was in Manhattan in January 2010.
* Communicated with a declared diplomat in the Russian mission to the
United Nations on Wednesdays.
* Knowingly accepted a fraudulent passport from an undercover FBI
agent whom she believed to be a Russian diplomatic officer June 26, but
turned it in to the police the next day shortly before her arrest.
* First surveillance mentioned in the criminal complaint was in June
2010 in Washington.
* Revealed to an undercover officer that he had received training and
instruction from "the center" (a common term for the Moscow headquarters of
16631496> Intelligence Service, or SVR).
* Accepted a payment of $5,000 and followed orders given by an
undercover FBI agent posing as a Russian diplomatic officer to deliver the
money to a drop site in Washington.
According to the FBI, some of the alleged "undeclared agents" moved to the
United States in the 1990s, while others (such as Anna Chapman) did not
arrive until 2009. The FBI says nine of the suspects were provided with fake
identities and even fake childhood photos and cover stories (part of what
would be called a "legend") in order to establish themselves in the United
State under "deep
telligence_apparatus?fn=6316631437> cover." Chapman and Semenko used their
own Russian identities (Chapman is divorced and may have taken her surname
from her former husband). The true nationalities of the other suspects are
unknown, but several passages in the criminal complaint indicate that most
of them were originally from Russia. The Russian SVR allegedly provided the
suspects with bank accounts, homes, cars and regular payments in order to
facilitate "long-term service" inside the United States, where, according to
the criminal complaint, the individuals were supposed to "search [for] and
develop ties in policymaking circles" in the United States.
The FBI criminal complaint provides evidence that two of the deep-cover
couples (Heathfield/Foley and Lazaro/Palaez) and the two short-term cover
agents (Semenko and Chapman) were operating without knowledge of each other
or in connection with the other two couples and Metsos, who did interact.
This suggests that they would not have formed one network, as is being
reported, but perhaps discrete networks. The criminal complaint provides
evidence indicating that most of the operatives were being run out of the
SVR residence at the U.N. mission.
It is unclear exactly how successful the 11 accused individuals were in
finding and developing those ties in policymaking circles. The criminal
complaint accuses the individuals of sending everything from information on
the gold market from a financier in New York (a contact that Moscow
apparently found helpful, since it reportedly encouraged further contact
with the source) to seeking out potential college graduates headed for jobs
at the CIA. The criminal complaint outlines one recorded conversation in
which Lazaro told Pelaez that his handlers were not pleased with his reports
because he wasn't attributing them properly. Pelaez then advised Lazaro to
"put down any politician" (to whom the information could be attributed) in
order to appease the handlers, indicating that the alleged operatives did
not always practice scrupulous tradecraft in their work. Improperly
identifying sources in the field ultimately diminishes the value of the
information, since it cannot be adequately assessed without knowing where it
came from. If these kinds of shortcuts were normally taken by Pelaez, Lazaro
and others, then it would reduce their value to the SVR and the harm that
they may have done to the United States. The suspects were allegedly
instructed by their handlers in the United States and Russia to not pursue
high-level government jobs, since their legends were not strong enough to
withstand a significant background investigation. But they allegedly were
encouraged to make contact with high-level government officials, in order to
have a finger on the pulse of policymaking in Washington.
The criminal complaint alleges that the suspects used traditional tradecraft
of the clandestine services to communicate with each other and send reports
to their handlers. The suspects allegedly transmitted messages to Moscow
containing their reports encrypted in "radiograms" (short-burst radio
transmissions that appear as Morse code) or written in invisible ink, and
met in third countries for payments and briefings. They are also said to
have used "brush passes" (the quick and discreet exchange of materials
between one person and another) and "flash meets" (seemingly innocuous,
brief encounters) to transfer information, equipment and money. The criminal
complaint also gives examples of operatives using coded phrases with each
other and with their operators to confirm each other's identities.
In addition to the traditional tradecraft described in the criminal
complaint, there are also new operational twists. The suspects allegedly
used e-mail to set up electronic dead drops to transmit encrypted
intelligence reports to Moscow, and several operatives were said to have
used steganography (embedding information in seemingly innocuous images) to
encrypt messages. Chapman and Semenko allegedly employed private wireless
networks hosted by a laptop programmed to communicate only with a specific
laptop. The FBI claims to have identified networks (and may have intercepted
the messages transmitted) that had been temporarily set up when a suspect
was in proximity to a known Russian diplomat. These electronic meetings
occurred frequently, according to the FBI, and allowed operatives and their
operators to communicate covertly without actually being seen together.
Operations are said to have been run largely out of Russia's U.N. mission in
New York, meaning that when face-to-face meetings were required, declared
diplomats from the U.N. mission could do the job. According to the criminal
complaint, Russian diplomats handed off cash to Christopher Metsos on at
least two occasions, and he allegedly distributed it to various other
operatives (which provided the grounds for the charge of money laundering).
The actual information gathered from the field appears to have gone directly
to Russia, according to the complaint.
It is important to note that the accused individuals were not charged with
espionage; the charge of acting as an undeclared agent of a foreign state is
less serious. The criminal complaint never alleges that any of the 11
individuals received or transmitted classified information. This doesn't
mean that the suspects weren't committing espionage. (Investigators will
certainly learn more about their activities during interrogation and trial
preparation.) According to the criminal complaint, their original guidance
from Moscow was to establish deep cover. This means that they would have
been tasked with positioning themselves over time in order gain access to
valuable information (it is important to point out that "valuable" is not
synonymous with "classified") through their established occupations or
social lives. This allows agents to gain access to what they want without
running unnecessary security risks.
Any intelligence operation must balance operational security with the need
to gather intelligence. Too much security and the operative is unable to do
anything; but if intelligence gathering is too aggressive, the handlers risk
losing an intelligence asset. If these people were operating in deep cover,
the SVR probably invested quite a bit of time and money training and
cultivating them, likely well before they arrived in the United States.
According to information in the criminal complaint, the suspects were
actively meeting with potential sources, sending reports back to Moscow and
interacting with declared Russian diplomats in the United States, all the
while running the risk of being caught. But they also took security
measures, according to the complaint. There is no evidence that they
attempted to reach out to people who would have fallen outside their natural
professional and social circles, which could have raised suspicions. In many
ways, these individuals appear to have acted more like recruiters, seeking
out people with access to valuable information, rather than agents trying to
gain access to that information themselves. However, all we know now is
based on what was released in the criminal complaint. An investigation that
lasted this long surely has an abundance of evidence (much of it likely
classified) that wasn't included in the complaint.
According to authorities, the suspected operatives were under heavy
surveillance by U.S. counterintelligence agents for 10 years. Working out of
Boston, New York and Washington, the FBI employed its Special Surveillance
Group to track suspects in person; place video and audio recorders in their
homes and at meeting places to record communications; search their homes and
safe-deposit boxes; intercept e-mail and electronic communications; and
deploy undercover agents to entrap the suspects.
Counterintelligence operations don't just materialize out of thin air. There
has to be a tip or a clue that puts investigators on the trail of a
suspected undeclared foreign agent. As suggested by interviews with the
suspects' neighbors, none of them displayed unusual behavior that would have
tipped the neighbors off. All apparently had deep (but not airtight) legends
going back decades that allayed suspicion. The criminal complaint did not
suggest how the U.S. government came to suspect these people of reporting
back to the SVR in Russia, although we did notice that the beginning of the
investigation coincides with the time that a high-level SVR agent stationed
at Russia's U.N. mission in New York began passing information to the FBI.
Sergei Tretyakov (who told his story in the book by Pete Earley called
"Comrade J," an abbreviation of his SVR codename, "Comrade Jean"), passed
information to the FBI from the U.N. mission from 1997 to 2000, just before
he defected to the United States in October 2000. According to the criminal
complaint, seven of the 11 suspects were connected to Russia's U.N. mission,
though evidence of those links did not begin to emerge until 2004 (and some
as late as 2010). The timing of Tretyakov's cooperation with the U.S.
government and the timing of the beginning of this investigation resulting
in the arrest of the 11 suspects this week suggests that Tretyakov may have
been the original source who tipped off the U.S. government. So far, the
evidence is circumstantial - the timing and the location match up - but
Tretyakov, as the SVR operative at Russia's U.N. mission, certainly would
have been in a position to know about operations involving most of the
people arrested June 27.
Nothing in the complaint indicates why, after more than 10 years of
investigation, the FBI decided to arrest the 11 suspects June 27. It is not
unusual for investigations to be drawn out for years, since much information
on tradecraft and intent can be obtained by watching foreign intelligence
agencies operate without knowing they are being watched. Extended
surveillance can also reveal additional contacts and build a stronger case.
As long as the suspects aren't posing an immediate risk to national security
(and judging by the criminal complaint, these 11 suspects were not), there
is little reason for the authorities to show their hand and conclude a
fruitful counterintelligence operation.
It has been suggested that some of the suspects were a flight risk, so
agents arrested all of them in order to prevent them from escaping the
United States. Metsos left the United States on June 17 and was arrested in
Cyprus on June 29, however, his whereabouts are currently unknown, as he has
not reported back to Cypriot authorities after posting bail. A number of the
suspects left and came back to the United States numerous times, and
investigators appear not to have been concerned about these past comings and
goings. It isn't clear why they would have been concerned about someone
leaving at this point.
The timing of the arrests so soon after U.S. President Barack Obama's June
25 meeting with Russian President Dmitri Medvedev also raises questions
about political motivations. Medvedev was in Washington to talk with Obama
in an attempt to improve relations between the two countries on the day the
FBI officially filed the criminal complaint. The revelation of a network of
undeclared foreign agents operating in the United States would ordinarily
have a negative effect on relations between the United States and the
foreign country in question. In this case, though, officials from both
countries made public statements saying they hoped the arrests would not
damage ties, and neither side appears to be trying to leverage the incident.
Indeed, if there were political motivations behind the timing of the
arrests, they remain a mystery.
Whatever the motivations, now that the FBI has these suspects in custody it
will be able to interrogate them and probably gather even more information
on the operation. The charges for now don't include espionage, but the FBI
could very well be withholding this charge in order to provide an incentive
for the suspects to plea bargain. We expect considerably more information on
this unprecedented case to come out in the following weeks and months,
revealing much about Russian clandestine operations and their targets in the
Reprinting or republication of this report on websites is authorized by
prominently displaying the following sentence at the beginning or end of the
report, including the hyperlink to STRATFOR:
"This report is republished with permission of STRATFOR
[Non-text portions of this message have been removed]