89.1 WEMU

Meet The Internet Researchers Unmasking Russian Assassins

Oct 12, 2018
Originally published on October 15, 2018 10:25 am

Aric Toler isn't exactly sure what to call himself.






Chemical exposure





Toler says the organization is funded half through grants from places like Google and the Open Society Foundations. The other half comes from training workshops, including one NPR recently visited in the Washington, D.C., area.


We firmly believe it's so important that more people are aware of how to do these kinds of things. - Christiaan Triebert, Bellingcat




Leaky data


Bellingcat tracked down a second man it believes to have been involved in the poisonings through searching databases online.
Meredith Rizzo/NPR


We don't want to be co-opted. - Aric Toler, Bellingcat


This still taken from CCTV and issued by the Metropolitan Police in London on Sept. 5 shows two suspects in the Skripal poisoning at the Salisbury train station in England on March 3.
Metropolitan Police / AP

Russian retaliation





Christiaan Triebert is a former Dutch journalist who now works with Bellingcat. The organization's members come from all over the world.
Meredith Rizzo/NPR







It turns out that the two Russian operatives behind the U.K. nerve agent attacks had their identities blown by a team of Internet researchers. NPR's Geoff Brumfiel has this story of who they are and how they did it.

GEOFF BRUMFIEL, BYLINE: OK, so here's the one thing you need to know for this story. Everything is on the Internet.


UNIDENTIFIED PERSON: Our prime minister said there is no alternative conclusion other than the Russian state was culpable for the attempted murder...

BRUMFIEL: Back in September, British authorities held a press conference. They released passport photos and names used by two men they believe tried to kill a former Russian spy with nerve agent.


UNIDENTIFIED PERSON: It is likely that they were traveling under aliases, and these are not their real names.

BRUMFIEL: To a guy like Aric Toler, that sounded like a challenge. Toler works for a group called Bellingcat. His job is so unusual even he doesn't know how to describe it.

ARIC TOLER: Something like digital researcher, digital investigator, digital something - probably works.

BRUMFIEL: Toler and his friends are very, very good at finding all kinds of things online. They've used commercial satellite images to track Chinese air bases, watched security operations unfold on social media in Venezuela, pinpointed the locations of chemical weapons attacks in Syria. The true identity of a Russian spy...

TOLER: It's tough because this guy's, you know, a military intelligence officers. So it's not going to be easy to find this guy just on Facebook.

BRUMFIEL: But remember everything is on the Internet these days, including photos of a military academy that trains intelligence officers taken by Russian tourists.

TOLER: When you look at these photos - they're all on our on our website - it's just a bunch of Russians - just random Russian guys going through and kind of sightseeing at this like military academy.

BRUMFIEL: These tourists visit the academy. And one thing they like photographing is its wall of fame, with pictures of notable graduates.

TOLER: This is a year before the poisoning. Some totally random innocuous normal Russian person uploaded a photo that shows our boy, Anatoliy Chepiga, up on the wall.

BRUMFIEL: Col. Anatoliy Chepiga, the spitting image of the man in the photo released by the British - right there on the wall with his name spelled out for all to see. And Bellingcat turned up a lot more. It turns out if you're willing to risk getting a nasty computer virus, you can download all sorts of Russian databases.

TOLER: Things like insurance databases and driver's licenses, voter database, things like that - this stuff isn't 100 percent legal, but it's out there.

BRUMFIEL: And in those databases, they found way more photos and details about their man Chepiga - old phone numbers and addresses, including one that linked him to a local military intelligence headquarters. This week they also IDed Chepiga's fellow spy, a guy they think is named Alexander Mishkin. Mishkin came from a small town in Russia's far north. Once they found him, Bellingcat worked with Russian journalists to send someone up there.

TOLER: And they had his picture, they were showing it to random people in the town. They're like, oh, yeah, that's our - that's Sasha. Alexander in short in Russian is Sasha. That's Sasha Mishkin over there. He's a good - you know, he's a good boy. He's a good lad. His grandma - 92-year-old grandma also shows us a photo of him receiving a medal from Putin.

BRUMFIEL: Russian President Vladimir Putin probably didn't give Myshkin a medal for being such a good grandson. Bellingcat has 10 full-time researchers scattered across the globe. Toler works out of Kansas City. Others are in the U.K., the Netherlands and elsewhere. They say they're funded by a combination of grant money and money from classes they run. Christiaan Triebert is another member of the group.

CHRISTIAAN TRIEBERT: We firmly believe that it's so important that more people are aware of how to do these kind of things. And most of the times, it's not too hard.

BRUMFIEL: I caught up with him and Toler during a training they were doing near Washington, D.C.

TOLER: Today we're going to start with how do you determine approximately or exactly when a photograph or video was taken.

BRUMFIEL: The students include journalists, law enforcement types, human rights workers. Triebert says getting a lot more people to do this stuff is what Bellingcat is all about. The name Bellingcat comes from one of Aesop's fables about a group of mice who decide to put a bell on a stealthy cat in order to expose its presence. Triebert says that's how they see this new kind of work.

TRIEBERT: I hope the group of mice keeps growing, and I hope we can bell more cats.

BRUMFIEL: The truth these researchers believe is on the Internet. You just have to know how to look. Geoff Brumfiel, NPR News, Washington. Transcript provided by NPR, Copyright NPR.