Creative police work

How Russian law enforcement identifies Facebook and Telegram users

When policing online behavior in Russia, law enforcement agencies enjoy total compliance from the country’s most popular social network, Vkontakte, which coughs up users’ personal data whenever requested. This information — account registration times, linked email addresses and phone numbers, and IP addresses — constitutes sufficient evidence in court to prove that an individual is responsible for the content posted on their account. When it comes to Internet services based abroad, however, there’s no such cooperation, and Russia’s police have to get creative. In a new report for the website Mediazona, journalist Alexander Borodikhin summarizes 10 cases brought against individuals who allegedly violated Russia’s Internet laws by sharing illegal materials on foreign-operated social networks. Meduza summarizes this report.

Dmitry Tretyakov

This 32-year-old activist from Primorsky Krai has been in jail for a year now. He’s charged with inciting extremism by republishing a post on a pro-Navalny Telegram channel by the radical journalist Arkady Babchenko about a “negative natural selection social experiment” and the need for “mass national repentance.”

How did they link the account to Tretyakov?

Federal agents raided his home and seized his mobile phone, where the offending Telegram account was logged in. Officials also interviewed a former classmate and the local shopkeeper, who verified the names Tretyakov that used with friends and his opposition-leaning political views. Officials also recorded testimony from a “secret witness” who claims to be a staff member at Alexey Navalny’s Vladivostok office. This unnamed person says Babchenko’s Telegram post was a call to violence against police officers. The authorities also collected testimony from two of Tretyakov’s cellmates in pretrial detention, who say he confessed to reposting the Telegram content, and also encouraged them to “beat up the cops and save Russia.”

The FSB also added Tretyakov’s phone number to another mobile phone’s address book, then launched Telegram, and found the offender (@dimambr) as the associated account. Federal agents even got Tretyakov drunk on cognac during an interrogation and apparently got him to confess, on videotape, to sharing Babchenko’s post.

Emil Kurbedinov

A lawyer in Crimea who often defends Crimean Tatar activists, Kurbedinov was sentenced to five days in jail last December for publishing footage on Facebook in 2013 from a rally by the Hizb ut-Tahrir movement, a pan-Islamist political organization banned as a terrorist group in Russia. Kurbedinov was convicted of displaying extremist symbols, and in January 2019 Russia’s Justice Ministry demanded that he be disbarred. Oddly, Kurbedinov served 10 days in jail in 2017 for sharing the same video on Vkontakte — all this, despite the fact that Crimea was indisputably Ukrainian soil, when the content was published.

Case records show that Kurbedinov’s Facebook post was reported to Russian anti-extremism police by a man who now lives in Syria.

How did they link the account to Kurbedinov?

Police inspectors interviewed staff at Russia’s federal censor, Roskomnadzor, who stated that Facebook live videos can only be broadcast by individuals with direct account access. A former FSB agent who appears in one of Kurbedinov’s Facebook videos then confirmed that Kurbedinov was the man who recorded the video. A judge decided that this was sufficient evidence to prove that Kurbedinov shared the illegal content.

Marlen Mustafaev

Another activist in Crimea, Mustafaev was also convicted of sharing Hizb ut-Tahrir symbols on Facebook. In September 2018, he served 12 days in jail for content he posted in 2014. Also like Kurbedinov, Marlen Mustafaev had already served jail time a year earlier for publishing identical images on Vkontakte. In fact, the presiding judge in both cases was the same man, and some of the language in the two verdicts was apparently copied and pasted.

How did they link the account to Mustafaev?

Arresting police officers seized and searched his mobile phone, discovering that the device was logged into the offending Facebook account. Mustafaev then confirmed that the account was his.

Suleiman Kadyrov

Another activist in Crimea, Kadyrov was convicted of inciting separatism because he reposted a video claiming that Crimea belongs to Ukraine, and stated in a comment that he agrees with the video’s content. He was sentenced to two years probation and banned from public activities.

How did they link the account to Kadyrov?

FSB agents raided his home and seized his laptop and mobile phone, which were logged into the Facebook account in question. The authorities also obtained phone records indicating that Kadyrov “made an outgoing data connection” on the day that the video was reposted on Facebook.

Evgeny Lesovoi

A 52-year-old businessman living in Kurgan, Lesovoi was sentenced to two years in prison and banned from acting as a website administrator for another two years for inciting extremism and rioting through Telegram posts that promoted a “revolution” on November 5, 2017, organized by Vyacheslav Maltsev’s “Artpodgotovka” movement. Lesovoi was paroled early, but he says all his business assets were bankrupted, sold off, or seized while he was incarcerated. At trial, Lesovoi said he didn’t even know what Telegram was before his arrest, saying that phone repair staff may have installed the app on his device without his knowledge.

How did they link the account to Lesovoi?

Federal agents and anti-extremism unit officers monitored a pro-Navalny group on Vkontakte. There, they found a link to a Telegram channel, where a user called “LEV” advocated acts of violence against the police. The user’s avatar matched the profile picture of a Vkontakte account registered to a man named Evgeny Lesovoi in Kurgan. When officers determined that there was only one Evgeny Lesovoi living in Kurgan, they wiretapped his phone and recorded a conversation with a friend with whom he discussed “revolution.” Records obtained from Lesovoi’s phone company also show that his mobile device was transmitting data when his Telegram account was active. Two days later, federal agents detained him and seized his mobile phone, which was logged into the offending Telegram account. (Lesovoi says the phone was planted on him.)

When searching Lesovoi’s home, the authorities turned up a CD loaded with a document calling for anti-Putin protests on November 5, 2017. The judge later ignored the fact that the file identified in Lesovoi’s case materials was edited after his arrest, suggesting that police officers may have tampered with it.

Alexander Petrovsky

A 35-year-old taxi driver in Kaliningrad, Petrovsky was sentenced to two years in prison in June 2018 for posting two audio messages on Telegram in late October 2017, less than a week before Artpodgotovka’s “revolution.” Addressing a group of about 100 people, Petrovsky advocated rioting, violence against the police, and the overthrow of the state.

How did they link the account to Petrovsky?

He admitted to sharing the messages, but he denied the felony-charges. One of the witnesses called by prosecutors was a man identified as the creator of the Telegram group in question, leading to speculation that the group was created by an FSB informant deliberately to entrap “extremists.”

Konstantin Ishutov

An opposition activist in Cheboksary, Ishutov was charged last October with “rehabilitating Nazism” by sharing a photograph of a German leaflet from World War II addressed to Soviet soldiers, which promised land and religious freedom to the USSR’s oppressed peasantry. A comment attached to the repost said, “When the Third Reich addresses the Soviet people better than Putin addresses the Russian people.” Recently, the case has stalled, but in the meantime the authorities convicted Ishutov of spreading extremism in a LiveJournal blog post published 16 years ago, fining him 1,000 rubles ($15).

How did they link the account to Ishutov?

At one of Ishutov’s hearings, police issued summons to the fellow activists who turned out to support him, instructing them to come in for questioning, to confirm that the Facebook account in the case actually belongs to Ishutov. When this scheme didn’t work, officers ordered molecular genetic testing of Ishutov’s bicycle helmet, arguing that the Facebook account’s profile picture shows Ishutov wearing a bicycle helmet. Police ordered similar tests for Ishutov’s computer mouse and keyboard (seized in a third search of his home), even though Ishutov doesn’t deny that the equipment is his.

Dmitry Baikov and Dmitry Grabar

Residents of Magadan, Baikov and Grabar used WhatsApp last year to insult Mayor Yuri Grishan in a public group, just as the city was debating whether to restore direct mayoral elections, which were abolished in 2013.

How did they link the accounts to Baikov and Grabar?

To find the culprits, police identified every member of the WhatsApp group in question and seized their mobile phones, one by one. Criticized for committing illegal searches and seizures, the authorities insist that they ignored any data they encountered on the phones that didn’t pertain to their investigation. When the officers narrowed it down to Baikov and Grabar, the two men confessed and apologized to Mayor Grishan. In the end, they were each fined 15,000 rubles ($225).

Vyacheslav Rybakov

Another activist in Cheboksary, Rybakov was detained in December 2017 for allegedly reposting a picture on Facebook that showed a swastika painted on Vladimir Putin’s forehead — an illegal display of Nazi symbols.

How did they link the account to Rybakov?

They didn’t. The district court rejected the case, when police couldn’t prove that Rybakov was responsible for the Facebook repost. The authorities later tried to gain entry to his home, planning to seize his computer, but Rybakov refused to let them inside. In the end, the police dropped the case.

Report by Alexander Borodikhin for Mediazona

Summary by Kevin Rothrock