Comrade Major

Who posted the data of three thousand people on the Internet and announced them with "supporters of Navalny": the investigation of "Medusa"

What happened

On Friday, August 9, the day before the rally on Sakharov Avenue , a post with the words with the words with the words: “Listen, these idiots in the chat of Navalny’s team were completely distraught-they accidentally laid out the entire base of their supporters for the calls of people for a rally in their chat. Everything is generally there: passports, phones, addresses. In general, that's it! We even have nothing to do now, well, they burned themselves. Lord, what are the idiots! ” "Comrade Major" has almost 30 thousand subscribers. In the description of the telegram channel, its authors call themselves "your personal curator from the FSB." For cooperation, they offer to contact the user @silovikicat (“Silovikov Cat”).

The Excel file called "Base" was attached to the next post. Soon the post with the table was deleted. An employee of the Moscow headquarters Alexei Navalny informed Medusa that a certain unknown account posted a message with this database in the headquarters chat, after which he immediately left the chat and deleted the account. The screenshot of the chat with this message appeared in the Comrade Major channel. A source of Medusa at Navalny’s headquarters stated that they did not store the bases of volunteers and headquarters in this format.

The properties of the file indicate that it was created on July 27, and was last edited on August 9. The field "Company" is indicated "Main Directorate of the Ministry of Internal Affairs of Russia in Moscow." The file of 3198 fields with personal data: phone, name, registration address, date of birth, passport number. Not all fields are complete data: only the name and phone are indicated somewhere, somewhere there is not enough registration address. Of the 1794 telephone numbers in 1406, the prefixes of the MTS operator (not all of them are MTS subscribers: someone moved to another operator, retaining the previous number).

Whose data fell into the "base"

People who discovered their telephone numbers in the database said that after publishing the file, they began to receive SMS with an appeal to disguise themselves for promotions on August 10 and organize groups to coordinate actions. The link to the SMS led to an anonymous site on a free Tilda Blogochoster without weekends, at which visitors were invited to gather in groups of “physically trained people, exclusively guys and men” and “fighting the devils in uniform”.

"Medusa" contacted several people from the list of "Comrade Major." Among them there is:

• People who went to protest rallies on July 27 and August 3 in Moscow and were detained by the police. They rewrote their personal data in the ATS, and it was in this form that they were in the “database” file. In the twitter of an unregistered candidate for the Moscow City Duma Dmitry Gudkov, information appeared that one of the detainees indicated a fictional address - and it was he who got into the “base”. In other cases, the police copied the passport data with errors, which also migrated to the file. One of the Medusa contacted Medusa on July 27 on Tverskaya Street before the rally began and said that his passport data and 12 more detainees from the same car carrier appeared in the “base” in the form in which they were rewritten by police officers.
• People who went to protest rallies on July 27 and August 3, but were not detained by the police and did not sign on the warning "On the inadmissibility of participation in an unauthorized rally." Among these are people whose phone number is indicated with the data of another person - most often the one for whom the telephone number is registered. For example, journalist Nina Abrosimova, who illuminated the rally on July 27, found her mother in the “base”, to whom her number was registered. Nina Abrosimova’s mother did not go to the rally. In one of the cases that the reader of Medusa spoke about, his age in the “base” was overestimated: he registered the MTS SIM card when he was 17 years old, and the MTS office attributed an extra year for him. In some cases, next to the person who went to rallies, the personal data of the other are indicated - the one who called him to the phone or sent SMS during a rally.
• People who left their signatures in support of candidates for the Moscow City Duma , not admitted to the elections. For example, the Brothers Zakhar and Pavel Artemyev, registered in the 43rd Moscow Particle District, left their signatures for love Sobol. Data Zakhara Artemyeva (phone number, date of birth and passport number) is in the “base”. Medusa contacted several more people from the list and found out that they were not at rallies, but left their signatures for sable. In addition, there are people on the list who left their signatures for other opposition candidates in the 2019 Moscow City Duma, for Alexei Navalny in the 2013 mayor’s elections, were recorded on the Smart Voting website or donated money to the corruption fund.
• Random people who were not at rallies and did not put their signatures for opposition candidates. In the GetContact application, other names are tied to their numbers.

Damir Gainutdinov, a lawyer of the Agora human rights organization, told Medusa that such a drain falls under at least two articles of the Criminal Code: 137 (illegal collection and dissemination of information about the personal life of citizens) and if personal data from the list transferred to the “comrade Mayor” 285 (abuse of official powers).

Who is "Comrade Major"

"Medusa" found a person who may be the administrator of "Comrade Major".

It was possible to find out the phone tied to the @silovikicat account using the Insider-Telogram program, developed at the ANO Center for Legitimacy and Political Protest Research. “Now in the program of the program - more than 10 million rooms,” explains the head of the center Evgeny Venediktov . - We simply check for the presence of all phones in a row in a telegram: we take, say, all the numbers that begin with +7911 - and from zeros to nine we drive off all this license plate. After all, you automatically see in your telegram the contacts of those users who are included in your phone book in a smartphone? Well, we simply bring to our very thick “phone book” of all users of the country. ”

When making a number established by Venediktov, the list of contacts on mobile telegram will automatically correlates it with the @silovikicat account (“Silovic Cat”).

The mobile phone number, tied to @silovikicat, made it possible to establish the alleged name and surname of the Channel Major channel administrator, says Igor Bederov, creator of the network investigation of the Internet Writing. In the user identification, he is confident “by 90%”: “The Moscow PRA Vitaliy Tysaev can be behind the leakage of personal data. Our development “Telpoisk” analyzed social networks, ads, the USRUL - as a result, the desired number managed to detect the GetContact electronic notebook, which correlated the phone with Subscriber Vitaly Tysaev. ”

Based on behalf of and the region (a Moscow telephone number is tied to the Comrade Major account), Bederov installed social networks of the alleged administrator of the telegram channel. “These data coincide with one person not only in Moscow, but in general in Russia,” says Bederov. - The program watched all the social networks, then I repeated the search manually - and the other Vitaliev Taisaevs neither in VKontakte, nor in Odnoklassniki or Facebook. ”

In one of the posts, he gives a reference to the publication of RIA Novosti with a report on the motorized run of Sergei Dorenko’s memory with the signature of “My photo”. Pictures on the page of the RIA material are signed by Vitaly Taisaev.

On the page on Instagram, Taisaev reports on his work in the media and telegram: “Media and Editor, Telegram Engagement”. On specialized sites and in his blog , he seems to be an SMM specialist. In an interview, he says that “he was engaged in the development of ... communities with an audience of more than 20 million users” and came to the SMM marketing “from science”.

On the Medium blog, Taisaev writes that he worked "in Digital, Marketing Agencies in the position of a copywriter, project manager, and social networks manager." Taisaev talks about "the management of ... advertising, CPA campaigns for large millionth communities in VKontakte." He also arranges “master classes and seminars on social networks for various audiences” and comments on the SMM sphere for the silver rain radio.

At Medium, Taisaev also writes about Telegram - one of the posts is called “Why Telegram is the main messenger in Russia?”: “All Russia is managed in Telegram. Believe me, most of all state and social processes are seething in the messenger chats. Moreover, this is not only Moscow, but also the deaf regions of our vast Motherland. <...> Very often, some political channels fall into screenshots from chats where representatives of all branches of the country's authority are sitting. ”

In the same text, Taisaev calls one of the main advantages of Telegram Privacy: “The demonstrative position of the command of the messenger who does not give the“ comrade major ”of encryption keys to the young girls - cadets of the FSB Academy to look at your closed chats. Many sources in law enforcement agencies claim that correspondence, even packaged, breaks out, but this is technically difficult and justified only in very important requests of the department. In any case, it is better than whatsApp, which is quite a holey and still freely fits your number to everyone present in the chat. Which, of course, enables spammers of all stripes to use scripts to collect telephone databases and conduct spam mailings. ”

Taisaev looks like an experienced administrator of telegram channels, including political ones: “Unlike communities in VK, profiles on Instagram, Telegram has a rather low (even at the beginning of 2019) threshold of entering a monetization point. <...> The channel for 5000 subscribers can be grown for 75,000–100,000 rubles of investments and can generate from 20,000 to 30,000 rubles of net profit for the editorial office. The level of costs will be greater for political projects, but a competent editorial policy can bring such a channel three to five times more profit. ”

“The interface for working with channels and chats is simply disgusting,” Taisaev writes . -If you have several of your channels, you read the main socio-political and thematic channels, there are 5-10 chats at work, then most likely you will constantly lose something (important information, advertising orders and work tasks). <...> It is better to have a “personal” client, for all contacts and subscriptions, and for work to start a “working“ ““ client ”client” to a separate SIM card. According to Venediktov and Bederov, all Taisaev’s personal accounts are instituted to his personal number, not related to Telegram.

Taisaev’s telephone numbers - and the one to which the @silovikicat account, indicated in the profile of the Comrade Major channel, is tied, and the personal is disconnected. The user of the @silovikicat account in the chat to the greeting of the "Medusa" "Hello, Vitaly" answered "Hello". To the question of the correspondent of Medusa, “did you publish the“ base of the supporters of Navalny ”yesterday-was it someone’s request or paid integration?” The user replied that he did not know this without specifying who is meant. When asked where the post came from in the channel about the alleged “Base of Data Supporters of Navalny”, the user replied: “The published materials in our channel are entertaining and scientific-journalistic. Information, nishtyaki and “exclusives” send us subscribers or other advertising agencies, as we are also for this channel. We hear about Taisaev for the first time. Perhaps this is one of many advertising agents or SMM managers, which this channel replaced dozens of times. By the way, you have a very interesting and cool edition). ”

In a conversation with the Medusa correspondent in Facebook messenger Vitaly Taisaev, he said that he had nothing to do with the channel, but “promoted it in 2017 for two months under a request”. When asked why his phone was registered in Telegram, indicated in the Comrade Major channel profile, Taisaev replied that he perhaps handed the SIM card to the new client, to which the account is tied to: “We sometimes do this so that the client has the history of correspondence” (after the publication of this text, he called other reasons for the transmission of the SIM card: “To control sales and control of sales and control budget "). Taisaev said that, according to his information, the Comrade Major channel was resold twice, but who his current owner does not know. Taisaev also could not name those by whose order he administered “Comrade Major”, but suggested that it could be people “from some kind of contracting party”.

How did the data from the “Base” file hit the “Comrade Major” file?

The representative of the MTS operator assured Medusa that he had no idea how the “base” was formed, where exactly people left their personal data from this list and by what principle they were united. “MTS is a long-term leader in the number of subscribers in Russia, so if somewhere MTS subscribers are more than subscribers of other operators, then this is not surprising,” he said. The representative of another major cellular operator, on the terms of anonymity, told Medusa that the numbers were more likely taken from the detention protocols than from the providers' bases: “The couple who called the left addresses during the detentions coincided [with those that were merged].”

The Director General of the Institute for Research of the Internet, Karen Ghazaryan, believes that special services collected data on mobile subscribers at rallies using special equipment. “Stingray Cells - fake [that is, working, but not operator] honeycombs - one of the FSB favorite tools right now; They are also used at rallies, ”he said.

Mikhail Klimarev from the Society for the Protection of the Internet does not agree with Ghazaryan: “ IMSI-Catcher is not used, it is too expensive and meaningless technology. Why put these expensive devices when they have access to all information in communication operators? If the database leak was there, then it was from communication operators. ”

Igor Bederov, the founder of the Internet Wall company, got acquainted with the merged base and believes that it is the result of operational work: “This is just a generalized certificate from different departments. See: only 40% indicate the data of the phones in the merged database, but everyone rewrites passports-this is how the operational-search bureau , which makes “sticks” for the main management of the Ministry of Internal Affairs, works.

“Sticks,” explains Bederov, are identified citizens. According to him, one or two departments of the operational-search bureau, each in each of 100 people, can work at rallies. “They go into place, rummage in the crowd, looking for supposedly provocateurs,“ in fact they simply rewrite people, ”says Bederov. - From there, completely left -wing people appear in these lists. For example, there are cars along the road there - they rewrote the numbers from the cars, pierced - and here you are also “citizens participating in the rally”. And then the numbers of cars are launched in the same “Kronos” - and here you are already passport data. ”

“When you delay one and a half thousand people, you have the opportunity to get their full base,” says Meduza, an interlocutor close to the FSB. - Some of them are “traffic lights” - admits everything and begins to cooperate. A person is detained, an opera is conducted by a primary survey (the most weakly prepared detainees), then psychologists are piled on them. On those who peck, they plant traces: beat, press. When the client is ready, he scribbles everything about everyone. ” For an operative who gained access to the basis of personal data, the source source is said, it is not a problem to find a passport and other information about the detainee who managed to “promote” the testimony of his friends.

According to the same source, the drain on August 9 can be regarded as a threat from the city authorities to the organizers of the rally on Sakharov Avenue on the 10th: “They say, we“ counted you all ”. But this threat is very unprofessional and dumb. Apparently, the brain crisis in the city hall is really really. ”

If you know exactly where the personal data of people from the “Base” file came to the “Comrade Mayor”, you can safely and anonymously share this information with the “Medusa” using the Securedrop system.

Lilia Yapparova, Alexey Kovalev, with the participation of Ilya Zheguleva