A #counterintelligence thread in the sense that I'm analyzing a foreign intelligence situation: I've been reading some very interesting analyses on the #Zakharchenko assassination and it's gotten me thinking about how this incident may or may not relate to FSB's role in Donbas /1
The first analysis I found useful was from @MarkGaleotti, and it emphasizes that it is doubtful that #Zakharchenko's death is move the situation towards peace. He mentions Dmitry Trapeznikov and Denis Pushilin as possible successors. /2 themoscowtimes.com/articles/war-p…
This article mentioned the thread I'm going to be pulling on here: the fact that #Zakharchenko and Alexander Timofeev, Z's tax minister sidekick who was injured in the blast, orchestrated the takeover of major illegal economies in Donbas - putting targets on their backs. /3
The second analysis comes from the @CarnegieRussia, with a larger focus on #Zakharchenko's role within his "generation" of Donbas separatist leaders and suggested that his most likely successor is SBU officer-turned-separatist Alexander Khodakovsky. /4 carnegie.ru/commentary/771…
The author emphasizes this would parallel the fact that in 2017 the then-leader of the Luhansk People’s Republic (LNR; the twin to #Zakharchenko's Donetsk's People's Republic/DNR) was replaced by another SBU officer-turned-separatist, Leonid Pasechnik. /5
This author suggested that if Khodakovsky does take over DNR, it could signal that Russia might try and push for reintegration of the western regions into Ukraine to distort whole-of-country elections with a stronger pro-Russian voting bloc. Interesting theory, but I doubt it. /6
The use of former Ukrainian security officials in leadership roles makes sense from both a practical standpoint (ex., they are operators) and a political one (ex., they have more potential cachet with Ukrainians). The best proxies are those with as much legitimacy as possible /7
Again in that article, it is noted how #Zakharchenko & Timofeev (Z&T)'s control of illegal trade in the area may have earned them hostile attention because they were viewed as being too powerful and greedy. /8
For what its worth, @WarsawInstitute has attributed Pasechnik's rise in LNR to an FSB victory over the GRU for dominance of regional influence and direction. It describes FSB as since then being the leading Russian "curator" in the region. /9 warsawinstitute.org/donbass-coup-d…
The piece also describes how Putin's adviser Vladislav Surkov has aligned with GRU to push the strategy of returning a largely autonomous (but heavily Russian influenced) Donbas to Ukraine, in order to be able to influence Ukraine as a whole through that "autonomous region". /10
This is contrasted with the FSB's view of how to handle Donbas: don't return an inch of territory, unite the DNR and the LNR, and then use the new united entity to harass and destabilize Ukraine. The ascent of Pasechnik was a win for the FSB and it's regional policies. /11
This brings me to the third analysis: that from @meduza_en. Here, the idea of Z&T having earned themselves the black spot is the "second theory" presented and is well-explained. This was also the first to mention Serhiy Kurchenko... /12 meduza.io/en/feature/201…
The Meduza piece emphasizes Kurchenko's role as the Russian end of illegal trade in the region. He's a wealthy Ukrainian oligarch hiding from a post-Yanukovych arrest warrant, under sanctions, highly security conscious and connected to the FSB. /13 theins.ru/korrupciya/494…
The Warsaw Institute claims Kurchenko got the ball rolling the putsch in the LNR that enabled Pasechnik's rise there by complaining to the FSB that the then-leader of the LNR (who had Surkov & GRU backing) was "taxing exports" too highly. /14 warsawinstitute.org/fsb-cheka-2-0/
So, from all of these pieces, a possible narrative emerges around FSB interests. Kurchenko had reason to want both Z&T dead because of their control over DNR trade and the FSB may have a charismatic former SBU officer in the wings amidst the DNR leadership. /15
(FWIW I don't know if Alexander Khodakovsky is tied to the FSB, but considering how riddled with FSB assets SBU was under Yanukovych, it would not surprise me. Also, a number of SBU officials have aligned themselves with the FSB since Maidan. /16) wsj.com/articles/how-s…
So, the goal of killing #Zakharchenko becomes twofold: secure higher profits from illegal trade via Kurchenko (who cuts FSB in for patronage & protection) + attempt to get things in motion to bring DNR closer to the LNR leadership model backed by the FSB at the expense of GRU /17
This would be a coup for the FSB in financial terms and political terms, particular in terms of dominance over Donbas proxies while the GRU is still recovering from the LNR putsch in 2017 and is more focused on Syria. But at the end of the day, who knows? /18
I like this theory because it accommodates a lot of the moving parts and speaks to my own views about the FSB's activities in the region. That said, some other theories about the assassination are very valid and I'm admittedly newer to Donbas politics. So, grain of salt here /19~
Addendum: for tactical details on the actual assassination, I highly recommend this massive thread.
John is right: if the intent of this disrupted black-bag job against the Spiez lab really was sabotage as opposed to espionage, it raises some curious potentialities about Russian motives. In a midnight analysis, it feels to me vaguely like some kind of desperation. 1/9
In my mind, the question is: what would make the increasing aggressive Russian services - in this case (apparently) the GRU - feel its necessary to engage in this particularly high-risk type of operation against a very hard target like a leading government CBRN facility? 2/9
I cannot overstate that deploying operators equipped with cyber sabotage tools to get physical/close, access to the networks of a Swiss chemical weapons laboratory when your service is already under scrutiny after a failed operation = just about all the moving parts. 3/9
To be very clear: I think that the “GRU are clowns” narrative is that is emerging is counterproductive and ill-informed. But I believe GRU’s aggressive “can do at all costs” attitude appears to have had a trending negative impact on the quality of its tradecraft. /1
Major data points that I think support this argument include the failed coup in Montenegro, the activity covered in the Mueller indictments, and the Skripal attack. Each presents it’s own examples of some subpar tradecraft and each has created substantive blowback. /2
As @jckichen has noted, tradecraft is not monolithic & should not be expected to applied equally/evenly throughout a given operation or across multiple operations. But I think these cases each had instances of subpar tradecraft that have since proven to be consequential. /3
In furtherance of the #counterintelligence discussion around the GRU and its competency, I want to address some recent reporting and analysis. Two articles - and one shared question - come to mind. /1
The 1st article takes the kind of argument I've made - the GRU has been sloppy resulting even successes generating some effects one would associate with qualified failures - and runs with it to the extreme. /2 bloomberg.com/view/articles/…
I have done my best to put as much nuance into my threads on this. I don't think so much that the GRU is incompetent (they have achieved numerous significant mission objectives) as that their tradecraft and OPSEC leaves much to desired, with that likely hurting them w/ Putin. /3
In today's edition of "The GRU don't need no stinkin' tradecraft", which is becoming a #counterintelligence tradition, we have the UK charging of the 2 GRU officers who carried out the Skripal attack. Here's the timeline assembled by Scotland Yard. /1 news.met.police.uk/news/counter-t…
This thread by @BBCDomC lays out the movements and footage described the Met in a very digestible thread. I highly recommend taking a look at it for reference alongside the Met's dry recitation of same. /2
The amount of detail and evidence the Met amassed about these officers' (Petrov & Boshirov) movements recalls the exposure of the Mossad operation that killed Mahmoud Al-Mabhouh in Dubai. This feels very much like that, which should embarrass the GRU. /3 spiegel.de/international/…
Active measures pivot: Microsoft indicates that the APT28/GRU has tried to spoof the websites of conservative think tanks known for advocating democracy promotion, examining corruption, and/or criticism of Trump. My #counterintelligence commentary /1 nytimes.com/2018/08/21/us/…
NYT has this right "The shift to attacking conservative think tanks underscores the Russian intelligence agency’s goals: to disrupt any institutions challenging Moscow and President Vladimir V. Putin of Russia." Russia doesn't care about our partisanship except to exploit it. /2
GRU needs to be doing something different to earn favor in the Kremlin right now. I recently explored how they are definitely not on Putin's good side these days (see included thread), and while this isn't "new" it is still a change of tact. /3
So I tried to make dankness while the sun shown about the newest sanctions that are going to hit Russia (delayed as they might be), but I'd like to take a moment to seriously address just how bad this all is for the GRU. #counterintelligence /1 nytimes.com/2018/08/09/wor…
The GRU's poor OPSEC has been a consistent driver among the naming-&-shaming and sanctions against Russia lately. Going all the way back to 2014, GRU - which has never been the most OPSEC conscious outfit - has been in the spotlight as Russia's primary meddling instrument. /2
Let's leave aside the ~2014 stuff about Crimea and Donbas because I have other work to do and focus on the more recent stuff. First, the identification of GRU as behind the Novichok attack in the UK was a double-edged sword for them. On one hand, it creates fear (Putin likey) /3