Last Friday, 23 August 2019, Zelimkhan Khangoshvili, a Georgian citizen living in Germany, was assassinated in downtown Berlin while having lunch on the way to a mosque for Friday prayer. Khangoshvili was assassinated with three bullets, two of them fired at close range at his head. The killer, who was hiding in the nearby bushes, rushed toward the victim on an electric bike and shot the victim — once in the shoulder and twice in the head — using a 9mm Glock 26 with an attached silencer. After speeding away from the crime scene for a few hundred meters along the Spree river, the assassin stopped and jettisoned the electric bike, a plastic bag with the murder weapon, and a wig he was using, into the river. In doing so he was observed by two teenagers who alerted the police. Their tips lead to the killer being caught a few minutes later, just as he was disappearing into a crowd of tourists – now sporting a clean-shaven head, a mustachioed face, a pink t-shirt, and a touristy pouch holding his passport and some cash suspended from his neck.

Media has reported that the suspect, who has so far been publicly referred to as Vadim S, 49, initially travelled by air from Moscow to Paris on a French-issued visa, before crossing into Germany six days before the murder. He has reportedly denied any involvement in the murder and has requested to meet Russian consular officials.

The victim was an ethnically Chechen Georgian citizen who had long been on the list of Moscow’s declared enemies. Having volunteered to fight against the central Russian armed forces in the second Chechen war in 1999-2002, he continued supporting Chechen separatists while based in his native Pankisi Valley in Georgia in the ensuing years. He also recruited and armed a volunteer unit to fight against Russia’s war in Georgia in 2008, although there is no evidence that his unit ever saw action before the war had ended. In 2012, Khangoshvili reportedly played the important role of mediator during the Lapota incident, when a group of armed Chechens took several people hostage in a remote mountain region of Georgia. Despite no evidence of Khangoshvili espousing Islamist ideology or supporting Islamist causes, Russia has repeatedly branded him as an Islamic terrorist threat. While fighting alongside Islamists during the early stage of the Second Chechen War, Khangoshvili was later known to be close to Aslan Maskhadov, the former Chechen president (killed in 2005) who was known as a moderate and nationalist rather than an Islamist.

At the time of his murder, Khangoshvili was awaiting the outcome of his appeal to deportation proceedings in Germany, where he sought political asylum with his family, having been the object of two assassination attempts in Georgia (the last one in May 2015 when he was shot in Tbilisi), and having received multiple threats while temporarily seeking refuge in Ukraine. Russia has officially disowned any link to the assassination attempts.

Photos posted on Khangoshvili’s Facebook profile. The left image was taken during the Second Chechen War and shows him together with Aslan Maskhadov, the last president of a de facto independent Chechnya

A joint investigation between Bellingcat, the German newspaper Der Spiegel, and The Insider (Russia), has established that the assassin travelled to Berlin via France under a validly issued, non-biometric Russian passport in the name of Vadim Andreevich Sokolov, born in August 1970. Despite the fact that he used a legitimate passport, we have determined that no such person exists in Russia’s sprawling, comprehensive national citizen database. In addition, no trace of such a person exists in a trove of hundreds of leaked residential databases, previously obtained and aggregated by Bellingcat. This discovery makes Russia’s claims that the killer is not connected to the Russian state implausible, as no person in Russia is in a position to obtain a valid Russian passport under a fake identity without the involvement of the state bureaucratic and security apparatus.

In addition, we have identified that the address given by the killer in his visa application as his residence in St. Petersburg does not exist. This glaring inconsistency, and the generally blank digital and data footprint of the Russian “ghost traveler” raises serious questions as to how and why he was able to obtain a multi-entry Schengen visa issued by the French consulate in Moscow.

A Phantom Tourist

Using the passport data from Sokolov’s visa application papers submitted in Russia and obtained by our team, we sought to identify the presence of this person in various Russian live and offline databases. We verified via two separate sources with direct access to the Russian Passport database that no person with the name Vadim Andreevich Sokolov and the birthdate used in his passport exists in that database.

Photograph of Vadim A. Sokolov from his visa application papers

The Russian Passport database is a centralized, comprehensive database containing residential address and passport data of all Russian citizens — including the full history of prior personal identity documents — maintained by Russia’s Ministry of Interior. Likewise, no presence of this person was found in another police-maintained database that tracks domestic and international travel of all Russian citizens, nor in the traffic police’s database of driving license owners. We have also searched hundreds of previously leaked offline passport, residential-address, insurance and employment databases, including ones with data as recent as 2018, and have found no evidence of a person with such personal data.

At the same time, for this man to have travelled via airplane from Moscow to Paris on an ordinary passport, he would have had to go through passport control, where his passport would have been scanned and automatically checked against the Russian Passport database. Any inconsistency — such as a missing record in that database — would have triggered the border officer’s alarm system, and the person would not have been authorized to proceed. There can be only two feasible scenarios that explain this inconsistency: either “Vadim Sokolov” was known to border officials as an undercover operative, and they were instructed to let him proceed, or alternatively, at the time of the trip — that is, on 31 July 2019 — Sokolov was still in the Russia Passport database.

Both scenarios are technically possible. The Russian immigration (border-control) system is supervised by the Federal Security Service (FSB), thus special arrangements could have been made for “Sokolov” to bypass the routine airport verification procedure, especially if the operative was FSB-linked.

Equally possible, and more consistent with prior practice, would be the second scenario, in which a cover identity was fully created for “Sokolov” — including a database entry in the Russian passport system — but was purged from Russian government databases shortly after news of the arrest in Berlin broke. In the case of Skripal-linked GRU officers previously identified by Bellingcat, the three undercover GRU operatives originally had dual presence in the Russia Passport database: both under their real and under their cover identity. Shortly after their public outing by Bellingcat, however, both their undercover and their true identities (including their immediate family members data) were purged from the Russian Passport and other government-run databases, creating several “ghost” families with no passport, residential ownership, or even tax information (in fact, apartments previously confirmed by us as owned by Col. Chepiga and Col. Mishkin, the main Skripal suspects, are now listed as owned by “the Russian state”).

Whether the first or the second scenario was used in the case of “Sokolov” might provide a clue as to which of the two main, and often competing, security services are linked to this brazen assassination operation. As outlined below, both agencies, the FSB and the GRU, would have felt entitled to pursue such an extrajudicial killing, albeit for different reasons.

What is certain, however, is that the cover identity behind “Vadim Sokolov” was created very recently, and was most likely custom-made for the specific operation in Berlin. This can be inferred from the absence of any digital footprint on this identity in previously leaked databases (for comparison, both “Boshirov” and “Petrov” — the cover identities behind the Skripal suspects — did show up in older offline databases). This conclusion is also consistent with the unusually recent date of issuance for “Sokolov”’s passport – 18 July 2019, only ten days before the planned trip. We have also verified — via sources with access to non-Russian airline booking databases — that a person with this name and birth date has not traveled to any European destination in the past 6 years, nor has obtained visas to any Schengen states. All of this implies either an ad-hoc operation following newly obtained information on the target’s whereabouts, or the use of a “single-use”, non-staff assassin. As discussed below, this latter hypothesis may prove true due to the certain peculiarities regarding the man now in German custody.

Passport Clues

In previous investigations, Bellingcat has identified batches of sequential passport numbers issued to GRU officers in different years. The passport number used for Sokolov’s passport cannot be matched against these batches, as it was issued only in July 2019, and we have no empirical data of other GRU officers with fresh passports. However these batches were all issued by the same Moscow “central” unit of the Federal Migration Service (now integrated into the Ministry of Interior) that apparently issued “Sokolov”s passport.

“Sokolov”’s number is also like the other GRU officers’ passports in another way: it is a passport of the “old” type — i.e. without embedded biometrical data. While in 2009 Russia introduced biometric passports, and they are the default choice when applying for a new travel document, “old-style” passports are issued upon request, usually in emergency situations when the applicant has no time to wait for the fingerprint encryption and printing process. All internationally active GRU officers identified by us thus far (numbering more than 20) and “Sokolov” opted for the old-style “paper” passport, most likely due to the risk of a clash between the undercover persona’s fingerprints with pre-existing fingerprint data of the real person. In “Sokolov”’s case, this may also have been the reason, or it may have been the unavoidable consequence of a rushed operation, as the lead time to receive a biometric passport is at least one week.

An Express Visa For a Ghost

Our joint investigating team was able to obtain most of the suspect’s passport data from a source with access to visa-linked documents submitted by “Vadim Sokolov” in Russia. The document shows that the suspect applied for an express visa at the French consulate in Moscow on 29 July 2019 — just 11 days after he received his non-biometric passport. He requested a multi-entry, 6-month visa, that would provide him with unlimited reentry access to any of the 26 countries of the Schengen area. Unusually, and boldly, he indicated that his planned date of travel is 30 July 2019 — literally the day after his visa application date. In addition, he indicated that he planned to stay in France for the maximum permitted 90-day period during his six-month visa, stating that he plans to travel in and out of France until 25 January 2020.

Despite such bold aspirations — the requested visa duration and reentry terms are the maximum that can be issued to a first time traveler, and the lead time to travel is unusually short — “Sokolov” had little to show in terms of a traceable background in Russia. His passport showed he was born in the Siberian city of Irkursk, but he indicated his place of residence as “Alpiyskaya Street 37” in Saint Petersburg. There is no “Alpiyskaya Street” in St. Petersburg, although there is an “Alpiyskiy Pereulok” (Alpiysky Lane), and at number 37 of that lane there are 3 upscale residential apartment building clusters, each cluster with a separate sub-address (corpus 1, 2 or 3) that would typically be stated in when providing an address.

Photograph of one of the three apartment-block clusters located at Alpiyskiy Lane in St. Petersburg as seen in Yandex Maps

The only place in the vicinity of St. Petersburg that does have an actual “Alpiyskaya Street” is a nearby town named Kudrovo, just outside the city limits. However, there is no number 37 on that street either.

Satellite view of Alpiyska Street in Kudrovo showing all house numbers

In his application, the suspect also listed his occupation as “senior company employee”, although the document reviewed by the investigating team did not contain the name of the company he claimed to be employed by. It is not clear if he provided the name of the company to the French consulate.

As a point of contact in France — which is a mandatory requirement for visa applicants from Russia — the suspect listed the name of the mid-range Practic hotel in Paris. As of press time, we have been unable to receive feedback from the hotel management as to whether they were in contact or aware of this person, or whether he used the hotel as an intended place of residence during his trip into France. A hotel receptionist, upon being shown a photograph of the suspect, said they had not seen this person at the hotel.

Given that the suspect does not have any digital or data footprint in Russia, listed an incomplete or false address and employment data, had a freshly issued passport, and had not travelled to Europe at least since 2013, it is puzzling that the French Ministry of Foreign Affairs, ultimately in charge of deciding on visa requests, decided to honour the application in full and issued the multi-entry visa with no detailed review and no waiting period. Bellingcat has previously reported on the nominally draconian, but empirically porous visa application system for Western Europe that has enabled Russian spies with fake identities and no data footprint to obtain multi-entry visas and unrestricted European travel for almost a decade.

An Unusual Suspect

The report on the detained suspect, according to German security sources interviewed by our joint team, describe him as 176 cm tall and weighing 86 kg. Notably, the report also states the suspect has three tattoos on his body: a crown and a panther on his upper left arm, and a snake on the lower right arm.

Vadim A. Sokolov, left an original image obtained in the course of the investigation, right a version of the same image with digital removed beard

The presence of tattoos on an assassin’s body is unusual in the context of a Russian security service operation. Russian security services do not permit their staff officers to thus decorate themselves. This suggests that the suspect is not a staff officer, or that he was permitted to have tattoos as part of a long-term embedded undercover operation. One possible explanation might be that the suspect was a former convict who was coopted by one of the secret services, as the style of the described tattoos is consistent with a special and severely “regulated” body decoration nomenclature known as “prison tattoos”. However, without further information or images of the tattoos — such as whether they are in monochrome or color — it would be impossible to assess if the suspect’s body art is of the “prison tattoo” variety.

It is not unprecedented for the Russian security services to resort to freelancers or even ex-convicts as assassins, as shown by at least two recent examples of (attempted) extraterritorial killings in Ukraine. In one case, an FSB-handled former drug-enforcement officer who had been indicted on corruption charges was sent to Ukraine to organize a car-bomb assassination of a member of Ukrainian military intelligence. In another, a Ukrainian prison official was recruited by Russia’s GRU to assassinate a former Ukrainian artillery officer who had advised Georgian military forces during the 2008 Russia-Georgian war. However, it would be a precedent for a Russian security service to use a freelancer in Western Europe.

Who Gave the Orders?

The complex past of the victim leads to possibilities that he may have been assassinated in an operation led by either of the FSB, the GRU or even Ramzan Kadyrov’s own security apparatus. Due to his involvement in the Russo-Chechen war, and the more recent qualification as an “Islamic threat”, he would have been in the cross-hairs of the FSB capture or kill list.

On the other hand, his involvement in the war and his support for Georgians in the Russian-Georgian war, would have made him a revenge-assassination target for the GRU, as paralleled by other assassinations of former armed-conflict adversaries from Russia’s near-abroad – which, in the eyes of the Russian military, is tantamount to treason. Separately, his Chechen background, and the fact that he sided with Aslan Mashadov during the Chechen war, would have pitted Khangoshvili against Ramzan Kadyrov’s clique.

Indeed, most of the assassinations of ethnic Chechens overseas in the last 10 years has been perpetrated by Chechen emissaries acting in the name of Kadyrov, sometimes — as in the case with the June 2017 assassination attempt on Ukrainian citizen Amina Okueva (who did not survive a follow-up assassination attempt that same year) in Kyiv — traveling under cover, non-Chechen identities.

Whatever the answer is, the access to a valid, Moscow-issued passport, and the immediate and comprehensive purging of the any data linked to the cover identity “Vadim Sokolov” is a clear indication of the state involvement in this extraterritorial assassination, similar in brazenness and lack of plausible deniability to the Skripal case.

Bellingcat and its investigative partners will continue to investigate this story, seeking to identify the actual identity of the person traveling under the “Sokolov” persona.