Bulgarian trio convicted of conspiring to spy for Russia

Three members of a Russian spy ring who carried out espionage activity on British and European soil over three years have been convicted.

Katrin Ivanova, 33, Vanya Gaberova, 30, and Tihomir Ivanchev, 39, were today found guilty of conspiracy to spy at the Central Criminal Court following a trial.

Ivanova was also found guilty of possessing identity documents with improper intention in relation to fake passports and ID cards.

Three further members of the spy ring, Orlin Roussev, 47, Bizer Dzhambazov, 43, and Ivan Stoyanov, 32, previously pleaded guilty to spying offences.  

The team, who are all Bulgarian nationals, worked under the direction of Roussev, and were tasked with gathering information about prominent individuals – and significant locations – that were of interest to the Russian state.

Between August 2020 and February 2023, the group used sophisticated methods to carry out their surveillance, including manufacturing and using fake identities, making and adapting covert recording devices and deploying advanced technology to acquire information.

They compiled detailed reports on their targets and were paid significant sums of money for their work.

Roussev received his instructions from Jan Marsalek, who was acting as the intermediary for the Russian Intelligence Services.

Recovered messages show that Roussev tasked his network of Dzhambazov, Ivanova, Stoyanov, Gaberova, and Ivanchev to gather intelligence as a team, with a view to that information being passed to the Russian authorities via Mr Marsalek.

Frank Ferguson, Head of the CPS Special Crime and Counter Terrorism Division, said: “This was a high-level espionage operation with significant financial rewards for those involved in the spy ring.

“The group acted together, under the leadership of Orlin Roussev, to spy on prominent individuals and locations on behalf of Russia using sophisticated methods.

“The police raid on Roussev’s home revealed a spy factory, with a wide-ranging degree of gadgets and technology with one clear purpose – to obtain information.

“By targeting individuals in the UK fleeing persecution as well as journalists opposing the Russian regime, the group undermined the message that the UK is a safe country for those people.

“This prolonged activity also undermined the security and safety of the UK; and there can be no doubt that each of the defendants knew exactly who they were spying for.

“The Crown Prosecution Service worked very closely with the Metropolitan Police’s Counter Terrorism Command, and other key partners, in building this case and today’s convictions send a very clear message that this type of offending will not be tolerated on UK soil.”

The Operations

The group engaged in a number of operations with the prosecution focusing on six. Not all of the team were involved in all of the operations, but each individual played a role in at least two.

Operation 1

Christo Grozev, a Bulgarian investigative journalist, was targeted by the group on various occasions from December 2020 up to January 2023. Mr Grozev worked for the Bellingcat group and as the lead investigator on Russian affairs, he won awards for his work, including uncovering Russian links to the 2018 Salisbury attack. As a result of his activities, he was placed on the wanted list by the Russian Interior Ministry.

The operation spying on Mr Grozev was conducted by Roussev, Dzhambazov, Gaberova, Ivanova and Ivanchev. They followed Mr Grozev to different countries, including Austria, Montenegro and Spain and created a number of reports for their Russian clients which set out his movements and provided information about his accommodation, his vehicle and his contacts. It appears that the group also considered a potential ‘honeytrap’ plot, using Gaberova to target him.

Operation 2

Roman Dobrokhotov, a Russian who resides in the UK, was targeted in November 2022. He is an investigative journalist and founder/editor in-chief of the media outlet The Insider, which focuses on Russia and was previously based in the country. Mr Dobrokhotov had to flee Russia, having been arrested and then deprived of his passport.

The operation spying on Mr Dobrokhotov was carried out by Roussev, Dzhambazov and Ivanova. The surveillance included following him around Europe, with Ivanova sitting next to him on one flight from Budapest to Berlin.  A kidnap plot was also discussed but messages revealed that it was deemed too dangerous.

Operation 3

Former Kazakhstan politician Bergey Ryskaliyev was targeted in November 2021, having sought asylum in the United Kingdom.

The operation spying on Mr Ryskaliyev was carried out by Roussev, Dzhambazov, Stoyanov and Gaberova. The surveillance included staking out locations thought to be linked to Mr Ryskaliyev and exploring ways of accessing those addresses. Stoyanov was filmed by two of Mr Ryskaliyev’s assistants as he conducted surveillance in a parked car outside Mr Ryskaliyev’s residence in London. When challenged by them he provided a cover story about working for a nearby hospital, later supporting this lie by displaying an NHS sign in his vehicle.

Operation 4    

The group also planned disruptive activity at the Kazakh Embassy in September 2022, including spraying the building with large quantities of fake pig’s blood. The plan was to create a false opposition group and stage a demonstration outside the embassy, before feeding ‘intelligence’ about the group to the Kazakh Intelligence Services, via their Russian counterparts.

The aim of the operation was to increase the standing of their Russian clients in the eyes of the Kazakhs, for the benefit of Russia. The operation was conducted by Roussev, Dzhambazov, Stoyanov and Ivanova.

Operation 5

Surveillance at a US military base in Stuttgart, was undertaken from late 2022 until the point of the group’s arrests in February 2023.  The group believed the base to be a location where Ukrainian forces were being trained in the use of surface to air weapons, used by Ukraine to oppose the Russian invasion of that country.

The plan was to target the base using a range of sophisticated technology designed to capture key intelligence about those present on the base which could then be used to locate Ukrainian military personnel when they returned to their own country. The operation was carried out by Roussev, Dzhambazov and Ivanova. Surveillance images and videos of the base were recovered from devices along with general descriptions of security at the base. A car that was recovered had been adapted to house and deploy technical surveillance devices outside the base.

Operation 6

Kirill Kachur was targeted from September 2021 to 2022. Mr Kachur is a Russian who spent time in Montenegro in late 2021 and 2022. He was employed by the Investigative Committee of Russia but left the country in 2021 and was charged in absentia with embezzlement by Russia in November 2022, making him an obvious source of interest for Russia.

The operation was conducted by every member of the group. A surveillance report was conducted using drones and a kidnapping plan was discussed. The operation included the renting of a villa near to Mr Kachur’s location for 5,000 Euros per month and members of the group liaising directly with officers of the Russian Intelligence Service on the ground.

Building the case: How do you prove spying?

The prosecution’s case was based on a large body of evidence including extensive Telegram communications; evidence of travel; financial evidence; and numerous technical items found at their home addresses after they had been arrested. The latter included an extensive collection of covert surveillance devices concealed in everyday objects such as a fake water bottles, rocks, children’s toys, lighters and car keys as well as a number of pairs of glasses capable of recording both audio and visual footage. The use of which was evidenced in the operations.The ability of the group to rely on technology is important as none of them could have been in any doubt that they were engaged in serious espionage activity. They did not simply follow people around in the hope of finding out something useful. They conducted targeted, organised activity using sophisticated methodology.

It was clear that the activity was for the benefit of Russia, not just from the choice of targets but also from the nature of the Telegram messages that were exchanged between members of the group. Discussions included:

• The facilitation of obtaining military equipment on behalf of Russia
• The provision of espionage tools /data (digital devices, software, and manuals to assist with hacking /communication interception)
• Arranging physical surveillance and hostile activity against targets of the Russian state
• Frequent references were also made to the FSB (Federal Security Service of Russia), the GRU (Main Directorate of the General Staff of the Armed Forces of Russia), and President Putin.

In order to be guilty of this offending, the defendants did not have to share a pro-Russian ideology, or support Vladamir Putin.

They simply had to join an agreement to obtain or communicate information, intending that the information that was obtained or communicated would be directly or indirectly useful to Russia. It was agreed that objectively, their actions were, or would have been, prejudicial to the safety or interests of the United Kingdom.

All six defendants will be sentenced at the Central Criminal Court at a later date.