How prosecutors brought a Russian spy ring operating in the UK to justice
Six Bulgarians spied on prominent individuals and locations on behalf of Russia - this is how they were prosecuted
Between August 2020 and February 2023, a group of six Bulgarians used sophisticated methods to gather information about individuals and locations that were of interest to the Russian state.
Led by Orlin Roussev, the group carried out surveillance on prominent targets, at times using fake identities, and deployed advanced technology to acquire intelligence.
Orlin Roussev
Orlin Roussev
Roussev reported to a man named Jan Marsalek.
Marsalek - who is wanted in Germany and Austria over fraud and embezzlement offences after the collapse of the payments company Wirecard- acted as the intermediary for the Russian Intelligence Services and gave instructions to Roussev.
In turn, Roussev tasked his network of Bizer Dzhambazov, Ivan Stoyanov, Katrin Ivanova, Vanya Gaberova and Tihomir Ivanchev to carry out espionage on targets in the UK and across Europe.
This involved following people, including on flights, carrying out reconnaissance around significant buildings and feeding information back to others.
They compiled detailed reports on their targets and were paid handsomely for their work.
The prosecution’s case was based on a large body of evidence including extensive Telegram communications; evidence of travel; financial evidence; and numerous technical items found at their home addresses after they had been arrested.
The prosecution successfully proved that by conspiring to obtain information of this type, intended to be directly or indirectly useful to an enemy, the group acted with a purpose which was prejudicial to the safety or interests of the UK.
By carrying out these activities, orchestrated on UK soil, for the benefit of Russia, their activities prejudiced the safety and interests of the UK.
Operatives
Bizer Dzhambazov
Dzhambazov was Orlin Roussev's second-in-command and pleaded guilty to conspiracy to spy.
Katrin Ivanova
Ivanova was in a relationship with Dzhambazov and the pair were living together at an address in Harrow, Middlesex. She was found guilty of conspiracy to spy and possessing identity documents with improper intention in relation to fake passports and ID cards.
Vanya Gaberova
Gaberova worked as a beautician and also had a relationship with Dzhambazov. She lived in Churchway, north-west London. She was found guilty of conspiracy to spy.
Tihomir Ivanchev
Ivanchev lived in Enfield, north London, and was historically in a relationship with Gaberova. He was found guilty of conspiracy to spy.
Ivan Stoyanov
Stoyanov was a mixed martial-arts fighter, and lived in Greenford, west London. He pleaded guilty to spying.
The group used a series of false identity documents for their operations. These included pretending to be accredited members of the media and photographers as well as law enforcement and health workers.
On one operation, Roussev boasted to Marsalek that they had many different uniforms to gain entrance into a building, such as "DHL...Uber...Deliveroo...Just Eat...Pizza Express...all different outfits... and the ambulance of course".
An ID card printer and associated software was found at Roussev's home address. The manufacturers confirmed that the printer is used by companies to produce identity documents and a user manual could be downloaded online.
Police seized false Discovery Channel and National Geographic passes.
Also found were National Geographic uniforms.
When Roussev's base at a former guesthouse in Great Yarmouth, Norfolk, was raided, police found what was described as an 'Aladdin's Cave' of espionage equipment.
A wealth of spy cameras, hidden in items such sunglasses, ties, stuffed toys, pens, a car key and purses, were discovered as well as wi-fi and GPS jammers, listening bug detectors, eavesdropping technology and GPS trackers for cars.
In total, police seized the following equipment from the addresses of the operatives:
- 221 mobile phones
- 258 hard drives / digital storage devices;
- 495 SIM cards
- 33 audio recording devices
- 55 visual recording devices
- 11 drones
- 16 radios
- 3 IMSI grabbers
- 4 Pineapple Wi-Fi eavesdropping devices
- 6 Raspberry Pi programming devices
- 110 miscellaneous digital items including jammers, cyber exploitation hardware, hacking software, RFID card readers/writers, and GPS trackers
- 91 bank and other financial institution cards, including 17 in other individuals’ names
- 75 passports / identity documents, including 55 in other individuals’ names.
Prosecutors focused on six key operations carried out by the group. Not all of the team were involved in all of the operations, but each individual played a role in at least two of the operations.
Operation 1
Christo Grozev, a Bulgarian investigative journalist, was targeted by the group on various occasions from December 2020 up to January 2023. Mr Grozev worked for the Bellingcat group and as the lead investigator on Russian affairs, he won awards for his work, including uncovering Russian links to the 2018 Salisbury attack. As a result of his activities, he was placed on the wanted list by the Russian Interior Ministry.
The operation spying on Mr Grozev was conducted by Roussev, Dzhambazov, Gaberova, Ivanova and Ivanchev. They followed Mr Grozev to different countries, including Austria, Montenegro and Spain and created a number of reports for their Russian clients which set out his movements and provided information about his accommodation, his vehicle and his contacts. It appears that the group also considered a potential ‘honeytrap’ plot, using Gaberova to target him.
Operation 2
Roman Dobrokhotov, a Russian who resides in the UK, was targeted in November 2022. He is an investigative journalist and founder/editor in-chief of the media outlet The Insider, which focuses on Russia and was previously based in the country. Mr Dobrokhotov had to flee Russia, having been arrested and then deprived of his passport.
The operation spying on Mr Dobrokhotov was carried out by Roussev, Dzhambazov and Ivanova. The surveillance included following him around Europe, with Ivanova sitting next to him on one flight from Budapest to Berlin. A kidnap plot was also discussed but messages revealed that it was deemed too dangerous.
Operation 3
Former Kazakhstan politician Bergey Ryskaliyev was targeted in November 2021, having sought asylum in the United Kingdom.
The operation spying on Mr Ryskaliyev was carried out by Roussev, Dzhambazov, Stoyanov and Gaberova. The surveillance included staking out locations thought to be linked to Mr Ryskaliyev and exploring ways of accessing those addresses. Stoyanov was filmed by two of Mr Ryskaliyev’s assistants as he conducted surveillance in a parked car outside Mr Ryskaliyev’s residence in London. When challenged by them he provided a cover story about working for a nearby hospital, later supporting this lie by displaying an NHS sign in his vehicle.
Operation 4
The group also planned disruptive activity at the Kazakh Embassy in September 2022, including spraying the building with large quantities of fake pig’s blood. The plan was to create a false opposition group and stage a demonstration outside the embassy, before feeding ‘intelligence’ about the group to the Kazakh Intelligence Services, via their Russian counterparts.
The aim of the operation was to increase the standing of their Russian clients in the eyes of the Kazakhs, for the benefit of Russia. The operation was conducted by Roussev, Dzhambazov, Stoyanov and Ivanova.
Operation 5
Surveillance at a US military base in Stuttgart, was undertaken from late 2022 until the point of the group’s arrests in February 2023. The group believed the base to be a location where Ukrainian forces were being trained in the use of surface to air weapons, used by Ukraine to oppose the Russian invasion of that country.
The plan was to target the base using a range of sophisticated technology designed to capture key intelligence about those present on the base which could then be used to locate Ukrainian military personnel when they returned to their own country. The operation was carried out by Roussev, Dzhambazov and Ivanova. Surveillance images and videos of the base were recovered from devices along with general descriptions of security at the base. A car that was recovered had been adapted to house and deploy technical surveillance devices outside the base.
Operation 6
Kirill Kachur was targeted from September 2021 to 2022. Mr Kachur is a Russian who spent time in Montenegro in late 2021 and 2022. He was employed by the Investigative Committee of Russia but left the country in 2021 and was charged in absentia with embezzlement by Russia in November 2022, making him an obvious source of interest for Russia.
The operation was conducted by every member of the group. A surveillance report was conducted using drones and a kidnapping plan was discussed. The operation included the renting of a villa near to Mr Kachur’s location for 5,000 Euros per month and members of the group liaising directly with officers of the Russian Intelligence Service on the ground.
Building the case: how do you prove spying?
The prosecution’s case was based on a large body of evidence including extensive Telegram communications; evidence of travel; financial evidence; and numerous technical items found at their home addresses after they had been arrested. The latter included an extensive collection of covert surveillance devices concealed in everyday objects such as a fake water bottles, rocks, children’s toys, lighters and car keys as well as a number of pairs of glasses capable of recording both audio and visual footage. The use of which was evidenced in the operations.
The ability of the group to rely on technology is important as none of them could have been in any doubt that they were engaged in serious espionage activity. They did not simply follow people around in the hope of finding out something useful. They conducted targeted, organised activity using sophisticated methodology.
It was clear that the activity was for the benefit of Russia, not just from the choice of targets but also from the nature of the Telegram messages that were exchanged between members of the group. Discussions included:
- The facilitation of obtaining military equipment on behalf of Russia.
- The provision of espionage tools /data (digital devices, software, and manuals to assist with hacking/communication interception).
- Arranging physical surveillance and hostile activity against targets of the Russian state.
- Frequent references were also made to the FSB (Federal Security Service of Russia), the GRU (Main Directorate of the General Staff of the Armed Forces of Russia), and President Putin.
In order to be guilty of this offending, the defendants did not have to share a pro-Russian ideology, or support Vladamir Putin.
They simply had to join an agreement to obtain or communicate information, intending that the information that was obtained or communicated would be directly or indirectly useful to Russia. It was agreed that objectively, their actions were, or would have been, prejudicial to the safety or interests of the United Kingdom.
Frank Ferguson, Head of the CPS Special Crime and Counter Terrorism Division, said: “This was a high-level espionage operation with significant financial rewards for those involved in the spy ring.
“The group acted together, under the leadership of Orlin Roussev, to spy on prominent individuals and locations on behalf of Russia using sophisticated methods.
“The police raid on Roussev’s home revealed a spy factory, with a wide-ranging degree of gadgets and technology with one clear purpose – to obtain information.
“By targeting individuals in the UK fleeing persecution as well as journalists opposing the Russian regime, the group undermined the message that the UK is a safe country for those people.
“This prolonged activity also undermined the security and safety of the UK; and there can be no doubt that each of the defendants knew exactly who they were spying for.
“The Crown Prosecution Service worked very closely with the Metropolitan Police’s Counter Terrorism Command in building this case and these convictions send a very clear message that this type of offending will not be tolerated on UK soil.”
“The Crown Prosecution Service worked very closely with the Metropolitan Police’s Counter Terrorism Command in building this case and these convictions send a very clear message that this type of offending will not be tolerated on UK soil.”
- Frank Ferguson -
Built with Shorthand