Андрей Солдатов - The Red Web - The Struggle Between Russia's Digital Dictators and the New Online Revolutionaries

Stoyanov also took pains to cultivate his contacts with Western counterparts—not only American but also German, British, and Dutch law enforcement agencies, among others. Russian hackers tended to live in Russia, but their hacking fingerprints existed globally.

Stoyanov’s patriotic feelings didn’t prevent him from traveling abroad. Travel was important to his sense of self-esteem—a former major of the Russian police, he could go to the United States and talk with American cyber experts as an equal about fascinating things.

In the fall of 2016 Stoyanov, now in his late thirties, had a special reason to be proud of himself: he had helped collect evidence for Russia’s biggest-ever crackdown on financial hackers, involving the arrest of fifty members of a cyber crime ring known as Lurk that had stolen more than 3 billion rubles ($45 million) from banks in Russia and abroad. Stoyanov’s unit had been investigating the group’s activities for years, and a joint operation with the FSB and the Interior Ministry had finally resulted in arrests. [46] Kevin Townsend, “50 Hackers Using Lurk Banking Trojan Arrested in Russia,” SecurityWeek , June 2, 2016. See also “Legitimate Remote Access Software Used to Propagate Lurk Gang Trojan,” Kaspersky, July 22, 2016, http://newsroom.kaspersky.eu/en/texts/detail/article/legitimate-remote-access-software-used-to-propagate-lurk-gang-trojan/?no_cache=1&cHash=d808f9064aef2d900856a29ef49c734d .

Stoyanov knew just about everyone in the murky world of cyber, and he seemed indispensable for Kaspersky and the secret services. But as the winter of 2016 fell on Moscow, the city’s paranoid atmosphere turned Stoyanov’s assets into his biggest liability. In short, Stoyanov and his friends knew too much about the Russian digital underground and its intricate and complicated connections with the secret services. They also had contacts in the West. Thus, they were a vulnerability.

On December 4, a Sunday, the operatives of the FSB went after Stoyanov. He was arrested in the airport on his way to China. Stoyanov’s wife and colleagues at Kaspersky learned of his arrest only after he failed to get online when his plane landed the next day. Mikhailov and his subordinate, Dmitry Dokuchaev, once known by the hacker alias Forb, were also seized by the FSB. (A few months later it turned out that Dokuchaev was the only confirmed connection between criminal hackers and the Russian secret services engaged in offensive operations in the United States—in March 2017 the FBI identified Dokuchaev as a member of a group that had hacked Yahoo in 2014. [47] Four people were arrested on December 4, 2016: Ruslan Stoyanov, Sergei Mikhailov, his subordinate Dmitry Dokuchaev, and Georgy Fomchenkov, who was reportedly involved in some controversial business activities online. In March 2017 the US Justice Department alleged that Dokuchaev had conspired with, among others, known and unknown FSB officers to protect, direct, facilitate, and pay criminal hackers to gain unauthorized access to the computer networks and user accounts hosted at major companies providing worldwide webmail and Internet-related services (i.e., Yahoo) from at least January 2014. Dokuchaev is wanted by the FBI. See for details, see Jack Stubbs and Svetlana Reiter, “Treason Charges Against Russian Cyber Experts Linked to Seven-Year-Accusations,” Reuters , February 26, 2017, http://uk.reuters.com/article/uk-russia-cyber-insight-idUKKBN1650M8 ; and Ellen Nakashima, “Justice Department Charging Russian Spies and Criminal Hackers in Yahoo Intrusion,” Washington Post , March 15, 2017, www.washingtonpost.com/world/national-security/justice-department-charging-russian-spies-and-criminal-hackers-for-yahoo-intrusion/2017/03/15/64b98e32–0911–11e7–93dc-00f9bdd74ed1_story.html . )

The FSB charged Stoyanov, Mikhailov, and Dokuchaev with state treason and threw them into the Lefortovo Prison. Lefortovo is Russia’s closest equivalent to Dumas’s Château d’If. It is entirely isolated, with tough and effective guards, and unauthorized contacts are completely impossible. Although there are always ways to communicate with the outside world in other Russian prisons, Lefortovo is an exception. Its guards make every effort to prevent inmates from seeing one another. When escorting prisoners guards use little clackers—a circular piece of metal—or snap their fingers to make their presence known to the other guards. If two escorts meet, one puts his charge into one of many wooden cabinets lining Lefortovo’s corridors. This has been the practice since Tsarist times.

Most cells house two people, and as a rule a newcomer is placed with an undercover FSB agent as his inmate for several months—to spy on him constantly inside the cell.

Stoyanov, Mikhailov, and Dokuchaev were locked up and safely secured. The FSB also worked on their relatives and colleagues—the information about the arrests remained secret to the public until the next year.

In January Sergey Buravlyov, the FSB general at the Russian end of the cyber hotline with the Americans in 2016, was quietly removed from the Security Council. Contrary to all Kremlin rules, no public announcement was made about his resignation.

With that, all the doors to the information about the Russian cyber operations were shut and sealed.

Or were they?

In April 2017 Stoyanov managed to smuggle a letter out of Lefortovo. In the first sentence Stoyanov asks the question on everyone’s mind: “Why me?” He explains that he is “one of the people who fought cybercrime for the last 17 years… but the paradigm in cybercrime has changed. Now cybercrime is closely connected with geopolitics. That’s why [cybercriminals] could unleash the full power of the government against an expert like me. And that’s why I was prosecuted.” Stoyanov clearly believes that there is a connection between the Kremlin and hackers.

Vladimir Putin built a fortress out of the Russian government—impenetrable and suspicious, with dead-ends and trap pits to trick the enemy and protected by thousands of guards and secret agents. Here decisions are made for unclear reasons, and there is almost no way for outsiders to understand what’s going on. The officials behind the Kremlin walls accept by definition that the environment outside is hostile, so why tell the truth when it’s more practical to lie and thus surprise the enemy? The Kremlin adopted this logic years ago. This is why understanding what actually happened in 2016 is so tricky.

The Russian hackers did not compromise polling stations, nor did they affect the critical infrastructure of the United States during the presidential campaign. Donald Trump found himself in the White House for a number of very serious reasons, most of them originating in the United States, not from abroad.

Yet there was something the Kremlin did foster in the political culture of America, something that was all too familiar to Russian—and, before them, Soviet—citizens. The Soviet officials never trusted the people. They strongly believed that any Russian citizen at any moment could spontaneously go mad or get drunk, crush the equipment in the workplace or come into contact with a suspicious foreigner and expose state secrets. In short, the authorities wholeheartedly despised the people they governed. The people are unreliable and, thus, needed to be managed and kept under control. That’s why every Soviet citizen was limited in his or her travels and contacts and entangled in hundreds of instructions, all with the goal of preventing him or her from doing anything unauthorized. And there was always someone behind the next door—a party official or a KGB officer—to be asked for permission.

The KGB believed in the same theory, but it went deeper. They were trained to think that every person was driven only by baser, inferior motives. When confronting Soviet dissidents, they looked for money, dirty family secrets, or madness, as they couldn’t accept for a second that someone could challenge the political system simply because they believed in their cause.