Thread by @CCDHWatch

Today, two men were convicted at the Old Bailey for the May 2025 arsons targeting properties linked to Keir Starmer.
🇷🇺The media is screaming "Russian state sabotage".
A clinical OSINT analysis reveals something much darker: a sophisticated kompromat network, a lethal cleanup operation, and a manufactured catalyst for state censorship.
cps.gov.uk/cps/news/two-m…

Roman Lavrynovych and Stanislav Carpiuc were convicted today, while Petro Pochynok was cleared.
The press claims they were elite Russian agents.
Yet, Met Police Counter Terrorism Commander Helen Flanagan explicitly stated there is zero evidence of state backing. The motive was purely financial; Lavrynovych acted for crypto to pay medical bills.
news.met.police.uk/news/two-men-c…

Court transcripts revealed that Lavrynovych did not even know who Keir Starmer was at the time of the fires.
He explicitly testified to detectives that he held no ideological motive and felt severely threatened by the handler, stating he acted out of fear for the safety of his grandmother with whom he lived in London.
theguardian.com/uk-news/2026/j…

The tradecraft was intentionally atrocious. 🕵️

🔴The proxies targeted a Toyota RAV4 that Starmer had already sold.

🔴They bought white spirit on B&Q CCTV.

🔴They were paid via a transparent Tether blockchain trail.

🔴They were deployed to fail loudly and leave a massive digital footprint for authorities to easily trace.

Why such sloppy target selection?
Court disclosures showed the properties struck were merely managed by a company of which Starmer was formerly a director, and an address where his sister-in-law resided.
The operatives relied on wildly outdated public registers, contradicting the narrative of an elite military operation tracking a sitting leader.
tvpworld.com/93818083/ukrai…

Former MP Andrew Bridgen blew the whistle in August 2025. 😮‍💨
The convicted men were using fitness modelling profiles and Grindr to operate a digital honeytrap.
They gathered kompromat on senior Labour figures, feeding the files directly to Ukrainian political fixer Andriy Portnov in Spain.

When the quiet blackmail failed to shift UK policy, the network escalated.
The arsons were not a military strike; they were a kinetic warning delivered to the Prime Minister's perimeter.
It was a clear message: we have your data, and we can bypass your security.
ft.com/content/dd79d6…

The timeline completely destroys the state's "random digital proxy" narrative.
On 21 May 2025—literally hours after Petro Pochynok was formally processed under the London conspiracy banner at Westminster Magistrates’ Court—a professional execution squad struck in Spain.
A Mercedes pulled up outside the American School in the affluent Madrid suburb of Pozuelo de Alarcón. Andriy Portnov, 51, stepped out to drop off his daughters.
Within seconds, three to five masked men advanced and shot him five times: four in the chest, one in the head. He died on the pavement before an ambulance could arrive.
aljazeera.com/news/2025/5/21…

Portnov was no ordinary exile.
As the former deputy head of Viktor Yanukovych’s administration, he was a master political fixer who held deep contacts within both the Kremlin and Volodymyr Zelensky’s inner circle.
Whistleblower Andrew Bridgen exposed the structural truth: the London arsonists were low-level assets operating a location-app honeytrap to gather kompromat on senior Labour figures, routing everything to Portnov in Madrid.
The moment the London proxies were arrested and British counter-terrorism police began bypassing their device encryption, Portnov transformed into the single point of failure who could explicitly unmask the top of the chain.
He was eliminated to permanently sever the physical line of attribution.

How was Portnov tracked so precisely in a wealthy, heavily surveyed Madrid suburb?
Executing a daylight hit requires real-time encrypted device geolocation data.
If the suspect in Spanish custody connects to official security services, it proves a state-sanctioned liquidation was deployed to sever his intelligence connections before a Western cross-examination.

rferl.org/a/ukraine-who-…

Why is the mainstream press running with the Russia narrative completely unquestioned?
The BBC placed Olga Malchevska on the Old Bailey beat.
Her unparalleled emotional authority completely insulates the reporting from public scepticism, providing the perfect psychological cover for the state.

By utilising a high-profile Ukrainian journalist with deep personal stakes, the state creates an information-laundering pipeline. Unverified assertions from Senior Investigator Vitaliy Sova's unit in Kyiv are smoothly transformed into authoritative "public record" via the BBC, completely shielding the underlying intelligence gaps.
instagram.com/olga_malchevsk…
x.com/BBC_Olga_M

The mainstream media immediately pinned handler "El Money" on 23-year-old Russian diplomat Evgeny Lyukshin to lock down absolute Russian state attribution.
Yet look at the actual text of the BBC's report: they explicitly admit, "We do not know for sure if Evgeny Lyukshin is EL."

Reuters also reported :
🔴🇷🇺"NO EVIDENCE OF RUSSIAN STATE-BACKED THREAT AT THE MOMENT" reuters.com/world/europe/u…

bbc.co.uk/news/articles/…

The Lyukshin attribution relies entirely on superficial pattern-matching, shared initials, and open-source guesswork.
There is no declassified intercept, no financial transaction, and no forensic proof linking him to the London arsonists.
It is a highly convenient manufactured profile and he is not EL MONEY.

🔴Who actually controlled the digital server infrastructure of the "Direct Action UK" Telegram group where the handler operated?

If the hosting logs trace back to Western corporate cybersecurity contractors, it proves the platform was a pre-existing domestic honeypot allowed to run hot.

Maybe we should ask the NCSC to do their job properly? ncsc.gov.uk

Lavrynovych testified under oath that he was working on an ordinary construction site when he was first approached.
The contact did not happen in a hidden deep-web cell; it occurred on an open public Telegram board used day-to-day by Ukrainian refugees to find casual construction labor in London.
The handler simply combed public boards for economically vulnerable marks.
straitstimes.com/world/europe/a…

Were the Grindr and modelling profiles of these Ukrainian nationals being algorithmically flagged by automated "threat-scoring" systems prior to the arson attacks?
If private intelligence firms were monitoring these specific nodes beforehand, the proxies were inside a closed, managed loop long before they ever lit a match.
Ofcom have "Closely Monitored" social media in the recent Belfast Unrest. Why don't they use those skills and apply them to the modelling profiles on Grindr?
digit.fyi/ofcom-closely-…

Who was parsing this digital profile data before the match was even lit?
Corporate registry filings show private intelligence firms like Horus Security Consultancy utilise proprietary AI tools to harvest vast internet data streams for horizon scanning.
libertyinvestigates.org.uk/articles/briti…

Firms like Adarga provide advanced data-fusion platforms to UK defence. Alongside state-supported units like Tech Against Terrorism, these networks ensure location-app telemetry is continually fed directly into Home Office analytics long before any official court trial begins.

Why the loud failure?
It was a controlled catalyst.
Omidyar-funded NGOs like HOPE not hate and TELL MAMA instantly weaponised the Telegram chat logs. They used the panic to lobby Ofcom and push the Online Safety Act (which they funded), demanding the total destruction of end-to-end encryption in the UK.
gov.uk/guidance/a-gui…

The BBC's media assets and narrative framing were heavily assembled and waiting for deployment well before the forensic phone extractions were completed.
The entire media presentation acted as a pre-baked asset, held in reserve until the exact day of the criminal conviction.
publications.parliament.uk/pa/cm5901/cmse…

The exact synchronisation between London's digital forensics and Madrid's kinetic execution exposes the total inter-state mapping of this operation.
From the arsons on May 12, to phone seizures on May 14, charges on May 20, and Portnov's execution on May 21, the attribution chain was systematically severed.

This broadcast provides direct on-the-scene video reporting and footage of the cordoned-off Mercedes outside the school gates in Madrid, anchoring the reality of the physical elimination that took place right as the London legal machinery spun up.

youtube.com/watch?v=zaz3wD…

The true danger of the Starmer arson narrative lies in the deliberate friction between the public theatre and the forensic reality. We are left with a massive analytical paradox: a low-level, coerced labourer trawled from an open construction board, directed by outdated public records, utilizing un-mixed public crypto tokens, and caught immediately because the operation was designed for them to fail loudly.

If this was truly an elite, hostile foreign intelligence operation targeting a Western G7 leader, why did the perpetrators rely on basic, public internet records that any low-level fraudster could find?

Or is the reality far more unsettling: was a highly visible, easily solvable "foreign threat" intentionally allowed to activate on British soil because the resulting geopolitical panic provided the exact legal levers needed to finally demolish end-to-end user encryption under the banner of national security?
#OnlineSafetyAct
#E2EE
#DigitalBlackmail
#EncryptedMessaging
#OSINT
#TetherTrail
#GrindrEspionage

@threadreaderapp unroll please.