Thread by @bellingcat

We worked with @BBCNewsnight on a new investigation into Denis Sergey ("Sergey Fedotov"), a GRU officer who coordinated the operation to poison Skripal with his colleagues Alexander Mishkin and Anatoliy Chepiga. We'll summarize our findings in this thread.

Bellingcat obtained telephone metadata records for Sergeev from a whistleblower working at a Russian mobile operator, who was convinced s/he was not breaching any data privacy laws due to the fact that the registered person for this number (“Sergey Fedotov”) doesn't really exist.

This heatmap shows the activities of "Sergey Fedotov" (real name Denis Sergeev) in Moscow throughout 2018 from his telecom data. The hotspots of this supposed private citizen include GRU headquarters at Khoroshevskoe Shosse 67B, and the GRU Academy at Narodnoe Opolchenie 50.

On 1 March 2018, the hero of our story, Denis Sergeev, booked a flight to London while working from home. On March 4th, Sergei Skripal and his daughter were poisoned.

He bought this ticket under the name of his cover identity, "Sergey Fedotov", who supposedly worked as a department manager of a courier service (actually a GRU front company). He had to book the ticket himself and used a travel agency to get a ticket for the next morning.

The next morning, Sergeev/Fedotov got to Sheremetyevo airport at 6am. While waiting for his (delayed) flight, Sergeev got a call from an "Amir", with whom he spoke for a few minutes. He talked a *lot* with "Amir" over the next few days.

If you're curious, here's the GetContact profile for "Amir". He's an important character in this affair.

Sergeev/Fedotov got into Heathrow at 10:33am local time , then went from Terminal 4 to downtown London. He got to his hotel, near Paddington Station, a bit after noon. Here's a map showing his movement based on his telecom data. The number shows the number of connections.

He apparently splurged for a taxi instead of taking the underground, as we can see with the trajectory of the route and the fact that he didn't lose service much during his ride.

Sergeev/Fedotov stayed in London for two days, but barely left his hotel at all. He spent almost the whole trip in his hotel room on his phone, using 3G/4G connections (over 1GB of data in 48 hours, apparently not trusting the hotel WiFi).

Throughout the trip, Sergeev/Fedotov only called and received calls from one number -- "Amir" from Moscow, with whom he spoke 11 times in two days. This is a very strange number -- best to copy/paste the text from our upcoming article to explain why.

On March 3, the day before the Skripal poisoning, Sergeev left his hotel room (per his telecom data) by Oxford circus and the west bank of the Thames between 11:30am and 1:30pm.
Not coincidentally, Chepiga and Mishkin left for Salisbury in the same area at 12:50pm.

On the day of the poisoning, Sergeev talked again with "Amir" in the morning. At 10:20am -- the exact same time that Chepiga / Mishkin were leaving London again for Salisbury -- Sergeev either sent or received an 8mb file. 20 minutes later, he called Amir, and left for Heathrow.

While all of this telecom data can't tell us everything that happened in the lead-up to the Skripal poisoning, everything it shows us is consistent with what we already know -- Denis Sergeev ("Sergey Fedotov") is a high-ranking GRU officer involved with the Skripal poisonings.

Next week, @christogrozev will be talking more about this investigation and the data we used to come to our conclusions at the #CIJSummer Investigative Journalism Conference in London
tcij.org/summer-confere…

You can read the full investigation here on our site: bellingcat.com/news/uk-and-eu…

And, of course, our investigative partner @the_ins_ru: theins.ru/politika/163562