Suspected Assassin In The Berlin Killing Used Fake Identity Documents

August 30, 2019

By Bellingcat Investigation Team

Photos posted on Khangoshvili’s Facebook profile. The left image was taken during the Second Chechen War and shows him together with Aslan Maskhadov, the last president of a de facto independent Chechnya

Photograph of Vadim A. Sokolov from his visa application papers

Photograph of one of the three apartment-block clusters located at Alpiyskiy Lane in St. Petersburg as seen in Yandex Maps

Satellite view of Alpiyska Street in Kudrovo showing all house numbers

Vadim A. Sokolov, left an original image obtained in the course of the investigation, right a version of the same image with digital removed beard

What we know so far

Last Friday, 23 August 2019, Zelimkhan Khangoshvili, a Georgian citizen living in Germany, was assassinated in downtown Berlin while having lunch on the way to a mosque for Friday prayer. Khangoshvili was assassinated with three bullets, two of them fired at close range at his head. The killer, who was hiding in the nearby bushes, rushed toward the victim on an electric bike and shot the victim — once in the shoulder and twice in the head — using a 9mm Glock 26 with an attached silencer. After speeding away from the crime scene for a few hundred meters along the Spree river, the assassin stopped and jettisoned the electric bike, a plastic bag with the murder weapon, and a wig he was using, into the river. In doing so he was observed by two teenagers who alerted the police. Their tips lead to the killer being caught a few minutes later, just as he was disappearing into a crowd of tourists – now sporting a clean-shaven head, a mustachioed face, a pink t-shirt, and a touristy pouch holding his passport and some cash suspended from his neck.

Media has reported that the suspect, who has so far been publicly referred to as Vadim S, 49, initially travelled by air from Moscow to Paris on a French-issued visa, before crossing into Germany six days before the murder. He has reportedly denied any involvement in the murder and has requested to meet Russian consular officials.

The victim was an ethnically Chechen Georgian citizen who had long been on the list of Moscow’s declared enemies. Having volunteered to fight against the central Russian armed forces in the second Chechen war in 1999-2002, he continued supporting Chechen separatists while based in his native Pankisi Valley in Georgia in the ensuing years. He also recruited and armed a volunteer unit to fight against Russia’s war in Georgia in 2008, although there is no evidence that his unit ever saw action before the war had ended. In 2012, Khangoshvili reportedly played the important role of mediator during the Lapota incident, when a group of armed Chechens took several people hostage in a remote mountain region of Georgia. Despite no evidence of Khangoshvili espousing Islamist ideology or supporting Islamist causes, Russia has repeatedly branded him as an Islamic terrorist threat. While fighting alongside Islamists during the early stage of the Second Chechen War, Khangoshvili was later known to be close to Aslan Maskhadov, the former Chechen president (killed in 2005) who was known as a moderate and nationalist rather than an Islamist.

At the time of his murder, Khangoshvili was awaiting the outcome of his appeal to deportation proceedings in Germany, where he sought political asylum with his family, having been the object of two assassination attempts in Georgia (the last one in May 2015 when he was shot in Tbilisi), and having received multiple threats while temporarily seeking refuge in Ukraine. Russia has officially disowned any link to the assassination attempts.

A joint investigation between Bellingcat, the German newspaper Der Spiegel, and The Insider (Russia), has established that the assassin travelled to Berlin via France under a validly issued, non-biometric Russian passport in the name of Vadim Andreevich Sokolov, born in August 1970. Despite the fact that he used a legitimate passport, we have determined that no such person exists in Russia’s sprawling, comprehensive national citizen database. In addition, no trace of such a person exists in a trove of hundreds of leaked residential databases, previously obtained and aggregated by Bellingcat. This discovery makes Russia’s claims that the killer is not connected to the Russian state implausible, as no person in Russia is in a position to obtain a valid Russian passport under a fake identity without the involvement of the state bureaucratic and security apparatus.

In addition, we have identified that the address given by the killer in his visa application as his residence in St. Petersburg does not exist. This glaring inconsistency, and the generally blank digital and data footprint of the Russian “ghost traveler” raises serious questions as to how and why he was able to obtain a multi-entry Schengen visa issued by the French consulate in Moscow.

A Phantom Tourist

Using the passport data from Sokolov’s visa application papers submitted in Russia and obtained by our team, we sought to identify the presence of this person in various Russian live and offline databases. We verified via two separate sources with direct access to the Russian Passport database that no person with the name Vadim Andreevich Sokolov and the birthdate used in his passport exists in that database.

The Russian Passport database is a centralized, comprehensive database containing residential address and passport data of all Russian citizens — including the full history of prior personal identity documents — maintained by Russia’s Ministry of Interior. Likewise, no presence of this person was found in another police-maintained database that tracks domestic and international travel of all Russian citizens, nor in the traffic police’s database of driving license owners. We have also searched hundreds of previously leaked offline passport, residential-address, insurance and employment databases, including ones with data as recent as 2018, and have found no evidence of a person with such personal data.

At the same time, for this man to have travelled via airplane from Moscow to Paris on an ordinary passport, he would have had to go through passport control, where his passport would have been scanned and automatically checked against the Russian Passport database. Any inconsistency — such as a missing record in that database — would have triggered the border officer’s alarm system, and the person would not have been authorized to proceed. There can be only two feasible scenarios that explain this inconsistency: either “Vadim Sokolov” was known to border officials as an undercover operative, and they were instructed to let him proceed, or alternatively, at the time of the trip — that is, on 31 July 2019 — Sokolov was still in the Russia Passport database.

Both scenarios are technically possible. The Russian immigration (border-control) system is supervised by the Federal Security Service (FSB), thus special arrangements could have been made for “Sokolov” to bypass the routine airport verification procedure, especially if the operative was FSB-linked.

Equally possible, and more consistent with prior practice, would be the second scenario, in which a cover identity was fully created for “Sokolov” — including a database entry in the Russian passport system — but was purged from Russian government databases shortly after news of the arrest in Berlin broke. In the case of Skripal-linked GRU officers previously identified by Bellingcat, the three undercover GRU operatives originally had dual presence in the Russia Passport database: both under their real and under their cover identity. Shortly after their public outing by Bellingcat, however, both their undercover and their true identities (including their immediate family members data) were purged from the Russian Passport and other government-run databases, creating several “ghost” families with no passport, residential ownership, or even tax information (in fact, apartments previously confirmed by us as owned by Col. Chepiga and Col. Mishkin, the main Skripal suspects, are now listed as owned by “the Russian state”).

Whether the first or the second scenario was used in the case of “Sokolov” might provide a clue as to which of the two main, and often competing, security services are linked to this brazen assassination operation. As outlined below, both agencies, the FSB and the GRU, would have felt entitled to pursue such an extrajudicial killing, albeit for different reasons.

What is certain, however, is that the cover identity behind “Vadim Sokolov” was created very recently, and was most likely custom-made for the specific operation in Berlin. This can be inferred from the absence of any digital footprint on this identity in previously leaked databases (for comparison, both “Boshirov” and “Petrov” — the cover identities behind the Skripal suspects — did show up in older offline databases). This conclusion is also consistent with the unusually recent date of issuance for “Sokolov”’s passport – 18 July 2019, only ten days before the planned trip. We have also verified — via sources with access to non-Russian airline booking databases — that a person with this name and birth date has not traveled to any European destination in the past 6 years, nor has obtained visas to any Schengen states. All of this implies either an ad-hoc operation following newly obtained information on the target’s whereabouts, or the use of a “single-use”, non-staff assassin. As discussed below, this latter hypothesis may prove true due to the certain peculiarities regarding the man now in German custody.

Passport Clues

In previous investigations, Bellingcat has identified batches of sequential passport numbers issued to GRU officers in different years. The passport number used for Sokolov’s passport cannot be matched against these batches, as it was issued only in July 2019, and we have no empirical data of other GRU officers with fresh passports. However these batches were all issued by the same Moscow “central” unit of the Federal Migration Service (now integrated into the Ministry of Interior) that apparently issued “Sokolov”s passport.

“Sokolov”’s number is also like the other GRU officers’ passports in another way: it is a passport of the “old” type — i.e. without embedded biometrical data. While in 2009 Russia introduced biometric passports, and they are the default choice when applying for a new travel document, “old-style” passports are issued upon request, usually in emergency situations when the applicant has no time to wait for the fingerprint encryption and printing process. All internationally active GRU officers identified by us thus far (numbering more than 20) and “Sokolov” opted for the old-style “paper” passport, most likely due to the risk of a clash between the undercover persona’s fingerprints with pre-existing fingerprint data of the real person. In “Sokolov”’s case, this may also have been the reason, or it may have been the unavoidable consequence of a rushed operation, as the lead time to receive a biometric passport is at least one week.

An Express Visa For a Ghost

Our joint investigating team was able to obtain most of the suspect’s passport data from a source with access to visa-linked documents submitted by “Vadim Sokolov” in Russia. The document shows that the suspect applied for an express visa at the French consulate in Moscow on 29 July 2019 — just 11 days after he received his non-biometric passport. He requested a multi-entry, 6-month visa, that would provide him with unlimited reentry access to any of the 26 countries of the Schengen area. Unusually, and boldly, he indicated that his planned date of travel is 30 July 2019 — literally the day after his visa application date. In addition, he indicated that he planned to stay in France for the maximum permitted 90-day period during his six-month visa, stating that he plans to travel in and out of France until 25 January 2020.

Despite such bold aspirations — the requested visa duration and reentry terms are the maximum that can be issued to a first time traveler, and the lead time to travel is unusually short — “Sokolov” had little to show in terms of a traceable background in Russia. His passport showed he was born in the Siberian city of Irkursk, but he indicated his place of residence as “Alpiyskaya Street 37” in Saint Petersburg. There is no “Alpiyskaya Street” in St. Petersburg, although there is an “Alpiyskiy Pereulok” (Alpiysky Lane), and at number 37 of that lane there are 3 upscale residential apartment building clusters, each cluster with a separate sub-address (corpus 1, 2 or 3) that would typically be stated in when providing an address.

The only place in the vicinity of St. Petersburg that does have an actual “Alpiyskaya Street” is a nearby town named Kudrovo, just outside the city limits. However, there is no number 37 on that street either.

In his application, the suspect also listed his occupation as “senior company employee”, although the document reviewed by the investigating team did not contain the name of the company he claimed to be employed by. It is not clear if he provided the name of the company to the French consulate.

As a point of contact in France — which is a mandatory requirement for visa applicants from Russia — the suspect listed the name of the mid-range Practic hotel in Paris. As of press time, we have been unable to receive feedback from the hotel management as to whether they were in contact or aware of this person, or whether he used the hotel as an intended place of residence during his trip into France. A hotel receptionist, upon being shown a photograph of the suspect, said they had not seen this person at the hotel.

Given that the suspect does not have any digital or data footprint in Russia, listed an incomplete or false address and employment data, had a freshly issued passport, and had not travelled to Europe at least since 2013, it is puzzling that the French Ministry of Foreign Affairs, ultimately in charge of deciding on visa requests, decided to honour the application in full and issued the multi-entry visa with no detailed review and no waiting period. Bellingcat has previously reported on the nominally draconian, but empirically porous visa application system for Western Europe that has enabled Russian spies with fake identities and no data footprint to obtain multi-entry visas and unrestricted European travel for almost a decade.

An Unusual Suspect

The report on the detained suspect, according to German security sources interviewed by our joint team, describe him as 176 cm tall and weighing 86 kg. Notably, the report also states the suspect has three tattoos on his body: a crown and a panther on his upper left arm, and a snake on the lower right arm.

The presence of tattoos on an assassin’s body is unusual in the context of a Russian security service operation. Russian security services do not permit their staff officers to thus decorate themselves. This suggests that the suspect is not a staff officer, or that he was permitted to have tattoos as part of a long-term embedded undercover operation. One possible explanation might be that the suspect was a former convict who was coopted by one of the secret services, as the style of the described tattoos is consistent with a special and severely “regulated” body decoration nomenclature known as “prison tattoos”. However, without further information or images of the tattoos — such as whether they are in monochrome or color — it would be impossible to assess if the suspect’s body art is of the “prison tattoo” variety.

It is not unprecedented for the Russian security services to resort to freelancers or even ex-convicts as assassins, as shown by at least two recent examples of (attempted) extraterritorial killings in Ukraine. In one case, an FSB-handled former drug-enforcement officer who had been indicted on corruption charges was sent to Ukraine to organize a car-bomb assassination of a member of Ukrainian military intelligence. In another, a Ukrainian prison official was recruited by Russia’s GRU to assassinate a former Ukrainian artillery officer who had advised Georgian military forces during the 2008 Russia-Georgian war. However, it would be a precedent for a Russian security service to use a freelancer in Western Europe.

Who Gave the Orders?

The complex past of the victim leads to possibilities that he may have been assassinated in an operation led by either of the FSB, the GRU or even Ramzan Kadyrov’s own security apparatus. Due to his involvement in the Russo-Chechen war, and the more recent qualification as an “Islamic threat”, he would have been in the cross-hairs of the FSB capture or kill list.

On the other hand, his involvement in the war and his support for Georgians in the Russian-Georgian war, would have made him a revenge-assassination target for the GRU, as paralleled by other assassinations of former armed-conflict adversaries from Russia’s near-abroad – which, in the eyes of the Russian military, is tantamount to treason. Separately, his Chechen background, and the fact that he sided with Aslan Mashadov during the Chechen war, would have pitted Khangoshvili against Ramzan Kadyrov’s clique.

Indeed, most of the assassinations of ethnic Chechens overseas in the last 10 years has been perpetrated by Chechen emissaries acting in the name of Kadyrov, sometimes — as in the case with the June 2017 assassination attempt on Ukrainian citizen Amina Okueva (who did not survive a follow-up assassination attempt that same year) in Kyiv — traveling under cover, non-Chechen identities.

Whatever the answer is, the access to a valid, Moscow-issued passport, and the immediate and comprehensive purging of the any data linked to the cover identity “Vadim Sokolov” is a clear indication of the state involvement in this extraterritorial assassination, similar in brazenness and lack of plausible deniability to the Skripal case.

Bellingcat and its investigative partners will continue to investigate this story, seeking to identify the actual identity of the person traveling under the “Sokolov” persona.

Share this article:

The Bellingcat Investigation Team is an award winning group of volunteers and full time investigators who make up the core of the Bellingcat's investigative efforts.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

Support Bellingcat

You can support the work of Bellingcat by donating through the below link:

24 Comments

1. Servus - August 30, 2019

Great inquiry again! Congratulations!

The discovery that of ´sokolovs’ tru identity is just a matter of time…

Reply

- Servus - August 30, 2019

“Sokolov” was certainly not alone, maybe it’s possible to check recently issued non-biometric passes or border crossings with such passes and identify possible complices ? Most likely a murderer does not qualify for spy exchange so chances are that he wil talk….

Reply

2. Tourist - August 30, 2019

Tip for EU/EC: Forbid russian immigration into European Community without biometric passports.

Reply

3. Mr.Bushkin - August 30, 2019

Quote: “We verified via two separate sources with direct access to the Russian Passport database that no person with the name Vadim Andreevich Sokolov and the birthdate used in his passport exists in that database.”

Sounds like security of personal data does not exist in Russia. But at least the suspect has been captured alive, so a next “Novichok” circus is unlikely.

Reply

- Your Mom's Friend - August 30, 2019

Quote: Sounds like security of personal data does not exist in Russia.

Maybe, just maybe Bellingcat is making crap up and they don’t have any access to Russian passport database, but stupid people like you believe whatever they tell you

Reply

- Dan - August 30, 2019

It isn’t expensive to buy such information in Russia. If you want I can give a link on recent Russia post about it. Bank information about account movements for example costs from 20$ till 300$

Reply

- Mikd - August 30, 2019

You seriously need to improve in trolling or you will be fired in after a short while

Reply

- Servus - August 30, 2019

´Maybe, just maybe Bellingcat is making crap up… ´

So even you find your own guesswork highly hypothetical …….

Reply

- Mirzoulugbek - August 31, 2019

Bravo!

👍

Reply

4. Matthew - August 30, 2019

my dear friends.

as Focus reported this week, that guy was Sergeevich – not Andreevich. different

patronymic and probably wrong man.

and it looks like you know nothing on the issue.

btw tatoo with crown- lion- snake are usual for so-called thiefs-in-law. May be this murder had a criminal background? GRU can not be responsible for EVERYTHING.

(or you think, that was GRU who put Boris Johnson to Downing Str 10?)

Reply

- Kiselyov Dmitry - August 30, 2019

>as Focus reported this week, that guy was Sergeevich – not Andreevich.

You dumb piece of Prigozhin shit, the only mention of assassin name in focus article is …Vadim S. and… why did you guess he is Sergeevich?

https://www.focus.de/politik/deutschland/georgier-in-moabit-getoetet-auftragsmord-mitten-in-berlin-dann-haben-wir-einen-zweiten-fall-skripal_id_11072807.html

>May be this murder had a criminal background? GRU can not be responsible for EVERYTHING.

s a m i y

l u c h i y

i z

a r m y a n

m a r g a r i t a

s i m o n y a n

Reply

- PS - August 30, 2019

Is very good comment, my bro! Is still selling sister on market?

Seriously, you paid trolls are so pathetic. Learn some English.

Reply

- mark - August 31, 2019

in a couple of years you will feel rather stupid when it comes out that johnson was lined to russian oligarchs who had leverage over him. people like you need to wake up and smell the fucking coffee.

Reply

5. unknown - August 30, 2019

a crown and a panther – Ex member of French Foreign Legion

Reply

- JL - August 31, 2019

How are those symbols related to the Foreign Legion? A crown to represent a French army unit of any type sounds implausible. Even more so for the Foreign Legion.

Reply

6. Sergey - August 30, 2019

Matthew two above…subtly sent by the Russians to discredit in broken English. They’re not the best at this are they

Reply

- Norm - August 30, 2019

Ha ha!! Not they are not 🙂🙂

Reply

- Norm - August 30, 2019

No, even!

Reply

- Norm - August 30, 2019

Excuse the errant ‘t’.

Reply

7. Richard - August 30, 2019

This seems to convey the mind-set from above coming from the Putin state:

https://therussianreader.com/2019/08/28/death-to-traitors/

Reply

- Germann Arlington - August 30, 2019

“Death to traitor” during wartime is common and not specific to Russia, maybe you did not (or did not want to) know that?

[Putin was not even born in 1943.]

Reply

- Richard - August 31, 2019

If you noticed, this is from now. What would you think of county fairs including hate speeches against the Germans and Japanese? These are teenage kids learning how Russia is always a victim.

How about considering this as the start of WWII?

https://louisproyect.org/2019/08/30/the-hitler-stalin-pact-reconsidered/

Reply

8. flemrod - August 30, 2019

Terrible photoshop job!

There can be so many more plausible causes which you could consider…

So many assassination attempts…The victim had more than one enemy.

But so far this scenario fits the british viewpoint, while the rubber duck makes putin dance from joy.

Reply

- Servus - August 31, 2019

´the scenario’ is that Russian national that murdered mr Zelimkhan Khangoshvili was arrested by German police. Where are your ´other possibilities’ ? Mr Sokolov was born recently in a mature age, a birth more miraculous then the Jesuses, he has no mother or father.

So… if we are at that, why not be creative and help our friend Wania, dropout of an English class.

1. Nothing happend, Khangoshvili was already dead when Sokolov fired his gun. Bellingecats can you prove he was alive?

2. German police got the wrong man. Throwing bicycles to rivers is an old Russian custom of celebrating Christmas. Bellingcats, isn’t Christmas coming or no Christmas in 2019? Say, do Germans celebrate Christmas ?

3. According to an interview with a Spanish traffic policemen passing by (soon to be aired by RT), an Ukrainian military bicycle was spotted near by, carrying a man in Bandera and ´trizub’ T-shirt .

4. It was suicide, the man was recently depressive, there were traces of caffeine, Prozac and viagra in his blood.

5. Radical Al Kaida operative Zelimkhan Khangoshvili attacked a peaceful orthodox Russian tourist, thanks Christian God (or was it GRU), the tourist could défend himself in a discreet civilised way (silencer). Will Bellingcat defend AlKaida again? And a mega idiocy; When did you stop supporting IS and AlKaida or the other way around?

…., hard work, only 200 ideas left… that many fakes were produced for MH17..