Content
MH17 – Russian GRU Commander ‘Orion’ Identified as Oleg Ivannikov
A joint investigation between Bellingcat, The Insider, and McClatchy DC Bureau has conclusively identified another key person of interest in the ongoing investigation of the downing of Malaysian Airlines Flight 17 (MH17). The person known as ’Andrey Ivanovich’, a.k.a. call sign ‘Orion’, is in fact a high-ranking Russian GRU officer named Oleg Vladimirovich Ivannikov.
Русская версия этого расследования опубликована изданием The Insider.
Read McClatchy’s article here.
Research and report by Moritz Rakuszitzky, Daniel Romein, and Roman Dobrokhotov.
Additional research and editing by Aric Toler and Klement Anders.
Summary
A joint international open source investigation led by Bellingcat has identified conclusively that the person of interest known as ‘Andrey Ivanovich’ or ‘Orion’ whose identity is sought by the Joint Investigating Team in connection with the criminal investigation into the downing of MH17, is in fact Russian citizen Oleg Vladimirovich Ivannikov, born on 2 April 1967.
Bellingcat has determined with very high certainty that at the time of the downing of MH17, Oleg Ivannikov was an officer of the Main Directorate of the General Staff of the Russian Ministry of Defence (GRU), and served in that function until at least as late as September 2017.
Bellingcat has also established with very high certainty that Oleg Ivannikov, using the alias ‘Andrey Ivanovich Laptev’ in a covert operation for the Russian intelligence services, served as chairman of the Security Council (2004-2006), and as Minister of Defense and Emergencies (2006-2008) of the self-proclaimed Republic of South Ossetia.
The Bellingcat-led investigating team used primarily open source data sources to reconstruct a curriculum vitae of Oleg Ivannikov. As detailed in the biographical timeline below, Ivannikov was born in Eastern Germany as son of a decorated Russian major general, before attending a Soviet military academy in Kyiv, and graduating from the Aerospace Faculty of the Moscow Aviation Institute in Moscow in 1990. At an undetermined stage between his graduation and 2003, Ivannikov became a military officer working for GRU.
During his undercover deployment in South Ossetia from 2004 to 2008, Ivannikov provided military guidance to the breakaway region at a time when both Russia and Georgia competed for its closer reintegration. During his term in office, military tensions between South Ossetia and Georgia escalated, with Russian mercenaries joining South Ossetian militias in attacking Georgian peacekeeping forces, and at one point shooting down a Georgian reconnaissance drone.
After stepping down from ministerial position in 2008, Ivannikov pursued a PhD degree in Russia with a thesis titled “The Complex Nature of the Information War in the Caucasus”. From 2012, Ivannikov served – under his real name and credentials as ‘military expert’ – as director of the Russia-Caucasus Research Center of the state-funded International Institute of the Newly Established States. In this capacity he published more than twenty articles, mainly about the war in Syria and the conflict between Georgia and South Ossetia. Simultaneously, he continued to play a limited role in South Ossetian political life via his alter ego, establishing a research institute in South Ossetia, and at one point publicly endorsing a presidential candidate. Ivannikov continued publishing articles as director of the Russia-Caucuses Center until late 2013.
The reporting team has also determined with high certainty that Oleg Ivannikov was the person behind the covert name ‘Andrey Ivanovich’ who, according to multiple reports by Russian militant commanders and separatists fighting in the so-called ‘Luhansk People’s Republic’ (‘LNR’), was military adviser and de facto handler of the political leadership of the LNR in 2014. Ivannikov was deployed to Ukraine at an undetermined point in the first half of 2014, and remained there at least until early 2015. During his undercover deployment to LNR, he coordinated and supervised the military activities of Russian militants, pro-Russian separatists and “private army” contingents from the Wagner group. Ivannikov also supervised the procurement and transport of weapons across the Russia Ukraine border. He held these functions at the time of the downing of MH17.
The findings in this report for the first time establish the direct or indirect involvement of a high-ranking Russian military officer on active duty operating on the territory of Ukraine in the destruction of the airliner.
Andrey Ivanovich ‘Orion’: SBU intercepts and the JIT Call for Witnesses
One day after the downing of MH17 over eastern Ukraine, on 18 July 2014, the Security Service of Ukraine (SBU) published intercepted telephone conversations allegedly related to the criminal act that led to the deaths of all 298 people on board the plane. One conversation dated 14 July 2014 – three days before the downing – was reported to be between Oleg Bugrov, former Deputy Minister of Defense of the LNR, and a man referred to as ‘Andrey Ivanovich’ with the call sign ‘Oreon’, who, according to SBU’s description to the call, was a Russian citizen and officer of the GRU. In this conversation, ‘Oreon’ is heard boasting that “they” have come into possession of a ‘Buk’ and will start shooting down [Ukrainian military] planes with it. According to a 18 July 2014 statement by the SBU, the Buk-M1 missile launcher that downed MH17 was transported from Russia to Ukraine during the night of 16 to 17 July 2014. It is unclear from the call whether ‘Oreon’ was referring to a different Buk that had been procured in Eastern Ukraine on or before 14 July 2014, or about the Buk that was expected to arrive later that week.
The same persona – ‘Andrey Ivanovich’ with the call sign ‘Orion’ (Oreon) – was referenced again on 28 September 2016, when the Dutch-led Joint Investigation Team (JIT), responsible for the criminal investigation into the downing of MH17, published more intercepted telephone conversations in a call for witnesses. The JIT appeal focused on identifying two individuals: the aforementioned Andrey Ivanovich with the call sign ‘Orion’, and Nikolay Fedorovich with the call sign ‘Delfin’. In a previous joint investigation, Bellingcat and The Insider identified the person behind the covert alias ‘Delfin’.
https://www.youtube.com/watch?v=0a6nMJyZ1JU
Out of the five conversations published by the JIT, two conversations were between Andrey Ivanovich ‘Orion’ and Nikolay Fedorovich ‘Delfin’. ‘Orion’ appeared also in a third intercept, speaking to a third individual. ‘Delfin’, in turn, appeared in two other conversations speaking to a fourth individual. In our report on ‘Delfin’, we pointed out that ‘Orion’ addresses ‘Delfin’ with the formal form of you in Russian (‘вы’), while ‘Delfin’ addresses ‘Orion’ with the informal form (‘ты’), an indication that ‘Orion’ has a lower military rank and/or is younger than ‘Delfin’.
As described in our previous report on ‘Delfin’, the exact role of Andrey Ivanovich ‘Orion’ and Nikolay Fedorovich ‘Delfin’ in the MH17 tragedy cannot be determined from the released telephone calls included in the JIT’s call for witnesses. While ‘Orion’ and ‘Delfin’ appear to discuss, in different segments of the JIT-released calls, procurement of a crane and trailers, as well as repatriation of certain military equipment across the border, no one explicitly mentions a ‘Buk’. Furthermore the JIT did not disclose the date and time of the intercepted calls. However, considering that the JIT specifically requested more information on the two individuals involved in these five conversations, and in the SBU-released calls ‘Orion’ discussed a Buk while discussing plans to start “shooting down [Ukrainian military] planes” just days before the downing of MH17, it is highly likely that ‘Orion’ had a role, at a minimum, in the transport of the Buk missile launcher that downed MH17.
The third conversation between ‘Orion’ and another person is the one most likely to be directly related to the downing of MH17, as the route and convoy described in the call matches that of the Buk missile launcher from the day of the tragedy.
Novaya Gazeta reported on 13 July 2015 (archive), based on interviews with former separatist sources, that Orion was a military advisor to the LNR command and that he “is or was an officer from Russia’s Ministry of Defense.” This information is corroborated by additional reports from sources familiar with the situation in Luhansk from 2014-2015, including a blog post from a former separatist combatant describing how ‘Andrey Ivanych’ was sent to the LNR as an advisor from Russia and worked with former LNR leader Igor Plotnitsky in a military commissariat building. (In Russian, ‘Ivanych’ is a colloquial variant of the patronymic ‘Ivanovich’.) According to this post, while based in Luhansk ‘Andrey Ivanych’ was in close contact with the authorities in Moscow, even providing recommendations on political appointments in Eastern Ukraine to Vladimir Putin’s advisor Vladislav Surkov. The military advisor who went by the name ‘Andrey Ivanych’, per the post, possesses two traits that matches the ‘Andrey Ivanovich’ from the intercepted calls: a distinctly high voice, and a background in military intelligence.
In an interview with Russian pro-government news site Ridus on 15 May 2018, a former battalion commander of Russian and separatist militants in the LNR, Evstafiy Botvinyev, stated that a certain Andrey Ivanovich, based in LNR during the summer of 2014, was his de facto commander. Botvinyev also claimed that Andrey Ivanovich directly supervised the (then) defense minister of LNR Igor Plotnitzky, and Dmitry Utkin, the commander of the Russian private army known as Wagner. Botvinyev told the new site that Andrey Ivanovich was part of certain “public structures” in Russia that provided funding, instructions, and protection to the Wagner private army, which has been active both in the Russia-Ukraine military conflict and in Syria.
Identification of ‘Orion’
Initially, Bellingcat attempted to identify the persona behind ‘Orion’ by the method used to identify ‘Delfin’ – i.e. by identifying all possible candidates with matching name and patronymic and securing voice samples, in the hope of obtaining a match, as described later in this report. For at least two reasons, this approach was quickly deemed ineffective. First, ‘Andrey Ivanovich’ is a relatively common name-patronymic combination among Russian names. Second, assuming ‘Orion’ might indeed by a GRU officer, as claimed in the SBU intercept release, the likelihood of him using his real name and patronymic in communication on open (GSM) lines was deemed negligible. This assumption was corroborated by a 2016 post from an LNR insider asserting that ‘Andrey Ivanovich’ was an alias and not the real name of the Russian military adviser to LNR.
Instead, Bellingcat used a different starting point for its identification process. In the initial publication of the phone call intercept from 14 July 2014, the SBU had included the phone number used by ‘Orion’ in that call: +380634119133.
The Ukrainian mobile number visible on SBU’s video was disconnected shortly after the publication of the intercept.
Bellingcat investigated an extensive list of open source databases of telephone numbers in the hope of identifying this number. Ultimately, the number was found in two telephone number-sharing apps popular among Russian speakers, one of which was TrueCaller.
As seen in this screenshot from TrueCaller, the owner of the telephone number is described as ‘Oreon’, identical to the spelling of the call sign initially announced by SBU, and slightly different than the ‘Orion’ spelling used in the subsequent JIT releases. The difference might be explained by the nature of phone-sharing apps which aggregate all contact lists of their users. Therefore, the owner of a telephone number may appear with various spellings – or even different names – reflecting the way this number is described in the contact list of the user who first introduced it into the phone sharing app.
The operator of the mobile number, ‘Life’, offered anonymous prepaid SIM cards in Eastern Ukraine in 2014. Thus Bellingcat assumed it is unlikely that the number would be registered to an actual identifiable person.
In early 2018, while working with several investigative reporters on a joint unrelated project, Bellingcat, through a Ukraine-based reporter, obtained access to mobile traffic data for the Ukrainian mobile number listed under the name ‘Oreon’. Four Russian mobile numbers were found that had received or originated calls to the Ukrainian number belonging to ‘Oreon’. These Russian numbers became the focus of Bellingcat’s further investigation.
Bellingcat checked all four Russian numbers against various open source telephone-number databases. Two of the numbers appeared in phone-sharing apps, and one of the them appeared in two phone-sharing apps. Bellingcat deemed this latter number to be of particular interest.
In one phone sharing app, this number appeared under the name ‘Andrey Ivanovich GRU – from Husky’. In the other phone-sharing app, the same number appeared under the name ‘Ivannikov’.
This discovery provided Bellingcat with an initial confirmation that the persona behind ‘Orion’ is indeed known as ‘Andrey Ivanovich’ and plausibly linked to GRU. Crucially, it provided the investigating team with the clue that he may be known under the (family) name ‘Ivannikov’. The ‘from Husky’ comment next to the name in the first app suggested that the number had been obtained from a person or organization known as Husky. We identifieda special operations military unit in the Donetsk People’s Republic using the call sign ‘Husky’.
Following this discovery, the investigating team searched for additional open source data on the Russian telephone number in combination with the name ‘Ivannikov’. Bellingcat located this number in two databases: in a Russian open source online telephone database, and on a now defunct e-commerce site with an exposed customer and order-booking database.
The telephone number in the online telephone database displayed its owner’s full name as ‘Oleg Vladimirovich Ivannikov’, as well as his full address in Moscow, and his birth date (2 April 1967). Bellingcat located the address to be across the street from the Russian Military Academy, housing among others the Military Intelligence Institute. A photograph of a residential building, found on a social media profile of a relative of Oleg Ivannikov residing at the same address, was geolocated to the address listed in the telephone database. (The home address and telephone number, as well as the identity of the relatives identified and used by Bellingcat to validate the identity of Oleg Ivannikov, have been withheld from publication to protect the privacy of the family members.)
In the exposed database of the defunct Russian web shop, the same telephone number appeared in the customer profile of a person named ‘Oleg’, who had ordered an ‘elevation training mask’ from that website in 2017. The address for delivery noted in the database was not Ivannikov’s home address, but a different address in Moscow, described as ‘ulitsa Polina Osipenko 76’. Searches both in Google maps as well as Yandex Mapsshowed that this address did not exist, as house numbers in this street do not exceed the number 22. A reporter from ‘The Insider’ traveled to review the address, and drove the street until the end at number 22. He noticed, however, that the street morphs into Khoroshovskoye shosse’, a section of a highway running through Moscow. The reporter proceeded to number 76 on that road, and realized he was standing in front of the headquarters of the Main Intelligence Directorate, or the GRU. The official address of the GRU is ‘Khoroshovskoye shosse 76’, as identified in open sources.
After obtaining sufficient level of certainty that the person Oleg Vladimirovich Ivannikov is linked to GRU and is likely to be the same person known as Andrey Ivanovich ‘Orion’, the investigating team needed to determine which of the two names – if any – is the actual legal name, and which is the cover name. Bellingcat’s hypothesis was that Oleg Vladimirovich Ivannikov was the true identity, and Andrey Ivanovich was an alias for covert operations. This hypothesis was supported by the discovery of a 2003 record for a person with an identical full name and birth date, in an open source automobile registration database from Rostov-on-Don.
In order to confirm this hypothesis beyond any doubt, Bellingcat and The Insider reviewed address registration details of an Oleg Vladimirovich Ivannikov, born on 2 April 1967, who resides at the same address identified by Bellingcat in open sources. Based on the registration records, the team could further establish that this person is – or was at one point – an officer with the Russian Ministry of Defense who had graduated from the Kyiv Military Aviation Engineering Academy in 1988.
The investigating team also obtained a 2012 photograph of Ivannikov.
