Russian Oligarch Hired Spies to Surveil Girlfriend in Major US Cities
Discover more from Hacking, but Legal
Russian Oligarch Hired Spies to Surveil Girlfriend in Major US Cities
by Scott Stedman and Jackie Singh
by Scott Stedman and Jackie Singh
This piece originally appeared in Forensic News on August 1, 2022.
Update: Forensic News has been shuttered due to an abusive SLAPP-type lawsuit brought against Stedman and other journalists by security consultant Walter Soriano. Story to come
The Russian oligarch who once purchased one of Donald Trump’s properties for $95 million hired a team of private agents to spy on a romantic partner in New York, Las Vegas, and Los Angeles in late 2015, according to a trove of thousands of pages of documents acquired by Forensic News.
Dmitry Rybolovlev, a multi-billionaire businessman who made his fortune in the Russian fertilizer industry and now owns the football club AS Monaco, used an offshore company to pay the private intelligence company, Arcanum, more than $1 million per month.
The agreement between Arcanum and a company represented by Rybolovlev’s personal attorney, Tetiana Bersheda, was signed in the middle of 2015. The contract is the first hard evidence in the public domain proving that Rybolovlev has turned to human intelligence sources to covertly gather information on those in his circle.
It was previously reported by Intelligence Online and other outlets that Arcanum conducted work for Rybolovlev in his high-profile art dispute against Yves Bouvier, but the surveillance on his romantic partner has never been revealed.
One of Rybolovlev’s many directives for Arcanum was to track down and surveil his then-romantic interest, model Daria Strokous. The surveillance report produced by Arcanum and obtained by Forensic News shows agents deploying aggressive techniques and gaining remarkable proximity to Strokous.
Invoices, bank transfer statements, text messages, and a declaration of beneficial ownership, all of which were also obtained by Forensic News, paint a detailed picture of how Rybolovlev spent millions to secretly gather intelligence on both friend and foe. Sources with knowledge of Rybolovlev’s business activities supplemented the documentation, describing the billionaire as an avid consumer of intelligence.
The Money Trail
The agreement signed by an Arcanum executive stipulates that
“the Client shall pay Arcanum a monthly fee of [$1 million]”
for six months and
“1/3 of the total fee, i.e. [$2 million]… shall be paid to Arcanum in advance upon execution of this Agreement.”
Rybolovlev, who has resided in Monaco for over a decade, facilitated the payments to Arcanum via Eagle Rock Resources Group Ltd, a British Virgin Islands company that used a PO Box address in Cyprus. Another company used by Rybolovlev for Arcanum payments was his family office, Rigmora Holdings.
A Bank of Cyprus credit transfer receipt for the month of August 2015 shows Eagle Rock Resources Group paid $1,060,000 to the HSBC bank account for Arcanum’s Hong Kong branch.
The bank transfer receipt of $1,060,000 matches two August 2015 invoices sent by Arcanum to Bersheda for $1 million and $60,000, respectively. The purpose of the additional $60,000 is unclear.
Eagle Rock Resources Group has no public-facing presence but it is involved with Rybolovlev’s intelligence and security operations for his family office, Rigmora, according to a source familiar with the offshore company. Other financial documents show that Rybolovlev has also paid lawyers and other advisors via Eagle Rock Resources Group.
British Virgin Islands law allows companies to mask their ownership, but a Julius Baer statement of beneficial ownership leaked to Forensic News shows that Rybolovlev and his adult daughters are the ultimate beneficiaries of the trust company that controls Eagle Rock Resources Group.
Corporate documents obtained from Hong Kong show that at the time of the Rybolovlev deal, the shareholder of Arcanum (Asia) was Magellan Investment Holdings, a UK company in turn solely owned by Arcanum’s American founder Masudul Rony “Ron” Wahid.
Arcanum and Ron Wahid
Arcanum Global, the opaque firm hired by Rybolovlev whose name translates to “secret” in Latin, is part of a network of offshore companies owned by Wahid, a wealthy 53-year-old American of Bangladeshi origin who has variously been credited in company materials and published opinion pieces as M. Ron Wahid, Ron Wahid, and Rony Wahid.
Wahid owns a palatial mansion in McLean, Virginia, near Tyson’s Corner, Washington, D.C., the Pentagon, and the Central Intelligence Agency. Public records show he purchased the 16,500-square-foot property with four floors, six bedrooms, thirteen bathrooms, a library, gym, steam room and sauna, home theater, and garages for up to six cars for $5.5 million in 2017.
Wahid has hired from a veritable “Who’s Who” of global government, especially recently departed senior-level intelligence community officials.
Some examples of these hires include:
Bernard Squarcini, former Chief of the French Counterterrorism and Intelligence Agency (DCRI)
Meir Dagan, former three-term head of Mossad and former Israeli IDF General
Admiral Dennis C. Blair, former U.S. Director of National Intelligence
Lt. Gen. Robert P. Ashley, former Director of the Defense Intelligence Agency (DIA) and former U.S. Army Deputy Chief of Staff
John Hannah, former National Security Adviser to U.S. Vice President Dick Cheney
A Foreign Policy Op-Ed in 2015 co-written by Wahid and Hannah revealed that both have also had roles with the Foundation for Defense of Democracies, a pro-Israel neoconservative lobbying firm and think tank, with Wahid serving on their board.
Wahid has been a large donor to both Democrats and Republicans, but his largest donations have been to Jeb Bush and the Trump inauguration.
Project Pluto
“Have you managed to locate the target?”
Rybolovlev’s attorney Tetiana Bersheda asked in a text message sent to an Arcanum executive on October 27, 2015 around midnight.
“Working,”
the executive replied the next day,
“will let you know as soon as I have something.”
The “target” discussed in a series of text messages acquired by Forensic News was Daria Strokous, then a model with Elite Model Management. She began dating Rybolovlev in 2015, according to sources with knowledge of the situation, and the couple was photographed numerous times together in 2017 and 2018.
Strokous traveled from New York to Las Vegas and then later to Los Angeles. Entirely unbeknownst to her, however, private spies working for Arcanum on behalf of Rybolovlev followed her nearly every step of the way.
The agents gained extreme proximity to Strokous, surreptitiously taking photos of her on a flight from New York City, using the ploy of acting as a deliveryman (with a hidden camera activated) to confirm her exact location in Los Angeles, and following her to a James Bond-themed party in Las Vegas.
The full 46-page report on Strokous, whom Arcanum refers to as “T1” or TI”, is linked here.
Forensic News spoke with a number of surveillance experts who raised red flags about sections of the report, named Project Pluto. All of the experts noted it appeared that Arcanum agents had gained access to Strokous’s personal flight records.
One source familiar with the situation suggested Rybolovlev may have paid for the flights and therefore may have had access to the details for the Strokous account. That suggestion contradicts the first page of the report, however, which states,
[t]he only information provided at the commencement of the OSINT [] and HUMINT operations were Tl’s name and her phone number.
Forensic News granted anonymity to multiple sources for this article due to the following factors:
Some familiar with Rybolovlev’s business dealings were concerned about professional retaliation for sharing information publicly.
Others were granted anonymity because of the sensitivity around potential ongoing investigations.
Those who supplied documents feared being identified as the source of the information and requested certain redactions, which Forensic News approved because it did not alter any material matters of the investigation. The documents have been verified via an independent source.
One current intelligence analyst with experience in HUMINT said that they would not be comfortable accessing Strokous’s flight data regardless of how the login information was obtained. “It is definitely an aggressive collection strategy and would likely need to be vetted by a lawyer,” the analyst said.
While the collection methods used by the investigators who contributed to the report were aggressive, the analyst also noted several aspects of the surveillance that were lackluster and/or unprofessional.
For example, after Arcanum agents tracked Strokous to her hotel lobby before going out on Halloween, they appeared to have no insight into the event.
“Page 25 notes the cost of attending the event [the] target went to, but not what the event was, what it was called, or where it took place.” “Very unprofessional,” the analyst opined.
Daniel Maki, Senior Intelligence Manager at the UK-based Institute for Strategic Dialogue echoed the intelligence analyst’s sentiments after reviewing a redacted copy of the report.
“My reaction to the contents of this report is somewhat mixed. It’s sloppy and unprofessional and yet also somewhat terrifying,”
he said.
“It’s written as if the author(s) decided to structure a report based on tropes you might see in pop culture. Slick intel lingo and surreptitiously hidden camera shots, the whole nine yards.”
Despite the report’s perceived shortcomings, Maki also raised questions about how some of the information was acquired by Arcanum agents. Maki, who has nearly a decade of experience in the intelligence world, said that
“outside of matters where warrant powers were a factor, I can count on one hand the number of times I’ve seen this kind of detailed flight information be collected.”
“If this were a law enforcement document, I wouldn’t be surprised in the slightest, for obvious reasons. But this was produced by a private intelligence firm.”
Igor Ostrovskiy, a private investigator who worked with journalist Ronan Farrow to expose Harvey Weinstein’s spying on journalists, said that accessing such flight details was a line he, too, would not cross.
“If the party was not involved in the payment then it is an egregious violation to access her flight data,”
he told Forensic News.
“It is a violation of privacy.”
Ostrovskiy also classified the use of body cameras on private property to confirm that Strokous was staying at a friend’s house in Los Angeles as a “gray area.”
“Covert cameras on private property like a Starbucks are normal since it’s accessible to the public,”
Ostrovskiy said.
“If it’s clearly not accessible to the public, like a private spa or showers at the beach, it’s a gray area.”
Arcanum has previously insisted that it follows all local and federal laws and the company has never been accused of criminal wrongdoing. The company did not respond to a list of questions about this article.
The text messages from Bersheda to Arcanum employees show that the surveillance on Strokous was carefully planned, yet executed on somewhat short notice. The messages suggest that surveillance on Strokous was requested just days before the operation began.
Communications between Arcanum and Rybolovlev’s attorney were quiet in the midst of the operation, but the two sides made plans to meet in person quickly after the mission.
In conversation with an Arcanum employee, Bersheda repeatedly pushed for a get-together with Wahid and Rybolovlev.
“pls let me know if we can meet with Ron between 4 and 6 Nov?”
she asked in late October.
Just one week after tracking Strokous in Los Angeles, a Rigmora security employee and Bersheda discussed an in-person meeting in Paris with “DR” and “Bernard,” references to Rybolovlev and Squarcini, respectively.
“Pis (sic) also confirm you will give full surveillance reports to us and results of your work until now,”
Bersheda wrote on November 12, 2015. A meeting with Wahid was apparently more elusive.
“I tried to call you yesterday with the client,”
Bersheda texted to her primary Arcanum contact in a more formal tone.
Please let me know when convenient to speak? When would Ron and you be available to meet with the client in Miami/NY in the next ten days?
The text messages largely reflect general dissatisfaction with Arcanum and Wahid. The contract between Rybolovlev’s company and Arcanum ended in early 2016 with Rybolovlev angry about the engagement, according to multiple sources.
Other Arcanum Activities
Arcanum has worked for both government and private clients and is well-known in the bustling private intelligence industry.
The prominence of the individuals employed by Arcanum has not stopped them from becoming involved in multiple controversies with problematic clients, including:
Allegedly conducted surveillance of Financial Times journalists at the behest of their client Wirecard. Arcanum’s primary contact was former Wirecard COO Jan Marsalek, who has an extensive relationship with Russian intelligence.
Reportedly worked with Khadem Al-Qubaisi, an Emirati business leader who was under investigation in multiple European countries for corruption, bribery, and money laundering in a scandal that has been described as “one of the world’s greatest financial scandals”.
Allegedly engaged in politically-motivated surveillance and data theft on behalf of the Kazakhstan government.
A reputation for “playing both sides” by accepting clients who are warring with each other, as described by Tom Burgis at the Financial Times
Bernard Squarcini, the Arcanum executive who previously headed France’s domestic intelligence agency from 2008 to 2012 and subsequently headed Arcanum France, was held for questioning in France in September 2016 for suspected influence peddling. He was accused of using his previous position and influence to gather insider information in a case unrelated to Arcanum.
The private company that hired Squarcini eventually paid €10 million to settle claims and end the criminal investigations into Squarcini and others.
Other Rybolovlev-Connected Surveillance
Strokous was not a target for Arcanum or Rybolovlev until October 2015, three months after the multimillion-dollar contract was signed, though the full scope of Arcanum’s work for Rybolovlev remains unclear.
Text messages confirm that Arcanum executives met with Rybolovlev and Bersheda in Monaco days after the deal was signed by Arcanum in July 2015 and sent to Rybolovlev. Sources familiar with the matter said Squarcini first worked for Rybolovlev personally before introducing him to Arcanum.
“We have received the contract proposal,”
Bersheda wrote to an Arcanum executive on July 15, 2015, just after noon. The two sides confirmed details for a meeting involving Rybolovlev, Bersheda, the Arcanum executive, and Peder Garske, the Arcanum employee who signed the contract.
Arcanum employees and Bersheda discussed other unspecified projects after the meeting, and often mentioned Yves Bouvier, Rybolovlev’s former art dealer.
“Artnet news reported that target turned himself in after iMessage hearing about arrest warrant,”
an Arcanum executive texted Bersheda in September 2015 referencing an article about Bouvier. Bersheda replied by asking for a call from Wahid.
“Tens of newspapers had been writing about it before you sent me your message. Pls ask Ron to call me,”.
she said.
The long-standing feud between the Russian billionaire and his art dealer largely began when Bouvier was detained in Monaco earlier in 2015 after a criminal complaint was lodged by Rybolovlev, alleging fraud. Rybolovlev claimed that Bouvier overcharged him for multiple art sales. All charges on Bouvier were later dismissed, but a court of appeals recently granted Rybolovlev’s appeal to reinstate the investigation.
Investigators in Monaco have conducted a corruption investigation into Rybolovlev regarding his alleged undue influence on Monaco officials. Authorities charged Rybolovlev and Bersheda in 2018 over a series of allegations that they corruptly influenced authorities to go after Bouvier in a scandal dubbed, “MonacoGate”.
In Switzerland, Bouvier was cooperating with the Public Prosecutor’s Office in Geneva in a similar corruption investigation into the Russian oligarch when overt surveillance was first noticed. Bouvier, according to correspondence reviewed by Forensic News, provided evidence that Rybolovlev asked him to “find all vulnerabilities of the various magistrates [judges] concerned” with Rybolovlev’s $4 billion divorce proceedings. Bouvier rejected the invitation.
Criminal investigations into Rybolovlev in Monaco, Switzerland, and elsewhere appear ongoing.
According to sources familiar with the situation, Bouvier’s team detected surveillance beginning in June 2018 as he prepared to provide more evidence to the Genevan authorities. Bouvier hired a counter-surveillance team to investigate.
The team found that multiple people with rented Hyundais, Fiats, and Opels tailed Bouvier, at times parking in front of the Prosecutor’s Office before Bouvier arrived. They did not make efforts to conceal their activity, which led the team to believe that the surveillance was an effort to intimidate Bouvier.
“The number of people and vehicles involved implies a very substantial budget,” a report from Bouvier’s counter-surveillance team concluded. Neither Rybolovlev nor any of his associates were confirmed to be behind this operation.
Sources with knowledge of Rybolovlev’s consumption of private intelligence said that “stringent” NDAs are signed by employees of his private companies Rigmora Holdings and Eagle Rock Resources. Similar to a head of state, Rybolovlev receives regular “intelligence briefings” according to one of the sources directly familiar with the situation.
Rybolovlev’s various residences also have extensive security, including drones and numerous surveillance cameras.
Bersheda, Rybolovlev’s personal lawyer, did not respond to questions from Forensic News.
Rybolovlev’s US Ties
Rybolovlev is perhaps best known in the U.S. for his purchase of Donald Trump’s Florida mansion for $95 million in 2008. It was one of Trump’s most lucrative private business transactions ever.
In 2018, Rybolovlev was included as one of 96 oligarchs in the U.S. Treasury Department’s so-called “Putin’s list” which contained the names of those assessed to be associated with the Kremlin. Despite this, he has not been sanctioned by the U.S. or any other nation.
Rybolovlev has also poured nearly a billion dollars into U.S. business ventures. He invested over $100 million into a failed North Carolina battery plant, and more than $500 million in various biotechnology companies. Forensic News found that a trust company controlled by Rybolovlev, who is a doctor by trade, continued investing in 2021 in biotechnology and pharmaceutical companies trading on the NASDAQ. As of publication, the fund has approximately $375M invested in Stoke Therapeutics and Akero Therapeutics.
The Putin Accountability Act, a GOP bill that would force President Biden to make sanctions determinations on six oligarchs, including Rybolovlev, appears stalled in the House. The bill, HR 6422 introduced by Rep. Jim Banks (R), describes Rybolovlev as the owner of “multiple…assets in the West.”
Author's Note
Scott Stedman is a journalist currently being sued for covering Russian interference. Read this recent Byline Times piece to catch up:
The European Center for Press & Media Freedom notes (emphasis mine):
The Committee was reportedly interested in Soriano’s connections to several people of interest, including the Russian oligarch Oleg Deripaska, who had been a former business associate of Donald Trump’s campaign chairman Paul Manafort.
The Forensic News team was sued by Soriano in July 2020, one month after they published their last article about him. Although the defendants are all based in the United States and Forensic News is incorporated in the state of California, the lawsuit has been brought in London. […]
“The case has many of the hallmarks of a SLAPP, including that Soriano is not only suing the news organisation, but also the four individual reporters. He also has lawsuits pending against investigative journalists in France and Israel, as well as against Twitter in Ireland,” the organisations said.
This letter is signed by:
Index on Censorship
Blueprint for Free Speech
The Campaign for Freedom of Information in Scotland (CFoIS)
Coalition For Women In Journalism (CFWIJ)
The Daphne Caruana Galizia Foundation
English PEN
European Centre for Press and Media Freedom (ECPMF)
IFEX
International Press Institute (IPI)
Justice for Journalists Foundation
Organized Crime and Corruption Reporting Project (OCCRP)
Osservatorio Balcani Caucaso Transeuropa (OBCT)
PEN International
Reporters Without Borders (RSF)
Spotlight on Corruption
If you appreciated learning about the private surveillance and hack-for-hire industry and the oligarchs who use it, please consider supporting the intrepid journalists at Forensic News with a one-time gift or Patreon. Here is the crowdfunding campaign to help fund the legal defence in England and Wales.
The case is expected to go to trial before the end of 2022.