Illustration (c): Bellingcat

On January 6, chaos descended on Washington D.C. as supporters of President Donald Trump stormed the United States Capitol Building. Amid the melee, a longtime QAnon promoter known as “the Q Shaman” made his way onto the Senate floor and occupied the speaker’s rostrum. He was far from the only QAnon supporter on the scene that day: another led the charge into the Capitol.

Once again, this dangerous and eclectic conspiracy is in the spotlight. It has come a long way since its birth on a forum barely three years ago.

On October 28, 2017, an anonymous user browsing the /pol/ section of 4chan, a notorious alt-right imageboard, saw a post that read, “Hillary Clinton will be arrested between 7:45 AM — 8:30 AM EST on Monday — the morning on Oct 30, 2017,” and decided to respond. This user would later adopt the name “Q Clearance Patriot” (soon shortened to “Q”). Q hinted that they were a military officer in President Trump’s inner circle; their writings — almost 5,000 posts to date — gave birth to the QAnon conspiracy theory.

Q’s first “drop”

Most accounts of QAnon present this first “Q drop”, as Q’s posts are known by their acolytes, as the starting point of the Q movement. This is mistaken for two reasons. One is trivial: Q first gained an audience with a different set of drops, because their earliest efforts sank without a trace and weren’t rediscovered by anyone on 4chan until November 11 that same year. The other is deeply significant: Q’s origins can’t be divorced from the culture of /pol/, which was a rich slurry of racism, anti-Semitism, and (especially relevant here) right-wing conspiracy theories.

Therefore, QAnon was both an outgrowth and an evolution of /pol/ culture: not only were many of Q’s claims already popular on /pol/, but Q borrowed key themes and ideas from predecessors. The key to understanding the roots of Q is to understand the culture of /pol/.

But first, we need to understand the myth.

Meet the Mythos

Here is the core of the QAnon myth: with the aid of a small group of military intelligence officers called the Q team (one or more of whom is supposedly responsible for writing the drops), President Donald Trump is waging a shadow war against a cabal of Satan-worshipping, child-eating pedophiles who are conspiring to obstruct and overthrow him. The military will arrest them en masse in an event called “the Storm.” The cabal’s membership has grown in the telling (at first, it was “many in our government;” within a month, any “celebs” who had “supported HRC” might very well be in on it; a few months later, there were too many to fit into Guantanamo Bay; later still, three other “detention centers [were] being prepped”), but it would be fair to say that virtually anyone who’s angered or defied President Trump is considered part of the cabal, along with the usual suspects like financier and philanthropist George Soros.

After the Storm, military tribunals will ensure that these baby-eating traitors are executed or sentenced to life in prison. Faced with overwhelming proof of the cabal’s existence, a stunned public will mourn; rage; and ultimately unite behind President Trump, ushering in a golden age of patriotism and prosperity.

Remarkably, this description covers none of the most bizarre corners of QAnon (for instance, in QAnon lore, North Korea was controlled by the CIA but has now been liberated by Trump and the Q team). It also omits a key aspect of the QAnon worldview: that every public act or utterance of President Trump or a suspected cabal member might contain “comms,” or secret messages, which QAnon believers can decode. And it leaves out one of the most important QAnon slogans: “disinformation is necessary,” which some might call a wonderful excuse for Q’s failed predictions, also allowing believers to pick and choose which parts of the theory they embrace.

From these humble and eccentric beginnings, QAnon has grown explosively. At first, that growth was limited to 4chan, where Q became a sensation on /pol/.  Soon after, a pair of 4chan moderators and a YouTube conspiracy theorist began working together to spread Q’s messages to a far wider audience. This effort succeeded beyond their wildest dreams.

Roughly 10 percent of American adults believe in some or all of QAnon’s theories, according to a Pew Research study conducted last year. This finding is consistent with another study conducted in 2020 by the British charity HOPE not hate. Political scientist Joe Uscinski, who has written that “support for QAnon appears to be deeper than it is wide,” nonetheless finds QAnon support running between five to 10 percent of the US adult population. However you slice it, millions of Americans believe in QAnon to some degree. Furthermore support for QAnon’s ideas is much more widespread than belief in Q: a YouGov poll last October found that fully 50 percent of Trump’s supporters agreed that “top Democrats are involved in elite sex-trafficking rings.”

Even before what many are calling an attempted coup, QAnon had reached the halls of Congress.

Representative-elect Marjorie Taylor Greene, praised as a “future Republican star” by President Trump, has written that “child sex, Satanism, and the occult [are] all associated with the Democratic Party.” Greene also recorded videos describing Q as “a patriot” and “completely for the good… very high up and connected,” offering “a once-in-a-lifetime opportunity to take this global cabal of Satanists and pedophiles out.”

So what was it about QAnon that made anyone think this obscure theory on /pol/ might be worth trying to spread?

A Deep and Dark Well

Simply put, the broad outlines of Q’s beliefs were popular on /pol/ before Q started posting.

Reviewing threads on /pol/ that predate Q, as well as the earliest threads in which Q was active, yields a critical insight: many “anons” (as 4chan’s denizens called themselves) believed the key elements of Q’s story before Q came along.

As one perceptive anon writing before Q’s first mention of Satanism (and, in fact, before anons began discussing Q at all) pointed out: “Funny how everyone the /pol/acks dislike are all actually secretly part of a huge child abusing, devil worshipping [sic], Jewish conspiracy that is only coming to light as more people are threatening the big D [Trump]. Almost as if it’s all delusional fantasy, and D might actually just be a retard in danger of being impeached.”

An anon calls out Q’s conspiratorial appeal

If that fantasy was delusional, it was also incredibly common on 4chan. Lurid claims and conspiracies like these found in the anons an eager audience: the Pizzagate conspiracy theory, which was far and away the most direct predecessor to QAnon, was mentioned at least 45,027 times on /pol/ alone in the year before Q’s first posts. (The actual number is sure to be higher: there were plenty of posts about Pizzagate before that name came into use, and almost 2500 more using the alternate name “Pedogate,” which more directly reflects Pizzagate’s claims — namely, that prominent Democrats, especially Hillary Clinton, sexually abused and ritually sacrificed children, using restaurants as a front for their crimes.)

Therefore, when viewed in its original context, Q’s conspiracy theory — far from blazing new trails — trod a well-worn path.

For example, here’s one anon predicting the imminent “arrest of the Cabal” and “liberation of Planet Earth from dark forces” in July 2017 — three months before Q’s first post. Here’s another, two weeks before Q appeared, writing: “Soon their demise will come. The storm approaches. Hollywood is directly connected.”

Even if we restrict ourselves to the week before Q’s first drop, we can find countless anons expressing their belief in ideas that Q went on to espouse.

For example, three days before Q’s first post, an anon who believed in the Pizzagate conspiracy listed Hillary Clinton’s supposed crimes: “Sex with a minor, rape, cannibalism” — the exact charges against Hillary that would go on to become a core part of QAnon. Another anon in that thread wanted to “talk about what the Clinton Foundation did in Haiti.” The reference was to a less-central part of Pizzagate lore which, despite its relative obscurity, Q folded into some of their early drops.

Yet another anon, writing on October 23, 2017 (five days before Q’s first post) created a thread that neatly encapsulates Q’s original story: Special Counsel Robert Mueller was working with Trump to take down the deep state in general and Hillary in particular, after which “tribunals involving hundreds are going to take place.” The denizens of /pol/ were thirsty for military tribunals that would punish their most hated enemies. Indeed, it was Q’s hints about the coming tribunals that won over the earliest converts. One anon, overcome by enthusiasm, all-caps’d it: “THE JUNTA !!!!! TIME FOR MILITARY OVERRIDE! All hail dictator Trump!” Another went straight to the point, with /pol/’s trademark anti-Semitism: Trump, he predicted, would declare martial law on November 4th, 2017, and while he wasn’t certain what would happen next, he offered up a guess: “kikes hang soon after in military tribunals?”)

There’s strong evidence that Q had read the October 23, 2017 thread: it references an obscure, months-old statement by Representative Trey Gowdy which Q cited less than a week later in one of the earliest drops.

To be clear, there’s no reason to think Q stole the entire Mueller theory from the author of this thread — just that one line. Q had almost certainly already encountered the idea that Mueller and Trump were working together, which was widespread on /pol/: “this shit has been spammed here for months,” complained an anon, with “literally not one iota of proof.”

Yet another anon, two days before the advent of Q, posted a thread that practically begged for an overarching conspiracy theory to come along that would make “all these scandals… converge,” leading to “the biggest military tribunal in world history.”

An anon calls for order to chaos

This was fertile soil. Even before Q came onto the scene, all of the raw materials for their writings were scattered about their environment, waiting to be forged into a semi-coherent mythos.

Playing to the Gallery

In this respect, a reply to the post asking if “all these scandals” would “converge” is especially notable. This reply listed almost every alleged Democratic scandal that was popular on Fox News (and therefore also widely discussed on 4chan) at the time. Q devoted extensive attention to most of the items on the list. As of the writing of this article, the “Awan scandal” has been mentioned in 26 drops; “Uranium 1” — in its abbreviated form of “U1” — appears in 39 drops, and the word “uranium” appears in 11; Seth Rich is mentioned in 13 drops; and “dossier” appears in 32 drops.

Fox News meets QAnon

In other words, Q — far from leaking top-secret information to the anons — simply repackaged what right-wing media (and therefore the anons) were already discussing.

In the hands of Q, these scandals — seemingly unconnected — became part of a sinister, pedophilic conspiracy the anons could work to unravel, saving innocent children and sweeping their enemies away in a wave of cleansing fire.

Probably the two most hated individuals on /pol/ were Hillary Clinton and George Soros. Considering /pol/’s nature — right-wing, anti-Semitic, and conspiracy-minded — its hostility to a liberal Jewish philanthropist like Soros is supremely unsurprising. For similar reasons, /pol/ also loathed President Barack Obama.

But the anons’ animus towards Clinton was special. Inspired by Pizzagate, their enmity was all-encompassing and unremitting. Just a day before Q’s first post, one anon put it succinctly: “Victory,“ he wrote, “is when [Hillary] and everyone related to the pedophile ring known as [the] ‘Clinton Foundation’ are thrown in Gitmo.” (Gitmo, or Guantanamo Bay, looms large in the QAnon imagination: the US naval base and detention camp in the Caribbean is’ supposedly where the Cabal’s members will be imprisoned, tried, and executed when the Storm arrives, a belief which has Q encouraged both cryptically and directly.)

From the beginning, Q focused fire on all three figures: drops 1 and 2 concerned preparations for Clinton’s arrest (the second drop even claiming that she’d been “detained”), while Q mentioned Soros in drops 2, 4, 5, 6, 14, and 15, ending the latter with: “Soros is targeted.” Obama was mentioned even more often than Soros, earning his own special role in the conspiracy to boot: he served, Q suggested, as a globetrotting point man for the Cabal.

Q’s most frequent targets — America’s first black president; a Jewish philanthropist; and Hillary Clinton — pandered to the audience’s prejudices, winning acclaim and attention from an audience that was hungry for a happy ending: the death or imprisonment of all of its enemies.

The Greatest LARP

One more element of 4chan culture helps explain QAnon’s success: LARPing.

Q embodied this practice, or perhaps even perfected it. The acronym refers to “live action role playing,” but on /pol/, it has a more specialized meaning: a LARPer is someone who pretends to be a well-placed source with confidential information about current events, which they then leak to the anons.

LARPing was and remains extremely common on /pol/ — so common that Q’s first post was itself a response to, or a riff on, another LARPer. In fact, that LARPer was greeted with a moan of “not another one” and a picture called “dance of the LARPer.gif.”

Most LARPs petered out within a few posts (which is what happened to the anon who wrote “drop 0,” the post to which Q first responded). Some lasted for a handful of threads. Several, however, found success and became well-known parts of /pol/ culture.

Prominent LARPs before Q included FBI Anon, High Level Insider, Mega Anon, and White House Insider; other well-known LARPers included CIA Anon, Victory of the Light, Highway Patrolman, and Anonymous 5. In turn, many of these had their disciples and imitators.

In some cases, Q’s claims are directly descended from those made by other popular LARPers. In particular, some skeptical anons compared Q to Victory of the Light — with good reason, since “the Storm,” as predicted by Q, is almost a beat-for-beat copy of “The Event,” as described by a Victory of the Light superfan.

A checklist for “The Event”

A side-by-side comparison is revealing.

At the beginning of The Event, claimed Victory of the Light, normal economic life will be suddenly, jarringly disrupted for “two weeks max” as banks close down and the financial system is thrown into disarray. The Storm, in QAnon lore, will begin with  “ten days of darkness,” a phrase first deployed by Q only a week after beginning to post. The advent of this period is breathlessly awaited by Q’s followers to this very day.

In the second stage of The Event, the news will be full of “disclosure” (in which the government reveals some of the shocking truths it’s kept hidden). These messages will be pushed out to citizens on television and via the emergency broadcast system.

In the Storm, the ten days of darkness will also be followed by disclosure — not of alien life, but of the full extent of the Cabal’s depravity. This, according to Q, will happen via the emergency broadcast system, as the Cabal’s last-ditch resistance is crushed and the mass arrests roll on.

In The Event, “mass arrests of the Cabal” will be televized.” In both the Storm and The Event, these mass arrests herald the “liberation of Planet Earth from dark forces,” as Victory of the Light would have it.

By no means does this exhaust the parallels between the claims Victory of the Light made in the summer of 2017 and the story Q began to peddle that fall. However, as the subsequent parallels are not as strong, it would serve little purpose to keep listing them — especially since Victory of the Light wasn’t the only LARPer who served as a clear ancestor to QAnon.

For instance, Anonymous5 (also referred to by anons as Frank) was easily the most reviled LARPer on /pol/, but he was also the key figure in the development of /HTG/ (for “Human Trafficking General”) threads. In fact, he was so central to /HTG/ culture that the threads routinely included a post that began, “Look for these kinds of things to map out the trafficking networks (courtesy of Anon5).”

Frank wasn’t the first LARPer to realize that lurid tales of child sexual abuse would hold /pol/’s attention. It was a fairly obvious strategy; Highway Patrolman, for example, once burst into a thread (on Valentine’s Day, no less) to claim that he was investigating an international child prostitution ring. In this entirely fictitious ring, dastardly non-white offenders (especially “illegals”) held innocent white girls captive, and even murdered some. Since /pol/ is enthusiastically racist, this storyline was especially well chosen; it’s always wise to know your audience.

Frank’s claims, too, were heavily racialized. It was an article of faith for /HTG/ anons that Blue America (or, as the standard opening post for /HTG/ threads claimed, “urban areas, specifically sanctuary cities”) hosted a huge network of pedophiles trafficking unlimited numbers of children, and it was an article of faith (rather than fact) that these children were obtained primarily through child abductions and “breeding grounds.”

/HTG/ anons were a small, tight-knit community who, in the most charitable reading of their activities, engaged in collaborative storytelling and followed rules of evidence (however strange and disconnected from reality) that led them to believe they’d uncovered rings of pedophiles. A less charitable, but more accurate, description of /HTG/ threads might be that their participants were engaged in bouts of wild speculation and free association which they termed “investigations,” but which led to no arrests — because they’d uncovered no evidence of actual crimes.

Indeed, other anons often mocked /HTG/’s participants as a group of feckless idiots spiralling ever more deeply into confirmation bias. And yet the /HTG/ community endured.

In all of these respects, /HTG/ was almost exactly identical to QAnon — and that isn’t a coincidence.

Q’s audience was hungry for something like /HTG/, but better — more far-reaching, more connected. Q supplied it.

From Pizzagate to QAnon

Perhaps the best way to describe QAnon is that it’s an evolution of Pizzagate; and perhaps the best way to describe /HTG/ culture is that it’s the missing link between Pizzagate and QAnon.

Pizzagate gained followers because it had the right targets; the right accusations; and, in its earliest days, a strong participatory element, as anons raced to find new “proofs” of child abuse derived from the DNC’s hacked emails.

But that kind of creative ferment could never last: there were only so many emails to read, and only so many “code words” to be detected within. Eventually, Pizzagate stopped being an exciting new thing to investigate, and became a set of ideas that anons were free to accept or reject.

Puzzlingly, /HTG/ threads were much less popular than Pizzagate. After all, they too had the right targets; the right accusations; and a seemingly infinite amount of source material, since anons were now “investigating” real-world locations from the comfort of their homes.

However, /HTG/ was missing two key ingredients: storyline and storyteller. There was no overarching story to keep the anons engaged, and even if there had been, Anonymous5 or “Frank” wasn’t the right person to tell it — /HTG/ threads were constantly derailed by outsiders coming in to make fun of him.

The Secret Sauce

Why did Q succeed where so many had failed?

One reason is that Q had the right idea at the right time. Q also had the right style at the right time, often relying on long lists of leading questions. Other LARPers acknowledged as much — in 2017, MegaAnon, who was perhaps the most successful active LARPer when Q first appeared, wrote that Q was “doing a fantastic job” of “breaking down a ton of detail in a more /pol/-friendly format” than she’d ever been able to.

You wouldn’t be reading this article if Q appealed only to /pol/ and had stayed there. I may not have even written it. Q slipped the surly bonds of 4chan within days of their first post, thanks to a handful of people who mounted a concerted push to promote QAnon in other venues (in particular, a subreddit).

“Normies”, as the anons call most other human beings, got a taste of Q for themselves. Some of them liked it. It turned out that normies — at least, the fanatically pro-Trump, conspiracy-minded normies who were Q’s initial audience — were at least as ready for a Pizzagate successor as 4chan was. Soon, across multiple platforms, Q and their fans had created a community strikingly similar to /HTG/: a band of followers convinced they were “uncovering pedophiles” via their own community practices and rules of evidence, despite a lack of real-world results.

The difference was that Q had a much larger and more committed following than /HTG/ ever did. Moreover, Q kept cranking out content and the anons kept dissecting it, finding new meaning in even the most baroque, outlandish claims.

Even Q’s failed prophecies could not dissuade them, for “disinformation,” as Q explained, “is necessary.”

Perhaps this answer to the question of Q is unsatisfying. It is an answer which boils down to: “Q was a skilled LARPer who fed the audience’s beliefs back to them; recycled ideas from earlier LARPs; and had help early on from a small but clever band of fans who spread word about the drops outside of 4chan.”

Whether the rise of Q has been simple or not, it has had tremendous and sometimes tragic real-world consequences.

The QAnon movement has taken a wrecking ball to families around the world — the QAnonCasualties subreddit offers a small glimpse of the human cost of QAnon.

And while most QAnon followers will probably never take any violent actions themselves, the political damage they have wrought is considerable.

Last December, President Trump reportedly described QAnon as a group of people who “basically believe in good government”.

But Q’s message is that “good government” can arrive only in the form of a purge — because every prominent Democrat, and most Republicans who don’t show enough fealty to Trump, is part of a cabal of Satan-worshipping pedophiles. True justice and “good government” can only exist after the Storm, when Trump — and Trump alone — rules the country, with all his opposition dead or imprisoned.

Three years ago, Q stitched together the most widely-held beliefs of one of the darkest corners of the internet. Drop by drop and stitch by stitch, the right-wing media scandals, the racist conspiracies and LARPs of bygone days grew into something greater than the sum of their parts. Q has eclipsed them all.

The story told above can only be incomplete. It addresses the supply side of the QAnon phenomenon, but the demand side is where the problem lies. To explore that would be to tell a story about the deepest fissures in American society — through the dangerous succor of conspiracy.

The post The Making of QAnon: A Crowdsourced Conspiracy appeared first on bellingcat.

Yevgeny Prigozhin can be described as the Renaissance man of deniable Russian black ops. An ex convict who served time for robbery, fraud and forcing a minor into prostitution, he began his legitimate business career in the 90s as a St. Petersburg restaurant owner and later as caterer for the Kremlin.

Today, his official business is a sprawling catering consortium that provides meals to millions of Russian soldiers, policemen, prosecutors, hospital patients and schoolchildren in return for hefty tax-funded payments estimated at at least $3 billion since 2011. Yet his unofficial operations fit the profile of an authoritarian state’s shadow security apparatus: industrial-scale manufacturing of fake-news, intimidating journalists, election interference, political engineering, and actual clandestine military operations. Prigozhin was famously indicted in the US over the role of his troll factory in trying to influence the 2016 elections in favor of Donald Trump, a charge he flatly denies to this day. His troll-factory generated one of the largest known online disinformation campaigns, churning out 71,000 tweets aimed at presenting Russia’s version of events in the downing of flight MH17. The same troll infrastructure posted thousands of messages promoting Brexit. Prigozhin has also been linked to Kremlin-friendly political engineering across dozens of African countries while he has been sanctioned by the US over his funding for the Wagner Group, an unincorporated private military company with a history of clandestine operations in Eastern Ukraine, Syria and several African countries. It was most recently accused of placing booby-trapped mines around Libya’s Tripoli. The EU has yet to sanction him or his metastatic group over any of his activities.

Now, a long-running investigation by Bellingcat, The Insider and Der Spiegel has uncovered that Yevgeny Prigozhin’s disinformation, political interference and military operations are tightly integrated with Russia’s Defense Ministry and its intelligence arm, the GRU. Prigozhin’s private infrastructure – along with that of other government-dependent entrepreneurs, like Kostantin Malofeev – it appears serves as a deniable veneer and a round-tripping money laundering channel for government-mandated overseas operations.

At the same time, Prigozhin’s attempts to take initiative and leverage his crucial role for personal gain has also resulted in embarrassment for the Kremlin. During what appears to have been a failed operation to capture oil-wells from SDF and U.S. Armed Forces in the Syrian province of Deir ez-Zor in February 2018, Wagner mercenaries suffered heavy casualties in a U.S. counter-attack that left the Kremlin scrambling for an appropriate reaction (which never came). On another occasion, Russian mercenaries have posted self-incriminating videos into semi-public online groups, such as this gruesome chronicle of the torture, murder and beheading of a Syrian civilian near Palmyra.

Our investigation team spoke to a number of current and former employees who worked in Prigozhin’s overseas interference and political engineering projects. They told us of widespread lack of motivation, infighting and alcohol-driven dysfunction at these operations, more indicative of bloated, government-funded junkets than a private operation with clear goals and outcomes.

We have also identified a key figure serving as a liaison between Prigozhin’s influencing operations in Africa and the Russian Defense Ministry. According to documents seen by our investigation team and corroborated by interviews, this person has been in overall command of Russian paramilitary operations in Africa, including at the time when three Russian journalists investigating Prigozhin’s operations in the Central African Republic were murdered, as well as while Western journalists were tailed and harassed. This key person appears not to be on the radar of Western intelligence or law enforcement agencies, as he enjoys unrestricted travel in Europe based on multi-entry Schengen visas.

This investigation is based on a review of leaked email archives belonging to employees working for Prigozhin’s group of companies. Some of these archives have already been subject of investigations by independent Russian media while others have been obtained exclusively by the investigative team. We have validated the authenticity of the messages and contained documents through interviews with several former and current employees of Prigozhin’s overseas influencing operations.

Prigozhin’s (un-)Deniable Link to the Kremlin: Digital Breadcrumbs

Yevgeny Prigozhin’s links to the Kremlin and Russia’s Ministry of Defense (MoD) are hard to disguise given his companies’ prominent role as catering providers to the Kremlin and the Russian military. However, the intensity of his communication with the top echelon – both within the Kremlin and the MoD – is difficult to explain away simply based on the “catering” relationship.

Bellingcat has analyzed Prigozhin’s telephone records for an eight-month period spanning late 2013 and early 2014. The records were obtained from hacked emails of Prigozhin’s personal assistant leaked in 2015 by the Russian hacking collective Shaltai Boltay. The emails contained telephone billing records for his company Concord Consulting & Management, and we were able to identify Prigozhin’s personal number among the list of corporate numbers based on a reverse-phone-number-search app. This period coincided with Prigozhin’s troll-farm operations transitioning from a purely domestic political tool – used primarily to trash opposition figures and independent journalists – to an ambitious international operation with more and more efforts allocated to foreign interference operations – first in Ukraine, and later globally.

During this period, Prigozhin spoke or texted with practically the entire leadership of the Presidential Administration Office, along with a number of senior figures at the FSB, in the Federal Protective Service (FSO) and the Ministry of Defense. In particular, he called and texted Dmitry Peskov – President Putin’s adviser and spokesperson – a total of 144 times. He also called – or was called by – Anton Vayno, Putin’s chief of staff, a total of 99 times. He communicated 54 times with Igor Diveykin – Putin’s deputy chief of staff overseeing domestic politics, arguably a job description that doesn’t include the logistics of food catering. Prigozhin spoke more than 25 times with Lt. General Alexey Dyumin – Putin’s ex head of security and – at the time of the calls – deputy director of GRU who supervised the Crimea annexation. He also spoke at least twice in person with Sergey Shoigu, Russia’s minister of defense, while email traffic showed more planned in-person meetings with him. Prigozhin also spoke 31 times with Shoigu’s number two, the Deputy Defense Minister Bulgakov in charge of army logistics. Prigozhin also spoke 3 times with Yury Ushakov, Russia’s former ambassador to the USA and Putin’s senior advisor on foreign policy issues.

The interactive graphic below shows some of the key government figures that Prigozhin communicated with with during this period. By hovering over or clicking a name, a pop-up will show further in formation on the person and the number of communications during the fairly brief 2013-2014 period. Double-click a section (e.g. Ministry of Defense) to only bring up individuals in that grouping.

While Prigozhin’s companies were indeed catering providers both to the Kremlin and to the Ministry of Defense, it is not plausible that this service relationship would have required such frequent, high-level communication on either side along with members of state intelligence services – especially given the purely political or military mandates of his counterparts.

The Virtual Reality of Wagner

The Wagner Group – which does not exist on paper – got its name from its purported founder and commander, the elusive and camera-shy Dmitry Utkin, who – thanks to his obsessive fascination with the history of third Reich – had received the nom-de-guerre “Wagner”. Col. Dimitry Utkin, born on 11 June 1970, was a career officer who had seen first-hand military action in both Chechen wars. In the early 2000’s, as the military phase of the second war subsided, he was moved to the town of Pechora near the Estonian border, where he served out the next ten years as commander of GRU’s Second Spetsnaz Brigade. According to his former wife, he found it hard to adapt to civilian life and always longed to be back on the battlefield.

Immediately after his retirement in 2013, Utkin joined a little-known Hong-Kong based private security company called Slavonic Corps (archived website in English and Russian here), which – in May 2013 – advertised online for “24 to 45 year old …former Spetznaz employees.. having the necessary training in military action… for work abroad on business trips of 3-6 months“. The only known deployment of this private military company (PMC) – in Syria in late 2013 – ended up with the mercenaries losing a battle with Al-Qaeda-linked militants, and then falling out with their Syrian paymasters over who was to blame. Utkin’s name did not feature among the known command structure of Slavonic Corps, and the person in charge of the Syrian operation – based on witness statements – appears to have been Vladimir Gusev, deputy director of yet another Hong-Kong-incorporated, but St. Petersburg-run PMC, the Moran Security Group. The Syrian mission ended up in shambles, with Russia’s FSB arresting many of the returning mercenaries and charging them with “unlawful warfare abroad“, the requisite crime for mercenary work which is illegal in Russia.

By early 2014, however, many of the people who were involved with the Slavonic Corps were back in demand. As Russia needed quick – and deniable – military presence in Crimea, the concept of a private, legally unincorporated, shadow army employing skilled soldiers with prior combat experience, appeared to be the perfect solution.

From the data we have reviewed it cannot be determined who came up with the initiative for the Wagner Group. But what is certain is that after successful initial deployment as a deniable Russian military proxy in Crimea and Donbass in 2014, it received a permanent training base at a top-secret GRU facility at the village of Molykino, near Krasnodar, in 2015. Wagner’s largest international deployment so far has been in Syria, where according to a former Wagner officer, at least 2,500 mercenaries were deployed, under the GRU’s and FSB’s supervision, to assist pro-government Syrian forces.

According to a journalistic investigation by the Russian website The Bell, the idea of creating a deniable, “off-balance” private army – and entrusting its logistical operational aspect to Yevgeny Prigozhin – came from high-ranking officers from Russia’s Defense Ministry, after being impressed with a 2010 presentation by Eben Barlow, the founder of the South-Africa-based PMC “Executive Outcomes”. Three different sources are quoted as saying that initially Prigozhin objected to such a high-risk role, but that given his pre-existing service relationship with the Defense Ministry – which provided the cover operation with both an alibi and an existing support infrastructure – he did not have the option to refuse it.

Whether or not the “Wagner Group” was the brainchild of the Russian military establishment or of Prigozhin himself, various digital breadcrumbs corroborate the linkage between his operations and the private military company. These include joint air-travel bookings between Prigozhin employees – including the head of his trolling operation – with known Wagner officers, and the use of at least three companies controlled by Prigozhin as payroll providers for Wagner mercenaries.

GRU In The Driver’s Seat

While Dmitry Utkin has been widely presented as the front man and “principal” for the Wagner PMC, there is ample data suggesting that his role was more of a field commander, and that the “Wagner Group” mercenaries are integrated in an overall chain of command under central Kremlin control with its military intelligence (GU/GRU) apparatus.

In phone intercepts published by Ukraine’s Security Service (SBU), Utkin is heard reporting to a man named Oleg Ivannikov on the progress of military activities in Eastern Ukraine at the time of the battle for Debaltseve in February 2015. Bellingcat has previously identified Ivannikov as a senior GRU officer who helped procure at least one Buk missile system for the militants in Donbass in the days before the downing of MH17. In another intercept from the same period, Utkin is heard reporting to Andrey Troshev, a former police colonel from St. Petersburg. In the call, Utkin despondently complains to Col. Troshev that he has lost count of how many casualties his unit has suffered, and begs to be recalled back to Russia for fear of being killed himself by his own soldiers. A third intercept from early 2015 shows Utkin taking instructions and coordinating the mercenaries’ work directly Maj. General Evgeniy Nikiforov, then chief of staff of the 58th Western Army.

It is clear from the context of the calls that Utkin appears to be subordinated both to GRU’s Ivannikov and overall to the Russian military command, and that Col. Troshev is his superior within the so-called Wagner Group. Not surprisingly, in March 2016 it was namely Col. Troshev who was awarded the Hero of Russia Award for his role as commander of the Wagner Group engaged in supporting government forces in Syria in 2015 and 2016.

Bellingcat has also identified joint airline bookings between Wagner’s commanding officers – including Utkin himself – and active GRU officers. On at least one occasion, Utkin flew in the company of both Troshev and “Andrey Ivanovich Laptev” – the fake identity of GRU’s Gen. Ivannikov.

Dmitry Utkin and Andrey Troshev as co-travelers on a flight between Krasnodar (near the Wagner base) and Moscow’s Sheremetyevo airport, on 5 June 2015. The two being co-travelers (the field “С кем вместе летит”) indicates their tickets were booked together.

Andrey Laptev (cover identity of GRU officer Oleg Ivannikov), Andrey Troshev, Aleksey Dmitriev (Wagner commander), and Dmitry Utkin on the same flight from Krasnodar to Moscow. There were only ten passengers on this flight, four of whom were tied to Wagner and the GRU.

The Kremlin’s deniability of any formal links to the Wagner Group became famously impossible after Utkin was spotted during a video broadcast from a Kremlin reception held on 9 December 2016. After initially denying any knowledge of Utkin’s existence, Putin’s press secretary Dmitry Peskov ultimately acknowledged he had attended the Heroes of the Fatherland gala event at the Kremlin. Subsequently a VK account focused on mercenary activities published a photograph in which Putin is seen standing next to four heavily – and apparently recently – decorated Wagner officers at a Kremlin function. While there is no public information on when Utkin received his latest award, a Russian website tracking military honors reported that Col. Troshev was given Russia’s highest military honor, the Hero of Russia award, plus a Gold Star order for his military services as a “volunteer” in Syria. The award was reportedly granted through a secret decree signed by Putin on 17 March 2016. The fact that Utkin was not presented with that award (he is seen wearing four Bravery orders, a less exclusive military honor), plus the standing arrangement supports the hypothesis that Utkin is of lesser relevance within the so-called Wagner Group than Col. Troshev.

Vladimir Putin with Col. Andrey Troshev (second from left), sporting a fresh Hero of Russia award, and Col. Dmitry Utkin (far right), wearing four Bravery orders.

Clone Wars

Following this unplanned public appearance, Dmitry Utkin “Wagner” was never seen or heard of in public. A phone number previously used by him is now disconnected. However, travel records reviewed by us show that he continued making rare trips between St. Petersburg and Krasnodar through late 2019.

Despite Dmitry Utkin’s apparent withdrawal from active operational involvement with Wagner activities, his name has not stayed out of focus. A few months after the publication of the Kremlin photograph, in November 2011 a person bearing Utkin’s exact full name was7appointed as CEO of Yevgeny Prigozhin’s flagship catering company, Concord Management and Consulting, a company with nearly $20 million in unconsolidated revenues and controlling a group of companies with nearly 10 times that turnover. When approached by Russian media to comment on Concord’s presumed links to the Wagner Group, Prigozhin responded that “the appointment of Dmitry Utkin – who has never before held any position within our group – is a private personnel decision”, and said he had no knowledge of the existence of a private military company which, he said, “is not even legal under Russian law”.

Prigozhin’s coy response disguised the fact that the Dmitry Valeryevich Utkin in fact appointed as CEO was not the Wagner Group commander. In fact, this Dmitry Utkin was created just a month earlier – through a legal name change (permissible in Russia) of a little-known St. Petersburg resident, eighteen years younger than the original Utkin and having only three months of prior management experience running his own startup company: Alexey Karnaukhov. This fact can be established by the common tax-payer number for the two names – Karnaukhov registered a company under his original name in March 2017, while the cloned “Utkin” was registered as Concord’s CEO under the same tax number in November 2017. On 1 March 2018 – just after the Deir ez-Zor Wagner fiasco – Prigozhin removed the freshly-created Dmitry Utkin from the CEO position and appointed himself instead.

Prigozhin went through this cloning exercise a second time: in early 2018, a former St. Petersburg convict with no prior business experience, Alexander Anufriev, underwent a legal name change, and once again, legally become a Dmitry Valeryevich Utkin. The age difference between the new, third Utkin and the original flagship was only two months, suggesting he may have been more apt to be passed off as the original “Wagner” Utkin. As reported by Russian media, in May 2018 this freshly cloned Utkin incorporated four companies, some of them showing indirect links to Prigozhin’s group. All of these companies were de-registered by 2019. Current Russian debtor databases show that both Utkin clones have unpaid, court-adjudicated debts to third parties, in the case of the latter Utkin – incurred under both his original and new identities.

It is not clear what Prigozhin’s rationale was for causing people to undergo legal name changes to that of the Wagner Group’s public face, and in the first case, flaunting Utkin’s appointment for such a short period of time. Russian media have speculated this may have been a trolling stance of defiance after the US placed both him and Utkin under sanctions over their role in the Ukraine military conflict.

The Colonel is Gone. Long Live the Colonel!

In 2018 and 2019, western and Russian media began reporting on a growing presence of Russian political strategists in various African countries, offering to provide electoral support – including cash, advice and personal protection – to Russia-friendly candidates. An investigation by the independent Russian website Proekt, based on leaked internal documents from a Prigozhin corporate unit “African Back Office”, claimed that as of 2019 Prigozhin had political advisors working in twenty different African states, and had interest in another nineteen. According to Proekt’s analysis of the leaked documents and follow-up interviews with current or former employees, the tasks and scope of work vary greatly by country. In some countries, like Mozambique and the Central African Republic (CAR), the lead role is played by military mercenaries. In others, like the Democratic Republic of the Congo (DRC), Zimbabwe and Madagascar, there were only political strategists, often boosted by the presence of Russian “bodyguards”. In Chad and Benin, Prigozhin’s people work with politicians close to the armed Muslim group Seleka. In some countries, like the CAR and Mozambique, Prigozhin already had business interests in addition to political interference and paramilitary presence.

According to sources interviewed by Proekt, in 2019 Col. Dmitry Utkin had been planning to travel to Rwanda with Valery Zakharov, a Russian security advisor to the President of the Central African Republic. This trip was reportedly cancelled at the last moment. By early 2019 Dmitry Uktin was over-exposed, both due to his presence at the Kremlin gala and through the US sanctions imposed on him. This may have resulted in his withdrawal from the African campaigns.

However, at the same time a different Russian colonel with no media footprint began popping up at different African locations where Russia had dispatched political strategists or security advisers. The colonel, who was known only by his presumed first name “Konstantin”, was spotted initially in Madagascar during the period before the country’s presidential elections in November 2018. He was initially assigned as campaign security chief to an early Russian favorite – Pastor Mailhol of the Madagascar’s Church of the Apocalypse. Mailhol told the BBC that the Russian political strategists who had initially persuaded him to run for president – and had given him suitcases of cash along with a personal bodyguard – ultimately pulled out “Konstantin” from his campaign when a different front-runner emerged. He said they later assigned the Colonel as bodyguard to Andry Rajoelina, who went on to win the election.

The Pastor refused to pull out.

He’d been hearing rumours.

And his Russian bodyguard, Konstantin, had been transferred to the campaign favourite. pic.twitter.com/FDV06LniFM

— BBC News Africa (@BBCAfrica) April 10, 2019

“Konstantin” (right), a personal body-guard provided by Russian strategists in September 2018 to an early Russian favorite in the presidential elections. Photo: Screengrab from BBC AfricaEye report.

Pastor Mailhol and the Colonel on the campaign trail in Ambiolobe on 22 October 2018. Photo exclusively obtained by our investigation team.

Madagascar was not the only African country where “Konstantin” has appeared. Leaked emails from employees of Prigozhin’s “African Back Office”, reviewed by our investigation team, show that the same person referred to in correspondence by his nom-de-guerre “Mazay” was stationed in the CAR in the summer of 2018, and returned there after the Madagascar elections. “Mazay” first arrived to the CAR in early July 2018, approximately three weeks before the murder of three Russian journalists on 30 July just outside the town of Sibut. The three journalists had arrived to investigate the role of the Russian mercenaries in the exploitation of local mineral resources. Investigative Journalists digging into the case have found evidence that points to possible Wagner involvement in the murders, but both the CAR and Russian authorities have shown no willingness to investigate this case further.

 “Konstantin”, “The Colonel”, “Mazay”

Leaked back-office emails reviewed by our investigation team do not identify the Colonel by his real name, and only refer to him as “Mazay”. From the context of the correspondence – which only relates to his deployment in the CAR – it is clear that the Colonel was the most important Russian figure on the ground in the republic, and that Russia’s military advisor to the CAR’s president was taking instructions from him. Prigozhin had his own team on the ground in Africa – approximately fifteen individuals with social media, political consultancy or information security backgrounds, all working for a unit referred to in correspondence as “Project Continent”. However, these people all appeared to be taking instructions on ideological matters, countering media leaks and all military matters from “Mazay”. Documents in the emails show that while Valery Zakharov was formally Russia’s military advisor to the CAR’s president, important questions of military relevance were always directed to “Mazay”, who was widely seen by Prigozhin’s team as a representative of the Ministry of Defense, and/or the Kremlin in general. Email exchanges among employees describe “Mazay” as the only person in the CAR who talks with Prigozhin without fear and as an equal.

For example, one email contains an attached scanned letter from local provisional authorities in the town of Bambari addressed to the Commander of the Russian Armed Forces in the South African Republic. The letter, dated 13 May 2019, requests an urgent and private meeting in order to “discuss a particularly delicate situation in the town of Bambari”. The local official, M’Sarvaise-Ildevert, further writes that he would like to pass the Russian military command information about the economic, social and weapons-proliferation crisis caused by “the Mercenaries” on the local population. The author implores that an urgent solution be found jointly during such meeting.

Notably, the email containing the letter says the Russian military command had forwarded to “Mazay” for further action.

It is unclear from the letter if the author requests Russian help to deal with local armed groups, such as the Seleca rebels active in the area, or to raise issues caused namely by Russian mercenaries. Just three months prior to this letter, the United Nations had requested CAR authorities address reports of torture of local Bambari civilians by Russian mercenaries or regular armed forces, including an incident in which a local resident had been strangled with a metal chain and had his finger cut off during interrogations. It is clear, however, that an issue originally referred to the official Russian military command deployed in the CAR was delegated for further action to “Mazay”. This example shows once more the tight integration between the Russian military and the hybrid operations fronted by Prigozhin – including political engineering in Africa, as proven by the role of “Mazay” in the Madagascar election campaign.

Identifying “Mazay”

“Mazay”, also known as “The Colonel” and “Konstantin”, has not been previously identified by any publication and was not identified by name in any of the African back-office correspondences. It appears that his identity was not in fact known to Prigozhin’s Africa-focused employees. “Mazay” was careful to never be captured on camera without his sunglasses on. which made identification via facial recognition search impossible.

In the absence of open-source data to proceed with our investigation, and in order to identify “Mazay”, we obtained and analyzed Russian telephone billing records of Valery Zakharov, Russia’s military advisor to the CAR’s president. Two of the numbers he communicated with in 2019 belonged to a St. Petersburg-based company with the name Military-Security Company “Convoy”. This company was incorporated on 15 January 2015 with an inordinately high share capital – 100 million Russian rubles (approximately $1.5 million USD at the exchange rate of the time). “Convoy” lists its main activity as “providing military security services”. Despite its impressive share capital, the company officially employed only three individuals in 2019, and had a turnover of just over $70,000 USD. The newly-registered company has maintained its cash reserves at over 100 million rubles since its incorporation and to the time of this article’s publication.

The company’s founder was another St. Petersburg legal entity: The St. Petersburg Cossack Association “Convoy” which also boasts “military security services” as its activity. This organization was incorporated in 2009 and has five individual shareholders, one of whom is also the CEO of the Military Security Company “Convoy”. His name is Konstantin Aleksandrovich Pikalov, born on 23 July, 1968.

A search in reverse number-search apps showed that the numbers called by Zakharov and registered to Convoy were in fact used by Konstantin Pikalov.

What’s more, the reverse phone number search app GetContact, which is extremely popular in Russia, provided a number of different ways in which Pikalov’s number had been entered in various users’ contact list. GetContact, along with other apps like TrueCaller, vacuum up their users’ contact books and will publicly list the various names inputted into its users’ phones for an associated phone number. This practice provides researchers with a plethora of names, nicknames, functions, mnemonic devices, and so on, unbeknownst to both the app user and the phone number’s operator. Many of these results displayed entries you would perhaps expect from someone’s cell phone contacts, such as “Konstantin Pikalov” or “Kostya Pikalov”, but also include more personalized names, such as “Ilya’s Uncle Pikalo” and “Neighbor husband Pikalov Konstantin”.

As seen in a screenshot of the GetContact results below, a common thread among many was the use of Mazay, or Mazaev, as his moniker. This finding corroborated our hypothesis that Konstantin from Madagascar and Mazay are the same person. The entries also shine more light onto the nature of Pikalov’s background. He was listed by some as “Pikalov – Private Military Company”, “Konstantin the Cossack”, “Konstantin MDG Mazay” (MDG being a likely reference to Madagascar), and “Ragozin’s Bodyguard”. The latter is likely to be a misspelled reference to Dmitry Rogozin, ex-Deputy Prime Minister of Russia and current head of its space program. Rogozin was sanctioned by the US and EU over his role in the Crimea annexation and war in eastern Ukraine.

Screenshot from the GetContact listings for Konstantin Pikalov’s cell phone number.

To validate our hypothesis that Konstantin Pikalov and the “Colonel”, aka “Mazay”, are the same person, we obtained a passport photo from a source with access to the Russian passport database. While it is not possible to conduct a proper forensic facial comparison given the partial visibility of his face on the African photos, when considering all of the other evidence, we found a sufficiently convincing match of the visible facial features, including ears, nose and skull shape, to conclude that this is the same person.

Who is Konstantin Pikalov

Based on a review of leaked offline databases, until at least 2007 Pikalov served as an officer at Russia’s military unit 99795, located in the village of Storozhevo near St. Peterburg. Russian open sources list this particular base as an experimental unit of the Ministry of Defense, tasked, in part, with “determining the effects of radioactive rays on living organisms”. Following his retirement, Pikalov continued to live on the military base at least until 2012, and ran a private detective agency. In 2016 he ran for office in local council elections in the district of the military base on behalf of the Just Russia, a pro-Kremlin political party. His participation was denied by the Central Election Committee for unknown reasons. However, this may have been the result of a criminal record, as his name is listed in a Central Bank blacklist with a note that he was “a suspect in money laundering”. Pikalov’s current criminal file is blank, which can mean either that the suspicion did not result in actual criminal charges, or that the records have been purged.

Based on reviewed travel records, in 2014 and 2017 Konstantin Pikalov traveled several times to destinations near the Ukraine border, sometimes on joint bookings with known Wagner officers – including with Vadim Gusev, the person who supervised the original Syrian endeavor of Slavonic Corps, and Nikolay Khamatkoev, a known Wagner operative.

“We’re The Dancers”

Pikalov’s international electoral experience does not seem to be limited to the African continent. On 27 September 2014, he flew to Belgrade, Serbia and traveled on to Republika Srpska in Bosnia and Herzegovina. He returned via Belgrade on 15 October 2014. During this period, which coincided with the re-election bid of the Kremlin-supported President Dodik, a large group of Cossacks arrived to the small country and loitered around the streets for several weeks in full paramilitary attire. The theatrics of this visit were implausible: an all-male group, 144 strong, had ostensibly arrived to dance at a cultural exchange festival. However the trip was widely seen as an effort to interfere in the elections by suppressing an anti-Dodik vote. The spokesman for the group gave interviews in which he, half-smirking, repeatedly denied that the visitors were Russian Spetznaz. The Cossack group left immediately after the successful reelection of Dodik on 12 October 2014. As we reported in 2017, Konstantin Malofeev traveled to Republica Srpska during the same period and was photographed with Dodik on election day.

While we could not find Konstantin Pikalov in photographs from the 2014 events in Bosnia and Herzegovina (most “dancers” shied away from the cameras, as was reported by local media), his co-shareholder in the Convoy Military Security company, Vasily Yaschikov, did post photographs from Banja Luka.

A year after his trip to Republika Srpska, Pikalov took a twenty-day trip to Kazakhstan beginning on 20 June 2015. He also made a number of trips to Finland and Estonia, possibly to justify his freshly-issued Schengen visa.

Col. Konstantin Pikalov, seen getting progressively younger on different passport photos used for various travel documents since 2015

In and Out of Africa

While former employees of Prigozhin’s back office we interviewed on the condition of anonymity told us that “Mazay” was known to have been taken part in military operations in both Ukraine and Syria, we did not find corroborating data in the border crossing or flight records. This, however, does not indicate he did not travel to those destinations, as he would have done so either on military aircraft or by crossing the border with Ukraine illegally.

Pikalov’s first tour in Africa, based on commercial flight records, began on 7 July 2018 with a trip to the Central African Republic by way of Istanbul. It is not clear if and what other countries in Africa he may have visited during this trip, as he returned to Moscow two-and-a-half months later on 28 September 2018 by way of Amsterdam.

He stayed in Russia only two weeks and then returned to Africa for a second tour – this time flying by way of Qatar to Madagascar initially on 9 October 2018. He stayed in Madagascar until at least after the presidential elections in November that year, and returned – likely after spending time in the CAR – to Russia via Paris on 21 January 2019.

Pikalov’s third African tour began on 9 April 2019 and ended on 15 July 2019. During this trip he flew via Qatar and Lisbon, and spent a significant amount of time in the CAR, judging by references to Mazay in the leaked correspondence. His last trip to Africa was the shortest: between 26 November and 7 December 2019. He flew to and back from an unidentified location via Istanbul.

It must be noted that this trip history to Africa may not be exhaustive, as they may exclude flights on military aircraft, which are not subject to the same border-crossing logging as commercial flights.

Flying under the EU Radar

Despite being on the blacklist for money-laundering in Russia, his apparent key role in Russia’s hybrid military-mercenary operations, and interference in elections in Africa and the Balkans, and despite his possible – but not independently investigated – link to the murder of independent Russian journalists, as well as to torture of civilians in Africa, Konstantin Pikalov has been able to traverse Europe unimpeded. In the period 2015 to 2019, Pikalov has received three Schengen visas issued by the Finnish consulate in St. Petersburg, all granted for “tourism purposes”. His latest visa is valid through 16 March 2021. So far he has traveled, on his way to and back from assignments in Africa, via France, the Netherlands and Portugal.

Yevgeny Prigozhin, an arguably more menacing figure in Russia’s hybrid permanent war, is not under any EU sanction. The US indictment against him for fronting the electoral interference in the 2016 US elections has limited his personal travel possibilities. However, his proxies and associates continue unimpeded travel. European businesses continue conducting business with him. Following the US indictment against him and his group of companies, a German business trading with him sent the following email to his secretary:

“From now on, it will be hard to do business with Concord. Please pay future bills from any other unrelated company”

In Part 2 of this report, we will investigate Yevgeny Prigozhin’s history of illegally surveilling, threatening and harassing independent journalists, as well as fabricating false narratives to preempt Russian and foreign media’s attempts to peek into his relationship with the Russian military.

The post Putin Chef’s Kisses of Death: Russia’s Shadow Army’s State-Run Structure Exposed appeared first on bellingcat.