Russia Theft Watch: when corporate interests hijack the open-source investigative space

_{This post was written in August 2022.}

On the 26 July 2022, the Russian Theft Report dropped, claiming to ‘expose’ Russia’s looting of Ukrainian assets “like steel and grain” using “open-source intelligence tools”. The report was the work of the Initiative for the Study of Russian Piracy (ISRP)  a self-described group of “former U.S. government officials, international trade experts, national security experts, and research analysts concerned by … Russia’s theft of Ukrainian assets”. In the days before and after their publication, they would receive media attention in places such as the New York Times and AP News.

For reasons I will get into below, no one seriously doubts that Russian forces are pillaging Ukraine in a variety of ways (so, no, this is not a post that in any way exonerates Russia for its criminal aggression against Ukraine). But, unfortunately, the Russian Theft Report makes the case in a remarkably poor way. The report itself is not great with many simple errors and questionable data.

I say this as someone who has paid close attention to Russian looting of Ukraine. I just also happen to like looking at what makes investigations high or poor quality. Both of these interests motivated me to look a little closer. And the more I looked into the Russia Theft Report and ISRP, the more uneasy I became about the whole project. It didn’t take more than a little digging to figure out that ISRP is a purpose-built vehicle for the efforts of one of Ukraine’s richest men to defend his interests in the steel trade.

So, while I started to try to get a handle on the veracity of this report, and then write a post about a poor-quality maritime investigation, I will instead describe an example of how powerful people and corporations can invade the open source ‘space’ for their own benefits.

First, to the report. One is immediately struck by how dull it is. I am tempted to suggest that a first red flag for the veracity of any document should be the use of MS Word default font Calibri throughout the entire report. What I mean is that, overall, the Russia Theft Report document has the feel of something that was quickly thrown together by an moderately competent intern not a report that would launch the ISRP as a serious initiative.

More importantly, I would argue almost nothing in this report is new. The transportation of stolen grain and steel has been extensively covered by a number of investigations and monitoring projects that report on suspected ships leaving Ukraine with looted goods.[1]  The report does cite to this work, which is the least it should do, but in a way that does not make clear the fact that it relies on this work almost exclusively. I suppose there is no harm – and potentially some good – in amplifying the results of these investigations. But the report was sold as an exposé and a lot of it just isn’t. It is hardly what you’d expect of a high-powered group of former government officials using “open-source intelligence tools”. More like a competent undergraduate’s paper.

A mistaken ship called Miranda

Drawing on the reports of other open-source researchers, the report produces a long list of ships that have partaken in transporting stolen grain and steel. But the list also includes a ship called Miranda. According to their report, the Miranda received stolen goods from a ship called M. Andreev (IMO 8946377) during a stop at sea, in the Kerch straight, on 17 June 2022.

There are two problems with this claim. The first is that it is not easy to verify. Miranda is a general and common name for a ship and including no other details about the ship leaves me having to guess which Miranda this is. The writers of the report did not include the ship´s unique identification number (IMO number) which is standard practice for this kind of investigation. If they knew what they were doing and/or had any understanding of the importance of transparency in open-source investigations, they would have done so. However, I was curious about what this ship called Miranda was. So, initially I decided to run it through the maritime database called Equasis, to see if I could figure out which of the Mirandas the report was referring to.

To my surprise, I could not find any ship called Miranda that could have transported stolen grain. Most of the ships were not built to carry 3700 tons of grain (which was the reported size of the Andreev´s cargo) or they were so old they have been taken out of service.  

IMO number	Name of ship	Gross tonnage	Type of ship	Year of build	Flag
7314620	MIRANDA	144	Tug	1969	Bulgaria (BGR)
9020182	MIRANDA	601	Fishing Vessel	1990	Ecuador (ECU)
8329995	MIRANDA	463	Fishing Vessel	1983	United Kingdom (GBR)
7715965	MIRANDA	30995	General Cargo Ship	1979	Bahamas (BHS)
8330542	MIRANDA	235	Pollution Control Vessel	1984	Russia (RUS)
9738258	MIRANDA	397	Utility Vessel	2016	Bahamas (BHS)
8619948	MIRANDA	373	Fishing Vessel	1987	United Kingdom (GBR)
8328006	MIRANDA	262	Fishing Vessel	1981	Venezuela (VEN)
5127970	MIRANDA	265	General Cargo Ship	1915	Not Known
6418118	MIRANDA	17042	Bulk Carrier	1964	Panama (PAN)
5236642	MIRANDA	308	Fishing Vessel	1919	Greece (GRC)
7028465	MIRANDA	1236	General Cargo Ship	1970	Norway (NIS) (NIS)
9344394	MIRANDA	3610	General Cargo Ship	2007	Antigua and Barbuda (ATG)

Since the report provided a time and place for the transfer between the Andreev and the Miranda, I decided to dig a little. I created a trial account with MarineTraffic to access historical data to see if I could find out more. I was able to determine which ship M.Andreev had, according to AIS data, met with on the 17 June. To my initial surprise, the vessel did meet with a ship called Miranda. This Miranda (IMO 8330542, fifth from the top in the above table) is a pollution control vessel and is largely incapable of carrying cargo, never mind 3700 tons of grain.

Sloppy? Probably. But It raised the likelihood of other flaws or mistakes yet to be uncovered and in general reinforced my negative first impression. Note: This was actually the first and only ship I had bothered to check out, in part because I had not seen Miranda reported elsewhere (for example, I had not seen Катерина Яресько for Myrotvorets mention this ship) or anyone else on Maritime Twitter.

One more point about the content of the report itself is the characterisation of sea transportation in the Sea of Azov. The report claims ships travelling through the Sea of Azov turn off their AIS transponders until they reach the Kerch Straight. The image on the left is the one used in the report. Honestly, I have not seen the Sea of Azov that empty before. By way of comparison, the image on the right is a screenshot I took of the MarineTraffic livemap 8 August 2022 at 17:30 CET just by way of comparison. Lots of AIS pings on 8 of August. Go ahead and give it a try. [I have reached out to MarineTraffic for help on this issue but no luck yet].

2. What even is ISRP?

The presentation, lack of transparency in their methodology, the flaws in their findings, and piggy-backing off other peoples work without properly citing them bugged me enough to that I wondered, who are the people behind this report? What is ISRP?

In their introduction, the ISRP state that the “investigators responsible for this report do not have access to … any non-public information or classified intelligence developed by the Ukrainian state”. OK. Fine. ISRP did have a web site but did not seem to have a street address. The apparent focus on Washington D.C. prompted me to begin searching for U.S. officials online that had spoken publicly about ISRP, but to no avail. The sole exception is ISRP spokesperson, James K. Glassman, a former U.S. Under Secretary of State under President Bush from 2007-2008.  

Then I noticed a notice at the very top of page 3 of the report:

“These materials are distributed by DCI Group AZ, L.L.C., on behalf of SCM Consulting, Ltd. Additional information is available at the Department of Justice, Washington DC.”

Not too long ago, media engagement would perhaps have been less of an issue for Rinat Akhmetov who recently had to hand over his large media holding to the Ukrainian state due to an anti-oligarch law coming into effect. It would seem he has found other ways to influence the discourse, such as hiring a D.C. PR firm to create a questionable research institute, piggybacking on the work by open-source researchers, in order to shape a narrative favourable to its client’s interests.

Almost exactly a month following the report, the ISRP published a tweet claiming to have uncovered “shocking new evidence that Russia is likely stealing advanced equipment from Ukrainian-owned steel plants in Mariupol”. It is unclear to what degree the report, ISRP, and Akhmetov’s legal battle hang together, but one can guess.

No real surprise there, but definite harm done to the credibility of the very legitimate claims of Russian looting of Urkainian assets, as well as to the reputation of open-source investigation as a investigative method of backing up those claims. Anything to do with the war in Ukraine is hotly contested online and poor-quality investigations only add to the confusion and undermine the credibility of open-source investigations in the process. There is a lot of evidence to suggest Russian is systematically pillaging Ukraine so it should not be too difficult to get things right.

I tried reaching out to ISRP for comment on multiple occasions but got no response.

Some final words

The Russian invasion of Ukraine demonstrated the impact open-source information and investigators can have in shaping the narrative of war, effectively dealing with Russian disinformation campaigns. For the most part, it has been citizens leading the way, although we should not underestimate the role of state actors in trying to shape the discourse online. Governments and special interest organizations on either side have been paying closer attention to the success of open-source methods. We are increasingly seeing powerful people and corporations looking to utilize and shape this public space for their own benefit. While there is nothing illegal about ISRP or SCM efforts, it does demonstrate how quickly special interest groups can hijack someone’s work when the topic interests them.  

 

---

[1] For example, Катерина Яресько is an open-source researcher for Myrotvorets and has covered looted grain and steel a great deal. She is cited in the ISRP report. Other investigative reports have also relied extensively on her and her colleagues´ work.

[2] The application was received on the 19 May 2022, three days after the last troops at Azov steel factory surrendered on the 16^th  May 2022.

---