“Taken swiftly, so he wouldn’t have time to delete anything.” How investigators prove Facebook and Telegram account ownership in criminal proceedings

Vladivostok. Tretyakov

The case of opposition activist Dmitriy Tretyakov from Spassk-Dalny in Primorsky krai is now being considered by the Spassky District Court. However, finding information about the proceedings on the court’s website is difficult—only by clarifying the dates of the hearings can one find a depersonalised case file that does not mention either the defendant’s name or the Criminal Code article he is charged under.

The 32-year-old lawyer is accused of public calls for extremism via the internet (Part 2 of Article 280 of the Criminal Code) for reposting a text by publicist Arkady Babchenko from a Telegram chat of supporters of opposition leader Alexei Navalny. Tretyakov has been under arrest for a year.

“I’ll drop an important post now,” writes user Dmitriy in the chat, following which he reposts Babchenko’s text about a “social experiment on the people with negative natural selection” and the need for “mass national repentance.”

This text catches the eye of FSB officer Anatoly Verkhoturov, who, while engaged in “countering extremist and terrorist activities,” discovers it in the “Operation Duck” group chat and regards it as a “call to carry out extremist activity.”

Based on the case file materials provided to Mediazona by Sergei Valiulin, a lawyer with Pravozashchita Otkrytki, a human rights project, the logic of the investigative actions can be reconstructed: first, a search with seizure of the phone, then reinforcing the obtained data with witness testimony. During the search, in addition to a T-shirt with the inscription “In any unclear situation, blame State Department cookies,” a ZTE smartphone was found on the activist, and in it—the Telegram app linked to a phone number and the username Dmitriy (@dimambr).

After that, special services officers interrogated storekeeper Roman Gutarev, who has known Tretyakov since childhood; he said that Dmitriy Tretyakov used the nickname “either Dimon or Dmitriy.” Next, police inquirer Anton Kisashev from Spassk-Dalny, who went to school with the suspect, was questioned; they later worked together in the inquiry department. Kisashev confirmed his friend’s, Dmitriy’s, use of the Dmitriy username and added that even while serving in the police, Tretyakov “was into politics, supporting the movement led by blogger Navalny.”

A secret witness from Navalny’s Vladivostok headquarters, who asked to change his personal data, was also interrogated. He told the FSB about the “Operation Duck” chat and its participant Dmitriy (@dimambr), who forwarded Babchenko’s post and “indicated that it was necessary to confront law enforcement officers, that is, to fight them, burn police vans, set up barricades, and sleep on the street with bonfires.”

“I became curious about who the fearless and desperate person named Dmitriy was,” the anonymous witness explained. “Around July 2017, while communicating with Alexei Navalny’s supporters, I learned that the person named Dmitriy <...> is a volunteer at the headquarters <...> named Dmitriy Tretyakov. I remembered the last name because I really love hockey, and it was associated with the legendary Soviet goaltender Vladislav Tretiak.”

The fourth witness interrogated was Valentin Ivanov, a detainee at Vladivostok’s Detention Center No. 1. He testified that on March 16, 2018, he was brought to the investigative department of the FSB Directorate for Primorsky krai, where “one of the suspects” informed him about the detention of Dmitriy Tretyakov “for extremism.” Later, Ivanov was placed in a shared cell with a stranger named Dmitriy, who “said that he [was arrested for] extremism, namely for writing on the internet, ‘reposting’ an article related to setting police vans on fire.” “I realised that this person named Dmitriy is none other than Dmitriy Tretyakov,” the detainee’s recollections are recorded in the protocol. “He spoke negatively about the current government, namely against President V. V. Putin, the Russian government, and others. Moreover, at one point, the cell №1 door was opened by a convoy guard Alexey, and you [presumably senior forensic investigator Tunyk, who conducted the interrogation—Mediazona] were standing with him. You greeted and asked those present how they were doing, after which Tretyakov D. uttered the phrase: ‘Beat the cops, save Russia’.”

Another detainee, Sergei Petrov, said that on March 16 he was also at the FSB investigative department, where he heard about the detention of an “extremist who is being blamed for a ‘repost’.” After that, he met a young man in his cell, whom someone asked “if he was that extremist,” and he answered affirmatively. At the same time, witness Petrov says that he heard the phrase “beat the cops, save Russia” in a different context—it was mentioned by one of his cellmates in a conversation, adding that “they don’t imprison for that.”

In the presence of witness Petrov, an proper operative experiment was conducted: an FSB officer entered Tretyakov’s number in the phone’s address book, then opened Telegram and found a contact under that name. Then the officer opened Instagram, searched for a user named @dimambr, found his user profile and took screenshots.

Finally, the case file contains a video recording in which Tretyakov talks in an FSB investigative department cell with another detainee, Andrey Tarnopolsky, and allegedly confirms that he made the repost. The recording is dated April 10, 2018; after reviewing it, Pravozashchita Otkrytki lawyers accused the special service of trying to get Tretyakov drunk for testimony: according to lawyer Valiulin, during the four-hour conversation, FSB officers passed several bottles of cognac in bags to Tarnopolsky, and the detainees drank some of the contents. The defence petitioned to exclude this video from the evidence.

Last year, the Memorial Human Rights Center recognised Dmitry Tretyakov as a political prisoner. The human rights activists noted that the Primorsky krai resident’s short comment did not contain calls for violence, Babchenko’s text was not recognised as extremist material, and none of the chat readers—including Tretyakov himself—committed any crimes after the repost. At Memorial, this criminal case was called “an attempt by the FSB to create a practice of prosecuting Telegram users for posts and messages in this messenger, which is popular among Russian users, including due to its principled refusal to cooperate with special services.”

Crimea. Kurbedinov

Emil Kurbedinov is one of the most well-known lawyers in Crimea who specialise in cases against Crimean Tatar activists. In January, the Ministry of Justice demanded to exclude Kurbedinov from the list of members and founders of the bar association, citing court decisions that arrested the defender for publishing a video from a Crimean rally of the Hizb ut-Tahrir movement, recognised as a terrorist organisation in Russia. The lawyer was found guilty under the article on displaying extremist symbols (Article 20.3 of the Code of Administrative Offences).

Documents from the Crimean Center for Combating Extremism (commonly referred to as “Center E”) in December 2018 reveal that in November, police officers investigated an appeal from a man named Sahim Muallem, who had previously lived in Crimea before moving to Damascus, Syria. In a message from Syria, Muallem wrote, “I ask you to pay attention to this situation, especially to the activities of Kurbedinov E., who, under the guise of serving the people, diligently works for his Hizb leaders and promotes extremism.”

Opening Kurbedinov’s Facebook page, the operatives established “the fact of public display of symbols and attributes of a terrorist organisation”—a leaflet with a black flag against the background of the globe “with inscriptions presumably in Arabic and the signature Hizb ut-Tahrir Ukraine.”

Unlike VK, obtaining information about Facebook users is challenging for law enforcement. In Kurbedinov’s case, the security forces attempted to prove his account ownership through other posts, including saved video streams of the lawyer. The case file contains an interview with an employee of the General Radio Frequency Center, a subsidiary of Roskomnadzor (Russia’s censorship agency), who stated that only the account holder can broadcast on Facebook. Additionally, former FSB operative Andrey Sushko, who appeared in the video broadcast, was interrogated by the Center E and confirmed that lawyer Kurbedinov filmed him in September 2017.

The account owner reposted a leaflet featuring the Hizb ut-Tahrir flag back in 2013. In 2017, Kurbedinov was arrested for 10 days for the same post on VK. Nine defenders stepped up to represent the lawyer, demanding the termination of proceedings. They argued that there was no direct intent to undermine the constitutional order, as the posts were made when the constitutional order was different. However, Judge Anton Tsykurenko of the Kievsky District Court in Simferopol disregarded these arguments and sentenced Kurbedinov to five days of administrative arrest.

Crimea again. Mustafayev

Crimean Solidarity activist Marlen Mustafayev was also tried in September last year in an administrative case on Hizb ut-Tahrir symbols on Facebook (Part 1 of Article 20.3 of the Administrative Code). According to the investigation, in 2014 he published a post with the symbols of an organisation recognised as terrorist in Russia.

In court, Mustafayev did not confirm the authorship of the post, saying that he did not remember whether he wrote it. Then, according to lawyer Nazim Sheikhmambetov, officers of the Center E presented an operative’s report stating that during a search as part of a criminal case, the police “opened an account on his phone and asked: ‘Is this your account?.’ He said: ‘Yes’.” The operatives did not send a request to Facebook, referring to the fact that the company does not have an official representative office in Russia.

Judge Viktor Mozhelyansky of the Kievsky District Court of Simferopol accepted the evidence and sentenced Mustafayev to 12 days of administrative arrest. Like lawyer Kurbedinov, this was Mustafayev’s second conviction—he had already served 11 days for the same VK post. Notably, Judge Mozhelyansky might have simply copied the text from his previous decision against Mustafayev, as the final paragraphs in the 2017 and 2018 rulings are identical. The document even mistakenly mentions VK instead of Facebook.

Another error likely stemming from the judge’s inattentiveness was the inclusion of a line from the old ruling’s operative part: “Return the Nokia mobile phone to Mustafayev M.E.” In fact, the phone was seized and returned in 2017. In 2018, the Supreme Court of Crimea had to cross out this line “as erroneously stated.”

And again Crimea. Kadyrov

Crimean Tatar activist Suleiman Kadyrov was charged with public calls for separatism (Part 2 of Article 280.1) for reposting a video on Facebook with the comment “Crimea is Ukraine...” According to the prosecution, Kadyrov added: “I, Suleiman Kadyrov, agree: Crimea is Ukraine. It has always been and will be. Thanks to the author for the video. I support it.” In court, Kadyrov denied the accusation, linking the prosecution to his political activities and denying that he posted the video.

The case file, reviewed by Mediazona, reveals that on October 5, 2017, FSB operative Dolgachev searched Kadyrov’s home in Feodosia, seizing a laptop and phone. The operative claimed the laptop automatically logged into Kadyrov’s Facebook account, which Kadyrov confirmed was his, though he refused to sign the search protocol. Investigators also noted that a connection was made from Kadyrov’s phone at the time of the alleged post, confirming his presence at home.

In March 2018, the Feodosia City Court sentenced Kadyrov to a two-year suspended sentence and two years of probation, with a ban on public activities.

Kurgan. Lesovoy

Entrepreneur Yevgeny Lesovoy, 52, from Kurgan, is now free after serving two years in a colony-settlement for extremism in the Telegram chat of the banned Artpodgotovka movement. According to the Investigative Committee, on November 5, 2017, just before the “revolution” announced by the movement’s leader, Vyacheslav Maltsev, Lesovoy posted messages promoting mass riots, arson, and violence against authorities.

Lesovoy was detained on November 7, allegedly with a smartphone containing incriminating chat correspondence in his pocket. Until recently, the details of his case remained unknown. Anastasia Polyakova, a reporter for the Oblast 45 publication who attended the court hearings, told Mediazona in 2018 that during the process, the swiftness of the operation to detain Lesovoy was separately mentioned—and explained: “He was ‘taken’ so abruptly so that he wouldn’t have time to delete anything.”

Despite denying involvement with extremist groups, Lesovoy was sentenced to two years in a colony-settlement and banned from administering websites for two years. After his release, Lesovoy told Mediazona he planned to appeal, claiming that while he was imprisoned, he was bankrupted and his property, including gas stations and plants, was sold off.

His case file outlines the security forces’ work: on November 4, 2017, they examined the Telegram chat “Kurgan 5.11.17”; by November 6, a criminal case was initiated for inciting riots. On November 7, Lesovoy was detained, and the next day, charges of promoting extremist activity were added. In April 2018, inciting hatred against police officers was also included in the charges. However, the final verdict only involved the charge of extremism.

The investigation documented their methods thoroughly, using fake accounts to infiltrate online chats. They identified Lesovoy as the user LEV, who inquired about the time and location of the protest rally in Kurgan. LEV mentioned that he had “only participated in sending one hundred and fifty people to Moscow” but did not go himself, as “desperate heads are needed here.” He advised against bringing weapons to the “revolution,” stating that “the cops will take it right away.” Instead, he suggested taking weapons from the security forces or using stones. “Everyone should know that the winners are not judged, and the losers are [hanged] on poles,” LEV instructed his associates.

Shokhirev and Popov, two Kurgan residents invited to examine the chat, provided nearly identical statements confirming that LEV “constantly called on those gathered to go to protest actions and carry out physical reprisals against Putin’s supporters and police officers.”

On November 5, the user Boogerman Boogie-Woogie expressed his concerns, saying, “Damn, I’m freaking out. If there are few of us, they will break us right away! It’s game over, not a Revolution. Somehow it’s not organized.” In contrast, LEV remained determined, reminding the group about the gathering time and instructing them about the “ultimatum until 2:00 a.m. in Kurgan, and then we start burning, igniting, or rather, the gallows.”

On the day of the planned event, Boogerman Boogie-Woogie wrote, “Only some damn teenagers were there, in groups of 3–5 people. Where are the fighters? Where is the action? Where is the revolution?” Another user, Fucking ASSHOLE, replied, “I’m near the train station, attacked the cops. Threw stones at them. Well, at least something.”

Later, these incredible nicknames appeared in a request from the Kurgan Region’s Ministry of Internal Affairs to Interpol. The investigation determined that Telegram is registered in the UK and sought assistance in obtaining information about the users LEV, Boogerman Boogie-Woogie, Ilya Drunk Bastard, Fucking ASSHOLE, and their comrades from the “law enforcement agencies of England.” The request included a machine translation into English, which transformed the group name “Kurgan 5.11.17” into the literal “mound 5.11.17.”

Investigators meticulously documented the process of identifying LEV. They accessed VK, found the “Artpodgotovka Kurgan” group, and discovered a user named “Yevgeny Lesovoy” with the same avatar as LEV. After identifying him as the only person in Kurgan with that name, they detained him. Lesovoy recounts, “I was driving in a car, surrounded by officers. They tried to break the windshield, so I got out. I had a phone in my hand, which they knocked out during the detention, and it flew under the car. At the trial, they presented a shortened video and ignored this fact. During the search, this phone appeared in my pocket. Whether it’s my phone or not, I don’t know. I only saw it when they showed it to me for the first time, and that’s it.”

Based on the case file, a Lenovo phone with two SIM cards was seized from Lesovoy. The Investigative Committee claimed it had subscriptions to Maltsev’s channels and the Telegram account LEV. Even before his detention, operatives had tapped Lesovoy’s phone and recorded his conversations for two days. By May, investigators obtained Lesovoy’s call records from Tele2 company, which mentioned a Telegram message from October 24, 2017. They argued this “directly indicates that the Telegram messenger was installed and subsequently used by him.”

The investigator insisted on the urgency of searching Lesovoy’s home, claiming he could “instantly delete correspondence” and “inform his relatives about deleting the Telegram application” after being detained. During the search, a disc containing a file named “listovka” was found, calling for Putin’s resignation at a November 5 rally. Lesovoy maintains the file was altered during the search, which the investigator indirectly admitted was due to a “technical error” in the protocol.

Correspondence with “Vyacheslav Maltsev” was also found on Lesovoy’s phone in WhatsApp and Viber, discussing Kurgan’s role in the “revolution.” LEV mentioned asking a judge to postpone a bankruptcy hearing due to the impending revolution; the judge approved.

During his first interrogation, Lesovoy claimed he was a United Russia party member, didn’t use social networks or Telegram, and grew flowers in his free time. His lawyer argued that no mass riots occurred, calls for extremism should address a wide audience, and “law enforcement officers” aren’t a social group that can be offended. Lesovoy insisted the phone was tampered with during repair.

The prosecutor sought a 5-year sentence under three articles, but the judge only applied Article 280 part 2, sentencing Lesovoy to two years. The defense appealed, arguing Lesovoy was unaware of Artpodgotovka’s ban and the documents weren’t extremist.

The verdict was upheld. “Imprisoned for nothing, they took everything...” Lesovoy remarked, before adding, “But these are trifles. Life is healthy, we will work it out.”

Baltiysk. Petrovsky

Alexander Petrovsky, a 35-year-old taxi driver from Baltiysk, became a defendant in a case of public calls for terrorism (Part 2 of Article 205.2 of the Criminal Code) due to two audio messages he sent to the Telegram chat “Revolution Kaliningrad” on October 31, 2017. According to the investigation, Petrovsky urged the chat’s 100 subscribers to erect barricades, seize military units, and kill police officers with Molotov cocktails to “overthrow the power of the central government.” He was detained on November 5, the day of “Maltsev’s revolution.”

Experts deemed the taxi driver’s messages to be “speech acts for a radical upheaval of the entire socio-economic structure of society.” Petrovsky admitted to recording the messages but maintained his innocence. Witnesses included two operatives from the Center E and Kaplyukov, the alleged creator of the “Revolution-Kaliningrad” chat.

Petrovsky’s lawyer, Rostislav Kulikov, told Mediazona, “He was registered simply as Alexander in a general chat. They agreed to meet with a person, who I understand was an FSB informant. They were waiting for him. It was simple: I hadn’t joined the case yet, and during the first interrogation, he said he was registered under a certain nickname and had sent audio messages. A phonographic examination confirmed the voice matched Petrovsky’s. That’s it.”

During the trial, Petrovsky suggested the chat might have been created by the security forces. On May 21, the Moscow District Military Court sentenced him to two years in a general regime colony; the sentence was upheld on appeal.

Cheboksary. Ishutov

Konstantin Ishutov, an activist and opposition blogger from Cheboksary, became a defendant in a criminal case on the rehabilitation of Nazism (Part 2 of Article 354.1 of the Criminal Code) last fall due to a Facebook post. Ishutov had published a German leaflet from World War II addressed to Soviet soldiers, which called for “ending senseless resistance” and promised to transfer land ownership to peasants and restore religious freedom. Ishutov added: “When the Third Reich treats the Soviet people better than Putin treats the Russian people.”

Although not arrested, Ishutov was banned from using the internet, leaving his house at night, and sending letters during the investigation. At the October 8 hearing, police officers summoned activists who came to support Ishutov to confirm that the Facebook account belonged to him. However, this was insufficient.

Lawyer Yuri Ivanov explained that to link the account to Ishutov, the investigation needed registration data such as the date and time of registration, email address, phone number, and IP address. This information is harder to obtain from Facebook than from VK.

To prove the account belonged to Ishutov, investigators ordered a molecular genetic examination of a bicycle helmet, based on the account’s profile picture showing Ishutov wearing the helmet. The logic was that if Ishutov’s biological material was found on the helmet, it would confirm his ownership of the account. However, the investigation disregarded the possibility that anyone could have found Ishutov’s photo online and used it for a fake account.

Investigators also ordered two molecular genetic examinations of Ishutov’s keyboard and mouse, which he did not deny owning, seized during a third search. Ivanov believes the investigators are desperately seeking evidence, noting that each examination costs 10,000 rubles, with about twelve already appointed. He finds it concerning how much money will be spent on a baseless case.

Currently, no active investigative actions are being conducted. During the investigation, Ishutov was fined 1,000 rubles under an administrative protocol for disseminating extremist materials in a six-year-old LiveJournal post containing a slogan about “Russian power” in Russia, which is recognized as extremist.

Magadan. Baykov and Grabar

Last year, two Magadan residents, Dmitry Baykov and Dmitry Grabar, were charged for messages they sent in a public WhatsApp group that insulted the city’s mayor, Yuri Grishan. The messages were considered a public insult to a representative of the authorities under Article 319 of the Criminal Code. The incident occurred amidst discussions about reinstating direct mayoral elections in Magadan, which were canceled in 2013.

To identify the authors, mobile phones were seized from subscribers of the WhatsApp group “For the return of mayoral elections” in March 2018. A Magadan resident named Natalya told the Vesma publication that two policemen, one introducing himself as an employee of the department for combating terrorism, came to her home and confiscated her phone. Later investigators questioned her about a message containing obscene language directed at the mayor. Natalya clarified that she did not write to the group and was neither an activist nor a terrorist.

The Investigative Committee subsequently explained that the seizure of mobile phones, which caused widespread discussion on social networks, was conducted lawfully, and the phones were returned to their owners. They assured that information unrelated to the criminal case was not examined.

Court decisions revealed that Baykov and Grabar participated in the WhatsApp groups “mayor-resignation #1 09.12.17” and “mayor-resignation #1 21.01.18”. On January 31 and February 1, they intentionally and publicly sent messages humiliating the honor and dignity of the mayor in connection with his official duties. Both defendants pleaded guilty, apologized to the mayor, and were fined 15,000 rubles (about 225 USD back then) each before the cases were terminated.

Shortly after the incident, an article in Vesma reported that “the mayor of Magadan commented on his ‘insult,’ quoted Navalny, and compared himself to Trump.” In a conversation with a local journalist, Yuri Grishan explained that the attacks offended him not just as a city head but as a person and a man.

Again Cheboksary. Rybakov. Happy ending

Vyacheslav Rybakov, another resident of Cheboksary, faced a unique situation with an unexpected outcome. In December 2017, Rybakov was detained for a Facebook post that allegedly demonstrated Nazi symbols (Part 1 of Article 20.3 of the Code of Administrative Offenses). The post in question was a repost of Vladimir Putin’s portrait with a swastika drawn on his forehead.

The Leninsky District Court received the administrative offense protocol but refused to consider it, as the police failed to provide evidence that Rybakov was the one who made the post.

After the court’s refusal, the police attempted to enter Rybakov’s apartment to conduct an inspection and seize his computer, but he denied them entry. The police left empty-handed and did not pursue any further claims against Rybakov, as confirmed by Alexei Glukhov, a lawyer from Agora, a human rights group.

Editor: Dmitry Tkachev