The mass exposure of Russia’s most valuable spies, the so-called “illegals,” allows for identifying some of
Moscow’s general approaches to setting up cover identities for their assets, as well as mechanisms for
deploying them in the country of destination and ways to exfiltrate them.
Greek intelligence officials announced that they had revealed the true identity of a female Russian spy who had been living in the center of Athens under a cover identity. According to the Greek National Intelligence Service (NIS/EYP), the case is being investigated by several Western intelligence agencies. Additionally, there seems to be a connection with Brazil where the Russian spy’s husband lived until recently under forged IDs.
In an article published by the Greek daily Kathimerini, the woman was identified as “Irena A.S.”. The report said she had arrived in Greece from an unspecified Latin American country in 2018. Soon afterward, she assumed a new cover identity, using the birth certificate of a Greek child named Maria Tsalla. The child is believed to have died in the northeastern Athens suburb of Marousi in December 1991, just a few days after being born. According to the report, NIS/EYP officers discovered that the dead child’s archived death certificate in the Marousi town hall had been removed by persons unknown, giving officials the impression that Maria Tsalla was still alive.
Soon after assuming her cover identity, Irena A.S. registered herself as a resident of Aliveri, a largely rural municipality on the central Greek island of Euboea. Less than a year later, using the name Maria Tsalla, she opened a knitwear store in the central Athens neighborhood of Pagrati, where she also rented an apartment. It is believed that she had hired an employee and had a Greek boyfriend, none of whom were aware that she was not Greek. According to the article in Kathimerini, the NIS/EYP has yet to uncover evidence that Irena A.S. was in contact with officials at the Russian embassy in Athens.
For reasons that remain unclear, Irena A.S. left Greece in a hurry in January of this year, leaving behind most of her personal belongings. She eventually contacted her store and apartment landlords, informing them that she would not be returning to Greece due to some health issues. In the weeks that followed, she ensured that all of her financial obligations towards her landlords and employees were met. It is believed that Irena A.S.’s husband, also a Russian national, who lived in Brazil using forged cover credentials, and going by the cover name “Daniel Campos”, also disappeared in January of this year. It is highly likely that they have both returned to Russia, possibly under fear of their cover being blown.
This case is similar in some details to that of Maria Adela Kuhfeldt Rivera, who returned to Moscow in 2018 due to the threat of being exposed in Italy. It was her passport number and series, linked with military intelligence operatives, that could point to her malign affiliation. During her deployment, she was working on obtaining information from and trying to recruit NATO officers stationed in Naples.
Similarities between the Rivera and Tsall cases point to the common elements of a cover identity that Russian intelligence uses for its elite “illegal” spies abroad.
The assets arrive in Europe from destinations in Central or Latin America. Earlier, RLI published an analysis showing how Russian intelligence opts for Argentina in an effort to infiltrate and legalize its deep undercover operatives.
Among other countries, Brazil and Peru were also used to create the cover identity and IDs. The choice is likely due to both the level of corruption, which allows intelligence to obtaining passports of these countries and the opportunities for visa-free travel to Europe once those passports are available. The two spouses arrested in Slovenia on charges of spying for Russia also held Argentinean passports. They turned out to have worked for Russia’s Foreign Intelligence Service. Sergey Cherkasov, who US intelligence believes is an elite “illegal” operative of Russia’s GRU military intelligence agency posed as Brazilian citizen Victor Muller Ferreira over many years and won an internship at the ICC.
Exposed Russian “illegals” usually run some small businesses, imitating commercial activities to explain their income and expenses. It should be noted that Russian intelligence, as a rule, doesn’t have their assets employed by random companies, instructing their “illegals” to manage their own businesses. The analysis points to a trend where the Russians use cover identities of foreign nationals who died in infancy, which complicates verification across various databases.
There was a similar story of Donald Howard Graham Heathfield, an infant who died decades ago in Montreal. The Russian spy, who stole Heathfield’s identity, worked for Global Partners Inc., a Canadian business-services firm. Russian intelligence field offices, or “rezidenturas,” at embassies regularly search in media for obituaries and personal data of the deceased. As they seize on the identity of a dead infant, they start building a new one for their asset around this base. The fact that such work has been going on since the Cold War times means the Russians have at their disposal a large selection of cover identities with incredible potential for choosing gender, locality, and date of birth. This practice is confirmed by the case of the Primrose-Morrison couple, who assumed the identities of two infants, Bobby Fort and Julie Montague, who had died in Texas in 1967 and 1968 respectively.
The exfiltration to Russia of their “illegals” judging by the incidents over the recent years, proceeds under the fake pretext of sudden and serious health issues. Perhaps, in this way, Moscow seeks not to harm their valuable assets by exposing them in a hope that taking them to safety in Russia will allow them to consider redeploying them after providing them with new handlers.
If their assets have already been detained and charged, Russia may launch an extradition request, claiming the person in question is wanted on criminal charges (non-related to spying) filed in Russia, as was the case of Sergey Cherkasov, the “illegal” who had tried to infiltrate the ICC using a fake Brazilian identity.
Most of the exposed “illegals” were supervised by Russia’s military intelligence, which confirms the assumption about a deep crisis in the agency’s operations.
