3 ms·

> Travel and border crossing data, recently made available thanks to an avalanche of terabytes leaked from Russian government databases, showed that Elena Šapoš

> Travel and border crossing data, recently made available thanks to an avalanche of terabytes leaked from Russian government databases, showed that Elena Šapošnikova is in possession of a secret Russian passport. Critically, her nine-digit passport number is part of a numerical range reserved exclusively for members of Unit 29155, differing from those of her colleagues only by its last two digits. Šapošnikova’s is 646518955. That is very sloppy of Russia. Why even bother doing something so dumb? > Šapošnikova used this passport to travel between Greece and Russia on at least two occasions, once in December 2015 and the second time in December 2017. In both cases, she used sophisticated tradecraft that sought to leave no trace in databases accessible to European authorities. For instance, she booked her trips and bought her plane tickets using her Czech passport, registering only that nationality with the Greek airline. But upon crossing the Russian border, Šapošnikova used her secret Russian passport, thus bypassing the need to obtain a Russian visa issued to her as a Czech citizen and eliding the digital footprint associated with the relevant application. How does "bypassing the need to obtain a Russian visa" "elide the digital footprint associated with the relevant application"? Why would the Czech government learn of a visa application to Russia? The airline most likely would want to know that Šapošnikova had a visa, so they would have looked, and Šapošnikova would have shown them her Russian passport, which the airline probably would have reported to Czech authorities (I imagine that's what happens normally). So this is just more sloppiness, or at least TFA reaches the wrong conclusion about the point of not Šapošnikova not applying for a visa. Perhaps she should have applied for a visa so as not to have to reveal her Russian passport to the airline, or she should have had a different Russian passport to show the airline. In any case, having a block of passport numbers for a super-secret ops team is just beyond dumb. It's so dumb that I'm not sure I believe it -- I might sooner believe that such evidence was planted than that such evidence is real, but maybe the Russians just don't have enough Soviet-era intelligence clue left and haven't developed enough post-Soviet intelligence capabilities.

eastbound 3y ago
Yes: “Great, you’re our spy now. Keep it secret. Also, please always carry on you this piece of Russian evidence with serial numbers adjacent to all our other moles, because otherwise our own border patrol may reject you on entry with your Czech passport, I decided.” So they’re telling us that Russia is that bad at spying. But the first commercial supersonic jet was the Tupolev 144, not the Concord.
- dralley 3y ago
  The Tupolev 144 was famous for being an utter piece of shit, rushed for the propaganda value of being "first", put into service with half the flight testing as Concorde, and crashing multiple times with not that many flights on it's record
ivan_gammel 3y ago
>That is very sloppy of Russia. Why even bother doing something so dumb? Some old-fashioned generals did not account for the digital footprint that may be left and modern data mining capabilities when they designed it. In fact, that digital footprint may have not existed yet when the entire scheme was designed. When you need to tell everyone doing ID check that this person must not be bothered, you give them plates from some VIP series or a passport with a certain number - it was a common practice in Russia. I'm pretty sure that this has changed in last few years after those investigations and they write the laws and design the databases assuming zero trust (public property registries now hide or obfuscate information about some entries for example).
- cryptonector 3y ago
  I too can guess that the point of the ID block was for Russian migration controls to more easily understand that "these people are special", but that would be idiotic whether it was done in 1950, in 1970 or in 2020.
  - epolanski 3y ago
    And what's the point of Russian border control having them know? They are Russian citizens with a Russian passport, they can enter their country without issues.
    - cryptonector 3y ago
      I know right? What tremendous foolishness. It's incredible, as in just not believable.
      - dralley 3y ago
        Not any more unbelievable than the sloppiness behind the attempted assassinations of Navalny, Skripal or the successful assassination of Litivenko
epolanski 3y ago
> That is very sloppy of Russia. Why even bother doing something so dumb? Because the scheme predates today's digital capabilities.
- cryptonector 3y ago
  Why would they have needed this in 1970, or 1950?
- refurb 3y ago
  That doesn't make much sense. If you have suspected spies, the first you'd do is pull their entry into the country. It wouldn't take long to realize the similarity between passport numbers. Even in the 1950's.
  - ivan_gammel 3y ago
    You cannot draw any conclusions from this similarity alone. The scheme is common and sequential numbers were likely used in many other legitimate cases. You think this is a flop only because The Insider has found very close numbers of passports for people in the same military unit. But there are just 4 numbers of 100 in the same range. Is there any evidence that the remaining people belong to the same unit, are spies or even work for Russian government?
    - refurb 3y ago
      Sure, but that's no different back then than now? You catch 3 spies in 1950. Someone shuffling through their paper files notices the numbers are close in range. You have a suspected 4th, and interestingly the passport number is clustered with the prior 3. You use a super computer to analyze passport numbers and compare them to 3 known spies. The computer spits out a pattern. [...] You have a suspected 4th, and interestingly the passport number is clustered with the prior 3. As per the original post it "is part of a numerical range reserved exclusively for members of Unit 29155". I could see if it wasn't a numerical range, but rather a reserved pattern (e.g. the 2nd, 3rd, 7th, 8th numbers were always sequential), then sure, a super computer could help you analyze known number to find a pattern. But it's just a group of number close in series? That seems discoverable by mere humans.
lobochrome 3y ago
While I agree with your general point, thinking about the passport numbers for a bit makes it plausible: - You would have to reserve some numbers that can't be assigned to regular citizens. - If you make those "random" - you need to store them in a database that can be checked against when issuing numbers to regular citizens. - You wouldn't want such a database to exist. - If you remove a whole "block," it's much simpler (do not assign passport numbers starting with...). - Passports are NOT issued by the services themselves, and normal institutions (foreign office) only collaborate "covertly" — not everybody involved can be aware. Fake passports that pass muster (regular patterns of a country's passport are known to foreign border guards, like checknums, typical issuance ranges, etc.) are not simple.
- jojobas 3y ago
  The reasons to have a separate range don't seem to be compelling. I'd hazard a guess no other secret service ever did that kind of blunder.
- rehevkor5 3y ago
  If you want to keep the information secret, you need a way to store it. Assuming number generation must be coordinated centrally (to prevent collisions), that does not seem like an impossible task. A system that involves a cryptographic hash could divide the id space up into different segments without being dectpherable from the outside world unless the cryptography is broken. A periodic key rotation system could reduce the impact of a compromise. To me, the real question is why embed that information in the passport number at all? Even if driven by cryptography, it seems to represent a risk for which i don't understand the benefit.
- cryptonector 3y ago
  > - You would have to reserve some numbers that can't be assigned to regular citizens. Because why? > - If you make those "random" - you need to store them in a database that can be checked against when issuing numbers to regular citizens. You have to store passport numbers assignments in a database anyways. > - You wouldn't want such a database to exist. Because it could leak? But number block schemes leak. > [...] > Fake passports that pass muster (regular patterns of a country's passport are known to foreign border guards, like checknums, typical issuance ranges, etc.) are not simple. If you want a fake/second passport to look like a real/first passport then you need to make sure that there's nothing fake-y about it, like none of this reserved number block thing. If the country in question assigns passport numbers sequentially, then that's going to be a problem because the passport numbers will indicate when the passport was issued -- you wouldn't want that. So instead you'll need to either randomize passport number generation, pseudo-randomize it, or leave lots of gaps in sequential number assignments so there are always a few from each relevant time period available. Also, if you use the same number for national ID and passport, then you'll need to issue a second national ID to match the second passport. These things are not hard to figure out. The U.S. would never get this wrong because the State department has enough clue and could always reach out to NSA/CIA for clue if they needed it. Apparently the Russians are total amateurs at this stuff.
yieldcrv 3y ago
regarding passport and visa concerns: no schengen exit stamp for EU citizens, that particular airline/route doesn't check for destination visa I don't personally think this is top-tier spy stuff like this article is making it out to be, its spelled out for any 2nd passport collector on all those golden visa or perpetual traveller websites and literature

eastbound 3y ago

Yes: “Great, you’re our spy now. Keep it secret. Also, please always carry on you this piece of Russian evidence with serial numbers adjacent to all our other moles, because otherwise our own border patrol may reject you on entry with your Czech passport, I decided.” So they’re telling us that Russia is that bad at spying. But the first commercial supersonic jet was the Tupolev 144, not the Concord.

dralley 3y ago
The Tupolev 144 was famous for being an utter piece of shit, rushed for the propaganda value of being "first", put into service with half the flight testing as Concorde, and crashing multiple times with not that many flights on it's record

ivan_gammel 3y ago

>That is very sloppy of Russia. Why even bother doing something so dumb? Some old-fashioned generals did not account for the digital footprint that may be left and modern data mining capabilities when they designed it. In fact, that digital footprint may have not existed yet when the entire scheme was designed. When you need to tell everyone doing ID check that this person must not be bothered, you give them plates from some VIP series or a passport with a certain number - it was a common practice in Russia. I'm pretty sure that this has changed in last few years after those investigations and they write the laws and design the databases assuming zero trust (public property registries now hide or obfuscate information about some entries for example).

cryptonector 3y ago
I too can guess that the point of the ID block was for Russian migration controls to more easily understand that "these people are special", but that would be idiotic whether it was done in 1950, in 1970 or in 2020.
- epolanski 3y ago
  And what's the point of Russian border control having them know? They are Russian citizens with a Russian passport, they can enter their country without issues.
  - cryptonector 3y ago
    I know right? What tremendous foolishness. It's incredible, as in just not believable.
    - dralley 3y ago
      Not any more unbelievable than the sloppiness behind the attempted assassinations of Navalny, Skripal or the successful assassination of Litivenko

epolanski 3y ago

> That is very sloppy of Russia. Why even bother doing something so dumb? Because the scheme predates today's digital capabilities.

cryptonector 3y ago
Why would they have needed this in 1970, or 1950?
refurb 3y ago
That doesn't make much sense. If you have suspected spies, the first you'd do is pull their entry into the country. It wouldn't take long to realize the similarity between passport numbers. Even in the 1950's.
- ivan_gammel 3y ago
  You cannot draw any conclusions from this similarity alone. The scheme is common and sequential numbers were likely used in many other legitimate cases. You think this is a flop only because The Insider has found very close numbers of passports for people in the same military unit. But there are just 4 numbers of 100 in the same range. Is there any evidence that the remaining people belong to the same unit, are spies or even work for Russian government?
  - refurb 3y ago
    Sure, but that's no different back then than now? You catch 3 spies in 1950. Someone shuffling through their paper files notices the numbers are close in range. You have a suspected 4th, and interestingly the passport number is clustered with the prior 3. You use a super computer to analyze passport numbers and compare them to 3 known spies. The computer spits out a pattern. [...] You have a suspected 4th, and interestingly the passport number is clustered with the prior 3. As per the original post it "is part of a numerical range reserved exclusively for members of Unit 29155". I could see if it wasn't a numerical range, but rather a reserved pattern (e.g. the 2nd, 3rd, 7th, 8th numbers were always sequential), then sure, a super computer could help you analyze known number to find a pattern. But it's just a group of number close in series? That seems discoverable by mere humans.

lobochrome 3y ago

While I agree with your general point, thinking about the passport numbers for a bit makes it plausible: - You would have to reserve some numbers that can't be assigned to regular citizens. - If you make those "random" - you need to store them in a database that can be checked against when issuing numbers to regular citizens. - You wouldn't want such a database to exist. - If you remove a whole "block," it's much simpler (do not assign passport numbers starting with...). - Passports are NOT issued by the services themselves, and normal institutions (foreign office) only collaborate "covertly" — not everybody involved can be aware. Fake passports that pass muster (regular patterns of a country's passport are known to foreign border guards, like checknums, typical issuance ranges, etc.) are not simple.

jojobas 3y ago
The reasons to have a separate range don't seem to be compelling. I'd hazard a guess no other secret service ever did that kind of blunder.
rehevkor5 3y ago
If you want to keep the information secret, you need a way to store it. Assuming number generation must be coordinated centrally (to prevent collisions), that does not seem like an impossible task. A system that involves a cryptographic hash could divide the id space up into different segments without being dectpherable from the outside world unless the cryptography is broken. A periodic key rotation system could reduce the impact of a compromise. To me, the real question is why embed that information in the passport number at all? Even if driven by cryptography, it seems to represent a risk for which i don't understand the benefit.
cryptonector 3y ago
> - You would have to reserve some numbers that can't be assigned to regular citizens. Because why? > - If you make those "random" - you need to store them in a database that can be checked against when issuing numbers to regular citizens. You have to store passport numbers assignments in a database anyways. > - You wouldn't want such a database to exist. Because it could leak? But number block schemes leak. > [...] > Fake passports that pass muster (regular patterns of a country's passport are known to foreign border guards, like checknums, typical issuance ranges, etc.) are not simple. If you want a fake/second passport to look like a real/first passport then you need to make sure that there's nothing fake-y about it, like none of this reserved number block thing. If the country in question assigns passport numbers sequentially, then that's going to be a problem because the passport numbers will indicate when the passport was issued -- you wouldn't want that. So instead you'll need to either randomize passport number generation, pseudo-randomize it, or leave lots of gaps in sequential number assignments so there are always a few from each relevant time period available. Also, if you use the same number for national ID and passport, then you'll need to issue a second national ID to match the second passport. These things are not hard to figure out. The U.S. would never get this wrong because the State department has enough clue and could always reach out to NSA/CIA for clue if they needed it. Apparently the Russians are total amateurs at this stuff.

yieldcrv 3y ago

regarding passport and visa concerns: no schengen exit stamp for EU citizens, that particular airline/route doesn't check for destination visa I don't personally think this is top-tier spy stuff like this article is making it out to be, its spelled out for any 2nd passport collector on all those golden visa or perpetual traveller websites and literature