Photograph: Supplied by BellingcatĬhristo Grozev, Bellingcat’s CEO and lead investigator, said in an interview that he had first found the trail of a possible GRU illegal when he was looking at a leaked database of border crossings logged by Belarusian border guards and provided by a group of hackers in opposition to the regime of Alexander Lukashenko. ‘Rivera’ (pictured right) took a one-way flight to Moscow the day after Bellingcat published a joint article suggesting the 2018 Salisbury novichok poisoning suspects were GRU operatives. Traditionally, illegals have been extremely hard for counterintelligence agencies to find, but in a world of biometric data, facial recognition software and open source investigation possibilities, it has become harder for Russia to keep its illegals below the radar. One Nato employee told the investigators that he had a brief romantic relationship with “Rivera”. Her acquaintances said that by taking on the role of secretary at the Naples branch of the international Lions Club, she was able to befriend many Nato staff and other affiliates. She set up a jewellery boutique called Serein and led an active social life. Posing as “Rivera”, the illegal moved between Rome, Malta and Paris, eventually settling in Naples, home of Nato’s Allied Joint Force Command, around 2013. Sometimes, they stay living in their fake identities for decades.

Moscow’s intelligence agencies have used illegals since the early Soviet period. “Rivera” was what the intelligence community call an illegal, a deep-cover agent trained to pose as a foreigner. In fact, she was a career GRU officer from Russia, according to research by Bellingcat in partnership with a number of media outlets including La Repubblica in Italy and Der Spiegel in Germany, and shared with the Guardian before publication.

Cartoon spy agent posing