It looked like a spy agency’s worst nightmare: The unmasking of several agents, and the disclosure of sloppy tradecraft in what appeared to be a bungled intelligence operation.
But heads have yet to roll — at least not publicly — at the GRU, Russia’s military intelligence agency.
On Thursday, Western governments mounted a coordinated effort to unmask what they claimed were “brazen” efforts by GRU agents to sow chaos on foreign soil.
In a briefing Thursday, the Dutch government said it had foiled a “close-access hack operation” by the GRU aimed at the Organisation for the Prohibition of Chemical Weapons (OPCW), the world’s chemical-weapons watchdog. The Dutch claimed that the four alleged agents planned to travel next to an OPCW-accredited laboratory in Switzerland, but did not get there because their operation was intercepted.
That same day, Britain accused the GRU of carrying out a worldwide campaign of “malicious” cyberattacks, and the US Justice Department announced criminal charges against seven GRU officers, accusing them of involvement in an effort to deflect attention from Russia’s state-sponsored sports doping program.
The coordinated information dump revealed what appeared to be an embarrassing security breach for the GRU. Details in the Dutch briefing were particularly tantalizing: The head of Dutch counterintelligence named four alleged Russian GRU officers, noting that two of them had consecutive passport numbers, a potential red flag for intelligence agencies.
And then there was the taxi receipt: When detained, one of the alleged agents had a receipt for a trip to Moscow’s Sheremetyevo Airport from Nesvizkhskiy Pereulok, a road bordering what Dutch counterintelligence said was a GRU facility.
The owner of the cab company confirmed to CNN that the receipt was authentic, but added that the driver couldn’t recall whether any of the men named were indeed the passengers. Such details provided fodder for online sleuths, and raised questions among some observers about the GRU’s level of professionalism.

Digital footprints

Unlike Alexander Petrov and Ruslan Boshirov, the two Russians named by the UK as the suspects in the nerve agent attack earlier this year in Salisbury, England, the four men named by the Dutch on Thursday left more digital traces.
The Moscow Times even reported that Yevgeny Serebryakov, one of the Russian men accused of the attempted OPCW hack, appeared to be a participant in a Moscow amateur soccer league.
So how big a scandal is this in Russia, and how will it play? The case of Petrov and Boshirov proves instructive.
In early September, British authorities released the names of the two men, saying they were GRU agents traveling under aliases. Following the release of those names, Russian President Vladimir Putin described the two men as “civilians,” and encouraged them to come forward.
The following day, Russia’s state-owned RT aired an interview with the two men, who admitted traveling to Salisbury but denied working for the GRU. That prompted insinuations and jokes on Russian media about the sexual orientation of “Boshirov” and “Petrov” as well as their fondness for Gothic spires.
The RT interview was a weapon of mass distraction, turning the Salisbury poisoning into fodder for memes. But the information war continued: After the RT interview aired, the UK investigative website Bellingcat claimed to have identified “Boshirov” as a GRU colonel.
In the coming days, no doubt, we’ll learn more about the identities of the supposed GRU agents. But the Russian response has been to double down on accusations of “fake news.”
On Thursday, Russian Foreign Ministry spokesperson Maria Zakharova called the UK allegations a “hellish perfume mix,” saying, “The rich imagination of our UK colleagues truly knows no limits. Who comes up with this?”
Kremlin spokesman Dmitry Peskov played the same note on Friday. Western governments, he said, were driven by “hysteria” and “spy phobia” after the US, the Netherlands and Britain publicly unmasked the alleged Russian intelligence agents.
To be sure, the latest round of spy wars has not been consequence-free for Russia. The US and its allies expelled dozens of Russian diplomats in the wake of the Salisbury poisoning, and the fears of Russian meddling persist: US lawmakers are considering new sanctions to punish Russia over its interference in US elections.

The German government on Friday called on Russia to desist from carrying out cyberattacks in other countries, adding its voice to those of Britain and the Netherlands.
“We sharply condemn such attacks on international organizations and institutions of our allies and call on Russia to meet its responsibility and cease such actions,” government Spokesman Steffen Seibert said in Berlin.
He said that Germany, like Britain, believed that the Russian military intelligence agency GRU was, “with almost absolute certainty,” behind the APT28 cyberespionage campaign, which attacked a number of targets worldwide, including the German Bundestag and government data network. 
If such attacks were successful, Seibert said, they could directly threaten public security and “in principle also our democracy,” making it imperative that Germany ensured it was ready and able to take action in the digital sphere.
He emphasized the importance of working together with other states to defend against such attacks.
Read more: Cybersecurity: Why it’s ‘hard to protect yourself’ online
Growing evidence
On Thursday, the Netherlands and Britain went public with accusations that Russia was trying to damage Western democracies through cyberattacks. Among other things, Dutch authorities said they had prevented an attack by Russian hackers on The Hague-based Organization for the Prohibition of Chemical Weapons (OPCW) in April.

The OPCW, the UN’s chemical weapon’s watchdog, has been involved in investigations into the attempted killing of former Russian double agent Sergei Skripal using the nerve agent Novichok and into alleged chemical attacks in Douma, Syria, by the Russia-backed Syrian regime.
Germany’s accusations come as evidence mounts of a worldwide cyber campaign targeting Western institutions launched by Russia. The US Justice Department announced after Thursday’s revelations that it had charged seven Russian military intelligence offices with hacking organizations including anti-doping agencies.
Russia has been revealed to have long run a state-sponsored athlete doping program, leading to several of its sportspeople being banned from participating in international events.
Moscow has denounced the allegations as products of “fantasy.”

tj/ng (dpa, Reuters)
Each evening at 1830 UTC, DW’s editors send out a selection of the day’s hard news and quality feature journalism. You can sign up to receive it directly here.

Germany on Friday joined other Western countries in blaming Russia for engaging in a global campaign of cyber attacks against political institutions, businesses, media outlets and sports organizations.
“We have full confidence in the assessment of the British and Dutch authorities. The (German) government is also almost certain that the Russian GRU secret service is behind the APT28 campaign,” government spokesman Steffen Seibert said.
Advanced Persistent Threat 28 is another name used to describe the Sofacy or Fancy Bear hacking group.
Seibert said Germany believes successful attacks “could directly threaten free society, public safety and in principle our democracy” — and urged Moscow “to meet its responsibilities and cease such actions.”
Russia denies any involvement in the worldwide attacks.
On Thursday, Foreign Secretary Jeremy Hunt accused Russia’s military intelligence agency GRU of carrying out various “reckless and indiscriminate” high-profile online attacks, according to Agence France-Presse.
Britain’s National Cyber Security Centre has “high confidence” that the GRU “almost certainly” targeted the US Democratic Party ahead of the 2016 presidential election, as well as last year’s attempted hacking of the World Anti-Doping Agency in Switzerland official said.
“This pattern of behavior demonstrates (the GRU’s) desire to operate without regard to international law or established norms and to do so with a feeling of impunity and without consequences,” Hunt said.
“Our message is clear: together with our allies, we will expose and respond to the GRU’s attempts to undermine international stability.”
In addition to APT28, Britain said the GRU was associated with several other hackers, including Pawnstorm, Sednit, CyberCaliphate, Cyber Berkut and Voodoo Bear, Reuters reported.
Australia joined Britain in its accusations, with Prime Minister Scott Morrison and Foreign Minister Marise Payne calling Russian online meddling “unacceptable.”
The Kremlin rejected the accusations that Russian spies were behind the cyber attacks.
“It’s some kind of a diabolical perfume cocktail (of allegations),” Russian Ministry of Foreign Affairs spokeswoman Maria Zakharova told reporters, TASS reported.
The latest allegations came a day after seven GRU officers were charged with carrying out an international hacking campaign on agencies and organizations that were investigating the country’s athlete doping program and the poisoning of a former KGB agent in Britain.
According to an indictment filed in Pennsylvania, the suspects conducted the cyber-attacks from 2014 through May using malware, spearfishing techniques and other high-tech weapons to steal information that was then circulated online.
Three of the seven had been indicted by special counsel Robert Mueller’s prosecutors for hacking into the Democratic National Committee during the 2016 election.
With Post wires