Intelligence Studies Review

Dr Kevin Riehle and Professor Philip H J Davies

In September 2023, five Bulgarians—Orlin Rusev, Vanya Gaberova, Ivan Stoyanov, and Bizer Dzhambazov and Katrin Ivanova as a couple—appeared in a British court charged with ‘conspiring to collect information intended to be directly or indirectly useful to an enemy’, in other words, espionage. Some have assessed that the five Bulgarians were Russian intelligence illegals similar to others arrested since Russia’s invasion of Ukraine, like Mikhail Mikushin/José Assis Giammaria, who was arrested while working at the Arctic University of Norway in Tromsø, and Sergey Cherkasov/Viktor Muller Ferreira, who was refused entry into the Netherlands to start a position at the International Criminal Court. Both Mikushin and Cherkasov were affiliated with the Russian military intelligence service, the GU (formerly known as the GRU). However, several aspects of the Bulgarians’ case are different and cast doubt on the assessment that they were illegals like Mikushin and Cherkasov.

Russian intelligence illegals typically try to avoid displaying any connection to Russia. The purpose for an illegal is to conduct intelligence operations in Russia’s interests while deflecting attention from the operations and from Russia. In the early 2000s, the Russian Foreign Intelligence Service (SVR) appears to have tried an experiment that departed from that tradition, dispatching illegals abroad overtly as Russians. Three of the illegals arrested or deported from the United States in 2010—Anna Chapman (née Kuscheko), Mikhail Semenko, and Aleksey Karetnikov—were operating overtly as young, single Russian émigrés. They all entered the United States between 2006 and 2009. However, that experiment appears to have failed—all three were compromised. Subsequent illegals, like Mikushin and Cherkasov, as well as others compromised in Italy, Slovenia, and Greece used traditional legends with no connection to Russia.

On the other hand, one of the Bulgarians arrested in the UK in 2023, Orlin Rusev, had overt business ties to Russia, something that an illegal would typically avoid. He arrived in the UK in 2009, but it is unclear whether he was already working as a Russian operative at that time or whether he was recruited later. When Rusev and the other Bulgarians appeared in court in September, they were reported to have begun conducting intelligence operations in 2020, years after they arrived in the country. Rusev’s overt connections to Russia and the later reported start time for intelligence activities point to recruited agents rather than illegals.

Another factor that raises doubt about whether they were illegals was their target. The UK prosecutor accused the group of conducting ‘information gathering activities against several addresses and individuals on behalf of the Russian state’ and ‘assisting the Russian state in conducting hostile actions against specific targets including the potential abduction of these targets.’ They reportedly received their tasking from Jan Marsalek, an individual with multiple connections to Russian intelligence services, most recently to the Russian Federal Security Service (FSB). The mission of collecting information to support abduction operations, along with the connection to Marsalek, points toward the possibility that the group was working for the FSB, Russia’s primary internal security service. 

And herein lies the next part of the puzzle, because the FSB has no history nor, in all likelihood, any direct institutional memory or legacy expertise in mounting and running illegals operations.  It is important to keep in mind that the FSB is not simply a rebranded KGB filling the same role with unbroken continuity. In the wake of the Cold War, the old KGB was broken into multiple pieces. Its foreign operations branch, the First Chief Directorate, became the SVR. The domestic security and counterintelligence component, a smaller Federal Counterintelligence Service (FSK) inherited the mission of the Second Chief Directorate absent law enforcement powers, supposedly modelled on MI5. In 1995, the FSK was reconstituted as the FSB, which over the following decade reaccumulated many of KGB-era features and capabilities that had been broken off, such as special operations units, Border Guards, and signals intelligence.[1]

During the Soviet era, illegals operations had been the preserve of the KGB’s First Chief Directorate. Consequently, when the First Chief Directorate was hived off as the SVR it retained its illegals methods and doctrine.

Distribution of KGB Functions in Post-Soviet Russia.

The FSB has inherited other responsibilities from the Soviet-era KGB, including pursuing oppositionists and traitors abroad. Some have asserted similarities between the five Bulgarians and the 2018 assassination attempt on Sergey Skripal. But the Skripal case was run by the GRU, not the FSB. Skripal was a GRU officer who betrayed his service, and the GRU was given the green light to assassinate him essentially to avenge his betrayal. However, the FSB has been involved in many more extraterritorial operations to pursue Russian targets than the GRU, such as the assassinations of over twenty Chechen militants and propagandists, as well as Aleksandr Litvinenko.

The FSB, which was founded primarily on security and counterintelligence elements of the KGB, had no illegals ‘prior operational practice’ in this area. Indeed, FSB has no known history of running illegals and it would be a significant departure for the FSB to do so. Instead, the evidence points to the possibility that the Bulgarians were recruited FSB agents, a different, lower-level category of intelligence contact than illegals. The fact that they carried multiple passports does not distract from that possibility—Russian supplies its agents with false passports for clandestine travel purposes.

Consequently, while the Bulgarian five may indeed have been long-term resident agents they cannot really be referred using the Russian term of art, ‘illegals’. Agents from countries within the EU but with long and close association with the old USSR and contemporary Russia can take advantage of Europe’s open borders to move and set up a resident presence. When we look at countries with sizeable and often politically alienated ethnic Russian populations, such as the Baltic states[2] and Central Asia, it is clear that Western counterintelligence is facing a potentially pervasive threat of a different order from its prior experience. Some of that hostile activity may be classic foreign intelligence, but a growing proportion may prove to be Soviet-style external pursuit of regime protection. It remains to be seen how allied counterintelligence with adapt and cope with this evolving, complex and ambiguous operational environment.

[1] Kevin Riehle, The FSB: A Concise History of the Federal Security Service (Washington, DC: Georgetown University Press, 2024).

[2] See, e.g. the annual reports of the Latvian, Lithuanian and Estonian security services – published, rather significantly, in English.