Assets in Flight: Tracing Africa’s Corrupt Ruling Elite in the Skies

Douma in Syria  By Kyodo News

Peter Kirechu, Lead Analyst

Five of the top ten longest serving heads of states govern African countries, all with tenures in office of over 20 years. Four of the five – Paul Biya (Cameroon), Teodoro Obiang’s Nguema Mbasogo (Equatorial Guinea), Dennis Sassou Nguesso (Republic of Congo) and Yoweri Museveni (Uganda) are over 70 years old. And until recently this cadre of rulers also included Omar al Bashir (Sudan) whose ouster on April 11, 2019 closely followed that of Abdelaziz Bouteflika, the 82-year-old former President of Algeria whose 20-year rule ended in forced resignation on April 2, 2019.  

These heads of state, both current and former, reportedly preside over impressive personal fortunes and commercial empires that are shrouded in secrecy and often hidden from public scrutiny. In 2017, French authorities successfully prosecuted and convicted Equatorial Guinea’s Vice President Teodoro Nguema Obiang Mangue (the son of the President) for illegally investing millions in embezzled funds through French real estate, luxury vehicles, and other assets. The investigation led to the seizure of a Parisian mansion worth $120 million and just one of Teodoro’s sprawling assets, which in 2011 included $70 million in US-based luxury assets, two Malibu mansions, and a $30 million Gulfstream private jet

Gulfstream G-V aircraft (VP-CES) allegedly purchased by Teodoro Obiang through his Cayman Island-based company    Ebony Shine International Ltd    for an estimated $33.8 million in 2011. Source:

Gulfstream G-V aircraft (VP-CES) allegedly purchased by Teodoro Obiang through his Cayman Island-based company Ebony Shine International Ltd for an estimated $33.8 million in 2011. Source:

The identification of the $30 million aircraft linked to Teodoro Obiang piqued the interest of C4ADS analysts, who in the past several months have investigated foreign air travel as an indicator of where kleptocrats store their wealth.


Tracing Equatorial Guinea’s Executive Fleet

Back in 2011, the US Department of Justice (DOJ) found that Teodoro Obiang purchased  a Gulfstream G-V aircraft (Cayman Islands Registration Number: VP-CES) through a Cayman Island-based company, Ebony Shine International Ltd for an estimated $33.8 million. The DOJ filed an asset forfeiture suit against the aircraft claiming that the purchase was financed by embezzled funds. The suit was eventually settled in 2014, and the aircraft barred from entering the United States while owned by Equatorial Guinean officials, their family members, and/or affiliated companies or businesses.

US Department of Justice Indictment against the Gulfstream G-V aircraft (VP-CES) purchased by Teodoro Obiang through his Cayman Island-based company    Ebony Shine International Ltd    for an estimated $33.8 million

US Department of Justice Indictment against the Gulfstream G-V aircraft (VP-CES) purchased by Teodoro Obiang through his Cayman Island-based company Ebony Shine International Ltd for an estimated $33.8 million

But despite the use of off-shore shell companies to obscure aircraft ownership, aircraft identification is made possible by the existence of several universal regulations adopted by most UN Member States. As a result of the 1944 Chicago Convention on International Civil Aviation, which established the International Civil Aviation Organization (ICAO), all civilian aircraft must be registered with a National Aviation Authority (NAA) which issues alpha-numeric aircraft registration numbers to all civilian aircraft before they can legally operate internationally. These alpha-numeric registration numbers (commonly known as tail code numbers) are often the most visible identifying feature of an aircraft (as displayed below) and have a discernible naming convention that helps identify the country of registry.

Equatorial Guinea-registered Dassault Falcon 50 (Registration Number: 3C-LGE). Source:

Equatorial Guinea-registered Dassault Falcon 50 (Registration Number: 3C-LGE). Source:

Each aircraft’s tail code number begins with a two-character prefix i.e “YA-XXX” that identifies the aircraft’s country of registration (also known as an aircraft nationality mark or emblem). Aircraft registered in the Equatorial Guinea begin with a “3C-” prefix, which indicates that all aircraft that bear that marking are registered with the country’s civil aviation authority. But in Equatorial Guinea, like many other African countries, the domestic civil aviation authority does not publicly disclose its domestically-registered private aircraft, thus limiting public visibility on the number of private or corporate-owned aircraft.


Overcoming the Paucity of Publicly-Available Domestic Aircraft Registers

In countries where official, publicly available aircraft registers are unavailable, aviation enthusiasts often provide a lifeline. Over the past several decades, these communities of enthusiasts have compiled hundreds of non-official aircraft registers that provide a helpful guide into current and historic aircraft registration records in some of the most data scarce environments across the globe. Some of these enthusiast-compiled registers include but are not limited to: the OpenSky Network,, Antonakis Spotters, Torben Koed,, and the LAAS International Corporate Aircraft register.

Using the aforementioned LAAS corporate aircraft register, we uncovered five executive/business-class aircraft, including two Dassault Falcons, a Lockheed Jetstar and a single Gulfstream V that operate under the “3C-”country designation, suggesting local registration in Equatorial Guinea.  

Corporate-registered aircraft in the Equatorial Guinea according to the LAAS enthusiast register. Source:    LAAC Corporate Jet Register

Corporate-registered aircraft in the Equatorial Guinea according to the LAAS enthusiast register. Source: LAAC Corporate Jet Register

However, based on the available imagery, this executive fleet differed quite starkly from Equatorial Guinea’s commercial airliners, a finding that suggests that these aircraft are likely operated by private parties or by the Equatorial Guinea government.  Open-source images of the aircraft fleet also revealed a paint and flag pattern that closely resembles the country’s flag and coat of arms.

Equatorial Guinea-registered Boeing BBJ (3C-EGE) spotted in Geneva. Source:    JetPhotos   .

Equatorial Guinea-registered Boeing BBJ (3C-EGE) spotted in Geneva. Source: JetPhotos.


The Equatorial Guinea Executive Fleet in Flight

Having identified the five non-commercial aircraft associated with the Equatorial Guinea government and/or some of the government’s private associates, we used open-source flight tracking data to identify and track their transit activities abroad. The available data revealed that at least one of the planes in this fleet – a Dassault Falcon 50 (Registration Number: 3C-LGE) – had made at least 17 trips in and around Berlin and Paris between February 25, 2018 and May 26, 2019.

Equatorial Guinea-registered Dassault Falcon 50 (Registration Number: 3C-LGE) flight activities in and around Paris and Berlin on February 26, 2018 and March 14, 2018. Source:    ADS-B Exchange Historical Flight Viewer   .

Equatorial Guinea-registered Dassault Falcon 50 (Registration Number: 3C-LGE) flight activities in and around Paris and Berlin on February 26, 2018 and March 14, 2018. Source: ADS-B Exchange Historical Flight Viewer.

Between November 2018 and April 2019, we identified 10 trips in and around Paris and Geneva taken by a Dassault Falcon 900B (3C-ONM) aircraft associated with Teodoro Obiang. This data was captured by ADS-B Exchange, an open-source flight tracking tool that is part of collaborative effort between C4ADS and ADS-B Exchange designed to improve the investigative use of flight data in open source research.

Teodoro Obiang’s Dassault Falcon 900B (3C-ONM) flight activities around Paris and Geneva in November and December, 2018. Source:  ADS-B Exchange Historical Flight Viewer .

Teodoro Obiang’s Dassault Falcon 900B (3C-ONM) flight activities around Paris and Geneva in November and December, 2018. Source: ADS-B Exchange Historical Flight Viewer.

Closer investigation into the aircraft’s arrivals in and around Geneva airport indicated that the majority of these arrivals occurred in the evening and were followed by next-day morning departures between May and December, 2018 according to the Geneva Airport Movement Enquiries database, a collection of landing and take-off flight data compiled by Geneva-area aircraft spotters. We also found over 200 landing and take-off events at Geneva airport between June 15, 2008 and May 29, 2019. These early findings indicate that the aircraft remains in operation and frequents Geneva airport on a fairly regular schedule.

Teodoro Obiang’s Dassault Falcon 900B (3C-ONM) landings and take-offs from Geneva Airport between May and December, 2018. Source: ARAG-GAME:    Geneva Airport Movement Enquiries   .

Teodoro Obiang’s Dassault Falcon 900B (3C-ONM) landings and take-offs from Geneva Airport between May and December, 2018. Source: ARAG-GAME: Geneva Airport Movement Enquiries.


Pattern of Life

Based on this initial research, we focused on tracing the globe-trotting activities of corrupt world leaders, particularly when that travel involves high risk banking jurisdictions, tax havens, and other luxury locales around the world. We have so far found that the combination of open-source aircraft registries and flight data provides excellent insights into the often-hidden activities of unscrupulous public officials.

Further research also revealed that another aircraft within the fleet – a Gulfstream V (Registration Number: 3C-LLX) had made at least five trips into Brazil throughout 2018. Several of these trips occurred around the September 17, 2018 detention of Teodoro Obiang’s entourage in Sao Paolo where Brazilian authorities seized $16 million in cash and luxury watches. Coverage of the incident indicated that Obiang’s 11-person delegation arrived on a government plane and were headed for Singapore after the stop in Brazil. We later found that the same Gulfstream V private aircraft was spotted flying east of Singapore on November 6, 2018 (pictured below) several days after the incident.

Equatorial Guinea-registered Gulfstream V (Registration Number: 3C-LLX) flight activities in and around Brazil and Singapore in 2018. Source:    ADS-B Exchange Historical Flight Viewer   .

Equatorial Guinea-registered Gulfstream V (Registration Number: 3C-LLX) flight activities in and around Brazil and Singapore in 2018. Source: ADS-B Exchange Historical Flight Viewer.

These preliminary findings indicate that despite the lack of official public registries in countries like Equatorial Guinea, the combination of unofficial flight registries and public-sourced air transit data does reveal insights into closely held travel activities of public officials like Teodoro Obiang. 

Stitched together, these data points reveal the great untapped potential that open flight tracking offers to open-source researchers and investigators, and broadens the investigative toolkit available to global transparency and accountability researchers, advocates, and enforcement agents. Over the next several months, C4ADS intends to publish a series of investigations that build upon the insights gleaned from this case in order to highlight investigative applications of publicly accessible flight data in open-source research.


The Handasieh Network – Investigating Chemical Weapons Procurement in Syria

Douma in Syria  By Kyodo News

Douma in Syria By Kyodo News

Irina Bukharin, Analyst

On April 6, 2018, a sunny day in Douma, Syria, bombs began falling from the sky, assaulting the city indiscriminately. The attack continued into the next day, when chemical weapons were dropped on the city’s citizens, over 500 of whom were brought to medical facilities with symptoms of exposure to a chemical agent. At least 43 people died as a result of this exposure.

Hundreds of chemical attacks like this one have taken place on Syrian soil since the beginning of the civil war there. The Global Public Policy Institute has attributed two percent of these attacks to the Islamic State and 98 percent to the Syrian government under the leadership of President Bashar al-Assad. The attacks carried out by the Assad regime have used chemical weapons such as chlorine and sarin, and they have resulted in the death and injury of thousands of Syrian citizens.

These persistent attacks raise the question of how a regime under such a heavy international sanctions regime can acquire the supplies needed to manufacture chemical weapons. Although some of the necessary chemicals and equipment may be available within Syria, other elements, such as specific chemical precursors or corrosion-resistant construction materials, must be sourced from abroad. The Syrian Scientific Studies and Research Center, also known as the SSRC, is the government body that oversees the production of Syria’s chemical weapons, including the import of chemical precursors and other materials. The United States government has identified and sanctioned Syrian and foreign companies used by the SSRC to procure such materials. By examining these companies, their broader corporate networks, and their current and former activities, we can identify possible routes for continued procurement of materials that support the Syrian chemical weapons program.


The Handasieh Network

One good example is Syria’s General Organization for Engineering Industries, a sprawling state-owned conglomerate under the authority of the Syrian Ministry of Industry that supervises public companies active in the construction and industrial sectors. Also known as Handasieh, the organization was sanctioned by the US Office of Foreign Assets Control (OFAC) on July 18, 2012 for “acting for or on behalf of Syria’s SSRC” and “contribut[ing] materially to the proliferation of WMD or the means of their delivery.” But Handasieh is more than just one Syrian company – there are at least fourteen subsidiaries operating directly under it that produce everything from steel to renewable energy to pencils. If these companies are 50% or more owned by Handasieh, they too are legally sanctioned under OFAC’s current regulations. However, only one of Handasieh’s direct subsidiaries, the Syrian Arab Electronic Industries Company (Syronics), has been explicitly sanctioned by OFAC, while two additional entities that share identifiers with one of Handasieh’s subsidiaries have also been sanctioned.

These unsanctioned subsidiaries represent possible avenues for sanctions evasion and chemical weapons procurement. By examining corporate and trade records associated with these entities, we can conclude that they may be acting in coordination with Handasieh (and thus potentially with the SSRC), and that foreign procurement activity continues through them. This foreign procurement activity may coincide with the procurement of chemical precursors or other materials the Assad regime needs to launch attacks like the one on April 7.

Network chart of Handasieh and its subsidiary companies. Network entities that have been sanctioned are colored red, while green entities have not been explicitly sanctioned.


Convergence and Coordination

Handasieh’s connections with its subsidiaries don’t end at the level of corporate affiliation: public records show that different companies in the Handasieh network can be tied together through their common use of identifiers like addresses, websites, and email addresses. For example, the General Company for Steel and Steel Products lists “” as its website on a public tender for zinc, while a profile for the General Company for Cable Industry in Damascus lists Handasieh’s primary email address as a point of contact. On public tenders, the General Company for Cable Industry in Damascus has used an email address associated with another Handasieh subsidiary, the Aleppo Company for Cable Industry. Such shared identifiers were common throughout tenders appearing in the names of Handasieh subsidiaries, indicating a high likelihood of coordination between the companies in the wider Handasieh network.

A series of three shipments from North Korea to Syria illustrates the point. In its March 2018 report, the UN Panel of Experts for North Korea indicated that the General Company for Cable Industry was the intended consignee of a 2016 shipment of industrial materials sent to Syria from North Korea. This shipment was part of a batch of five shipments sent from North Korea to Syria. Two of the shipments were sent to the Metallic Manufacturing Factory, an OFAC-sanctioned company that is connected with another Handasieh subsidiary, the Company of Metallic Constructions and Mechanical Industries. These shipments contained “acid-resistant tiles, adhesive paste, and accessories,” materials which, according to a UN Member State, could “be used to build bricks for the interior walls of [a] chemical factory.”  Not only does the network appear to be integrated, with members using identifiers associated with Handasieh and other Handasieh subsidiaries, but it appears to be coordinating activity among both sanctioned and unsanctioned nodes in the network, highlighting the risk of complex evasion schemes.

Network chart illustrating the shipments sent on behalf of a North Korean entity to the General Company for Cable Industry and the Metallic Manufacturing Factory. Sanctioned entities are colored red.

Network chart illustrating the shipments sent on behalf of a North Korean entity to the General Company for Cable Industry and the Metallic Manufacturing Factory. Sanctioned entities are colored red.


Procurement Abroad

Tenders, trade data, and other public material can provide a wealth of information about procurement pathways used by the Handasieh network (and therefore possibly the SSRC). Many of the companies associated with Handasieh have public tenders posted on their websites, Facebook pages, or on the websites of Syrian foreign affairs offices around the world. While tenders are of course helpful in identifying what a company is looking for, they are also helpful in identifying where the company is seeking to procure its materials from. For example, Syronics, the OFAC-sanctioned Handasieh subsidiary, has had tenders posted by the Syrian Ministry of Foreign Affairs in both Egypt and Lebanon. Trade data can also shine a light on the countries from which these companies are sourcing. Commercial trade data indicates that the Handasieh-linked General Company for Iron and Steel Products has received at least 39 shipments of industrial parts and equipment from Apollo International Limited, an Indian company. Sometimes making connections between these companies and foreign countries is even easier: one of Handasieh’s subsidiaries is the “Syrian-Ukrainian Joint Company for the Production of Photovoltaic Pumps.” To date, we have identified thirteen countries (Belarus, China, Egypt, France, Germany, India, Iran, Jordan, Lebanon, Malaysia, North Korea, South Korea, and Ukraine) from which Handasieh subsidiaries have procured, are procuring, or have attempted to procure materials after OFAC sanctioned Handasieh in 2012.

Map of countries from which Handasieh and its subsidiaries have procured or attempted to procure materials since 2012.

Map of countries from which Handasieh and its subsidiaries have procured or attempted to procure materials since 2012.

Much of the procurement that we can see in the open source, whether through tenders or trade data or international agreements, may be perfectly licit, and destined for civilian engineering projects across Syria. We do not assert that any entity mentioned in this blog post knowingly contravened any international law or treaty. However, the pathways that licit products take can also be used to procure the materials the Syrian government needs for its chemical weapons program. Given the known procurement of materials by Handasieh (and some of its subsidiaries) on behalf of the SSRC, the interconnected nature of the companies in the Handasieh network, and the illicit procurement on the part of non-sanctioned entities in the network, all Handasieh subsidiaries and the methods through which are worth a second look by the international community, law enforcement, and civil society.


Austin Bodetti contributed in the research and investigation for this blog post.


Paper Trails: How a Russia-based logistics network ties together Russian mining companies and military contractors in Africa

Screen Shot 2019-06-13 at 3.19.01 PM.png

Jack Margolin, Senior Analyst

PMC Wagner, a Russian private military firm supported by US-sanctioned oligarch Evgeniy Prigozhin, has been everywhere lately – whether in Eastern Ukraine, Syria, or Venezuela, the shadowy outfit has appeared at the vanguard of Russia’s foreign policy ambitions, providing a lightweight and deniable force that can be used to project Russian power at short notice and little cost. For analysts and observers, understanding where Russian private military forces are is important for gauging overall Russian policymaking intentions in a given region.

But merely understanding where Russian military contractors have been appearing misses half the story: equally illuminating are the trading relationships that show how contractors are sustaining themselves with supplies, and how these companies relate to Russian-owned extractives ventures. To take a closer look at these links, we analyzed customs records (held by author) and other official documentation to identify a global logistics network supporting companies associated with Prigozhin and PMC Wagner. This wider network extends from Saint Petersburg to Madagascar, and even touches the shores of Hollywood Beach in Florida, providing clues to the way in which networks of private companies allow Russia to promote its interests around the world.


Official and Unofficial Russian Activity Across Africa

Since 2017, a network of individuals and ostensibly private Russian companies have engaged in military assistance, political interference and exploitation of mineral wealth across Africa, facilitated in large part by close connections with commercial and political entities based in Russia. This activity has taken place in Sudan, the C.A.R., Madagascar, Libya, Burundi, and beyond. In the C.A.R., Russian personnel allegedly employed by Wagner have been involved in military training, while companies allegedly affiliated with Prigozhin have engaged in activities as diverse as mining, cultural events and diplomatic efforts with rebel groups. In Sudan, Russian contractors have provided security services, while a Prigozhin-linked company has engaged in mining. Prigozhin himself has been present at high-level military discussions  in Libya, where his contractors are alleged to be active in support of rebel leader Khalifa Haftar. In Madagascar, political consultants affiliated with Prigozhin have offered support to a range of local politicians, while a shadowy Russian mining firm tried and failed to establish a joint venture with state-owned mining company.

In each theater, these activities have been facilitated by an opaque corporate network of entities active in both Africa and Russia. Though their activities can be difficult to observe, each of these entities has a point of vulnerability: they depend on logistics providers to survive. As their logistical needs become more complex, the legal architecture of shell companies, trading relationships, and physical installations they must employ becomes more visible. We scrutinized these visible points, analyzing Russian customs records that detail trade between alleged Wagner affiliates in Africa and their support base back in Russia.

Two of the more visible entities in the network are Lobaye Invest in the Central African Republic, and Meroe Gold in Sudan, two companies that Russian investigative journalists have identified as being connected with Prigozhin. Lobaye has engaged in activities ranging from mining to beauty pageants and the screening of Russian movies. In July of last year, three journalists were killed under mysterious circumstances while investigating the activities of Wagner in the C.A.R, immediately prior to planned filming at gold mines operated by Lobaye Invest.

In Sudan, Meroe Gold’s mining operations have converged with political repression — unconfirmed reports allege that Russian guards have fired on local protestors, and that armed Russian personnel appeared at December protests. Additionally, according to Russian investigative outlet Proekt, Prigozhin sought to establish a foothold in Madagascar through a partnership with the state-owned mining firm Kraomita Malagasy S.A. This ultimately failed partnership dovetailed with attempts at political influence, and, as Russian trade record indicate, a larger logistics network supplying Meroe Gold and Lobaye Invest.

Both Lobaye Invest and Meroe Gold appear in commercially available Russian customs data, which shows them conducting trade with Russia-based firms M-Finance and M-InvestBoth of these companies are associated with Prigozhin in public reporting. M-Invest’s regional director is also a former business partner with an employee of Prigozhin’s infamous ‘troll farm’ who was indicted by the US Department of Justice.

Russian customs records corroborate this link, and illustrate how this network of companies supplies and supports Prigozhin-affiliated companies in Africa. They also show scale and change over time:

  • According to customs data, Meroe Gold received more unique shipments from Russia than any other company in Sudan during this period. 

  • Meroe Gold imported large amounts of geological equipment for mining exploration in 2017, before importing more heavy equipment including front-loaders and bulldozers.

Network chart showing current and former relationships between Lobaye Invest, Meroe Gold, and their trade partners. Links in grey indicate commercial and locative relationships, while green links indicate trade.

Network chart showing current and former relationships between Lobaye Invest, Meroe Gold, and their trade partners. Links in grey indicate commercial and locative relationships, while green links indicate trade.

Taking a more granular approach to these records shows us the chain of custody of these shipments, down to their eventual end use. In at least two cases, this methodology helps illuminate the provenance of vehicles employed by alleged Russian private military contractors, showing how armored vehicles and transport helicopters transited from Russia to end destinations in Africa all along Prigozhin-controlled supply chains.


Big Wheels – Ural Transport Vehicles

According to trade data reviewed by C4ADS, M-Invest, M-Finance and other Russian companies in this network supplied heavy transport vehicles to their partners in Africa which have since appeared in a variety of settings — from training the Central African Republic’s armed forces, cruising Khartoum during the December protests in Sudan, and being stopped by rebel militias in the C.A.R.

According to export declarations, M-Finance sent one Ural 4230 multi-purpose vehicle to Lobaye Invest in the Central African Republic on January 25, 2018. The export declaration accompanying this shipment bears the name of Evgeniy Khodotov, a regional representative of Lobaye Invest on mining concessions document from the C.A.R. (See document below). Khodotov is alleged by Russian investigative media to have been an employee of the Saint Petersburg Regional Counter-Organized Crime Directorate and the Main Directorate of the Ministry of Internal Affairs of Russia.

Concession document from the Central African Republic, showing ‘Evgenii Khodotov’ as the Director of Lobaye Invest SARLU

Concession document from the Central African Republic, showing ‘Evgenii Khodotov’ as the Director of Lobaye Invest SARLU

A few months later, trade data shows that the Saint Petersburg-based Broker Expert  shipped 20 of these vehicles to Meroe Gold on May 25, 2018. These Urals, all manufactured in 2018, were shipped out from Novorossiysk, and were collectively valued at EUR 518,400.00.

Broker Expert

According to Russian customs data, Meroe Gold is the only foreign company that Broker Expert has exported to. The Russian Federal Statistics Service documents that Broker Expert reported RUB 186,771,000.00 in revenue in 2017, when it began to export to Meroe Gold (USD $ 2,900,553.63 at the current rate). Prior to this, Broker Expert had a revenue of around RUB 2,010,000 in 2016 (USD $ 31,215.30 at the current rate).

Open source investigators with Bellingcat, Conflict Intelligence Team, and BBC have identified the presence of Ural 4230s in Sudan and the Central African Republic. Some of these vehicles appear to be up-armored. They frequently appear alongside armed and uniformed personnel.


Training of CAR armed forces

Soldiers in C.A.R. training with a Ural 4230 in spring 2018, identified on the C.A.R.’s president’s Facebook page by     Conflict Intelligence Team    .

Soldiers in C.A.R. training with a Ural 4230 in spring 2018, identified on the C.A.R.’s president’s Facebook page by Conflict Intelligence Team.


Convoy of armed Russian nationals in CAR

Armed Russian nationals in C.A.R. in 2018. Note Ural vehicle in background, from video taken by FPRC rebels released by France24


Presence at protests in Sudan

Images of Ural 43200s at December protests in Sudan, from Jon Hutson and Conflict Intelligence Team.


At Meroe Gold location in Sudan

Image of possible Ural 42300 outside of alleged location of Meroe Gold, spotted by     Benjamin Strick   .

Image of possible Ural 42300 outside of alleged location of Meroe Gold, spotted by Benjamin Strick.


Big Birds - Mi-8T Helicopters

Ural trucks aren’t the only heavy vehicles that this network has shipped to Africa. Customs data indicates that M-Finance shipped an Mi8-T transport helicopter, registration number RA-06114, to Meroe Gold, in February of 2018. Evgeniy Khodotov also appears on the customs declaration for this shipment. M-Invest sent an additional Mi-8T to Meroe Gold on the same date.  

Meroe Gold

According to Sudanese media, the Regional Director of Meroe Gold is Mikhail Potepkin. Conversely, Russian government publications identify Potepkin as the Regional Director of M-Invest.

Potepkin was once a ‘Commissar’ in pro-Putin youth group “Nashi”, before owning the tech company ‘IT-Debugger’ along with with Anna Bogacheva, an employee of Prigozhin’s Internet Research Agency, who oversaw the IRA’s data analysis team and who is alleged by the US Department of Justice to have collected intelligence in the United States in 2014. Bogacheva was indicted by the US Department of Justice for her work with the IRA.

Mikhail Potepkin, photographed by         local media     in Sudan meeting with officials regarding the opening of a Meroe Gold mine.

Mikhail Potepkin, photographed by local media in Sudan meeting with officials regarding the opening of a Meroe Gold mine.

In a video uploaded to YouTube by user Alex Tupolev on February 25, 2019, an Mi-8T transport helicopter with tail number RA-06114 appears in C.A.R., operated by Russian nationals. In the video, produced by the Presidency of C.A.R., French narration explains that the Russians use the helicopter to deliver humanitarian aid. European individuals in the video appear to deliver supplies and mattresses, wearing fatigues.

Still from YouTube video uploaded by user Alex Tupelov. Note tail number of the Mi-8T. Source:     Youtube

Still from YouTube video uploaded by user Alex Tupelov. Note tail number of the Mi-8T. Source: Youtube

Stills from YouTube video uploaded by user Alex Tupelov. Left: Material unloaded from helicopter. Right: Russian national unloading helicopter.


To Bangui with a layover in Miami 

At least four shipments of equipment had a US nexus, with the customs data showing an address in Hollywood, Florida for the recipient. Though the equipment likely never actually transited the US, the mysterious Florida address indicates that this Russian-African network may have a logistical node in South Florida.

138 Obvodniy Canal Embankment, St. Petersburg, the location of the company that sent security equipment to C.A.R.

138 Obvodniy Canal Embankment, St. Petersburg, the location of the company that sent security equipment to C.A.R.

Beginning in early 2018, M-Finance began routing its shipments to Lobaye Invest in the C.A.R. through Kraomita Malagasy S.A, a state-owned mining company in Madagascar with which an opaque Russian mining company was reportedly forming a commercial joint venture. Three shipments on May 25, 2018 and one on June 15, 2018 went from St. Petersburg in Russia to the C.A.R via Madagascar. These shipments contained 72 ‘PUS – 1’ police batons, 423.6 kilograms of ‘Shturm 3’ riot shields, uniforms, hard drives, printed products and ballpoint pens.

Customs data shows that these shipments, delivered to Antananarivo International Airport, were evidently ultimately bound for the C.A.R. according to the listed recipient. However, the recipient’s address was listed as 3505 S. Ocean Drive, Hollywood, Florida, indicating that the receiving party or its representative was located at that address. 

While no U.S company was named in these records, C4ADS used Florida corporate records to identify a number of businesses registered at this address, including two corporate and legal services providers and real estate firm that each had offices in both Florida and Russia. These corporate service providers have registered numerous companies at this address and others.

3505 S. Ocean Drive, Hollywood, Florida, the listed address of the recipient.

3505 S. Ocean Drive, Hollywood, Florida, the listed address of the recipient.

This pattern of information in customs declarations is not necessarily unusual, particularly given the common role of freight forwarders or other facilitators in international trade. Certainly, nothing in the trade data or our research provides solid evidence of any illegal activity. This shipment was unusual, however, because each of the parties involved have been associated in public reporting with Evgeniy Prigozhin and PMC Wagner, in relation to the training of the C.A.R. armed forces, political activity in C.A.R. and Madagascar, and the killing of three Russian journalists.

Network of Lobaye Invest and its Russian trade partners, with Madagascar and U.S. affiliations.

Network of Lobaye Invest and its Russian trade partners, with Madagascar and U.S. affiliations.

Right: Universal Specialized Baton-1 manufactured by Special Materials Corp., the same model sent to Lobaye Invest. Left: Shturm-0 riot shield, the same model sent to Lobaye.


Observing Grey Activity

Prigozhin’s ventures’ open source footprint gives insight into at least one element of Russia’s assertion of its influence in Africa—the millions of dollars of investment supporting actors involved in mineral extraction, military assistance and political interference. This is likely just a small part of the finance behind Russia’s growing profile on the continent.

The evident integration of these ostensibly private actors with activities of the Russian government makes it all the more surprising that this network would have a connection to the US. The US nexus in this case demonstrates the permeability of jurisdictions that allow for obscured ultimate beneficial ownership, and the importance of verifying the identities and affiliations of parties to trade transactions.

The private nature of Russian military contractors permits them to behave dynamically, with activities across a range of sectors, some of which appear to coincide more directly with Russian foreign policy objectives than others. This also creates opportunities for leverage: every point where Prigozhin’s activity relies on a commercial company, be it a bank or a customs broker, is a point for governments and the private sector to apply pressure.


Launch of ROUTES Dashboard


How do you feel about snakes on your plane?

Or the tusks of a hundred dead elephants in the cargo hold below you?

It has become increasingly common for traffickers to use ordinary commercial routes to illegally move live animals and wildlife products. When we began our work on illicit ivory supply chains back in 2014, air trafficking was a small minority of all large-scale seizures, i.e. those seizures that are indicative of organized crime involvement.

However, as awareness of ivory trafficking increased, that trend began to change. In 2015, Australian officials seized 110kg of ivory in an air cargo shipment (roughly equivalent to 14 elephants); one year later, South Sudanese officials seized a staggering 1.28 tons of ivory (about 168 elephants) in another air cargo shipment. And it is not just ivory: far too many species are under attack by unscrupulous networks of people driven by the promise of enormous profits with little risk from enforcement. By 2019, we had counted hundreds more seizures of ivory, as well as hundreds of seizures of rhino horn in checked baggage, pangolin scales in air freight, turtles in checked baggage, Guyanese finches in the sleeves of passengers, European eels packed in checked baggage by the tens of thousands, and tiger cubs sedated and hidden in suitcases.

To help combat wildlife trafficking by air, C4ADS, as part of the USAID Reducing Opportunities for Unlawful Transport of Endangered Species (ROUTES) Partnership, is proud to launch the first-ever data dashboard on wildlife trafficking in the air transport sector. The ROUTES Dashboard relies on the C4ADS Air Seizure Database, which currently includes 1,379 instances of air trafficking in more than 130 countries representing over 69 tons of smuggled wildlife products.

The ROUTES Dashboard is publicly available and provides in-depth and customizable analysis of the trafficking trends, routes, and methods associated with wildlife trafficking seizures in airports. The data and analysis it provides can be used by transport companies, enforcement personnel, government agencies, and other stakeholders to uncover actionable insights that can help strengthen counter-wildlife trafficking policies in the air transport sector.


Dive into the data!

Examine overall seizure trends. The chart below reveals that the top five airports for wildlife trafficking by seizure count are located in East Asia.


Filter the data by species. Break down your search by a range of further indicators such as species, trafficking method, and region. The routes map below shows global reptile trafficking moved only in air freight.

Screen Shot 2019-05-31 at 6.14.44 PM.png

Generate detailed graphics. After filtering the data, select one of several tabs to view detailed graphics. The chart below highlights trafficking trends for all species in Asia.

Screen Shot 2019-05-31 at 6.19.55 PM.png

Country Profile Map 

The Dashboard includes a Country Profile Map, allowing users to access available information on wildlife trafficking by air in each country.

Kenya, for example, emerges in the data both as a source and a transit country. Kenya’s prominence is primarily due to two factors: Jomo Kenyatta Airport’s role as a major hub between flight routes originating in Africa and destined for the Middle East and Asia, and Kenyan enforcement’s awareness of the prevalence of wildlife trafficking activity in their airports. The high volume of wildlife passing through the airport combined with enforcement’s heightened ability to stop wildlife trafficking instances in the airport leads to both the country’s high seizure count and the fairly diverse array of wildlife seized there. 


Route Risk Tool

Finally, the Dashboard’s Route Risk Tool can be used to produce a dynamic risk estimate for different airline routes.  This can provide predictive insights for policymakers, allowing airlines, governments, and other stakeholders to better direct scarce enforcement resources.

Although the tool is still in development, you can choose from any pair of flight routes in the C4ADS Air Seizure Database to view a list of wildlife seizures along that route.

For example, the Route Risk Tool generated the below tables for the route between Nairobi and Dubai. At least four seizures have occurred along this flight route, most of which were carried by air freight. None of these trafficking instances, however, were going to stay in Dubai–all used the UAE as a transfer country, with at least four other countries (China, Malaysia, Thailand, and Laos) listed as intended destinations.


C4ADS is proud to partner with ROUTES to analyze wildlife trafficking in the air transport sector. The Dashboard represents the ROUTES Partnership’s latest effort to put actionable information in the hands of governments and the air industry. In 2018, we released In Plane Sight, a nearly decade-long analysis of wildlife trafficking seizures at airports and in airlines worldwide. In Plane Sight was a follow-up to our 2017 report, Flying Under the Radar, which marked the first-ever analysis of wildlife trafficking in the aviation industry and showcased the widespread exploitation of transport supply chains by criminal networks engaged in wildlife trafficking.


Something Smells Fishy...

Austin Brush, Analyst

Combating illegal, unreported, and unregulated (IUU) fishing is inherently a big data challenge. Billions of Automatic Identification System (AIS) and Vessel Monitoring System (VMS) messages from tens of thousands of active vessels must be sorted and examined to find the few vessels that are likely to be committing illicit activity. On top of that, data visibility problems plague current monitoring systems, with AIS (which can “go dark” at the captain’s discretion) and VMS (which is largely unavailable to the public) both failing to provide the full picture of at-sea activity. In addition to the limitations that exist within these systems, only the largest fishing vessels are likely to carry AIS, and VMS adoption is dependent on coastal states requiring the system. The result is that the picture of maritime activity produced by AIS and VMS requires careful curating and additional analysis before conclusions can be drawn. Spotting these kinds of gaps in the huge amount of data collected can be difficult, but is necessary to identify many types of illicit activity.

With such a vast ocean of data to sift through, effective targeting requires focusing on chokepoints. For IUU fishing, the clearest chokepoint is the logistical vessels that support fishing vessels’ clandestine activities. For instance, “reefer” or refrigerated cargo vessels are critical facilitators that help deep sea fishing fleets regularly offload their catch and take on supplies while at sea, thereby allowing them to stay at sea for much longer periods of time than would otherwise be possible. Reefers service entire fleets, serving as a critical link bringing seafood— both licit and illicit—to shore. These reefers are far fewer in number than fishing vessels, and are much more likely to regularly transmit AIS signals, making them a visible data point that analysts can exploit.  

C4ADS’ partnership with Windward enables us to use this type of data in our analysis. Using Windward’s maritime risk analytics platform, C4ADS is able to access structured several years’ worth of historical data on vessel operations. The platform is easily filtered according to customizable search queries, allowing tailored, hypothesis-driven analysis of specific questions.

C4ADS analysts have recently been using these queries to uncover IUU trends through analysis of risky vessel behavior. Some examples of risk indicators include:

  • “Drifting” – Windward uses this term to denote vessel movement under 3 knots, which is the usual speed at which two adjacent vessels would travel to transfer goods, catch, or crew.

  • High Risk Zones – Windward allows analysts to define zones where suspicious activity, such as ship-to-ship transfers, IUU fishing, or sanctions violation, commonly occurs.

  • Flags of Convenience (FOC) – Vessels engaging in illicit activity often use flags of convenience as a means of obfuscating their ownership or avoiding legal action or scrutiny. FOCs are a means of circumventing regulatory oversight with little to no barrier to entry.

  • “Meetings” – Windward applies machine-learning algorithms to detect anomalous ship activities, including meetings between vessels at sea, for extended periods of time. Vessels that “meet” for extended periods of time are more likely to be refueling at sea or transferring catch, crew, and/or supplies (known as transshipment), potentially in violation of law.

As an example, we will walk through a case in which Windward tools helped C4ADS analysts hone in on suspicious vessel activity and then map the corporate network behind three refrigerated cargo vessels.


From Activities…

Using the above set of risk indicators, we identified three reefers operating in and around the Exclusive Economic Zones (EEZ) of Guinea Bissau, Guinea, and Ivory Coast:

*On February 23, 2019, the Gabu Reefer reflagged from Comoros to Moldova.

*On February 23, 2019, the Gabu Reefer reflagged from Comoros to Moldova.

All three vessels are flagged to FOCs (Comoros and Moldova). According to their historical AIS transmissions, they consistently behave in the following ways:

  • Drifting while at sea for periods ranging from under one hour to multiple days

  • Changing port of destination and draft after drifting at sea

  • Drifting near areas where fishing vessels from the same corporate fleet operate.

These behaviors are common for vessels that are transshipping, but do not necessarily indicate illicit activity. However, when this activity is observed in a particular high-risk zone, such as the EEZ of Guinea Bissau— where at-sea transshipment has been banned since 2015— this behavior warrants further scrutiny.

The SILVER ICE "drifted" on the border of the EEZ of Guinea Bissau and Guinea between January 9 and 11, 2019. Toward the end of its "drift", the SILVER ICE changed its destination from Monrovia, Liberia to Conakry, Guinea.

The SILVER ICE "drifted" on the border of the EEZ of Guinea Bissau and Guinea between January 9 and 11, 2019. Toward the end of its "drift", the SILVER ICE changed its destination from Monrovia, Liberia to Conakry, Guinea.


…to Insights…

All three vessels, along with at least four other trawlers, are registered to several Panama-domiciled companies, which are all ultimately controlled by Sea Group SL, a company incorporated in the Canary Islands. The Panama connection is a red flag for our analysts, as the country has frequently been criticized by experts as a haven for tax evasion, money laundering, and other illicit activity.

Vessels in Sea Group SL’s fleet have also been implicated in risky activity. For example, in 2014, the GABU REEFER was fined US$2,000 by Liberia for landing fish without the necessary authorizations. Then in 2015, the SILVER ICE was categorized as a high-risk vessel by the West Africa Task Force (WATF) after the government of Comoros raised concerns about the vessel’s activity in the region. While it is unclear what activity directly incited those concerns, the SILVER ICE was documented landing catch sourced from Guinea Bissau and Guinea in numerous ports in West Africa at the time.  

Inquiries into the SILVER ICE were also in part due to pressure from the European Union for Comoros to increase oversight of distant water fishing vessels registered under their flag. Flag registration in Comoros is reportedly controlled by the Administration of the Union of Comoros and is an open registry. This means that in Comoros, foreign companies are able to register vessels without proving a “genuine link” to the country and oversight is outsourced to private interests.

Finally, in 2017, the SALY REEFER was caught carrying out an illegal transshipment with three other ships in the EEZ of Guinea Bissau. The owners and crew members reportedly faced fines and legal action as a result of the illegal transshipment.

Sea Group SL, incorporated in the Canary Islands, beneficially owns a fleet of at least seven vessels. Four of these vessels were implicated in an illegal transshipment in the EEZ of Guinea Bissau in 2017. At sea transshipment has been banned in Guinea Bissau since 2015.

Sea Group SL, incorporated in the Canary Islands, beneficially owns a fleet of at least seven vessels. Four of these vessels were implicated in an illegal transshipment in the EEZ of Guinea Bissau in 2017. At sea transshipment has been banned in Guinea Bissau since 2015.


…to action.

Ultimately, fully understanding illicit maritime activity requires going from sea to shore. A vessel is just an asset owned by an onshore network, and its activity at sea is ultimately determined by the financial interests of its beneficial owners. C4ADS therefore believes effective maritime analysis requires both at-sea and onshore analysis to connect vessel behavior to corporate networks.

C4ADS’ Natural Resources Cell is committed to using these and other methods to combat IUU fishing. Windward’s technology is a critical part of this effort, helping our analysts identify high-risk activities at sea that can be tied to on-shore corporate networks. Directing this information to the right authorities can then result in real action—like arrests, seizures, and ship detentions—that have a tangible effect on the overall trade in illicit fish products.


Banks, Boats, and Bombs: Using Co-location to Expand the Evidence of DPRK Network Convergence from the 2019 UN Panel of Experts Report

Jason Arterburn, Lead Analyst & Lucas Kuo, Analyst

On Tuesday, the United Nations Panel of Experts released its 2019 report on North Korea’s sanctions evasion and WMD programs. The Panel found that—even today—a limited number of trusted overseas commercial facilitators continue to engage in a wide range of revenue-generating activities for the Kim regime, often using overlapping corporate architecture that can be exposed through shared addresses and phone numbers. Li Zhengang (李振刚) and his accomplices are but the latest example.


Co-location with Sanctioned Entities

Chinese national Li Zhengang was first identified in the 2017 midterm report for owning 70% of UN- and US-designated Daedong Credit Bank, which OFAC sanctioned  in June 2013 for supporting North Korea’s ballistic missile and WMD programs. The Panel found that Li also controlled two other companies, one of which remains active: Dandong Zhongrui Petrochemical Co., Ltd. (丹东中瑞石油化工有限公司). Zhongrui’s Chinese business registry filings indicate that it is registered in Dandong, China at Jiadi Plaza on No. 64 Binjiang Middle Road (滨江中路64号). If the address sounds familiar, that’s because it has appeared before: the same building also hosts a number of other companies sanctioned for supporting North Korea’s WMD program, including but not limited to OFAC-designated Dandong Zhicheng Metallic Material Co. ,  the subsidiary company of OFAC-designated Dandong Hongxiang Industrial Development Co., and further still its subsidiary DPRK restaurant.

Chinese business registry filing showing Dandong Zhongrui Petrochemical Co.’s registered address

Chinese business registry filing showing Dandong Zhongrui Petrochemical Co.’s registered address


Ties to North Korean Shipping Networks

In Tuesday’s report, the Panel showed that Li Zhengang’s network also has ties to a number of DPRK shipping operations through companies in both mainland China and Hong Kong. Chinese business registry filings show that Dandong Zhongrui shares an address with Dandong Jing’ao Trading Co. (丹东京奥贸易有限公司), with variation only in the character used to refer to room number. Dandong Jing’ao Trading appears to have had a Hong Kong-registered affiliate that used an identical name until March 14, 2017. Registry filings for both the mainland- and Hong Kong-registered Jing’ao companies list a Chinese national by the name Sun Chengguo (孙成国 or 孫成國) as director. The Panel notes that, as in the case of Dandong Zhongrui Petrochemical, Sun Chengguo used a residential address with ties to known DPRK entities: Room 916, DL1504, Youhao Building, 158 Youhao Road, Zhongshan District, Dalian, China. An almost identical address has also been used by multiple other Chinese nationals engaged in DPRK maritime sanctions evasion operations: Gu Baofu (顧寶富), the director of US- and UN-sanctioned Chang An Shipping & Technology Co., Ltd. (長安海運技術有限公司); and Pan Weichao (潘衛朝), the director of Pantech Shipping Limited (泛科海運有限公司) and an emergency contact for the Marshall Islands-based operator of the Jie Shun, a Cambodian-flagged cargo vessel that Egyptian authorities seized in August 2016 for carrying RPGs and various subcomponents from the DPRK to Africa.


Additional Shipping Networks at the Same Address 

But Sun Chengguo, Gu Baofu, and Pan Weichao are not the only individuals who list an address at Room 916 of 158 Youhao Road. In fact, when we searched for more co-located people and companies, we found that a fourth Chinese national Ji Xiangyu (嵇相宇) used an almost identical residential address in an alleged scheme to launder  prohibited DPRK coal through Far Eastern Russian ports in late 2017. On a 2017 annual return, Ji Xiangyu listed the address on a filing for his company Maple Source Shipping Limited (楓源海運有限公司), a Hong Kong-registered company whose plausible Marshall Islands-based counterpart owned the Togo-flagged Yu Yuan (IMO 95358694). In the fall of 2017, the Yu Yuan, along with other DPRK-flagged vessels, unloaded coal from North Korea at a coal terminal in Kholmsk, Russia. The coal was subsequently transshipped from Kholmsk to South Korea by several foreign-flagged vessels, one of which—the formerly Panama-flagged Sky Angel (IMO 9168441)—was managed by a Chinese company named Dalian Sky Ocean International Shipping Agency Co., Ltd. (大连天洋国际船舶代理有限公司) and is also registered at 158 Youhao Building, albeit in a different room.

The corporate network behind the Yu Yuan has changed since it was first exposed in early 2018. Equasis vessel ownership records pulled as recently as November 2018 indicated that the Yu Yuan’s owner at the time of transshipment was “in the care of” Rich Mountain Trading Co., Ltd. (富峰貿易有限公司), a second Hong Kong company of which Ji Xiangyu is the sole director and shareholder that had served as the Yu Yuan’s commercial and ISM manager at the time of transshipment. However, Rich Mountain Trading no longer appears in the Equasis database or the Yu Yuan’s ownership and management history. On Rich Mountain’s corporate filings, Ji Xiangyu reported a residential address nearly identical to that used on his first company’s filing and by Sun Chengguo, Gu Baofu, and Pan Weichao: Room 916, DL1398, Youhao Building, 158 Youhao Road, Zhongshan District, Dalian, China.

Network chart.png

Transshipping North Korean coal from Russia to South Korea: Voyage Paths of the Yu Yuan and Sky Angel


Bottom Line: Co-location Exposes North Korea’s Overseas Commercial Networks 

North Korea’s overseas commercial operations depend on a limited number of facilitators who are both highly capable and willing to undertake significant risk. As we observed in Dispatched, there are strong economic incentives for a resource-strapped regime to co-locate its overseas activities at a limited number of physical locations. This allows them to reduce costs while engaging in bank transactions, coal sales, technology purchases, surveillance of workers, shipping operations, and other revenue-generating activities for the Kim regime. Law enforcement and civil regulators can and should use the inherent exposure of a fixed physical location to uncover the full portfolio of DPRK sanctions evasion activities.

So what else is at Dandong’s No. 64 Binjiang Middle Road, Dalian’s 158 Youhao Building, or at any other addresses associated with DPRK commercial facilitators? In any investigation, law enforcement and civil society should be sure to check.


Public Data and Anticorruption Research

Phil Kittock, Cell Lead & Sofia Vargas, Analyst

Public data is essential for anticorruption research. Many countries publish online databases of public records of all varieties, from court filings to corporate registries, from timber exports to plane registries. These are critical sources of credible information for anticorruption researchers, investigative journalists, and civil society groups around the world.  

The way these datasets are structured ranges from individual records to bulk data, and every type in between. Merely collecting raw data only takes us halfway to conducting the kind of impactful analysis that we seek to provide. Any individual source of information, from a full corporate registry to a single judicial transcript, can be useful – however, keeping data sources separate keeps insight isolated, meaning you have to do a lot more work to discover illicit activity.

By integrating and comparing datasets across formats and jurisdictions, C4ADS’ Organized Crime and Grand Corruption Cell is able to more comprehensively and efficiently understand the transnational illicit networks we research and the systems in which they operate. When datasets are joined together, individuals and entities that appear separate can form networks, while examining activities allows us to identify interesting trends from large datasets.


Mapping out Networks:

In the modern world, criminal networks, including those that facilitate North Korean overseas labor or that specialize in wildlife trafficking worldwide, are able to move fluidly from jurisdiction to jurisdiction, deftly navigating the bounds between the illicit and licit worlds. Whenever illicit networks touch the licit system, they leave a paper trail that researchers can track – C4ADS uses public records to identify the networks that operate in the illicit economy. As we go through and investigate each person or company we come across in our research, we uncover dozens of related records. The trick to making these data points useful and actionable is knowing how to tie them all together, and what they mean when combined.  

Investigating the people and companies in a network can lead to the discovery of more specific data points, like luxury plane travel, export licenses, and property purchases, which all provide a better picture of how a particular network actually operates. When a Venezuelan businessman was indicted by US prosecutors in November 2018 for embezzling funds from the Venezuelan state-owned oil company PDVSA, we started to investigate his business dealings and the network around him. After structuring the data we uncovered in the course of our research, we found a key business associate that appeared to facilitate the business dealings of this network. This business associate co-owned businesses in the US, and we also discovered that they were family.

From there, we searched property records and airline registries to see if any of the companies or individuals in the network owned luxury planes, homes, or other big ticket items. Companies in the network owned luxury homes and a plane in South Florida, a key piece of information that led us to activities-based analysis.


Tracking Activities:

To use activities-based analysis to investigate aircraft, we apply the knowledge we already have about illicit activity involving aircraft to build a pattern we can look for in the data. Since the US government publishes the registration numbers of aircraft owned by now-indicted and sanctioned individuals, there are readily-available examples of illicit activity to analyze in the open source. Using a simple aircraft registration number published in a press release, we are able to connect an aircraft to its owner in an aviation registry, and we simultaneously viewed historical flight data from flight-tracking platforms like ADS-B Exchange.


After analyzing historical flight data to identify where aircraft of interest have been in the past, we can find other aircraft that follow a similar pattern. Additional information, like whether or not the aircraft is registered in a secrecy jurisdiction, provides further clues of suspicious and potentially illicit activity.

In the previously mentioned money laundering case involving the Venezuelan businessman, a sanctioned aircraft’s transmissions revealed that its flights were almost exclusively between South Florida and Caracas in the months prior to the plane being sanctioned. A different, unsanctioned plane that was publicly reported to operate in connection to the same network revealed almost identical flight patterns to that of the OFAC-sanctioned plane. This raised many interesting questions, and by identifying this activity we are able to further our investigation and uncover new layers of the network’s activity.


The Impact for Anticorruption Research

Identifying patterns or typologies of crime can provide a useful methodology, and it can assist in finding illicit activity that emerges from the open-source. In this way, using both network- and activities-based analyses allows us to sift through an immense amount of public data to find cases that are most interesting to the public, the most relevant to our research, and the most impactful for our partners. Furthermore, although a simple network-based analytical approach provides a useful roadmap for researching corruption, being able to highlight the actual activities of a network makes the results of anticorruption research much more dynamic, enlightening, and actionable.  

At the upcoming 2019 OECD Anti-Corruption & Integrity Forum, we will dive into these issues and our methodologies further to provide a glimpse of how C4ADS analysts and partners work to untangle the webs woven by illicit actors. 


Why We Love Graphics

Evangeline Hines, Operations Manager & Patrick Baine, Senior Analyst

If no one understands your research, did it really even happen? At C4ADS, we think hard about how to turn our research into concise analytical findings. Consistently, we find graphics to be one of the most effective ways of condensing research into a single, comprehensible format. Our work often requires the explanation of complex networks, relationships, and patterns that would be nearly impossible to make sense of without graphics. Good graphics pack in a lot of information, but they also drive you to ask questions and dig deeper.

Getting this right depends on choosing the right graphics. Representing the data in a dishonest or confusing way is worse than not using graphics at all. Here, I wish to highlight a few examples in which we have structured complex and large data sets to make them intuitive and informative. This work would not have been possible without the R Suite of software and our wonderful Senior Analyst, Patrick Baine.

Flying Under the Radar: Wildlife Trafficking in the Air Transport Sector 

How do you map the air transit routes used for wildlife trafficking? This is not an easy task, especially given the lack of open source data on the issue. For the ROUTES project, we needed to reconcile several different databases of seizures in the air transport sector of various wildlife products to help industry, government, and civil society better understand the flow of these products. 


This map is helpful because it gives you a few pieces of basic insight right when you first look at it. It then prompts you to ask questions. There appears to be more activity in Europe, Africa, and Asia; why? Why is there so little in North and South America? What about Australia? I don’t usually think of Western Europe as a trafficking hotspot, so what is going on there? If you were to look at the spreadsheets of data that went into this graphic, I doubt that many people would come away with the same level of insight as they would by looking at the graphic. Graphics like this help you see the bigger picture and then encourage you to ask important research questions.

World Customs Organization: Cultural Heritage Trafficking in 2016


For this project, C4ADS analyzed World Customs Organization data to determine patterns in the trafficking of cultural heritage objects, such as antiquities, art, or other significant objects. This graphic shows the flow of cultural heritage trafficking in 2016. The chart visualizes the flow of goods from the country in which they originated to the destination country, as indicated by the arrow. The number of goods per country can be seen along the edge of the circle.

This is another graphic that 1) is pleasing to the eye, 2) does a great job of conveying movement (before you even have context, you know something is moving from one place to another), and 3) raises questions. One question that is raised by this graphic is what happened to the cultural heritage flowing out of Syria given the context of events there in 2016? Given the news coverage of the issue, I would have expected to see that show up here, and yet… Questions like this require more digging to answer, and can even become the base of full-fledged C4ADS projects.

World Customs Organization: Psychotropic Substance Seizure in 2016


For the same WCO project, C4ADS received a different dataset related to seizures of narcotics. While flows were interesting, other patterns related to time of seizure told an equally compelling story. This jitter plot represents seizures of psychotropic substances in 2016 by country. From the chaos of dots, patterns emerge. Again, this graphic gives insight, but also points to important questions and next steps for further research. What caused the increase of seizures in the second half of the year in Germany? Why did Estonia have a drop in seizures at the end of the year? Was there a reason that Hungary started reporting seizures in March? What about the trends within the types of psychotropic substances being seized? Most strikingly, what caused the glaring disparity between the frequency of seizures in the United States compared to the rest of the world? By looking at this graphic, you can both gain knowledge and understand that there are underlying trends in drug trafficking that require further study.

These are only three examples from one of the multiple platforms we use to develop graphics, but I think they do a great job of demonstrating what great graphics can do, and how they can add to stellar research. The complexity of the world in which we live and the data it produces will only continue to grow. We want to continue to explore new and innovative approaches to open source data and analysis, and eye-catching and insightful graphics are going to be a key component of our approach.


Crowdsourcing, Central Asian Steppes, and a Creature Straight Out of Science Fiction

Ben Spevack, Analyst

In Kazakhstan, one environmental conservation organization has developed an innovative approach to preserve one of the region’s most unique yet critically endangered species. 

Saiga tartarica (saiga for short) is a species of antelope that has inhabited Eurasia for over 100,000 years. Adult saiga typically stand between two and three feet tall at the shoulder, and adult males have ribbed horns that grow to between eleven and fifteen inches. But the saiga’s most remarkable feature is undoubtedly its snout. The peculiar appendage allows the saiga to filter dust from the air and regulate its body temperature.

The saiga’s habitat used to stretch across the Eurasian continent, but now consists of a few small pockets in Central Asia.

The saiga’s habitat used to stretch across the Eurasian continent, but now consists of a few small pockets in Central Asia.

While once abundant and widespread, with 1.25 million saiga worldwide as recently as 1981, the species has suffered a catastrophic decline, decreasing to only 24,000 in 2004. Current estimates place today’s saiga population at around 165,600, with the remaining herds found in pockets of Kazakhstan, Uzbekistan, Russia, and Mongolia. 

Current distribution of saiga from the Convention on the Conservation of Migratory Species of Wild Animals.

Current distribution of saiga from the Convention on the Conservation of Migratory Species of Wild Animals.

Poaching is one of the principal causes of the saiga’s drastic population decline in recent years. According to traditional Chinese medicine, saiga horn is believed to have medicinal properties that can regulate “internal heat” (“清热”). The horn is typically crushed, dissolved, and sold as “cooling water.” While trafficking in saiga horn is nominally illegal under the CITES convention, enforcement is lax and the trade is relatively open. In Kazakhstan, traders will even post flyers soliciting the horns, complete with a phone number or an email address.

The Association for the Conservation of Biodiversity in Kazakhstan (Казахстанская ассоциация сохранении биоразнообразия, or ACBK for short) has a unique approach to tackling the issue of saiga poaching and horn trafficking. ACBK runs an annual campaign in partnership with the Ministry of Internal Affairs and the Committee on Forestry and Fauna to combat the domestic trade of saiga horns. The goals are twofold: 1) raise awareness of the illegal nature of saiga horn trafficking, and 2) create a database of names and phone numbers associated with traffickers. These goals are achieved through a crowdsourced targeting of the flyers plastered across the country.

When a volunteer comes across a poster soliciting saiga horn, he or she takes pictures and posts them on the ACBK Facebook or VKontakte page, along with the location of the ad (if the volunteer wishes to remain anonymous, he or she can send pictures to ACBK’s Whatsapp number). The volunteer then glues a sticker on the ad, which cites the specific law forbidding the sale of saiga horn. Finally, if the advertisement includes a phone number, the volunteer sends a templated text explaining that trading in saiga horn is illegal. The procedure is the same for online procurement posts, without the sticker. The campaign runs from November to January, after which ACBK aggregates the data, structures it, and passes it along to the environmental prosecutor for further investigation.

One of the stickers volunteers attached to procurement posters.

One of the stickers volunteers attached to procurement posters.

The most recently completed campaign wrapped up on January 21, 2017. As of February 26, ACBK’s pages on Facebook and VKontakte had 686 combined subscribers who contributed 92 photos. Twenty-one unique phone numbers were identified, spread across nine cities. Additionally, nineteen websites were identified as hosting posts for saiga horn. ACBK contacted the websites and requested that they take down the posts. Eleven websites complied, five did not reply, and three were defunct upon a follow-up check. While ACBK has not mentioned any resulting arrests or seizures, it has said that all the collected information has been transferred to the environmental police to assist in investigations.

This campaign is a low cost, effective approach to wildlife conservation. Organizing via social media allows for collaboration among disparate actors and crowdsourcing allows for the assiduous efforts of small-scale environmental organizations to be amplified by hundreds of local residents. While conventional anti-trafficking measures by law enforcement and NGOs hamper poaching operations and the flows of illicit wildlife products, they offer little opportunity for local participation. Contributions, regardless of size, give local volunteers ownership and investment in the outcome. In the long term, crowdsourcing campaigns such as ACBK’s may catalyze a shift in societal attitudes towards wildlife trafficking.



Welcome to the C4ADS Blog!


Varun Vira, Chief Operating Officer

We are proud to announce the formation of our new blog. This platform will allow our readers a look behind the curtain at C4ADS to get a glimpse of our processes and on topics that interest our analysts.

For those of you who are not already familiar with our work, C4ADS is a nonprofit organization dedicated to providing evidence-based reporting and analysis on transnational security issues. Around the world, bad actors are able to hijack licit infrastructure to accomplish their illicit aims: our mission is to make it more difficult for these bad actors and their networks to function. To do this, we use cutting-edge technologies and methodologies to analyze disparate datasets, shedding light on problems of corruption, crime, and conflict. Sound a little confusing and intense? We know what we do can be puzzling to people who don’t know us, but we hope this blog will provide a better understanding of what we do as an organization. Plus, our background provides some very interesting material that we wish to share with our readers.

What should you expect to read on this blog? Without giving too much of the suspense away, one can expect to read posts on everything from how Facebook posts can be used to deter illegal poaching of endangered animals, to follow-ups on previous C4ADS reports, to how we use different technologies to simplify our data for consumption. On this page you can expect to meet a rotating cast of North Korean proliferators, ivory and pangolin traffickers, Middle Eastern terror financiers, and other associated bad actors. And that’s just our analysts. These and many more riveting topics will be explored and posted on this blog page.

To make sure that you do not miss any content, sign-up to have C4ADS blog posts delivered directly to your inbox at the bottom of this page. We hope that you are as excited as we are for the launch of our blog—happy reading!