Samer Foz is a key Assad regime henchman designated by the United States along with his siblings and ten of their businesses in Syria, Lebanon, and the UAE. C4ADS, using publicly-available information (PAI), identified 18 unsanctioned companies that are likely linked to Samer Foz in Turkey, Lebanon, and the UAE. They could enable the Foz network to continue its support for the Assad regime and profit despite US sanctions. They could also help the Foz siblings protect their assets from Assad’s regime and benefit from the Syrian reconstruction process.
Every tool of war tells a story. For South Sudan, a country with no domestic weapons manufacturing and ongoing civil conflict, every weapon reflects international intermediaries and middle men that profit from procurement. In the fall of 2014, amidst ongoing civil war with the Sudan People’s Liberation Army in-Opposition (SPLA-IO), the government of South Sudan purchased Russian-made amphibious vehicles (AMVs). With the purchase of these AMVs, the government forces acquired a unique degree of mobility to maneuver in wetlands, extending the reach of their attacks, including deliberate attacks directed at civilians.
Peter Kirechu, Lead Analyst
Paul Biya, Cameroon’s octogenarian President, was re-elected to a record-setting 7th term in October 2018, becoming the longest serving non-royal head of state in the world. The October presidential election was marred by violence, particularly in the north-west and south-west Anglophone regions where a separatist insurgency has raged since 2016, threatening to split the country along linguistic fault lines. Despite the roiling tensions and escalating violence, President Biya is known for spending an inordinate amount of time outside the country on private, unofficial foreign visits. A February 2018 investigation by the Organized Crime and Corruption Project (OCCRP) estimated that over the course of his 35 years in power, President Biya has spent at least four and a half years on “brief private visits” (often to Europe, and specifically Geneva), including a third of the year in both 2006 and 2009.
President Biya’s jaunts into Europe frequently pass through Geneva, where his documented stays have included a 2017 trip for which his entourage booked at least 48 rooms at the Intercontinental Hotel, the site of significant protests during his most recent stay in July 2019. OCCRP estimated that the President has spent at least $65 million for his accommodations at the Intercontinental Hotel. All told, the President and his entourage have spent 1,645 days at the Intercontinental.
A quick look at the President’s Official Twitter and Facebook pages reveals surprisingly candid announcements of his “brief private stays” in Europe, either at the time of departure or return. These announcements are distributed from the Office of the President’s official website, and provide a helpful public guide into both his official and unofficial foreign excursions.
Despite the public nature of these announcements, they provide only a small glimpse into the President’s travels. These public announcements are also fairly sanitized and do not include identifying information like flight itineraries and/or imagery of the transport aircraft – an integral component of open-source analysis of aircraft activity in the public domain.
However, open flight data can help identify not only the President’s destinations, but also the type of aircraft used, as well as the duration of travel. Using public announcements as a starting point, we took a historical look at aircraft associated with the Government of Cameroon and identified at least 30 trips to Geneva between May 2008 and December 2013, many of which are conducted by a government-affiliated Gulfstream III aircraft. Narrowing down to this aircraft’s travel activities, we discovered additional trips to other Swiss cities, some as recent as July 10, 2019. That these flight activities are identifiable through open data serves a specific public interest: removing the veil of secrecy often exploited by the President when his trips abroad are characterized as “brief private stays.”
Tracing Cameroon’s Executive Aircraft Fleet
In the absence of a fully accessible civilian aircraft registry in Cameroon, C4ADS investigators consulted the LAAS registry of corporate aircraft, which provides a listing of private corporate aircraft registered under Cameroon’s national aircraft code, “TJ.” This list included two planes, one a Gulfstream III (Registration Number: TJ-AAW), and the other a Cessna 550 Citation Bravo (Registration Number: TJ-ROA).
While the ownership of both planes is not available through the Cameroonian Civil Aviation Authority (CAA), both aircraft appear in the CAA’s Aviation Safety Information System, which lists the minimum equipment requirements for aircraft registered in Cameroon. This dataset, despite its safety focus, serves as a valuable proxy for a domestically-generated aircraft registry.
Tracking President Biya’s Frequent Jaunts to Geneva
Since 2008, a community of aircraft enthusiasts (colloquially known as plane-spotters) have aggregated aircraft landing and take-off events at airports near Geneva into a publicly accessible dataset available on the Geneva Airport Movement Enquiries (GAME) website. This dataset is updated on a monthly basis and provides an individual listing of each take-off and landing event. C4ADS investigators explored the GAME database for all take-offs and landings events linked to the two aircraft associated with the Cameroonian government and found 30 events involving the Gulfstream III (Registration Number: TJ-AAW), some of which are displayed below.
As evident on the GAME site, information on the origin and destination of these flights is often minimal, if not entirely lacking. However, other open source flight data repositories such as ADS-B Exchange can provide a more detailed view into the routes and trajectories taken by the aircraft linked to Paul Biya and the Cameroonian government. Additionally, this type of flight data widens the scope of inquiry beyond specific airports.
For instance, in a review of 2019 trips involving the Cameroonian Gulfstream III aircraft (Registration Number: TJ-AAW) on ADS-B Exchange, we uncovered at least ten transit events (meaning takeoff and landing events, which are determined based on factors such as an aircraft’s transit speed and altitude) in and around Basel/Mulhouse EuroAiport in Switzerland, many of which were not captured by the Geneva-based public plane-spotting website. As a supplement to data provided by plane-spotter datasets, ADS-B Exchange expands the scope of investigation into route and trajectory analysis, giving analysts more visibility into an aircraft’s transit patterns.
Exploiting the Charter Aircraft Loophole
Within the Geneva dataset, we discovered that several of the Cameroonian Gulfstream III (TJ-AAW) flights were operated by a UK-based company, Cam Air Management, which provides executive business travel services for a variety of clients flying into Geneva. Some of the aircraft operated by Cam Air Management have included planes owned by the Saudi Royal Family (Aircraft Registration Number: VP-CAL), the government of Kazakhstan (Aircraft Registration Number: UP-B6701), as well as several other private, charter-based aircraft providers that service VIP clientele.
Charter aircraft providers often manage fleets that are registered in secrecy jurisdictions likes Aruba, where an aircraft’s ultimate owner is hidden from public view. Secrecy can be a benefit for those who wish to traverse the globe in non-domestic aircraft whose ownership is much more difficult to identify or trace. In Geneva, we identified 19 private charter flights involving two private airplanes – Aircraft Registration Numbers: P4-CLA and VP-CAL – operated by Cam Air Management and linked to Paul Biya and the Cameroonian government.
Twelve of these flights involved the Aruba-registered Boeing 767-200 aircraft – Aircraft Registration Number: P4-CLA – operated by Cam Air Management, but otherwise owned by Swiss-based VIP charter services company, Comlux Aviation. On September 16, 2016, this aircraft landed in Geneva and declared what appeared to be an airport departure code of “NSI”. This code corresponded to Cameroon’s Yaounde Nsimalen International Airport, which suggests that the aircraft took off from Cameroon before arriving in Geneva as displayed in the Geneva plane-spotters database.
The Boeing 767-200 aircraft linked to this event was, in March 2017, chartered by deposed Zimbabwean dictator, Robert Mugabe, for a five-day trip from Singapore to Ghana at an estimated cost of over $1 million. This luxury-laden aircraft boasts private bedrooms with king and queen-sized beds, prestige broadband communication systems and an operational cost of approximately $9,138 per hour – an amount that is nearly 34 times more than President Biya’s reported monthly salary of $271 per month.
Exploring Paul Biya’s Use of Chartered Aircraft
Using public disclosure of travel plans as a starting point, we also looked into the President’s official foreign travel that was also undertaken via chartered aircraft. In one case, we identified a Boeing 777-2KQLR (Registration Number: VP-CAL) also operated by Cam Air Management that was seemingly used during President Biya’s state visit to China in March 2018.
Open Source flight data from the Geneva plane-spotting consortium revealed that the trip originated in Geneva on March 20, 2018, rather than the Cameroonian capital, Yaounde. This departure was also corroborated by the historical flight tracker on ADS-B Exchange, which not only validated the Geneva departure, but also the majority of the eastward flight to China, terminating at the Hong Kong International Airport on March 22, 2018. ADS-B Exchange data similarly confirmed the President’s return trip (again to Geneva) on March 24, 2018.
Beyond the flight data, President Biya also confirmed his arrival in China via Twitter on March 22, 2018 in a post that also included a partial image of the transport aircraft. We identified other portions of the aircraft by matching the President’s attire at the time of arrival with other videos taken take on the tarmac in Hong Kong. Both the President and his wife’s attire closely matched publicly-shared Youtube videos of the tarmac reception in Hong Kong where larger portions of the transport aircraft, including its tail code (VP-CAL), are visible.
Based on the imagery from the tarmac reception, C4ADS swiftly confirmed the identity of the transport aircraft as the Boeing 777-2KQLR (Registration Number: VP-CAL) that appeared in the plane-spotters database in Geneva. This aircraft also re-appeared in arrival logs in Geneva during the President’s return trip on March 24, 2018 which was similarly observable on the ADS-B Exchange historical Flight viewer.
Altogether, this brief look at President Paul Biya’s foreign travel highlights the relative ease with which researchers and investigators can use public reporting (including official state disclosures) to map the activities of absentee leaders around the globe. This research also identifies the use of chartered aircraft as a potentially understudied aspect of corruption research especially given the high cost of these chartered trips, and the burden placed on local tax payers many of whom cannot afford the luxury enjoyed by their publicly elected officials.
Peter Kirechu, Lead Analyst
Five of the top ten longest serving heads of states govern African countries, all with tenures in office of over 20 years. Four of the five – Paul Biya (Cameroon), Teodoro Obiang’s Nguema Mbasogo (Equatorial Guinea), Dennis Sassou Nguesso (Republic of Congo) and Yoweri Museveni (Uganda) are over 70 years old. And until recently this cadre of rulers also included Omar al Bashir (Sudan) whose ouster on April 11, 2019 closely followed that of Abdelaziz Bouteflika, the 82-year-old former President of Algeria whose 20-year rule ended in forced resignation on April 2, 2019.
These heads of state, both current and former, reportedly preside over impressive personal fortunes and commercial empires that are shrouded in secrecy and often hidden from public scrutiny. In 2017, French authorities successfully prosecuted and convicted Equatorial Guinea’s Vice President Teodoro Nguema Obiang Mangue (the son of the President) for illegally investing millions in embezzled funds through French real estate, luxury vehicles, and other assets. The investigation led to the seizure of a Parisian mansion worth $120 million and just one of Teodoro’s sprawling assets, which in 2011 included $70 million in US-based luxury assets, two Malibu mansions, and a $30 million Gulfstream private jet.
The identification of the $30 million aircraft linked to Teodoro Obiang piqued the interest of C4ADS analysts, who in the past several months have investigated foreign air travel as an indicator of where kleptocrats store their wealth.
Tracing Equatorial Guinea’s Executive Fleet
Back in 2011, the US Department of Justice (DOJ) found that Teodoro Obiang purchased a Gulfstream G-V aircraft (Cayman Islands Registration Number: VP-CES) through a Cayman Island-based company, Ebony Shine International Ltd for an estimated $33.8 million. The DOJ filed an asset forfeiture suit against the aircraft claiming that the purchase was financed by embezzled funds. The suit was eventually settled in 2014, and the aircraft barred from entering the United States while owned by Equatorial Guinean officials, their family members, and/or affiliated companies or businesses.
But despite the use of off-shore shell companies to obscure aircraft ownership, aircraft identification is made possible by the existence of several universal regulations adopted by most UN Member States. As a result of the 1944 Chicago Convention on International Civil Aviation, which established the International Civil Aviation Organization (ICAO), all civilian aircraft must be registered with a National Aviation Authority (NAA) which issues alpha-numeric aircraft registration numbers to all civilian aircraft before they can legally operate internationally. These alpha-numeric registration numbers (commonly known as tail code numbers) are often the most visible identifying feature of an aircraft (as displayed below) and have a discernible naming convention that helps identify the country of registry.
Each aircraft’s tail code number begins with a two-character prefix i.e “YA-XXX” that identifies the aircraft’s country of registration (also known as an aircraft nationality mark or emblem). Aircraft registered in the Equatorial Guinea begin with a “3C-” prefix, which indicates that all aircraft that bear that marking are registered with the country’s civil aviation authority. But in Equatorial Guinea, like many other African countries, the domestic civil aviation authority does not publicly disclose its domestically-registered private aircraft, thus limiting public visibility on the number of private or corporate-owned aircraft.
Overcoming the Paucity of Publicly-Available Domestic Aircraft Registers
In countries where official, publicly available aircraft registers are unavailable, aviation enthusiasts often provide a lifeline. Over the past several decades, these communities of enthusiasts have compiled hundreds of non-official aircraft registers that provide a helpful guide into current and historic aircraft registration records in some of the most data scarce environments across the globe. Some of these enthusiast-compiled registers include but are not limited to: the OpenSky Network, OpenFlights.org, Antonakis Spotters, Torben Koed, Brugier.com, and the LAAS International Corporate Aircraft register.
Using the aforementioned LAAS corporate aircraft register, we uncovered five executive/business-class aircraft, including two Dassault Falcons, a Lockheed Jetstar and a single Gulfstream V that operate under the “3C-”country designation, suggesting local registration in Equatorial Guinea.
However, based on the available imagery, this executive fleet differed quite starkly from Equatorial Guinea’s commercial airliners, a finding that suggests that these aircraft are likely operated by private parties or by the Equatorial Guinea government. Open-source images of the aircraft fleet also revealed a paint and flag pattern that closely resembles the country’s flag and coat of arms.
The Equatorial Guinea Executive Fleet in Flight
Having identified the five non-commercial aircraft associated with the Equatorial Guinea government and/or some of the government’s private associates, we used open-source flight tracking data to identify and track their transit activities abroad. The available data revealed that at least one of the planes in this fleet – a Dassault Falcon 50 (Registration Number: 3C-LGE) – had made at least 17 trips in and around Berlin and Paris between February 25, 2018 and May 26, 2019.
Between November 2018 and April 2019, we identified 10 trips in and around Paris and Geneva taken by a Dassault Falcon 900B (3C-ONM) aircraft associated with Teodoro Obiang. This data was captured by ADS-B Exchange, an open-source flight tracking tool that is part of collaborative effort between C4ADS and ADS-B Exchange designed to improve the investigative use of flight data in open source research.
Closer investigation into the aircraft’s arrivals in and around Geneva airport indicated that the majority of these arrivals occurred in the evening and were followed by next-day morning departures between May and December, 2018 according to the Geneva Airport Movement Enquiries database, a collection of landing and take-off flight data compiled by Geneva-area aircraft spotters. We also found over 200 landing and take-off events at Geneva airport between June 15, 2008 and May 29, 2019. These early findings indicate that the aircraft remains in operation and frequents Geneva airport on a fairly regular schedule.
Pattern of Life
Based on this initial research, we focused on tracing the globe-trotting activities of corrupt world leaders, particularly when that travel involves high risk banking jurisdictions, tax havens, and other luxury locales around the world. We have so far found that the combination of open-source aircraft registries and flight data provides excellent insights into the often-hidden activities of unscrupulous public officials.
Further research also revealed that another aircraft within the fleet – a Gulfstream V (Registration Number: 3C-LLX) had made at least five trips into Brazil throughout 2018. Several of these trips occurred around the September 17, 2018 detention of Teodoro Obiang’s entourage in Sao Paolo where Brazilian authorities seized $16 million in cash and luxury watches. Coverage of the incident indicated that Obiang’s 11-person delegation arrived on a government plane and were headed for Singapore after the stop in Brazil. We later found that the same Gulfstream V private aircraft was spotted flying east of Singapore on November 6, 2018 (pictured below) several days after the incident.
These preliminary findings indicate that despite the lack of official public registries in countries like Equatorial Guinea, the combination of unofficial flight registries and public-sourced air transit data does reveal insights into closely held travel activities of public officials like Teodoro Obiang.
Stitched together, these data points reveal the great untapped potential that open flight tracking offers to open-source researchers and investigators, and broadens the investigative toolkit available to global transparency and accountability researchers, advocates, and enforcement agents. Over the next several months, C4ADS intends to publish a series of investigations that build upon the insights gleaned from this case in order to highlight investigative applications of publicly accessible flight data in open-source research.
Irina Bukharin, Analyst
On April 6, 2018, a sunny day in Douma, Syria, bombs began falling from the sky, assaulting the city indiscriminately. The attack continued into the next day, when chemical weapons were dropped on the city’s citizens, over 500 of whom were brought to medical facilities with symptoms of exposure to a chemical agent. At least 43 people died as a result of this exposure.
Hundreds of chemical attacks like this one have taken place on Syrian soil since the beginning of the civil war there. The Global Public Policy Institute has attributed two percent of these attacks to the Islamic State and 98 percent to the Syrian government under the leadership of President Bashar al-Assad. The attacks carried out by the Assad regime have used chemical weapons such as chlorine and sarin, and they have resulted in the death and injury of thousands of Syrian citizens.
These persistent attacks raise the question of how a regime under such a heavy international sanctions regime can acquire the supplies needed to manufacture chemical weapons. Although some of the necessary chemicals and equipment may be available within Syria, other elements, such as specific chemical precursors or corrosion-resistant construction materials, must be sourced from abroad. The Syrian Scientific Studies and Research Center, also known as the SSRC, is the government body that oversees the production of Syria’s chemical weapons, including the import of chemical precursors and other materials. The United States government has identified and sanctioned Syrian and foreign companies used by the SSRC to procure such materials. By examining these companies, their broader corporate networks, and their current and former activities, we can identify possible routes for continued procurement of materials that support the Syrian chemical weapons program.
The Handasieh Network
One good example is Syria’s General Organization for Engineering Industries, a sprawling state-owned conglomerate under the authority of the Syrian Ministry of Industry that supervises public companies active in the construction and industrial sectors. Also known as Handasieh, the organization was sanctioned by the US Office of Foreign Assets Control (OFAC) on July 18, 2012 for “acting for or on behalf of Syria’s SSRC” and “contribut[ing] materially to the proliferation of WMD or the means of their delivery.” But Handasieh is more than just one Syrian company – there are at least fourteen subsidiaries operating directly under it that produce everything from steel to renewable energy to pencils. If these companies are 50% or more owned by Handasieh, they too are legally sanctioned under OFAC’s current regulations. However, only one of Handasieh’s direct subsidiaries, the Syrian Arab Electronic Industries Company (Syronics), has been explicitly sanctioned by OFAC, while two additional entities that share identifiers with one of Handasieh’s subsidiaries have also been sanctioned.
These unsanctioned subsidiaries represent possible avenues for sanctions evasion and chemical weapons procurement. By examining corporate and trade records associated with these entities, we can conclude that they may be acting in coordination with Handasieh (and thus potentially with the SSRC), and that foreign procurement activity continues through them. This foreign procurement activity may coincide with the procurement of chemical precursors or other materials the Assad regime needs to launch attacks like the one on April 7.
Convergence and Coordination
Handasieh’s connections with its subsidiaries don’t end at the level of corporate affiliation: public records show that different companies in the Handasieh network can be tied together through their common use of identifiers like addresses, websites, and email addresses. For example, the General Company for Steel and Steel Products lists “www.handasieh.org” as its website on a public tender for zinc, while a profile for the General Company for Cable Industry in Damascus lists Handasieh’s primary email address as a point of contact. On public tenders, the General Company for Cable Industry in Damascus has used an email address associated with another Handasieh subsidiary, the Aleppo Company for Cable Industry. Such shared identifiers were common throughout tenders appearing in the names of Handasieh subsidiaries, indicating a high likelihood of coordination between the companies in the wider Handasieh network.
A series of three shipments from North Korea to Syria illustrates the point. In its March 2018 report, the UN Panel of Experts for North Korea indicated that the General Company for Cable Industry was the intended consignee of a 2016 shipment of industrial materials sent to Syria from North Korea. This shipment was part of a batch of five shipments sent from North Korea to Syria. Two of the shipments were sent to the Metallic Manufacturing Factory, an OFAC-sanctioned company that is connected with another Handasieh subsidiary, the Company of Metallic Constructions and Mechanical Industries. These shipments contained “acid-resistant tiles, adhesive paste, and accessories,” materials which, according to a UN Member State, could “be used to build bricks for the interior walls of [a] chemical factory.” Not only does the network appear to be integrated, with members using identifiers associated with Handasieh and other Handasieh subsidiaries, but it appears to be coordinating activity among both sanctioned and unsanctioned nodes in the network, highlighting the risk of complex evasion schemes.
Tenders, trade data, and other public material can provide a wealth of information about procurement pathways used by the Handasieh network (and therefore possibly the SSRC). Many of the companies associated with Handasieh have public tenders posted on their websites, Facebook pages, or on the websites of Syrian foreign affairs offices around the world. While tenders are of course helpful in identifying what a company is looking for, they are also helpful in identifying where the company is seeking to procure its materials from. For example, Syronics, the OFAC-sanctioned Handasieh subsidiary, has had tenders posted by the Syrian Ministry of Foreign Affairs in both Egypt and Lebanon. Trade data can also shine a light on the countries from which these companies are sourcing. Commercial trade data indicates that the Handasieh-linked General Company for Iron and Steel Products has received at least 39 shipments of industrial parts and equipment from Apollo International Limited, an Indian company. Sometimes making connections between these companies and foreign countries is even easier: one of Handasieh’s subsidiaries is the “Syrian-Ukrainian Joint Company for the Production of Photovoltaic Pumps.” To date, we have identified thirteen countries (Belarus, China, Egypt, France, Germany, India, Iran, Jordan, Lebanon, Malaysia, North Korea, South Korea, and Ukraine) from which Handasieh subsidiaries have procured, are procuring, or have attempted to procure materials after OFAC sanctioned Handasieh in 2012.
Much of the procurement that we can see in the open source, whether through tenders or trade data or international agreements, may be perfectly licit, and destined for civilian engineering projects across Syria. We do not assert that any entity mentioned in this blog post knowingly contravened any international law or treaty. However, the pathways that licit products take can also be used to procure the materials the Syrian government needs for its chemical weapons program. Given the known procurement of materials by Handasieh (and some of its subsidiaries) on behalf of the SSRC, the interconnected nature of the companies in the Handasieh network, and the illicit procurement on the part of non-sanctioned entities in the network, all Handasieh subsidiaries and the methods through which are worth a second look by the international community, law enforcement, and civil society.
Austin Bodetti contributed in the research and investigation for this blog post.
Jack Margolin, Senior Analyst
PMC Wagner, a Russian private military firm supported by US-sanctioned oligarch Evgeniy Prigozhin, has been everywhere lately – whether in Eastern Ukraine, Syria, or Venezuela, the shadowy outfit has appeared at the vanguard of Russia’s foreign policy ambitions, providing a lightweight and deniable force that can be used to project Russian power at short notice and little cost. For analysts and observers, understanding where Russian private military forces are is important for gauging overall Russian policymaking intentions in a given region.
But merely understanding where Russian military contractors have been appearing misses half the story: equally illuminating are the trading relationships that show how contractors are sustaining themselves with supplies, and how these companies relate to Russian-owned extractives ventures. To take a closer look at these links, we analyzed customs records (held by author) and other official documentation to identify a global logistics network supporting companies associated with Prigozhin and PMC Wagner. This wider network extends from Saint Petersburg to Madagascar, and even touches the shores of Hollywood Beach in Florida, providing clues to the way in which networks of private companies allow Russia to promote its interests around the world.
Official and Unofficial Russian Activity Across Africa
Since 2017, a network of individuals and ostensibly private Russian companies have engaged in military assistance, political interference and exploitation of mineral wealth across Africa, facilitated in large part by close connections with commercial and political entities based in Russia. This activity has taken place in Sudan, the C.A.R., Madagascar, Libya, Burundi, and beyond. In the C.A.R., Russian personnel allegedly employed by Wagner have been involved in military training, while companies allegedly affiliated with Prigozhin have engaged in activities as diverse as mining, cultural events and diplomatic efforts with rebel groups. In Sudan, Russian contractors have provided security services, while a Prigozhin-linked company has engaged in mining. Prigozhin himself has been present at high-level military discussions in Libya, where his contractors are alleged to be active in support of rebel leader Khalifa Haftar. In Madagascar, political consultants affiliated with Prigozhin have offered support to a range of local politicians, while a shadowy Russian mining firm tried and failed to establish a joint venture with state-owned mining company.
In each theater, these activities have been facilitated by an opaque corporate network of entities active in both Africa and Russia. Though their activities can be difficult to observe, each of these entities has a point of vulnerability: they depend on logistics providers to survive. As their logistical needs become more complex, the legal architecture of shell companies, trading relationships, and physical installations they must employ becomes more visible. We scrutinized these visible points, analyzing Russian customs records that detail trade between alleged Wagner affiliates in Africa and their support base back in Russia.
Two of the more visible entities in the network are Lobaye Invest in the Central African Republic, and Meroe Gold in Sudan, two companies that Russian investigative journalists have identified as being connected with Prigozhin. Lobaye has engaged in activities ranging from mining to beauty pageants and the screening of Russian movies. In July of last year, three journalists were killed under mysterious circumstances while investigating the activities of Wagner in the C.A.R, immediately prior to planned filming at gold mines operated by Lobaye Invest.
In Sudan, Meroe Gold’s mining operations have converged with political repression — unconfirmed reports allege that Russian guards have fired on local protestors, and that armed Russian personnel appeared at December protests. Additionally, according to Russian investigative outlet Proekt, Prigozhin sought to establish a foothold in Madagascar through a partnership with the state-owned mining firm Kraomita Malagasy S.A. This ultimately failed partnership dovetailed with attempts at political influence, and, as Russian trade record indicate, a larger logistics network supplying Meroe Gold and Lobaye Invest.
Both Lobaye Invest and Meroe Gold appear in commercially available Russian customs data, which shows them conducting trade with Russia-based firms M-Finance and M-Invest. Both of these companies are associated with Prigozhin in public reporting. M-Invest’s regional director is also a former business partner with an employee of Prigozhin’s infamous ‘troll farm’ who was indicted by the US Department of Justice.
Russian customs records corroborate this link, and illustrate how this network of companies supplies and supports Prigozhin-affiliated companies in Africa. They also show scale and change over time:
According to customs data, Meroe Gold received more unique shipments from Russia than any other company in Sudan during this period.
Meroe Gold imported large amounts of geological equipment for mining exploration in 2017, before importing more heavy equipment including front-loaders and bulldozers.
Taking a more granular approach to these records shows us the chain of custody of these shipments, down to their eventual end use. In at least two cases, this methodology helps illuminate the provenance of vehicles employed by alleged Russian private military contractors, showing how armored vehicles and transport helicopters transited from Russia to end destinations in Africa all along Prigozhin-controlled supply chains.
Big Wheels – Ural Transport Vehicles
According to trade data reviewed by C4ADS, M-Invest, M-Finance and other Russian companies in this network supplied heavy transport vehicles to their partners in Africa which have since appeared in a variety of settings — from training the Central African Republic’s armed forces, cruising Khartoum during the December protests in Sudan, and being stopped by rebel militias in the C.A.R.
According to export declarations, M-Finance sent one Ural 4230 multi-purpose vehicle to Lobaye Invest in the Central African Republic on January 25, 2018. The export declaration accompanying this shipment bears the name of Evgeniy Khodotov, a regional representative of Lobaye Invest on mining concessions document from the C.A.R. (See document below). Khodotov is alleged by Russian investigative media to have been an employee of the Saint Petersburg Regional Counter-Organized Crime Directorate and the Main Directorate of the Ministry of Internal Affairs of Russia.
A few months later, trade data shows that the Saint Petersburg-based Broker Expert shipped 20 of these vehicles to Meroe Gold on May 25, 2018. These Urals, all manufactured in 2018, were shipped out from Novorossiysk, and were collectively valued at EUR 518,400.00.
According to Russian customs data, Meroe Gold is the only foreign company that Broker Expert has exported to. The Russian Federal Statistics Service documents that Broker Expert reported RUB 186,771,000.00 in revenue in 2017, when it began to export to Meroe Gold (USD $ 2,900,553.63 at the current rate). Prior to this, Broker Expert had a revenue of around RUB 2,010,000 in 2016 (USD $ 31,215.30 at the current rate).
Open source investigators with Bellingcat, Conflict Intelligence Team, and BBC have identified the presence of Ural 4230s in Sudan and the Central African Republic. Some of these vehicles appear to be up-armored. They frequently appear alongside armed and uniformed personnel.
Training of CAR armed forces
Convoy of armed Russian nationals in CAR
Armed Russian nationals in C.A.R. in 2018. Note Ural vehicle in background, from video taken by FPRC rebels released by France24
Presence at protests in Sudan
At Meroe Gold location in Sudan
Big Birds - Mi-8T Helicopters
Ural trucks aren’t the only heavy vehicles that this network has shipped to Africa. Customs data indicates that M-Finance shipped an Mi8-T transport helicopter, registration number RA-06114, to Meroe Gold, in February of 2018. Evgeniy Khodotov also appears on the customs declaration for this shipment. M-Invest sent an additional Mi-8T to Meroe Gold on the same date.
Potepkin was once a ‘Commissar’ in pro-Putin youth group “Nashi”, before owning the tech company ‘IT-Debugger’ along with with Anna Bogacheva, an employee of Prigozhin’s Internet Research Agency, who oversaw the IRA’s data analysis team and who is alleged by the US Department of Justice to have collected intelligence in the United States in 2014. Bogacheva was indicted by the US Department of Justice for her work with the IRA.
In a video uploaded to YouTube by user Alex Tupolev on February 25, 2019, an Mi-8T transport helicopter with tail number RA-06114 appears in C.A.R., operated by Russian nationals. In the video, produced by the Presidency of C.A.R., French narration explains that the Russians use the helicopter to deliver humanitarian aid. European individuals in the video appear to deliver supplies and mattresses, wearing fatigues.
Stills from YouTube video uploaded by user Alex Tupelov. Left: Material unloaded from helicopter. Right: Russian national unloading helicopter.
To Bangui with a layover in Miami
At least four shipments of equipment had a US nexus, with the customs data showing an address in Hollywood, Florida for the recipient. Though the equipment likely never actually transited the US, the mysterious Florida address indicates that this Russian-African network may have a logistical node in South Florida.
Beginning in early 2018, M-Finance began routing its shipments to Lobaye Invest in the C.A.R. through Kraomita Malagasy S.A, a state-owned mining company in Madagascar with which an opaque Russian mining company was reportedly forming a commercial joint venture. Three shipments on May 25, 2018 and one on June 15, 2018 went from St. Petersburg in Russia to the C.A.R via Madagascar. These shipments contained 72 ‘PUS – 1’ police batons, 423.6 kilograms of ‘Shturm 3’ riot shields, uniforms, hard drives, printed products and ballpoint pens.
Customs data shows that these shipments, delivered to Antananarivo International Airport, were evidently ultimately bound for the C.A.R. according to the listed recipient. However, the recipient’s address was listed as 3505 S. Ocean Drive, Hollywood, Florida, indicating that the receiving party or its representative was located at that address.
While no U.S company was named in these records, C4ADS used Florida corporate records to identify a number of businesses registered at this address, including two corporate and legal services providers and real estate firm that each had offices in both Florida and Russia. These corporate service providers have registered numerous companies at this address and others.
This pattern of information in customs declarations is not necessarily unusual, particularly given the common role of freight forwarders or other facilitators in international trade. Certainly, nothing in the trade data or our research provides solid evidence of any illegal activity. This shipment was unusual, however, because each of the parties involved have been associated in public reporting with Evgeniy Prigozhin and PMC Wagner, in relation to the training of the C.A.R. armed forces, political activity in C.A.R. and Madagascar, and the killing of three Russian journalists.
Observing Grey Activity
Prigozhin’s ventures’ open source footprint gives insight into at least one element of Russia’s assertion of its influence in Africa—the millions of dollars of investment supporting actors involved in mineral extraction, military assistance and political interference. This is likely just a small part of the finance behind Russia’s growing profile on the continent.
The evident integration of these ostensibly private actors with activities of the Russian government makes it all the more surprising that this network would have a connection to the US. The US nexus in this case demonstrates the permeability of jurisdictions that allow for obscured ultimate beneficial ownership, and the importance of verifying the identities and affiliations of parties to trade transactions.
The private nature of Russian military contractors permits them to behave dynamically, with activities across a range of sectors, some of which appear to coincide more directly with Russian foreign policy objectives than others. This also creates opportunities for leverage: every point where Prigozhin’s activity relies on a commercial company, be it a bank or a customs broker, is a point for governments and the private sector to apply pressure.
The C4ADS ROUTES Team
How do you feel about snakes on your plane?
Or the tusks of a hundred dead elephants in the cargo hold below you?
It has become increasingly common for traffickers to use ordinary commercial routes to illegally move live animals and wildlife products. When we began our work on illicit ivory supply chains back in 2014, air trafficking was a small minority of all large-scale seizures, i.e. those seizures that are indicative of organized crime involvement.
However, as awareness of ivory trafficking increased, that trend began to change. In 2015, Australian officials seized 110kg of ivory in an air cargo shipment (roughly equivalent to 14 elephants); one year later, South Sudanese officials seized a staggering 1.28 tons of ivory (about 168 elephants) in another air cargo shipment. And it is not just ivory: far too many species are under attack by unscrupulous networks of people driven by the promise of enormous profits with little risk from enforcement. By 2019, we had counted hundreds more seizures of ivory, as well as hundreds of seizures of rhino horn in checked baggage, pangolin scales in air freight, turtles in checked baggage, Guyanese finches in the sleeves of passengers, European eels packed in checked baggage by the tens of thousands, and tiger cubs sedated and hidden in suitcases.
To help combat wildlife trafficking by air, C4ADS, as part of the USAID Reducing Opportunities for Unlawful Transport of Endangered Species (ROUTES) Partnership, is proud to launch the first-ever data dashboard on wildlife trafficking in the air transport sector. The ROUTES Dashboard relies on the C4ADS Air Seizure Database, which currently includes 1,379 instances of air trafficking in more than 130 countries representing over 69 tons of smuggled wildlife products.
The ROUTES Dashboard is publicly available and provides in-depth and customizable analysis of the trafficking trends, routes, and methods associated with wildlife trafficking seizures in airports. The data and analysis it provides can be used by transport companies, enforcement personnel, government agencies, and other stakeholders to uncover actionable insights that can help strengthen counter-wildlife trafficking policies in the air transport sector.
Dive into the data!
Examine overall seizure trends. The chart below reveals that the top five airports for wildlife trafficking by seizure count are located in East Asia.
Filter the data by species. Break down your search by a range of further indicators such as species, trafficking method, and region. The routes map below shows global reptile trafficking moved only in air freight.
Generate detailed graphics. After filtering the data, select one of several tabs to view detailed graphics. The chart below highlights trafficking trends for all species in Asia.
Country Profile Map
The Dashboard includes a Country Profile Map, allowing users to access available information on wildlife trafficking by air in each country.
Kenya, for example, emerges in the data both as a source and a transit country. Kenya’s prominence is primarily due to two factors: Jomo Kenyatta Airport’s role as a major hub between flight routes originating in Africa and destined for the Middle East and Asia, and Kenyan enforcement’s awareness of the prevalence of wildlife trafficking activity in their airports. The high volume of wildlife passing through the airport combined with enforcement’s heightened ability to stop wildlife trafficking instances in the airport leads to both the country’s high seizure count and the fairly diverse array of wildlife seized there.
Route Risk Tool
Finally, the Dashboard’s Route Risk Tool can be used to produce a dynamic risk estimate for different airline routes. This can provide predictive insights for policymakers, allowing airlines, governments, and other stakeholders to better direct scarce enforcement resources.
Although the tool is still in development, you can choose from any pair of flight routes in the C4ADS Air Seizure Database to view a list of wildlife seizures along that route.
For example, the Route Risk Tool generated the below tables for the route between Nairobi and Dubai. At least four seizures have occurred along this flight route, most of which were carried by air freight. None of these trafficking instances, however, were going to stay in Dubai–all used the UAE as a transfer country, with at least four other countries (China, Malaysia, Thailand, and Laos) listed as intended destinations.
C4ADS is proud to partner with ROUTES to analyze wildlife trafficking in the air transport sector. The Dashboard represents the ROUTES Partnership’s latest effort to put actionable information in the hands of governments and the air industry. In 2018, we released In Plane Sight, a nearly decade-long analysis of wildlife trafficking seizures at airports and in airlines worldwide. In Plane Sight was a follow-up to our 2017 report, Flying Under the Radar, which marked the first-ever analysis of wildlife trafficking in the aviation industry and showcased the widespread exploitation of transport supply chains by criminal networks engaged in wildlife trafficking.
Austin Brush, Analyst
Combating illegal, unreported, and unregulated (IUU) fishing is inherently a big data challenge. Billions of Automatic Identification System (AIS) and Vessel Monitoring System (VMS) messages from tens of thousands of active vessels must be sorted and examined to find the few vessels that are likely to be committing illicit activity. On top of that, data visibility problems plague current monitoring systems, with AIS (which can “go dark” at the captain’s discretion) and VMS (which is largely unavailable to the public) both failing to provide the full picture of at-sea activity. In addition to the limitations that exist within these systems, only the largest fishing vessels are likely to carry AIS, and VMS adoption is dependent on coastal states requiring the system. The result is that the picture of maritime activity produced by AIS and VMS requires careful curating and additional analysis before conclusions can be drawn. Spotting these kinds of gaps in the huge amount of data collected can be difficult, but is necessary to identify many types of illicit activity.
With such a vast ocean of data to sift through, effective targeting requires focusing on chokepoints. For IUU fishing, the clearest chokepoint is the logistical vessels that support fishing vessels’ clandestine activities. For instance, “reefer” or refrigerated cargo vessels are critical facilitators that help deep sea fishing fleets regularly offload their catch and take on supplies while at sea, thereby allowing them to stay at sea for much longer periods of time than would otherwise be possible. Reefers service entire fleets, serving as a critical link bringing seafood— both licit and illicit—to shore. These reefers are far fewer in number than fishing vessels, and are much more likely to regularly transmit AIS signals, making them a visible data point that analysts can exploit.
C4ADS’ partnership with Windward enables us to use this type of data in our analysis. Using Windward’s maritime risk analytics platform, C4ADS is able to access structured several years’ worth of historical data on vessel operations. The platform is easily filtered according to customizable search queries, allowing tailored, hypothesis-driven analysis of specific questions.
C4ADS analysts have recently been using these queries to uncover IUU trends through analysis of risky vessel behavior. Some examples of risk indicators include:
“Drifting” – Windward uses this term to denote vessel movement under 3 knots, which is the usual speed at which two adjacent vessels would travel to transfer goods, catch, or crew.
High Risk Zones – Windward allows analysts to define zones where suspicious activity, such as ship-to-ship transfers, IUU fishing, or sanctions violation, commonly occurs.
Flags of Convenience (FOC) – Vessels engaging in illicit activity often use flags of convenience as a means of obfuscating their ownership or avoiding legal action or scrutiny. FOCs are a means of circumventing regulatory oversight with little to no barrier to entry.
“Meetings” – Windward applies machine-learning algorithms to detect anomalous ship activities, including meetings between vessels at sea, for extended periods of time. Vessels that “meet” for extended periods of time are more likely to be refueling at sea or transferring catch, crew, and/or supplies (known as transshipment), potentially in violation of law.
As an example, we will walk through a case in which Windward tools helped C4ADS analysts hone in on suspicious vessel activity and then map the corporate network behind three refrigerated cargo vessels.
Using the above set of risk indicators, we identified three reefers operating in and around the Exclusive Economic Zones (EEZ) of Guinea Bissau, Guinea, and Ivory Coast:
All three vessels are flagged to FOCs (Comoros and Moldova). According to their historical AIS transmissions, they consistently behave in the following ways:
Drifting while at sea for periods ranging from under one hour to multiple days
Changing port of destination and draft after drifting at sea
Drifting near areas where fishing vessels from the same corporate fleet operate.
These behaviors are common for vessels that are transshipping, but do not necessarily indicate illicit activity. However, when this activity is observed in a particular high-risk zone, such as the EEZ of Guinea Bissau— where at-sea transshipment has been banned since 2015— this behavior warrants further scrutiny.
All three vessels, along with at least four other trawlers, are registered to several Panama-domiciled companies, which are all ultimately controlled by Sea Group SL, a company incorporated in the Canary Islands. The Panama connection is a red flag for our analysts, as the country has frequently been criticized by experts as a haven for tax evasion, money laundering, and other illicit activity.
Vessels in Sea Group SL’s fleet have also been implicated in risky activity. For example, in 2014, the GABU REEFER was fined US$2,000 by Liberia for landing fish without the necessary authorizations. Then in 2015, the SILVER ICE was categorized as a high-risk vessel by the West Africa Task Force (WATF) after the government of Comoros raised concerns about the vessel’s activity in the region. While it is unclear what activity directly incited those concerns, the SILVER ICE was documented landing catch sourced from Guinea Bissau and Guinea in numerous ports in West Africa at the time.
Inquiries into the SILVER ICE were also in part due to pressure from the European Union for Comoros to increase oversight of distant water fishing vessels registered under their flag. Flag registration in Comoros is reportedly controlled by the Administration of the Union of Comoros and is an open registry. This means that in Comoros, foreign companies are able to register vessels without proving a “genuine link” to the country and oversight is outsourced to private interests.
Finally, in 2017, the SALY REEFER was caught carrying out an illegal transshipment with three other ships in the EEZ of Guinea Bissau. The owners and crew members reportedly faced fines and legal action as a result of the illegal transshipment.
Ultimately, fully understanding illicit maritime activity requires going from sea to shore. A vessel is just an asset owned by an onshore network, and its activity at sea is ultimately determined by the financial interests of its beneficial owners. C4ADS therefore believes effective maritime analysis requires both at-sea and onshore analysis to connect vessel behavior to corporate networks.
C4ADS’ Natural Resources Cell is committed to using these and other methods to combat IUU fishing. Windward’s technology is a critical part of this effort, helping our analysts identify high-risk activities at sea that can be tied to on-shore corporate networks. Directing this information to the right authorities can then result in real action—like arrests, seizures, and ship detentions—that have a tangible effect on the overall trade in illicit fish products.
Jason Arterburn, Lead Analyst & Lucas Kuo, Analyst
On Tuesday, the United Nations Panel of Experts released its 2019 report on North Korea’s sanctions evasion and WMD programs. The Panel found that—even today—a limited number of trusted overseas commercial facilitators continue to engage in a wide range of revenue-generating activities for the Kim regime, often using overlapping corporate architecture that can be exposed through shared addresses and phone numbers. Li Zhengang (李振刚) and his accomplices are but the latest example.
Co-location with Sanctioned Entities
Chinese national Li Zhengang was first identified in the 2017 midterm report for owning 70% of UN- and US-designated Daedong Credit Bank, which OFAC sanctioned in June 2013 for supporting North Korea’s ballistic missile and WMD programs. The Panel found that Li also controlled two other companies, one of which remains active: Dandong Zhongrui Petrochemical Co., Ltd. (丹东中瑞石油化工有限公司). Zhongrui’s Chinese business registry filings indicate that it is registered in Dandong, China at Jiadi Plaza on No. 64 Binjiang Middle Road (滨江中路64号). If the address sounds familiar, that’s because it has appeared before: the same building also hosts a number of other companies sanctioned for supporting North Korea’s WMD program, including but not limited to OFAC-designated Dandong Zhicheng Metallic Material Co. , the subsidiary company of OFAC-designated Dandong Hongxiang Industrial Development Co., and further still its subsidiary DPRK restaurant.
Ties to North Korean Shipping Networks
In Tuesday’s report, the Panel showed that Li Zhengang’s network also has ties to a number of DPRK shipping operations through companies in both mainland China and Hong Kong. Chinese business registry filings show that Dandong Zhongrui shares an address with Dandong Jing’ao Trading Co. (丹东京奥贸易有限公司), with variation only in the character used to refer to room number. Dandong Jing’ao Trading appears to have had a Hong Kong-registered affiliate that used an identical name until March 14, 2017. Registry filings for both the mainland- and Hong Kong-registered Jing’ao companies list a Chinese national by the name Sun Chengguo (孙成国 or 孫成國) as director. The Panel notes that, as in the case of Dandong Zhongrui Petrochemical, Sun Chengguo used a residential address with ties to known DPRK entities: Room 916, DL1504, Youhao Building, 158 Youhao Road, Zhongshan District, Dalian, China. An almost identical address has also been used by multiple other Chinese nationals engaged in DPRK maritime sanctions evasion operations: Gu Baofu (顧寶富), the director of US- and UN-sanctioned Chang An Shipping & Technology Co., Ltd. (長安海運技術有限公司); and Pan Weichao (潘衛朝), the director of Pantech Shipping Limited (泛科海運有限公司) and an emergency contact for the Marshall Islands-based operator of the Jie Shun, a Cambodian-flagged cargo vessel that Egyptian authorities seized in August 2016 for carrying RPGs and various subcomponents from the DPRK to Africa.
Additional Shipping Networks at the Same Address
But Sun Chengguo, Gu Baofu, and Pan Weichao are not the only individuals who list an address at Room 916 of 158 Youhao Road. In fact, when we searched for more co-located people and companies, we found that a fourth Chinese national Ji Xiangyu (嵇相宇) used an almost identical residential address in an alleged scheme to launder prohibited DPRK coal through Far Eastern Russian ports in late 2017. On a 2017 annual return, Ji Xiangyu listed the address on a filing for his company Maple Source Shipping Limited (楓源海運有限公司), a Hong Kong-registered company whose plausible Marshall Islands-based counterpart owned the Togo-flagged Yu Yuan (IMO 95358694). In the fall of 2017, the Yu Yuan, along with other DPRK-flagged vessels, unloaded coal from North Korea at a coal terminal in Kholmsk, Russia. The coal was subsequently transshipped from Kholmsk to South Korea by several foreign-flagged vessels, one of which—the formerly Panama-flagged Sky Angel (IMO 9168441)—was managed by a Chinese company named Dalian Sky Ocean International Shipping Agency Co., Ltd. (大连天洋国际船舶代理有限公司) and is also registered at 158 Youhao Building, albeit in a different room.
The corporate network behind the Yu Yuan has changed since it was first exposed in early 2018. Equasis vessel ownership records pulled as recently as November 2018 indicated that the Yu Yuan’s owner at the time of transshipment was “in the care of” Rich Mountain Trading Co., Ltd. (富峰貿易有限公司), a second Hong Kong company of which Ji Xiangyu is the sole director and shareholder that had served as the Yu Yuan’s commercial and ISM manager at the time of transshipment. However, Rich Mountain Trading no longer appears in the Equasis database or the Yu Yuan’s ownership and management history. On Rich Mountain’s corporate filings, Ji Xiangyu reported a residential address nearly identical to that used on his first company’s filing and by Sun Chengguo, Gu Baofu, and Pan Weichao: Room 916, DL1398, Youhao Building, 158 Youhao Road, Zhongshan District, Dalian, China.
Bottom Line: Co-location Exposes North Korea’s Overseas Commercial Networks
North Korea’s overseas commercial operations depend on a limited number of facilitators who are both highly capable and willing to undertake significant risk. As we observed in Dispatched, there are strong economic incentives for a resource-strapped regime to co-locate its overseas activities at a limited number of physical locations. This allows them to reduce costs while engaging in bank transactions, coal sales, technology purchases, surveillance of workers, shipping operations, and other revenue-generating activities for the Kim regime. Law enforcement and civil regulators can and should use the inherent exposure of a fixed physical location to uncover the full portfolio of DPRK sanctions evasion activities.
So what else is at Dandong’s No. 64 Binjiang Middle Road, Dalian’s 158 Youhao Building, or at any other addresses associated with DPRK commercial facilitators? In any investigation, law enforcement and civil society should be sure to check.
Phil Kittock, Cell Lead & Sofia Vargas, Analyst
Public data is essential for anticorruption research. Many countries publish online databases of public records of all varieties, from court filings to corporate registries, from timber exports to plane registries. These are critical sources of credible information for anticorruption researchers, investigative journalists, and civil society groups around the world.
The way these datasets are structured ranges from individual records to bulk data, and every type in between. Merely collecting raw data only takes us halfway to conducting the kind of impactful analysis that we seek to provide. Any individual source of information, from a full corporate registry to a single judicial transcript, can be useful – however, keeping data sources separate keeps insight isolated, meaning you have to do a lot more work to discover illicit activity.
By integrating and comparing datasets across formats and jurisdictions, C4ADS’ Organized Crime and Grand Corruption Cell is able to more comprehensively and efficiently understand the transnational illicit networks we research and the systems in which they operate. When datasets are joined together, individuals and entities that appear separate can form networks, while examining activities allows us to identify interesting trends from large datasets.
Mapping out Networks:
In the modern world, criminal networks, including those that facilitate North Korean overseas labor or that specialize in wildlife trafficking worldwide, are able to move fluidly from jurisdiction to jurisdiction, deftly navigating the bounds between the illicit and licit worlds. Whenever illicit networks touch the licit system, they leave a paper trail that researchers can track – C4ADS uses public records to identify the networks that operate in the illicit economy. As we go through and investigate each person or company we come across in our research, we uncover dozens of related records. The trick to making these data points useful and actionable is knowing how to tie them all together, and what they mean when combined.
Investigating the people and companies in a network can lead to the discovery of more specific data points, like luxury plane travel, export licenses, and property purchases, which all provide a better picture of how a particular network actually operates. When a Venezuelan businessman was indicted by US prosecutors in November 2018 for embezzling funds from the Venezuelan state-owned oil company PDVSA, we started to investigate his business dealings and the network around him. After structuring the data we uncovered in the course of our research, we found a key business associate that appeared to facilitate the business dealings of this network. This business associate co-owned businesses in the US, and we also discovered that they were family.
From there, we searched property records and airline registries to see if any of the companies or individuals in the network owned luxury planes, homes, or other big ticket items. Companies in the network owned luxury homes and a plane in South Florida, a key piece of information that led us to activities-based analysis.
To use activities-based analysis to investigate aircraft, we apply the knowledge we already have about illicit activity involving aircraft to build a pattern we can look for in the data. Since the US government publishes the registration numbers of aircraft owned by now-indicted and sanctioned individuals, there are readily-available examples of illicit activity to analyze in the open source. Using a simple aircraft registration number published in a press release, we are able to connect an aircraft to its owner in an aviation registry, and we simultaneously viewed historical flight data from flight-tracking platforms like ADS-B Exchange.
After analyzing historical flight data to identify where aircraft of interest have been in the past, we can find other aircraft that follow a similar pattern. Additional information, like whether or not the aircraft is registered in a secrecy jurisdiction, provides further clues of suspicious and potentially illicit activity.
In the previously mentioned money laundering case involving the Venezuelan businessman, a sanctioned aircraft’s transmissions revealed that its flights were almost exclusively between South Florida and Caracas in the months prior to the plane being sanctioned. A different, unsanctioned plane that was publicly reported to operate in connection to the same network revealed almost identical flight patterns to that of the OFAC-sanctioned plane. This raised many interesting questions, and by identifying this activity we are able to further our investigation and uncover new layers of the network’s activity.
The Impact for Anticorruption Research
Identifying patterns or typologies of crime can provide a useful methodology, and it can assist in finding illicit activity that emerges from the open-source. In this way, using both network- and activities-based analyses allows us to sift through an immense amount of public data to find cases that are most interesting to the public, the most relevant to our research, and the most impactful for our partners. Furthermore, although a simple network-based analytical approach provides a useful roadmap for researching corruption, being able to highlight the actual activities of a network makes the results of anticorruption research much more dynamic, enlightening, and actionable.
At the upcoming 2019 OECD Anti-Corruption & Integrity Forum, we will dive into these issues and our methodologies further to provide a glimpse of how C4ADS analysts and partners work to untangle the webs woven by illicit actors.
Evangeline Hines, Operations Manager & Patrick Baine, Senior Analyst
If no one understands your research, did it really even happen? At C4ADS, we think hard about how to turn our research into concise analytical findings. Consistently, we find graphics to be one of the most effective ways of condensing research into a single, comprehensible format. Our work often requires the explanation of complex networks, relationships, and patterns that would be nearly impossible to make sense of without graphics. Good graphics pack in a lot of information, but they also drive you to ask questions and dig deeper.
Getting this right depends on choosing the right graphics. Representing the data in a dishonest or confusing way is worse than not using graphics at all. Here, I wish to highlight a few examples in which we have structured complex and large data sets to make them intuitive and informative. This work would not have been possible without the R Suite of software and our wonderful Senior Analyst, Patrick Baine.
Flying Under the Radar: Wildlife Trafficking in the Air Transport Sector
How do you map the air transit routes used for wildlife trafficking? This is not an easy task, especially given the lack of open source data on the issue. For the ROUTES project, we needed to reconcile several different databases of seizures in the air transport sector of various wildlife products to help industry, government, and civil society better understand the flow of these products.
This map is helpful because it gives you a few pieces of basic insight right when you first look at it. It then prompts you to ask questions. There appears to be more activity in Europe, Africa, and Asia; why? Why is there so little in North and South America? What about Australia? I don’t usually think of Western Europe as a trafficking hotspot, so what is going on there? If you were to look at the spreadsheets of data that went into this graphic, I doubt that many people would come away with the same level of insight as they would by looking at the graphic. Graphics like this help you see the bigger picture and then encourage you to ask important research questions.
World Customs Organization: Cultural Heritage Trafficking in 2016
For this project, C4ADS analyzed World Customs Organization data to determine patterns in the trafficking of cultural heritage objects, such as antiquities, art, or other significant objects. This graphic shows the flow of cultural heritage trafficking in 2016. The chart visualizes the flow of goods from the country in which they originated to the destination country, as indicated by the arrow. The number of goods per country can be seen along the edge of the circle.
This is another graphic that 1) is pleasing to the eye, 2) does a great job of conveying movement (before you even have context, you know something is moving from one place to another), and 3) raises questions. One question that is raised by this graphic is what happened to the cultural heritage flowing out of Syria given the context of events there in 2016? Given the news coverage of the issue, I would have expected to see that show up here, and yet… Questions like this require more digging to answer, and can even become the base of full-fledged C4ADS projects.
World Customs Organization: Psychotropic Substance Seizure in 2016
For the same WCO project, C4ADS received a different dataset related to seizures of narcotics. While flows were interesting, other patterns related to time of seizure told an equally compelling story. This jitter plot represents seizures of psychotropic substances in 2016 by country. From the chaos of dots, patterns emerge. Again, this graphic gives insight, but also points to important questions and next steps for further research. What caused the increase of seizures in the second half of the year in Germany? Why did Estonia have a drop in seizures at the end of the year? Was there a reason that Hungary started reporting seizures in March? What about the trends within the types of psychotropic substances being seized? Most strikingly, what caused the glaring disparity between the frequency of seizures in the United States compared to the rest of the world? By looking at this graphic, you can both gain knowledge and understand that there are underlying trends in drug trafficking that require further study.
These are only three examples from one of the multiple platforms we use to develop graphics, but I think they do a great job of demonstrating what great graphics can do, and how they can add to stellar research. The complexity of the world in which we live and the data it produces will only continue to grow. We want to continue to explore new and innovative approaches to open source data and analysis, and eye-catching and insightful graphics are going to be a key component of our approach.
Ben Spevack, Analyst
In Kazakhstan, one environmental conservation organization has developed an innovative approach to preserve one of the region’s most unique yet critically endangered species.
Saiga tartarica (saiga for short) is a species of antelope that has inhabited Eurasia for over 100,000 years. Adult saiga typically stand between two and three feet tall at the shoulder, and adult males have ribbed horns that grow to between eleven and fifteen inches. But the saiga’s most remarkable feature is undoubtedly its snout. The peculiar appendage allows the saiga to filter dust from the air and regulate its body temperature.
While once abundant and widespread, with 1.25 million saiga worldwide as recently as 1981, the species has suffered a catastrophic decline, decreasing to only 24,000 in 2004. Current estimates place today’s saiga population at around 165,600, with the remaining herds found in pockets of Kazakhstan, Uzbekistan, Russia, and Mongolia.
Poaching is one of the principal causes of the saiga’s drastic population decline in recent years. According to traditional Chinese medicine, saiga horn is believed to have medicinal properties that can regulate “internal heat” (“清热”). The horn is typically crushed, dissolved, and sold as “cooling water.” While trafficking in saiga horn is nominally illegal under the CITES convention, enforcement is lax and the trade is relatively open. In Kazakhstan, traders will even post flyers soliciting the horns, complete with a phone number or an email address.
The Association for the Conservation of Biodiversity in Kazakhstan (Казахстанская ассоциация сохранении биоразнообразия, or ACBK for short) has a unique approach to tackling the issue of saiga poaching and horn trafficking. ACBK runs an annual campaign in partnership with the Ministry of Internal Affairs and the Committee on Forestry and Fauna to combat the domestic trade of saiga horns. The goals are twofold: 1) raise awareness of the illegal nature of saiga horn trafficking, and 2) create a database of names and phone numbers associated with traffickers. These goals are achieved through a crowdsourced targeting of the flyers plastered across the country.
When a volunteer comes across a poster soliciting saiga horn, he or she takes pictures and posts them on the ACBK Facebook or VKontakte page, along with the location of the ad (if the volunteer wishes to remain anonymous, he or she can send pictures to ACBK’s Whatsapp number). The volunteer then glues a sticker on the ad, which cites the specific law forbidding the sale of saiga horn. Finally, if the advertisement includes a phone number, the volunteer sends a templated text explaining that trading in saiga horn is illegal. The procedure is the same for online procurement posts, without the sticker. The campaign runs from November to January, after which ACBK aggregates the data, structures it, and passes it along to the environmental prosecutor for further investigation.
The most recently completed campaign wrapped up on January 21, 2017. As of February 26, ACBK’s pages on Facebook and VKontakte had 686 combined subscribers who contributed 92 photos. Twenty-one unique phone numbers were identified, spread across nine cities. Additionally, nineteen websites were identified as hosting posts for saiga horn. ACBK contacted the websites and requested that they take down the posts. Eleven websites complied, five did not reply, and three were defunct upon a follow-up check. While ACBK has not mentioned any resulting arrests or seizures, it has said that all the collected information has been transferred to the environmental police to assist in investigations.
This campaign is a low cost, effective approach to wildlife conservation. Organizing via social media allows for collaboration among disparate actors and crowdsourcing allows for the assiduous efforts of small-scale environmental organizations to be amplified by hundreds of local residents. While conventional anti-trafficking measures by law enforcement and NGOs hamper poaching operations and the flows of illicit wildlife products, they offer little opportunity for local participation. Contributions, regardless of size, give local volunteers ownership and investment in the outcome. In the long term, crowdsourcing campaigns such as ACBK’s may catalyze a shift in societal attitudes towards wildlife trafficking.
Varun Vira, Chief Operating Officer
We are proud to announce the formation of our new blog. This platform will allow our readers a look behind the curtain at C4ADS to get a glimpse of our processes and on topics that interest our analysts.
For those of you who are not already familiar with our work, C4ADS is a nonprofit organization dedicated to providing evidence-based reporting and analysis on transnational security issues. Around the world, bad actors are able to hijack licit infrastructure to accomplish their illicit aims: our mission is to make it more difficult for these bad actors and their networks to function. To do this, we use cutting-edge technologies and methodologies to analyze disparate datasets, shedding light on problems of corruption, crime, and conflict. Sound a little confusing and intense? We know what we do can be puzzling to people who don’t know us, but we hope this blog will provide a better understanding of what we do as an organization. Plus, our background provides some very interesting material that we wish to share with our readers.
What should you expect to read on this blog? Without giving too much of the suspense away, one can expect to read posts on everything from how Facebook posts can be used to deter illegal poaching of endangered animals, to follow-ups on previous C4ADS reports, to how we use different technologies to simplify our data for consumption. On this page you can expect to meet a rotating cast of North Korean proliferators, ivory and pangolin traffickers, Middle Eastern terror financiers, and other associated bad actors. And that’s just our analysts. These and many more riveting topics will be explored and posted on this blog page.
To make sure that you do not miss any content, sign-up to have C4ADS blog posts delivered directly to your inbox at the bottom of this page. We hope that you are as excited as we are for the launch of our blog—happy reading!