Paper Trails: How a Russia-based logistics network ties together Russian mining companies and military contractors in Africa

Jack Margolin, Senior Analyst

PMC Wagner, a Russian private military firm supported by US-sanctioned oligarch Evgeniy Prigozhin, has been everywhere lately – whether in Eastern Ukraine, Syria, or Venezuela, the shadowy outfit has appeared at the vanguard of Russia’s foreign policy ambitions, providing a lightweight and deniable force that can be used to project Russian power at short notice and little cost. For analysts and observers, understanding where Russian private military forces are is important for gauging overall Russian policymaking intentions in a given region.

But merely understanding where Russian military contractors have been appearing misses half the story: equally illuminating are the trading relationships that show how contractors are sustaining themselves with supplies, and how these companies relate to Russian-owned extractives ventures. To take a closer look at these links, we analyzed customs records (held by author) and other official documentation to identify a global logistics network supporting companies associated with Prigozhin and PMC Wagner. This wider network extends from Saint Petersburg to Madagascar, and even touches the shores of Hollywood Beach in Florida, providing clues to the way in which networks of private companies allow Russia to promote its interests around the world.


Official and Unofficial Russian Activity Across Africa

Since 2017, a network of individuals and ostensibly private Russian companies have engaged in military assistance, political interference and exploitation of mineral wealth across Africa, facilitated in large part by close connections with commercial and political entities based in Russia. This activity has taken place in Sudan, the C.A.R., Madagascar, Libya, Burundi, and beyond. In the C.A.R., Russian personnel allegedly employed by Wagner have been involved in military training, while companies allegedly affiliated with Prigozhin have engaged in activities as diverse as mining, cultural events and diplomatic efforts with rebel groups. In Sudan, Russian contractors have provided security services, while a Prigozhin-linked company has engaged in mining. Prigozhin himself has been present at high-level military discussions  in Libya, where his contractors are alleged to be active in support of rebel leader Khalifa Haftar. In Madagascar, political consultants affiliated with Prigozhin have offered support to a range of local politicians, while a shadowy Russian mining firm tried and failed to establish a joint venture with state-owned mining company.

In each theater, these activities have been facilitated by an opaque corporate network of entities active in both Africa and Russia. Though their activities can be difficult to observe, each of these entities has a point of vulnerability: they depend on logistics providers to survive. As their logistical needs become more complex, the legal architecture of shell companies, trading relationships, and physical installations they must employ becomes more visible. We scrutinized these visible points, analyzing Russian customs records that detail trade between alleged Wagner affiliates in Africa and their support base back in Russia.

Two of the more visible entities in the network are Lobaye Invest in the Central African Republic, and Meroe Gold in Sudan, two companies that Russian investigative journalists have identified as being connected with Prigozhin. Lobaye has engaged in activities ranging from mining to beauty pageants and the screening of Russian movies. In July of last year, three journalists were killed under mysterious circumstances while investigating the activities of Wagner in the C.A.R, immediately prior to planned filming at gold mines operated by Lobaye Invest.

In Sudan, Meroe Gold’s mining operations have converged with political repression — unconfirmed reports allege that Russian guards have fired on local protestors, and that armed Russian personnel appeared at December protests. Additionally, according to Russian investigative outlet Proekt, Prigozhin sought to establish a foothold in Madagascar through a partnership with the state-owned mining firm Kraomita Malagasy S.A. This ultimately failed partnership dovetailed with attempts at political influence, and, as Russian trade record indicate, a larger logistics network supplying Meroe Gold and Lobaye Invest.

Both Lobaye Invest and Meroe Gold appear in commercially available Russian customs data, which shows them conducting trade with Russia-based firms M-Finance and M-InvestBoth of these companies are associated with Prigozhin in public reporting. M-Invest’s regional director is also a former business partner with an employee of Prigozhin’s infamous ‘troll farm’ who was indicted by the US Department of Justice.

Russian customs records corroborate this link, and illustrate how this network of companies supplies and supports Prigozhin-affiliated companies in Africa. They also show scale and change over time:

  • According to customs data, Meroe Gold received more unique shipments from Russia than any other company in Sudan during this period. 

  • Meroe Gold imported large amounts of geological equipment for mining exploration in 2017, before importing more heavy equipment including front-loaders and bulldozers.

Network chart showing current and former relationships between Lobaye Invest, Meroe Gold, and their trade partners. Links in grey indicate commercial and locative relationships, while green links indicate trade.

Network chart showing current and former relationships between Lobaye Invest, Meroe Gold, and their trade partners. Links in grey indicate commercial and locative relationships, while green links indicate trade.

Taking a more granular approach to these records shows us the chain of custody of these shipments, down to their eventual end use. In at least two cases, this methodology helps illuminate the provenance of vehicles employed by alleged Russian private military contractors, showing how armored vehicles and transport helicopters transited from Russia to end destinations in Africa all along Prigozhin-controlled supply chains.


Big Wheels – Ural Transport Vehicles

According to trade data reviewed by C4ADS, M-Invest, M-Finance and other Russian companies in this network supplied heavy transport vehicles to their partners in Africa which have since appeared in a variety of settings — from training the Central African Republic’s armed forces, cruising Khartoum during the December protests in Sudan, and being stopped by rebel militias in the C.A.R.

According to export declarations, M-Finance sent one Ural 4230 multi-purpose vehicle to Lobaye Invest in the Central African Republic on January 25, 2018. The export declaration accompanying this shipment bears the name of Evgeniy Khodotov, a regional representative of Lobaye Invest on mining concessions document from the C.A.R. (See document below). Khodotov is alleged by Russian investigative media to have been an employee of the Saint Petersburg Regional Counter-Organized Crime Directorate and the Main Directorate of the Ministry of Internal Affairs of Russia.

Concession document from the Central African Republic, showing ‘Evgenii Khodotov’ as the Director of Lobaye Invest SARLU

Concession document from the Central African Republic, showing ‘Evgenii Khodotov’ as the Director of Lobaye Invest SARLU

A few months later, trade data shows that the Saint Petersburg-based Broker Expert  shipped 20 of these vehicles to Meroe Gold on May 25, 2018. These Urals, all manufactured in 2018, were shipped out from Novorossiysk, and were collectively valued at EUR 518,400.00.

Broker Expert

According to Russian customs data, Meroe Gold is the only foreign company that Broker Expert has exported to. The Russian Federal Statistics Service documents that Broker Expert reported RUB 186,771,000.00 in revenue in 2017, when it began to export to Meroe Gold (USD $ 2,900,553.63 at the current rate). Prior to this, Broker Expert had a revenue of around RUB 2,010,000 in 2016 (USD $ 31,215.30 at the current rate).

Open source investigators with Bellingcat, Conflict Intelligence Team, and BBC have identified the presence of Ural 4230s in Sudan and the Central African Republic. Some of these vehicles appear to be up-armored. They frequently appear alongside armed and uniformed personnel.


Training of CAR armed forces

Soldiers in C.A.R. training with a Ural 4230 in spring 2018, identified on the C.A.R.’s president’s Facebook page by     Conflict Intelligence Team    .

Soldiers in C.A.R. training with a Ural 4230 in spring 2018, identified on the C.A.R.’s president’s Facebook page by Conflict Intelligence Team.


Convoy of armed Russian nationals in CAR

Armed Russian nationals in C.A.R. in 2018. Note Ural vehicle in background, from video taken by FPRC rebels released by France24


Presence at protests in Sudan

Images of Ural 43200s at December protests in Sudan, from Jon Hutson and Conflict Intelligence Team.


At Meroe Gold location in Sudan

Image of possible Ural 42300 outside of alleged location of Meroe Gold, spotted by     Benjamin Strick   .

Image of possible Ural 42300 outside of alleged location of Meroe Gold, spotted by Benjamin Strick.


Big Birds - Mi-8T Helicopters

Ural trucks aren’t the only heavy vehicles that this network has shipped to Africa. Customs data indicates that M-Finance shipped an Mi8-T transport helicopter, registration number RA-06114, to Meroe Gold, in February of 2018. Evgeniy Khodotov also appears on the customs declaration for this shipment. M-Invest sent an additional Mi-8T to Meroe Gold on the same date.  

Meroe Gold

According to Sudanese media, the Regional Director of Meroe Gold is Mikhail Potepkin. Conversely, Russian government publications identify Potepkin as the Regional Director of M-Invest.

Potepkin was once a ‘Commissar’ in pro-Putin youth group “Nashi”, before owning the tech company ‘IT-Debugger’ along with with Anna Bogacheva, an employee of Prigozhin’s Internet Research Agency, who oversaw the IRA’s data analysis team and who is alleged by the US Department of Justice to have collected intelligence in the United States in 2014. Bogacheva was indicted by the US Department of Justice for her work with the IRA.

Mikhail Potepkin, photographed by         local media     in Sudan meeting with officials regarding the opening of a Meroe Gold mine.

Mikhail Potepkin, photographed by local media in Sudan meeting with officials regarding the opening of a Meroe Gold mine.

In a video uploaded to YouTube by user Alex Tupolev on February 25, 2019, an Mi-8T transport helicopter with tail number RA-06114 appears in C.A.R., operated by Russian nationals. In the video, produced by the Presidency of C.A.R., French narration explains that the Russians use the helicopter to deliver humanitarian aid. European individuals in the video appear to deliver supplies and mattresses, wearing fatigues.

Still from YouTube video uploaded by user Alex Tupelov. Note tail number of the Mi-8T. Source:     Youtube

Still from YouTube video uploaded by user Alex Tupelov. Note tail number of the Mi-8T. Source: Youtube

Stills from YouTube video uploaded by user Alex Tupelov. Left: Material unloaded from helicopter. Right: Russian national unloading helicopter.


To Bangui with a layover in Miami 

At least four shipments of equipment had a US nexus, with the customs data showing an address in Hollywood, Florida for the recipient. Though the equipment likely never actually transited the US, the mysterious Florida address indicates that this Russian-African network may have a logistical node in South Florida.

138 Obvodniy Canal Embankment, St. Petersburg, the location of the company that sent security equipment to C.A.R.

138 Obvodniy Canal Embankment, St. Petersburg, the location of the company that sent security equipment to C.A.R.

Beginning in early 2018, M-Finance began routing its shipments to Lobaye Invest in the C.A.R. through Kraomita Malagasy S.A, a state-owned mining company in Madagascar with which an opaque Russian mining company was reportedly forming a commercial joint venture. Three shipments on May 25, 2018 and one on June 15, 2018 went from St. Petersburg in Russia to the C.A.R via Madagascar. These shipments contained 72 ‘PUS – 1’ police batons, 423.6 kilograms of ‘Shturm 3’ riot shields, uniforms, hard drives, printed products and ballpoint pens.

Customs data shows that these shipments, delivered to Antananarivo International Airport, were evidently ultimately bound for the C.A.R. according to the listed recipient. However, the recipient’s address was listed as 3505 S. Ocean Drive, Hollywood, Florida, indicating that the receiving party or its representative was located at that address. 

While no U.S company was named in these records, C4ADS used Florida corporate records to identify a number of businesses registered at this address, including two corporate and legal services providers and real estate firm that each had offices in both Florida and Russia. These corporate service providers have registered numerous companies at this address and others.

3505 S. Ocean Drive, Hollywood, Florida, the listed address of the recipient.

3505 S. Ocean Drive, Hollywood, Florida, the listed address of the recipient.

This pattern of information in customs declarations is not necessarily unusual, particularly given the common role of freight forwarders or other facilitators in international trade. Certainly, nothing in the trade data or our research provides solid evidence of any illegal activity. This shipment was unusual, however, because each of the parties involved have been associated in public reporting with Evgeniy Prigozhin and PMC Wagner, in relation to the training of the C.A.R. armed forces, political activity in C.A.R. and Madagascar, and the killing of three Russian journalists.

Network of Lobaye Invest and its Russian trade partners, with Madagascar and U.S. affiliations.

Network of Lobaye Invest and its Russian trade partners, with Madagascar and U.S. affiliations.

Right: Universal Specialized Baton-1 manufactured by Special Materials Corp., the same model sent to Lobaye Invest. Left: Shturm-0 riot shield, the same model sent to Lobaye.


Observing Grey Activity

Prigozhin’s ventures’ open source footprint gives insight into at least one element of Russia’s assertion of its influence in Africa—the millions of dollars of investment supporting actors involved in mineral extraction, military assistance and political interference. This is likely just a small part of the finance behind Russia’s growing profile on the continent.

The evident integration of these ostensibly private actors with activities of the Russian government makes it all the more surprising that this network would have a connection to the US. The US nexus in this case demonstrates the permeability of jurisdictions that allow for obscured ultimate beneficial ownership, and the importance of verifying the identities and affiliations of parties to trade transactions.

The private nature of Russian military contractors permits them to behave dynamically, with activities across a range of sectors, some of which appear to coincide more directly with Russian foreign policy objectives than others. This also creates opportunities for leverage: every point where Prigozhin’s activity relies on a commercial company, be it a bank or a customs broker, is a point for governments and the private sector to apply pressure.


Launch of ROUTES Dashboard


How do you feel about snakes on your plane?

Or the tusks of a hundred dead elephants in the cargo hold below you?

It has become increasingly common for traffickers to use ordinary commercial routes to illegally move live animals and wildlife products. When we began our work on illicit ivory supply chains back in 2014, air trafficking was a small minority of all large-scale seizures, i.e. those seizures that are indicative of organized crime involvement.

However, as awareness of ivory trafficking increased, that trend began to change. In 2015, Australian officials seized 110kg of ivory in an air cargo shipment (roughly equivalent to 14 elephants); one year later, South Sudanese officials seized a staggering 1.28 tons of ivory (about 168 elephants) in another air cargo shipment. And it is not just ivory: far too many species are under attack by unscrupulous networks of people driven by the promise of enormous profits with little risk from enforcement. By 2019, we had counted hundreds more seizures of ivory, as well as hundreds of seizures of rhino horn in checked baggage, pangolin scales in air freight, turtles in checked baggage, Guyanese finches in the sleeves of passengers, European eels packed in checked baggage by the tens of thousands, and tiger cubs sedated and hidden in suitcases.

To help combat wildlife trafficking by air, C4ADS, as part of the USAID Reducing Opportunities for Unlawful Transport of Endangered Species (ROUTES) Partnership, is proud to launch the first-ever data dashboard on wildlife trafficking in the air transport sector. The ROUTES Dashboard relies on the C4ADS Air Seizure Database, which currently includes 1,379 instances of air trafficking in more than 130 countries representing over 69 tons of smuggled wildlife products.

The ROUTES Dashboard is publicly available and provides in-depth and customizable analysis of the trafficking trends, routes, and methods associated with wildlife trafficking seizures in airports. The data and analysis it provides can be used by transport companies, enforcement personnel, government agencies, and other stakeholders to uncover actionable insights that can help strengthen counter-wildlife trafficking policies in the air transport sector.


Dive into the data!

Examine overall seizure trends. The chart below reveals that the top five airports for wildlife trafficking by seizure count are located in East Asia.


Filter the data by species. Break down your search by a range of further indicators such as species, trafficking method, and region. The routes map below shows global reptile trafficking moved only in air freight.

Screen Shot 2019-05-31 at 6.14.44 PM.png

Generate detailed graphics. After filtering the data, select one of several tabs to view detailed graphics. The chart below highlights trafficking trends for all species in Asia.

Screen Shot 2019-05-31 at 6.19.55 PM.png

Country Profile Map 

The Dashboard includes a Country Profile Map, allowing users to access available information on wildlife trafficking by air in each country.

Kenya, for example, emerges in the data both as a source and a transit country. Kenya’s prominence is primarily due to two factors: Jomo Kenyatta Airport’s role as a major hub between flight routes originating in Africa and destined for the Middle East and Asia, and Kenyan enforcement’s awareness of the prevalence of wildlife trafficking activity in their airports. The high volume of wildlife passing through the airport combined with enforcement’s heightened ability to stop wildlife trafficking instances in the airport leads to both the country’s high seizure count and the fairly diverse array of wildlife seized there. 


Route Risk Tool

Finally, the Dashboard’s Route Risk Tool can be used to produce a dynamic risk estimate for different airline routes.  This can provide predictive insights for policymakers, allowing airlines, governments, and other stakeholders to better direct scarce enforcement resources.

Although the tool is still in development, you can choose from any pair of flight routes in the C4ADS Air Seizure Database to view a list of wildlife seizures along that route.

For example, the Route Risk Tool generated the below tables for the route between Nairobi and Dubai. At least four seizures have occurred along this flight route, most of which were carried by air freight. None of these trafficking instances, however, were going to stay in Dubai–all used the UAE as a transfer country, with at least four other countries (China, Malaysia, Thailand, and Laos) listed as intended destinations.


C4ADS is proud to partner with ROUTES to analyze wildlife trafficking in the air transport sector. The Dashboard represents the ROUTES Partnership’s latest effort to put actionable information in the hands of governments and the air industry. In 2018, we released In Plane Sight, a nearly decade-long analysis of wildlife trafficking seizures at airports and in airlines worldwide. In Plane Sight was a follow-up to our 2017 report, Flying Under the Radar, which marked the first-ever analysis of wildlife trafficking in the aviation industry and showcased the widespread exploitation of transport supply chains by criminal networks engaged in wildlife trafficking.


Something Smells Fishy...

Austin Brush, Analyst

Combating illegal, unreported, and unregulated (IUU) fishing is inherently a big data challenge. Billions of Automatic Identification System (AIS) and Vessel Monitoring System (VMS) messages from tens of thousands of active vessels must be sorted and examined to find the few vessels that are likely to be committing illicit activity. On top of that, data visibility problems plague current monitoring systems, with AIS (which can “go dark” at the captain’s discretion) and VMS (which is largely unavailable to the public) both failing to provide the full picture of at-sea activity. In addition to the limitations that exist within these systems, only the largest fishing vessels are likely to carry AIS, and VMS adoption is dependent on coastal states requiring the system. The result is that the picture of maritime activity produced by AIS and VMS requires careful curating and additional analysis before conclusions can be drawn. Spotting these kinds of gaps in the huge amount of data collected can be difficult, but is necessary to identify many types of illicit activity.

With such a vast ocean of data to sift through, effective targeting requires focusing on chokepoints. For IUU fishing, the clearest chokepoint is the logistical vessels that support fishing vessels’ clandestine activities. For instance, “reefer” or refrigerated cargo vessels are critical facilitators that help deep sea fishing fleets regularly offload their catch and take on supplies while at sea, thereby allowing them to stay at sea for much longer periods of time than would otherwise be possible. Reefers service entire fleets, serving as a critical link bringing seafood— both licit and illicit—to shore. These reefers are far fewer in number than fishing vessels, and are much more likely to regularly transmit AIS signals, making them a visible data point that analysts can exploit.  

C4ADS’ partnership with Windward enables us to use this type of data in our analysis. Using Windward’s maritime risk analytics platform, C4ADS is able to access structured several years’ worth of historical data on vessel operations. The platform is easily filtered according to customizable search queries, allowing tailored, hypothesis-driven analysis of specific questions.

C4ADS analysts have recently been using these queries to uncover IUU trends through analysis of risky vessel behavior. Some examples of risk indicators include:

  • “Drifting” – Windward uses this term to denote vessel movement under 3 knots, which is the usual speed at which two adjacent vessels would travel to transfer goods, catch, or crew.

  • High Risk Zones – Windward allows analysts to define zones where suspicious activity, such as ship-to-ship transfers, IUU fishing, or sanctions violation, commonly occurs.

  • Flags of Convenience (FOC) – Vessels engaging in illicit activity often use flags of convenience as a means of obfuscating their ownership or avoiding legal action or scrutiny. FOCs are a means of circumventing regulatory oversight with little to no barrier to entry.

  • “Meetings” – Windward applies machine-learning algorithms to detect anomalous ship activities, including meetings between vessels at sea, for extended periods of time. Vessels that “meet” for extended periods of time are more likely to be refueling at sea or transferring catch, crew, and/or supplies (known as transshipment), potentially in violation of law.

As an example, we will walk through a case in which Windward tools helped C4ADS analysts hone in on suspicious vessel activity and then map the corporate network behind three refrigerated cargo vessels.


From Activities…

Using the above set of risk indicators, we identified three reefers operating in and around the Exclusive Economic Zones (EEZ) of Guinea Bissau, Guinea, and Ivory Coast:

*On February 23, 2019, the Gabu Reefer reflagged from Comoros to Moldova.

*On February 23, 2019, the Gabu Reefer reflagged from Comoros to Moldova.

All three vessels are flagged to FOCs (Comoros and Moldova). According to their historical AIS transmissions, they consistently behave in the following ways:

  • Drifting while at sea for periods ranging from under one hour to multiple days

  • Changing port of destination and draft after drifting at sea

  • Drifting near areas where fishing vessels from the same corporate fleet operate.

These behaviors are common for vessels that are transshipping, but do not necessarily indicate illicit activity. However, when this activity is observed in a particular high-risk zone, such as the EEZ of Guinea Bissau— where at-sea transshipment has been banned since 2015— this behavior warrants further scrutiny.

The SILVER ICE "drifted" on the border of the EEZ of Guinea Bissau and Guinea between January 9 and 11, 2019. Toward the end of its "drift", the SILVER ICE changed its destination from Monrovia, Liberia to Conakry, Senegal.

The SILVER ICE "drifted" on the border of the EEZ of Guinea Bissau and Guinea between January 9 and 11, 2019. Toward the end of its "drift", the SILVER ICE changed its destination from Monrovia, Liberia to Conakry, Senegal.


…to Insights…

All three vessels, along with at least four other trawlers, are registered to several Panama-domiciled companies, which are all ultimately controlled by Sea Group SL, a company incorporated in the Canary Islands. The Panama connection is a red flag for our analysts, as the country has frequently been criticized by experts as a haven for tax evasion, money laundering, and other illicit activity.

Vessels in Sea Group SL’s fleet have also been implicated in risky activity. For example, in 2014, the GABU REEFER was fined US$2,000 by Liberia for landing fish without the necessary authorizations. Then in 2015, the SILVER ICE was categorized as a high-risk vessel by the West Africa Task Force (WATF) after the government of Comoros raised concerns about the vessel’s activity in the region. While it is unclear what activity directly incited those concerns, the SILVER ICE was documented landing catch sourced from Guinea Bissau and Guinea in numerous ports in West Africa at the time.  

Inquiries into the SILVER ICE were also in part due to pressure from the European Union for Comoros to increase oversight of distant water fishing vessels registered under their flag. Flag registration in Comoros is reportedly controlled by the Administration of the Union of Comoros and is an open registry. This means that in Comoros, foreign companies are able to register vessels without proving a “genuine link” to the country and oversight is outsourced to private interests.

Finally, in 2017, the SALY REEFER was caught carrying out an illegal transshipment with three other ships in the EEZ of Guinea Bissau. The owners and crew members reportedly faced fines and legal action as a result of the illegal transshipment.

Sea Group SL, incorporated in the Canary Islands, beneficially owns a fleet of at least seven vessels. Four of these vessels were implicated in an illegal transshipment in the EEZ of Guinea Bissau in 2017. At sea transshipment has been banned in Guinea Bissau since 2015.

Sea Group SL, incorporated in the Canary Islands, beneficially owns a fleet of at least seven vessels. Four of these vessels were implicated in an illegal transshipment in the EEZ of Guinea Bissau in 2017. At sea transshipment has been banned in Guinea Bissau since 2015.


…to action.

Ultimately, fully understanding illicit maritime activity requires going from sea to shore. A vessel is just an asset owned by an onshore network, and its activity at sea is ultimately determined by the financial interests of its beneficial owners. C4ADS therefore believes effective maritime analysis requires both at-sea and onshore analysis to connect vessel behavior to corporate networks.

C4ADS’ Natural Resources Cell is committed to using these and other methods to combat IUU fishing. Windward’s technology is a critical part of this effort, helping our analysts identify high-risk activities at sea that can be tied to on-shore corporate networks. Directing this information to the right authorities can then result in real action—like arrests, seizures, and ship detentions—that have a tangible effect on the overall trade in illicit fish products.


Banks, Boats, and Bombs: Using Co-location to Expand the Evidence of DPRK Network Convergence from the 2019 UN Panel of Experts Report

Jason Arterburn, Lead Analyst & Lucas Kuo, Analyst

On Tuesday, the United Nations Panel of Experts released its 2019 report on North Korea’s sanctions evasion and WMD programs. The Panel found that—even today—a limited number of trusted overseas commercial facilitators continue to engage in a wide range of revenue-generating activities for the Kim regime, often using overlapping corporate architecture that can be exposed through shared addresses and phone numbers. Li Zhengang (李振刚) and his accomplices are but the latest example.


Co-location with Sanctioned Entities

Chinese national Li Zhengang was first identified in the 2017 midterm report for owning 70% of UN- and US-designated Daedong Credit Bank, which OFAC sanctioned  in June 2013 for supporting North Korea’s ballistic missile and WMD programs. The Panel found that Li also controlled two other companies, one of which remains active: Dandong Zhongrui Petrochemical Co., Ltd. (丹东中瑞石油化工有限公司). Zhongrui’s Chinese business registry filings indicate that it is registered in Dandong, China at Jiadi Plaza on No. 64 Binjiang Middle Road (滨江中路64号). If the address sounds familiar, that’s because it has appeared before: the same building also hosts a number of other companies sanctioned for supporting North Korea’s WMD program, including but not limited to OFAC-designated Dandong Zhicheng Metallic Material Co. ,  the subsidiary company of OFAC-designated Dandong Hongxiang Industrial Development Co., and further still its subsidiary DPRK restaurant.

Chinese business registry filing showing Dandong Zhongrui Petrochemical Co.’s registered address

Chinese business registry filing showing Dandong Zhongrui Petrochemical Co.’s registered address


Ties to North Korean Shipping Networks

In Tuesday’s report, the Panel showed that Li Zhengang’s network also has ties to a number of DPRK shipping operations through companies in both mainland China and Hong Kong. Chinese business registry filings show that Dandong Zhongrui shares an address with Dandong Jing’ao Trading Co. (丹东京奥贸易有限公司), with variation only in the character used to refer to room number. Dandong Jing’ao Trading appears to have had a Hong Kong-registered affiliate that used an identical name until March 14, 2017. Registry filings for both the mainland- and Hong Kong-registered Jing’ao companies list a Chinese national by the name Sun Chengguo (孙成国 or 孫成國) as director. The Panel notes that, as in the case of Dandong Zhongrui Petrochemical, Sun Chengguo used a residential address with ties to known DPRK entities: Room 916, DL1504, Youhao Building, 158 Youhao Road, Zhongshan District, Dalian, China. An almost identical address has also been used by multiple other Chinese nationals engaged in DPRK maritime sanctions evasion operations: Gu Baofu (顧寶富), the director of US- and UN-sanctioned Chang An Shipping & Technology Co., Ltd. (長安海運技術有限公司); and Pan Weichao (潘衛朝), the director of Pantech Shipping Limited (泛科海運有限公司) and an emergency contact for the Marshall Islands-based operator of the Jie Shun, a Cambodian-flagged cargo vessel that Egyptian authorities seized in August 2016 for carrying RPGs and various subcomponents from the DPRK to Africa.


Additional Shipping Networks at the Same Address 

But Sun Chengguo, Gu Baofu, and Pan Weichao are not the only individuals who list an address at Room 916 of 158 Youhao Road. In fact, when we searched for more co-located people and companies, we found that a fourth Chinese national Ji Xiangyu (嵇相宇) used an almost identical residential address in an alleged scheme to launder  prohibited DPRK coal through Far Eastern Russian ports in late 2017. On a 2017 annual return, Ji Xiangyu listed the address on a filing for his company Maple Source Shipping Limited (楓源海運有限公司), a Hong Kong-registered company whose plausible Marshall Islands-based counterpart owned the Togo-flagged Yu Yuan (IMO 95358694). In the fall of 2017, the Yu Yuan, along with other DPRK-flagged vessels, unloaded coal from North Korea at a coal terminal in Kholmsk, Russia. The coal was subsequently transshipped from Kholmsk to South Korea by several foreign-flagged vessels, one of which—the formerly Panama-flagged Sky Angel (IMO 9168441)—was managed by a Chinese company named Dalian Sky Ocean International Shipping Agency Co., Ltd. (大连天洋国际船舶代理有限公司) and is also registered at 158 Youhao Building, albeit in a different room.

The corporate network behind the Yu Yuan has changed since it was first exposed in early 2018. Equasis vessel ownership records pulled as recently as November 2018 indicated that the Yu Yuan’s owner at the time of transshipment was “in the care of” Rich Mountain Trading Co., Ltd. (富峰貿易有限公司), a second Hong Kong company of which Ji Xiangyu is the sole director and shareholder that had served as the Yu Yuan’s commercial and ISM manager at the time of transshipment. However, Rich Mountain Trading no longer appears in the Equasis database or the Yu Yuan’s ownership and management history. On Rich Mountain’s corporate filings, Ji Xiangyu reported a residential address nearly identical to that used on his first company’s filing and by Sun Chengguo, Gu Baofu, and Pan Weichao: Room 916, DL1398, Youhao Building, 158 Youhao Road, Zhongshan District, Dalian, China.

Network chart.png

Transshipping North Korean coal from Russia to South Korea: Voyage Paths of the Yu Yuan and Sky Angel


Bottom Line: Co-location Exposes North Korea’s Overseas Commercial Networks 

North Korea’s overseas commercial operations depend on a limited number of facilitators who are both highly capable and willing to undertake significant risk. As we observed in Dispatched, there are strong economic incentives for a resource-strapped regime to co-locate its overseas activities at a limited number of physical locations. This allows them to reduce costs while engaging in bank transactions, coal sales, technology purchases, surveillance of workers, shipping operations, and other revenue-generating activities for the Kim regime. Law enforcement and civil regulators can and should use the inherent exposure of a fixed physical location to uncover the full portfolio of DPRK sanctions evasion activities.

So what else is at Dandong’s No. 64 Binjiang Middle Road, Dalian’s 158 Youhao Building, or at any other addresses associated with DPRK commercial facilitators? In any investigation, law enforcement and civil society should be sure to check.


Public Data and Anticorruption Research

Phil Kittock, Cell Lead & Sofia Vargas, Analyst

Public data is essential for anticorruption research. Many countries publish online databases of public records of all varieties, from court filings to corporate registries, from timber exports to plane registries. These are critical sources of credible information for anticorruption researchers, investigative journalists, and civil society groups around the world.  

The way these datasets are structured ranges from individual records to bulk data, and every type in between. Merely collecting raw data only takes us halfway to conducting the kind of impactful analysis that we seek to provide. Any individual source of information, from a full corporate registry to a single judicial transcript, can be useful – however, keeping data sources separate keeps insight isolated, meaning you have to do a lot more work to discover illicit activity.

By integrating and comparing datasets across formats and jurisdictions, C4ADS’ Organized Crime and Grand Corruption Cell is able to more comprehensively and efficiently understand the transnational illicit networks we research and the systems in which they operate. When datasets are joined together, individuals and entities that appear separate can form networks, while examining activities allows us to identify interesting trends from large datasets.


Mapping out Networks:

In the modern world, criminal networks, including those that facilitate North Korean overseas labor or that specialize in wildlife trafficking worldwide, are able to move fluidly from jurisdiction to jurisdiction, deftly navigating the bounds between the illicit and licit worlds. Whenever illicit networks touch the licit system, they leave a paper trail that researchers can track – C4ADS uses public records to identify the networks that operate in the illicit economy. As we go through and investigate each person or company we come across in our research, we uncover dozens of related records. The trick to making these data points useful and actionable is knowing how to tie them all together, and what they mean when combined.  

Investigating the people and companies in a network can lead to the discovery of more specific data points, like luxury plane travel, export licenses, and property purchases, which all provide a better picture of how a particular network actually operates. When a Venezuelan businessman was indicted by US prosecutors in November 2018 for embezzling funds from the Venezuelan state-owned oil company PDVSA, we started to investigate his business dealings and the network around him. After structuring the data we uncovered in the course of our research, we found a key business associate that appeared to facilitate the business dealings of this network. This business associate co-owned businesses in the US, and we also discovered that they were family.

From there, we searched property records and airline registries to see if any of the companies or individuals in the network owned luxury planes, homes, or other big ticket items. Companies in the network owned luxury homes and a plane in South Florida, a key piece of information that led us to activities-based analysis.


Tracking Activities:

To use activities-based analysis to investigate aircraft, we apply the knowledge we already have about illicit activity involving aircraft to build a pattern we can look for in the data. Since the US government publishes the registration numbers of aircraft owned by now-indicted and sanctioned individuals, there are readily-available examples of illicit activity to analyze in the open source. Using a simple aircraft registration number published in a press release, we are able to connect an aircraft to its owner in an aviation registry, and we simultaneously viewed historical flight data from flight-tracking platforms like ADS-B Exchange.


After analyzing historical flight data to identify where aircraft of interest have been in the past, we can find other aircraft that follow a similar pattern. Additional information, like whether or not the aircraft is registered in a secrecy jurisdiction, provides further clues of suspicious and potentially illicit activity.

In the previously mentioned money laundering case involving the Venezuelan businessman, a sanctioned aircraft’s transmissions revealed that its flights were almost exclusively between South Florida and Caracas in the months prior to the plane being sanctioned. A different, unsanctioned plane that was publicly reported to operate in connection to the same network revealed almost identical flight patterns to that of the OFAC-sanctioned plane. This raised many interesting questions, and by identifying this activity we are able to further our investigation and uncover new layers of the network’s activity.


The Impact for Anticorruption Research

Identifying patterns or typologies of crime can provide a useful methodology, and it can assist in finding illicit activity that emerges from the open-source. In this way, using both network- and activities-based analyses allows us to sift through an immense amount of public data to find cases that are most interesting to the public, the most relevant to our research, and the most impactful for our partners. Furthermore, although a simple network-based analytical approach provides a useful roadmap for researching corruption, being able to highlight the actual activities of a network makes the results of anticorruption research much more dynamic, enlightening, and actionable.  

At the upcoming 2019 OECD Anti-Corruption & Integrity Forum, we will dive into these issues and our methodologies further to provide a glimpse of how C4ADS analysts and partners work to untangle the webs woven by illicit actors. 


Why We Love Graphics

Evangeline Hines, Operations Manager & Patrick Baine, Senior Analyst

If no one understands your research, did it really even happen? At C4ADS, we think hard about how to turn our research into concise analytical findings. Consistently, we find graphics to be one of the most effective ways of condensing research into a single, comprehensible format. Our work often requires the explanation of complex networks, relationships, and patterns that would be nearly impossible to make sense of without graphics. Good graphics pack in a lot of information, but they also drive you to ask questions and dig deeper.

Getting this right depends on choosing the right graphics. Representing the data in a dishonest or confusing way is worse than not using graphics at all. Here, I wish to highlight a few examples in which we have structured complex and large data sets to make them intuitive and informative. This work would not have been possible without the R Suite of software and our wonderful Senior Analyst, Patrick Baine.

Flying Under the Radar: Wildlife Trafficking in the Air Transport Sector 

How do you map the air transit routes used for wildlife trafficking? This is not an easy task, especially given the lack of open source data on the issue. For the ROUTES project, we needed to reconcile several different databases of seizures in the air transport sector of various wildlife products to help industry, government, and civil society better understand the flow of these products. 


This map is helpful because it gives you a few pieces of basic insight right when you first look at it. It then prompts you to ask questions. There appears to be more activity in Europe, Africa, and Asia; why? Why is there so little in North and South America? What about Australia? I don’t usually think of Western Europe as a trafficking hotspot, so what is going on there? If you were to look at the spreadsheets of data that went into this graphic, I doubt that many people would come away with the same level of insight as they would by looking at the graphic. Graphics like this help you see the bigger picture and then encourage you to ask important research questions.

World Customs Organization: Cultural Heritage Trafficking in 2016


For this project, C4ADS analyzed World Customs Organization data to determine patterns in the trafficking of cultural heritage objects, such as antiquities, art, or other significant objects. This graphic shows the flow of cultural heritage trafficking in 2016. The chart visualizes the flow of goods from the country in which they originated to the destination country, as indicated by the arrow. The number of goods per country can be seen along the edge of the circle.

This is another graphic that 1) is pleasing to the eye, 2) does a great job of conveying movement (before you even have context, you know something is moving from one place to another), and 3) raises questions. One question that is raised by this graphic is what happened to the cultural heritage flowing out of Syria given the context of events there in 2016? Given the news coverage of the issue, I would have expected to see that show up here, and yet… Questions like this require more digging to answer, and can even become the base of full-fledged C4ADS projects.

World Customs Organization: Psychotropic Substance Seizure in 2016


For the same WCO project, C4ADS received a different dataset related to seizures of narcotics. While flows were interesting, other patterns related to time of seizure told an equally compelling story. This jitter plot represents seizures of psychotropic substances in 2016 by country. From the chaos of dots, patterns emerge. Again, this graphic gives insight, but also points to important questions and next steps for further research. What caused the increase of seizures in the second half of the year in Germany? Why did Estonia have a drop in seizures at the end of the year? Was there a reason that Hungary started reporting seizures in March? What about the trends within the types of psychotropic substances being seized? Most strikingly, what caused the glaring disparity between the frequency of seizures in the United States compared to the rest of the world? By looking at this graphic, you can both gain knowledge and understand that there are underlying trends in drug trafficking that require further study.

These are only three examples from one of the multiple platforms we use to develop graphics, but I think they do a great job of demonstrating what great graphics can do, and how they can add to stellar research. The complexity of the world in which we live and the data it produces will only continue to grow. We want to continue to explore new and innovative approaches to open source data and analysis, and eye-catching and insightful graphics are going to be a key component of our approach.


Crowdsourcing, Central Asian Steppes, and a Creature Straight Out of Science Fiction

Ben Spevack, Analyst

In Kazakhstan, one environmental conservation organization has developed an innovative approach to preserve one of the region’s most unique yet critically endangered species. 

Saiga tartarica (saiga for short) is a species of antelope that has inhabited Eurasia for over 100,000 years. Adult saiga typically stand between two and three feet tall at the shoulder, and adult males have ribbed horns that grow to between eleven and fifteen inches. But the saiga’s most remarkable feature is undoubtedly its snout. The peculiar appendage allows the saiga to filter dust from the air and regulate its body temperature.

The saiga’s habitat used to stretch across the Eurasian continent, but now consists of a few small pockets in Central Asia.

The saiga’s habitat used to stretch across the Eurasian continent, but now consists of a few small pockets in Central Asia.

While once abundant and widespread, with 1.25 million saiga worldwide as recently as 1981, the species has suffered a catastrophic decline, decreasing to only 24,000 in 2004. Current estimates place today’s saiga population at around 165,600, with the remaining herds found in pockets of Kazakhstan, Uzbekistan, Russia, and Mongolia. 

Current distribution of saiga from the Convention on the Conservation of Migratory Species of Wild Animals.

Current distribution of saiga from the Convention on the Conservation of Migratory Species of Wild Animals.

Poaching is one of the principal causes of the saiga’s drastic population decline in recent years. According to traditional Chinese medicine, saiga horn is believed to have medicinal properties that can regulate “internal heat” (“清热”). The horn is typically crushed, dissolved, and sold as “cooling water.” While trafficking in saiga horn is nominally illegal under the CITES convention, enforcement is lax and the trade is relatively open. In Kazakhstan, traders will even post flyers soliciting the horns, complete with a phone number or an email address.

The Association for the Conservation of Biodiversity in Kazakhstan (Казахстанская ассоциация сохранении биоразнообразия, or ACBK for short) has a unique approach to tackling the issue of saiga poaching and horn trafficking. ACBK runs an annual campaign in partnership with the Ministry of Internal Affairs and the Committee on Forestry and Fauna to combat the domestic trade of saiga horns. The goals are twofold: 1) raise awareness of the illegal nature of saiga horn trafficking, and 2) create a database of names and phone numbers associated with traffickers. These goals are achieved through a crowdsourced targeting of the flyers plastered across the country.

When a volunteer comes across a poster soliciting saiga horn, he or she takes pictures and posts them on the ACBK Facebook or VKontakte page, along with the location of the ad (if the volunteer wishes to remain anonymous, he or she can send pictures to ACBK’s Whatsapp number). The volunteer then glues a sticker on the ad, which cites the specific law forbidding the sale of saiga horn. Finally, if the advertisement includes a phone number, the volunteer sends a templated text explaining that trading in saiga horn is illegal. The procedure is the same for online procurement posts, without the sticker. The campaign runs from November to January, after which ACBK aggregates the data, structures it, and passes it along to the environmental prosecutor for further investigation.

One of the stickers volunteers attached to procurement posters.

One of the stickers volunteers attached to procurement posters.

The most recently completed campaign wrapped up on January 21, 2017. As of February 26, ACBK’s pages on Facebook and VKontakte had 686 combined subscribers who contributed 92 photos. Twenty-one unique phone numbers were identified, spread across nine cities. Additionally, nineteen websites were identified as hosting posts for saiga horn. ACBK contacted the websites and requested that they take down the posts. Eleven websites complied, five did not reply, and three were defunct upon a follow-up check. While ACBK has not mentioned any resulting arrests or seizures, it has said that all the collected information has been transferred to the environmental police to assist in investigations.

This campaign is a low cost, effective approach to wildlife conservation. Organizing via social media allows for collaboration among disparate actors and crowdsourcing allows for the assiduous efforts of small-scale environmental organizations to be amplified by hundreds of local residents. While conventional anti-trafficking measures by law enforcement and NGOs hamper poaching operations and the flows of illicit wildlife products, they offer little opportunity for local participation. Contributions, regardless of size, give local volunteers ownership and investment in the outcome. In the long term, crowdsourcing campaigns such as ACBK’s may catalyze a shift in societal attitudes towards wildlife trafficking.



Welcome to the C4ADS Blog!


Varun Vira, Chief Operating Officer

We are proud to announce the formation of our new blog. This platform will allow our readers a look behind the curtain at C4ADS to get a glimpse of our processes and on topics that interest our analysts.

For those of you who are not already familiar with our work, C4ADS is a nonprofit organization dedicated to providing evidence-based reporting and analysis on transnational security issues. Around the world, bad actors are able to hijack licit infrastructure to accomplish their illicit aims: our mission is to make it more difficult for these bad actors and their networks to function. To do this, we use cutting-edge technologies and methodologies to analyze disparate datasets, shedding light on problems of corruption, crime, and conflict. Sound a little confusing and intense? We know what we do can be puzzling to people who don’t know us, but we hope this blog will provide a better understanding of what we do as an organization. Plus, our background provides some very interesting material that we wish to share with our readers.

What should you expect to read on this blog? Without giving too much of the suspense away, one can expect to read posts on everything from how Facebook posts can be used to deter illegal poaching of endangered animals, to follow-ups on previous C4ADS reports, to how we use different technologies to simplify our data for consumption. On this page you can expect to meet a rotating cast of North Korean proliferators, ivory and pangolin traffickers, Middle Eastern terror financiers, and other associated bad actors. And that’s just our analysts. These and many more riveting topics will be explored and posted on this blog page.

To make sure that you do not miss any content, sign-up to have C4ADS blog posts delivered directly to your inbox at the bottom of this page. We hope that you are as excited as we are for the launch of our blog—happy reading!