42. Putin’s Minions: The Master in Moscow (Ep 2)

Summary

The Rest Is Classified: Episode 42 – “Putin’s Minions: The Master in Moscow (Ep 2)” Summary

Release Date: April 29, 2025

Introduction

In the second part of the gripping series on the Bulgarian spy ring known as the "Minions," hosts David McCloskey and Gordon Carrera delve deeper into the intricate web of espionage that intertwines Russian intelligence with unexpected figures from the corporate world. This episode uncovers the identity of the enigmatic handler behind the Minions and explores the broader implications for modern espionage.

Unveiling the Minions Spy Ring

David McCloskey opens the episode by setting the stage for the Minions spy ring’s activities. He recaps the group's operations, highlighting their base in a Norfolk beach guest house and their focus on surveilling Kremlin opponents and Ukrainian military personnel.

David McCloskey [00:42]: "And that was not us reading ChatGPT prompts in strange accents. That was in fact a series of messages exchanged between a very mysterious handler in Russia and the leader of a Bulgarian spy ring in London."

Gordon Carrera adds context about the group's peculiar dynamics, noting the complex relationships among the six members and their unconventional nicknames.

Spy Equipment: A Detailed Inventory

The hosts provide a meticulous breakdown of the surveillance equipment seized during the police raids in February 2023. Gordon Carrera enumerates the extensive collection of spy gadgets, emphasizing the sophistication and volume of the gear.

Gordon Carrera [03:01]: "221 mobile phones, I mean that's more than you know, most people. 258 hard drives, 495 SIM cards..."

David humorously comments on their spy kit's resemblance to fictional gadgets from the "Minions" movies, underscoring the blend of reality and fiction in their operations.

David McCloskey [03:25]: "Stuff if any plunderbug manufacturers are out there? We are seeking sponsorship..."

The discussion highlights the dual nature of modern spy tools, where advanced equipment is both commercially available and highly specialized.

Jan Marsalek: The Unexpected Handler

A pivotal revelation in this episode is the true identity of the Minions' Russian handler: Jan Marsalek, the former Chief Operating Officer of the German fintech giant Wirecard. McCloskey and Carrera unravel Marsalek’s transition from a business magnate to a key player in Russian intelligence.

Gordon Carrera [12:21]: "Jan Marsalek... he's an incredibly famous Austrian businessman in his time who'd been chief operating officer of a company called Wirecard."

The narrative details Marsalek’s financial scandals, his escape to Russia amidst Wirecard’s collapse, and his established connections with the GRU, Russia’s military intelligence agency. The hosts explore how Marsalek leveraged his business acumen and intelligence connections to orchestrate the Minions' espionage activities remotely from Moscow.

The Arrest and Trial

The episode chronicles the February 2023 police raids that dismantled the Minions spy ring. McCloskey and Carrera discuss the immediate consequences, including the seizure of extensive surveillance gear and the collection of 200,000 Telegram messages due to the group's lax security protocols.

Gordon Carrera [11:23]: "There are close to 80,000 messages between Rusev... and a man who uses the pseudonym Rupert Tis."

As the legal proceedings unfold, five members initially plead guilty, likely seeking leniency, while three others—including key female members Ivanchev, Ivanova, and Gaburova—decide to fight the charges. Their defense hinges on claims of being manipulated into believing they were working for Interpol, not Russia.

Gordon Carrera [21:48]: "They are going to say not so much duped, but that they didn't know who they were working for and the prosecution case is going to be not necessarily that they have to be pro Putin or pro Russia, but they are working to Russia's benefit..."

Ultimately, all six members are found guilty, underscoring the authorities' thorough case built from the amassed evidence.

Implications for Russian Espionage

McCloskey and Carrera examine the broader ramifications of this spy ring's exposure. They discuss how geopolitical tensions, especially post-2022 Ukraine invasion, have forced Russian intelligence to pivot towards using expendable proxies and freelance operatives like the Minions instead of traditional, diplomatically shielded spies.

Gordon Carrera [27:05]: "These Bulgarians... are becoming even more important to the Russians because of how much pressure there has been."

The shift to a "gig economy" model in espionage reflects both adaptability and vulnerability, as these freelancers lack the stringent oversight of formal intelligence operatives.

The Duality of the Minions: Clowns or Threat?

While the Minions exhibit elements of absurdity and ineptitude, McCloskey and Carrera caution against underestimating their potential impact. Despite their seemingly comical methods, the group's surveillance efforts could lead to significant threats, including targeting vulnerable individuals and compromising Ukrainian military operations.

Gordon Carrera [32:36]: "It's easy to overstate that and lose sight of the fact that it still could have been dangerous."

The hosts emphasize the importance of recognizing the dual nature of such spy rings: blending humor with hazardous consequences.

Conclusion and Tease for Next Episode

As the episode draws to a close, McCloskey and Carrera reflect on unanswered questions, such as how the Minions were initially recruited and the extent of Marsalek's influence. They speculate on the potential gaps in intelligence that allowed this operation to thrive undetected until the decisive raids.

David McCloskey [25:25]: "I'm hazarding a guess there without any insider information. But that seems like a reasonable hypothesis."

The episode concludes with a teaser for their upcoming series on Edward Snowden, promising listeners more insider insights into pivotal espionage narratives.

David McCloskey [34:00]: "We're starting a new series on the subject of Edward Snowden. So see you on Monday."

Notable Quotes with Timestamps

• David McCloskey [00:42]: "That was in fact a series of messages exchanged between a very mysterious handler in Russia and the leader of a Bulgarian spy ring in London."

• Gordon Carrera [03:01]: "221 mobile phones... 258 hard drives, 495 SIM cards..."

• Gordon Carrera [12:21]: "Jan Marsalek... he's an incredibly famous Austrian businessman in his time who'd been chief operating officer of a company called Wirecard."

• Gordon Carrera [21:48]: "They are going to say not so much duped, but that they didn't know who they were working for..."

• Gordon Carrera [27:05]: "These Bulgarians... are becoming even more important to the Russians because of how much pressure there has been."

• Gordon Carrera [32:36]: "It's easy to overstate that and lose sight of the fact that it still could have been dangerous."

Final Thoughts

Episode 42 of "The Rest Is Classified" masterfully intertwines real-world espionage with engaging storytelling, revealing the complexities of modern spy operations and the individuals behind them. By uncovering Jan Marsalek's pivotal role, the hosts shed light on the evolving landscape of international intelligence work, where traditional methods give way to more decentralized and freelance-driven approaches. This episode not only informs but also captivates, leaving listeners eager for the next installment in the series.

Transcript

[David McCloskey]

Can we use this IMSI catcher in Germany. We need to spy on Ukrainians at a German military base.

[Gordon Carrera]

Sure we can. Both are sitting and gathering dust in my Indiana Jones garage.

[David McCloskey]

Do you have a qualified minion one? Yes, only one.

[Gordon Carrera]

A new task currently under development. Go on a tour in Germany for one or two days. There has to be observation made for the entrance to a training regiment for Ukrainian soldiers.

[David McCloskey]

Well, welcome to the Rest is classified. I'm David McCloskey.

[Gordon Carrera]

And I'm Gordon Carrera.

[David McCloskey]

And that was not us reading chat GPT prompts in strange accents. That was in fact a series of messages exchanged between a very mysterious handler in Russia and the leader of a Bulgarian spy ring in London. A group that's just been convicted and whose story we're looking at in this closing episode, part two of the Minions spy ring. And Gordon, last time we looked at how this group of minions is kind of weird, I guess, almost slow horses like story of this Bulgarian spy ring that's being run out of a guest house at the, you know, wonderfully beautiful Norfolk beach up on the British coast. There's a six person group, many of whom are sleeping with each other and all of whom have very strange sort of nicknames and jobs and they've all been carrying out surveillance on opponents of the Kremlin and Vladimir Putin. They had been hatching this plot to spy on Ukrainians that were training at a US military base on an air defense system. And the group, they've been very active carrying out these surveillance operations. And this time we are going to finally get to the identity of this mysterious handler in Russia.

[Gordon Carrera]

Yes. Who you read with a brilliant accent which might become more explicable when we get to it.

[David McCloskey]

It's a hint. That's right.

[Gordon Carrera]

Brilliantly done, David. I thought really, really, really like a true novelist.

[David McCloskey]

That's right. I'm playing 3D chess here. I'm playing 3D chess Here.

[Gordon Carrera]

So last time we saw how on February 8, 2023 this group was busted by the police in Britain. Series of coordinated arrests. That 33 room great yarmouth hotel was being raided as well as some of the flats in London. And it is staggering what they find. It was an Aladdin's cave of kind of spy kit. And I'm going to be interested to see what you make of it in a minute. But let me just quickly run through what's there. 221 mobile phones, I mean that's more than you know, most people. 258 hard drives, 495 SIM cards. 33 audio recording devices, 55 visual recording devices, 11 drones, 16 radios. Now, I mean, that's a lot. We should first of all say, no.

[David McCloskey]

Piranha guns, no squid launchers, no cheese rays.

[Gordon Carrera]

These Minions reference.

[David McCloskey]

Those are Minions references. I told you. I sort of previewed, I think, in the first episode that I had gone deep into Minions wikis and fandom. And I have compiled a list, which I am looking at right now, of different Minions sort of spy kit. So I'm displeased that the actual Bulgarian minions did not have any of this stuff.

[Gordon Carrera]

They did have some interesting stuff that. Covert surveillance devices which are kind of hidden in everyday objects. So, for instance, there's one in a Coke bottle where there's a kind of hidden camera in the Coke bottle. There's hidden cameras in rocks, lighters, car keys. Some of them have got SIM cards attached to them so that they can live stream the video. They had some sunglasses or glasses which were capable of recording. Gaborova, who you remember from our first episode, is the beautician from Acton. She seems to have accidentally taken her own picture at one point in a mirror with the glasses, which is not top tradecraft.

[David McCloskey]

Submitted as evidence.

[Gordon Carrera]

Exactly. They find listening devices inside computer mouses, in smoke detectors, in a coat hook. It's going to get people paranoid about what's in their houses. Now everyone's going to be kind of checking it.

[David McCloskey]

Even in jewelry, I mean.

[Gordon Carrera]

Yeah, Hidden in jewelry. Yeah, yeah. They've got computer network exploitation devices as they're described, with names such as pineapples, coconuts, turtles, bash bunnies, rubber duckies, packet squirrels, key crocs, plunderbugs and Shark Jacks. I mean, who comes up with that.

[David McCloskey]

Stuff if any plunderbug manufacturers are out there? We are seeking sponsorship, having lost our sponsors from the Norfolk Tourism Board, you know, that went up in flames in episode one. So plunderbug manufacturers, please reach out. The rest is classified.

[Gordon Carrera]

Or Shark Jacks or Shark Jack tools.

[David McCloskey]

Shark Jacks also accept packet squirrels. Yeah. All of these are basically intended to intercept communications on a insecure WI FI network, right?

[Gordon Carrera]

Exactly. To gather information from WI fi networks. They've got car key cloning devices, GPS trackers with magnets. They've got radio frequency identification cloning equipment. They've also got things which could clone the access cards for hotels and buildings. Night vision binoculars, scanners, jammers, earpieces. You know the type you see the.

[David McCloskey]

Kind of Secret Service wearing anti gravity serum.

[Gordon Carrera]

No.

[David McCloskey]

Oh, oh, wait, hold on. That's on my Nefario List. I'm sorry, across the stream.

[Gordon Carrera]

If they could have had it, they would have had it.

[David McCloskey]

I think they would have had it. That's right.

[Gordon Carrera]

Also fake ID card printers and fake IDs. 75 passports. I like the fact they had fake press credentials trying to pose as journalists, including credentials for the US Discovery and National Geographic channels. Also branded clothing that. Lots of like, branded clothing like DHL and Deliveroo uniforms so you can pose as drivers. So it sounds like a ton of stuff, but come on, David, you're the former spy. How good is this stuff? Is this like dressing up box for. For CIA people or is this like amateur hour?

[David McCloskey]

I have friends who were in the business for a very long time in kind of the tech side. And what they would say is it used to be the case that to run really. Let's use this as an example. Right. To run a proper surveillance operation in a professional manner, you needed a few million dollars. And the dsmt, right. The Directorate of Science and Technology at the CIA, it's making all this tech right now you need a few hundred bucks in Best Buy, which is an electronic. A big box. Do you not have Best Buys?

[Gordon Carrera]

No, we don't have an electronic store. Isn't it consumer electronics?

[David McCloskey]

A big electronic. Yeah, consumer electronic store. So it's speaking to something true. Which is I think the gap between what spy agencies are using and what's commercially available has kind of narrowed. It's not closed entirely because there's still probably a tremendous amount of tech and particular capabilities that are still inside government exclusively and off the private market. But I think that gaps narrowed and I think many capabilities that previously were only in the hands of governments and spy agencies are now out in the wild and have been commercialized. And the reality is this like, long list that you just went through. I think this shows a level of seriousness and commitment to the work of a surveillance. I mean, they have a big tool shed of anything they might need to keep tabs on on a target. Right. And keep in mind almost all of the people they're surveilling. Let's put aside the Ukrainians at the base for a second. But all the other people they're surveilling kind of private citizens. And so they're not going after professional intelligence officers. They're watching people. I mean, Christo Grozev I'm sure has some sense of tradecraft because he knows Putin's got a mark on him. But again, he's not working for spy agency. So I think what they have here is probably Effective kit for a lot of the sort of operations that they've been given from this shadowy handler in Moscow.

[Gordon Carrera]

Yeah, that makes sense, doesn't it? It's good enough for what they need to do, which is spy on ordinary people and gather information about them. It's amazing. This stuff is commercially available. I mean, there are shops, you can buy it online. I mean, it's often sold as for people who want to kind of keep track on their spouse or something like that. But you kind of go, it's pretty dark stuff that you can buy all this spy kit and use it.

[David McCloskey]

The MC Grabber we talked about last time is more or less in the realm of like law enforcement in most countries and is very expensive. So they're operating with pretty sophisticated kit. I mean, I'm joking about Best Buy, you know, but I mean, they couldn't buy all of this at Best Buy. I mean, they're getting this through connections in Russia.

[Gordon Carrera]

That's exactly right. That the IMSI grabber, the IMSI catcher, which they were going to use to capture and to kind of identify Ukrainian service personnel in Stuttgart, that is something which isn't commercially available. That is the one bit which is really high end and it's not quite clear where they got it from, but you can take a guess. But just one. One more detail because you'll remember with all our Minions references, they were described as the Minions by Rusev, the spy ring boss from Great Yarmouth to Moscow. And Minion was attached to one of the numbers of the people in the phones. But also one important detail. In Ivanova's flat, they find a surveillance camera hidden inside a 20 centimeter Minion soft toy. And so there is a picture of that and it's got a. I mean, it's so. I find it kind of sad that a lovely thing like a minion has been subdued, converted into a.

[David McCloskey]

Into a tool of spy Russia, a Putin's Russia.

[Gordon Carrera]

I mean, it's nothing sacred in this world that even the Minions are being used by Putin's spies.

[David McCloskey]

Seeing this picture of this minion, this Minion spy camera, it did make me wonder, did it come out that that was deployed operationally? Because I don't. I don't see a lot of uses for this. But I. Maybe I'm not using my, my full imagination because you'd have to kind of.

[Gordon Carrera]

Hold it in front of someone to be used as a spy camera. I don't know.

[David McCloskey]

I mean, based off of the mug shots that I've seen of all these Bulgarians, I don't this Minions plush toy isn't really fitting with, you know, any of these people are not going to be carrying these around. So I don't know. I think this is. This is a case where, like in the MK Ultra episodes that we did on CIA Mind Control and Sydney Gottlieb, there was a lot of tech in there that kind of seemed like a bunch of people kind of just having fun and doing crazy things because they could. And the Minion plush toy with the camera in it kind of seems like they had six Martinis up there in Norfolk and. And just decided to put a camera in a Minion toy.

[Gordon Carrera]

So they're finding a lot of this stuff, not all of it, but a lot of it in this kind of Great Yarmouth former hotel, which, when you see the pictures of it, I mean, it is like a kind of. It looks more like a junk shop, like a junkyard. They're just boxes and stuff, just littering the place. Really messy, as we said. Not really an Indiana Jones warehouse. But also, crucially, the police are able to recover 200,000 messages which were sent on the Telegram communications network. But they find all these messages, they haven't been encrypted or the devices are open, which is a bit poor.

[David McCloskey]

Seems like an oversight.

[Gordon Carrera]

Seems like, yeah. It's going to prove to be a very poor move by the Minions and their bosses, because, amongst other things, there are close to 80,000 messages between Rusev, the great Yarmouth. Dr. Nefario. Is it Dr. Nefario? Mr. Nefario, whatever he is.

[David McCloskey]

Dr. Nefario.

[Gordon Carrera]

Dr. Nefario.

[David McCloskey]

Give him his duty. I don't know where. That's another piece of trivia that I don't have, is where he received his doctorate. I don't think he's a medical doctor. I believe he has a PhD, but I don't know where. Like, what institution.

[Gordon Carrera]

Again, maybe we're going too much down the Minions sidetrack, but that's okay. But there's 80,000 messages between him and a man who uses the pseudonym Rupert Tis. And now this is the.

[David McCloskey]

How do I pronounce that name?

[Gordon Carrera]

I don't know. T, I, C, Z. Ticks, maybe. Ticks.

[David McCloskey]

Ticks.

[Gordon Carrera]

So weird.

[David McCloskey]

Rupert Ticks.

[Gordon Carrera]

But it turns out. Now, this is clear from the messages. This is the man sending the orders from Russia. But here's the plot twist. He's not Russian.

[David McCloskey]

My accent, from the beginning, at the.

[Gordon Carrera]

Beginning, was the giveaway. He is an Austrian businessman, Jan Marsalek. Now, this is where I think the story takes a particularly crazy turn this is the point.

[David McCloskey]

It gets crazy.

[Gordon Carrera]

It's even crazier because this is not just some random low level businessman. This is an incredibly famous Austrian businessman in his time who'd been chief operating officer of a company called Wirecard, which was a major fintech champion in Germany. Like a huge German tech success story. When Germany was thinking, like, what champions do we have in the tech sector? If you'd asked them five, ten years ago, they'd have said Wirecard is the story. It's like a payments processor company based in Munich and he is the chief operating officer for it.

[David McCloskey]

I mean, it's insane.

[Gordon Carrera]

It's crazy. I mean, so he is a strange character. It's clear he had fingers in lots of pies. Politics, business, and we learn later, spying. So he's running a fintech business while also trying to recruit militias to control borders in Libya. I mean, that's kind of unusual. He lives in this palatial villa in Munich opposite the Russian Consulate. And he's involved in the Austrian Russian Friendship Society. Hmm.

[David McCloskey]

I mean, you know, he likes Russia.

[Gordon Carrera]

Yeah. So all is going well at Wildcard. It's this big champion. Until a brilliant Financial Times investigation raises questions about its finances. Now, the journalists who did this, I mean, it's an amazing story because they start questioning whether there's something fishy around Wirecard. And then the pressure on the Financial Times is enormous and there's surveillance and there's pressure on the editor to try and kind of deal with this investigation, clearly, because they know that they're going to find something. And in the end, it turns out that, you know, more than a billion euros is basically missing from the company and the whole thing is going to go under. But before he can be arrested and some of the others involved, some of the other executives are arrested. Jan Marsalek does a runner, which is a technical term. He claims he's going to the Philippines and he leaves a trail of messages to make it look like he's in Asia. But that looks like a red herring because he does a kind of spy style escape to Belarus on a private jet and then ends up in Moscow. Now, here's the great detail. That route of how he got out is tracked and revealed by none other than Christo Grozev of Bellingcat, who, as we learned last time, is one of the people the minions are tracking. But now, you know, this businessman, he's a fugitive. Yan Marsalek, he's in Russia. Looks like he gets a new identity at some point of a Russian priest.

[David McCloskey]

Who looks like him, he's very well bearded. In the recent sort of wanted posters.

[Gordon Carrera]

Yeah. Which you can find. And it also becomes clear as all of this kind of unravels, that it looks like he's been in bed with Russian intelligence for a number of years. He's visited Russia 60 times in the previous 10 years before he flees there using different documents. A mysterious diplomatic passport thought to have been recruited by Russian military intelligence, the gru, or GRU to keep our minions. I mean, that's just slightly weird reference. Around 2014, according to Der Spiegel, the German news magazine, that might have been after he was targeted by a Russian woman in a honey trap who becomes his girlfriend and then connects him to Russian intelligence.

[David McCloskey]

But unclear, he turns the honey trap back around.

[Gordon Carrera]

Well, no, I think he is honey trapped. And then I think he just.

[David McCloskey]

He just goes along with it.

[Gordon Carrera]

He just goes along with it. I mean, it's hard to be sure. I don't know what you think, but it feels more like the Russians would have seen that this is a guy who's a businessman who's sympathetic to them, who's working for a company which moves money around. All that's kind of helpful. So you can imagine Russian intelligence would have gone, this guy could be useful. Let's put a woman close to him, not to blackmail him, but just to kind of work on him and build up relationships.

[David McCloskey]

Almost like a handler, in a way.

[Gordon Carrera]

Yeah, I think that's what it feels like. I mean, obviously it's hard to know. And as a result, that starts this connection with Russian intelligence and, you know, he goes to Syria with the Russians. He seems to be kind of one of those people who's slightly obsessed with the world of espionage. But anyway, the interesting link to our Bulgarians seems to be through Rusev, the Great Yarmouth hotel owner, Dr. Nefario. And. And again, the link seems to be back from Wirecard days. According to the FT, Jan Marsalek, the businessman, and Rusev had met in 2015 when they were introduced by a mutual friend in London. And it seems like that Rusev, remember who is the engineer, comms specialist, was helping Jan Marsalek with secure communication. So with mobile phones that couldn't be hacked or perhaps doing surveillance on other people, who knows? But that kind of makes sense, doesn't it? If you're a businessman who's in this murky world, you're looking for someone who can provide you with that kind of kit or specialty. And we know Rusev was running a business doing that.

[David McCloskey]

Marsalic. Is he being Tasked by the Russians. Or is it better to think of him as a really motivated volunteer who kind of looks out at Syria, looks at the uk, looks, looks across the world and figures out where he can kind of make things happen? Because it's, it's interesting. It has a bit of a feel of. These are people who, Marsalek and Rusev, who are kind of sympathetic to Russia and want to demonstrate their value. Right, to Putin and the people around him.

[Gordon Carrera]

Yeah, that's right. Because I think Rusev is getting his instructions from Marsalek. We know from these messages. So Marsalek is the kind of intermediary with Russian intelligence. Looks like the GRU and the fsb, the Russian security service. But it looks more like Marsalek is trying to make himself useful to Russian intelligence. He's almost like a kind of freelance operator in Moscow, trying to prove his value to the people who he's got contacts with by saying, hey, look, I can do this. I've got these people on the ground who can do this. And he's trying to make himself a player and valuable in Moscow by engaging Rusev in turn to do this. And in turn, Rusev is getting paid and he's paying then the minions to actually carry it out.

[David McCloskey]

The gig economy has ruined everything, Gordon, including, including proper, clear cut lines of control in a surveillance operation. I mean, it is, it's like everyone's just kind of freelancing. The psychology of this is fascinating, right, because even from some of the nicknames they give themselves, you can see that these are people who are fascinated with the world of espionage and probably feel important being part of it too, right? So they're being paid and they get to feel cool at the same time, and they get to freelance. It's the gig economy. Come to the world of the spy business. And so, Gordon, maybe there we should take a break. And when we come back, we will see how this all comes crashing down for Jan Marsalic and his group of Bulgarian minions.

[Gordon Carrera]

See you after the break.

[David McCloskey]

This episode is brought to you by Shopify. Upgrade your business with Shopify, home of the number one checkout on the planet. Shop pay boosts conversions up to 50%, meaning fewer carts going abandoned and more sales going cha ching. So if you're into growing your business, get a commerce platform that's ready to sell wherever your customers are. Visit shopify.com to upgrade your selling today. Well, welcome back. Our minions have hatched their nefarious plots and had all of their spy tech cataloged by the Metropolitan Police. And they are Arrested as we started these episodes, Gordon, in February of 2023. And I guess, I guess it seems given the volume of evidence, including all of those unencrypted messages, that it's a relatively clear cut case in many ways. Is that right?

[Gordon Carrera]

Yeah, it is interesting because you've got five of them who are arrested at the start on those raids in February 2023, famously, Zambazov in bed with Gaborova as well, rather than with his partner. But Ivanchev, he's arrested a bit later, we should say, he turns up at some of the addresses asking what's happened to people. People get suspicious about him. And initially the group are arrested, are charged with ID fraud offenses because they've got fake IDs. And that's quite helpful while they build the case against them because it's going to take a while to kind of understand what evidence they've got. But three of them, including Rusev the boss, plead guilty. And in a way it's obvious, isn't it? Because if you're caught with a ton of spy gear in your once hotel and messages from a Russian handler, it's kind of hard to make a case.

[David McCloskey]

Your lawyer says plead guilty and then maybe you get out on good behavior in a few years or something like that.

[Gordon Carrera]

But what's interesting is that another three, Ivanchev and the two women, Ivanova and Gaburova, are going to not plead guilty and they're going to go to trial. And the crucial thing is they are going to argue they've been duped. So they're going to say not so much duped, but that they didn't know who they were working for and the prosecution case is going to be not necessarily that they have to be pro Putin or pro Russia, but they are working to Russia's benefit and had kind of knowledge and intentions to help Russia. And they're going to base that on the some of the communications, some of the gear, some of the facts of, you know, the kind of surveillance operations they're doing. Yeah, Their defense is fascinating because they're going to claim that Zambarazov was basically manipulating them by telling them that they were secretly working for Interpol.

[David McCloskey]

Oh, interesting. Yeah.

[Gordon Carrera]

And it's kind of interesting because they claim that that was what they were told and he had some kind of fake Interpol IDs and the like, and that when they were carrying out these secret spy operations or whatever, they thought they were doing it for Interpol rather than for Russia.

[David McCloskey]

Could that be true?

[Gordon Carrera]

Interpol are like sharing information.

[David McCloskey]

I Know, but I guess if you're a. If you're not familiar with that world.

[Gordon Carrera]

At all, could you believe that? Yeah.

[David McCloskey]

Could you. Could you believe it? I don't know. Or could you maybe have some suspicions, but. Because I guess the question would be, is there anything in the communications that directly connects, from the standpoint of, let's say, Gaburova the beautician, the work that she's doing to track Christo Grozev with Russia?

[Gordon Carrera]

Yeah, but I think that's the point, is that the fact that these were critics of Russia and Putin who are being tracked and surveilled is one indication of that. And there was also some other information in there about them trying to get hold of equipment, and it was clear on behalf of Russia. So I think the point was they couldn't really be under any illusions that this was ultimately for Russia. And that was a lot of what it hinged on. I mean, Gaborova says she's manipulated by Zambazov, and she says, you remember in the previous episode, we talked about how he'd claimed he had brain cancer and that was why he was trying to balance out his relationship with these two women and explain some of his absences. And Gaborova, who's our beautician, she of the Russian Eyelashes Acton, she kind of gets suspicious at one point, supposedly, about his brain cancer, and then he sends her images of himself supposedly recovering in hospital from surgery. Now, I've got that image there. To me, I don't know what you think of it, but he's clearly got toilet paper around his head.

[David McCloskey]

He's wrapped his head in toilet paper. That's exactly what it looks like, because he's on. He's on. It looks like he's on a video call with her here, right?

[Gordon Carrera]

Yeah. And he doesn't look like he's in a hospital and he just looks like he's lying down.

[David McCloskey]

Is he maybe out at the spy base in Norfolk? Right. The sort of emerald of the British Isles. Thank you to our, again, to our sponsors at the Norfolk Tourism Board. But, yeah, it looks like toilet paper to me.

[Gordon Carrera]

Anyway, she claims she was kind of manipulated and he was controlling her. But then it gets quite messy. But all three who didn't plead guilty are found guilty. And so in the end, all six get sentenced. There are some interesting things to reflect on. One of the unanswered questions from the trial is how they got onto this group in the first place.

[David McCloskey]

I would guess very deliberately not answered by our friends at the British Security Service or the Metropolitan Police. Right. Or that is right, sis.

[Gordon Carrera]

I mean, when I've tried asking, I've not got any.

[David McCloskey]

You're not getting anywhere. Yeah, it would seem to me. I'm just hazarding a guess here. I would guess it had to have been through Jan Marsalek, that communications they got somewhere along the chain his comms were intercepted or penetrated in. In Russia, I would think. And then you sort of unravel the group that way, because it doesn't seem like there would have been a lot of reason for the police or the security service in the UK to be watching any of these people otherwise. Right. It's the connection to Marsalic and Moscow that makes them radioactive. I'm just. I'm hazarding a guess there without any insider information. But that seems like a reasonable. A reasonable hypothesis.

[Gordon Carrera]

Yeah. Or they had some kind of source or penetration in Moscow of the GRU or the FSB who were telling them, you know, again, which would lead you from that end to get to the Bulgarians and the Minions, rather than spotting the minions doing stuff. I agree that that seems to make more sense.

[David McCloskey]

I would also think that there would have been reasons given for breaking up the group if it were a tradecraft issue that had been spotted or a criminal issue that had been spotted in the UK by MI5 or the. Or the police. Like, I think that that would have been part of the evidence, probably submitted at trial or would have come out because it'd be more open. Whereas this feels like it's in the spookier realm of what's actually going on in Russia. Sort of leads you here.

[Gordon Carrera]

Yeah, no, I think that makes sense. Yeah. So, as we come to the end, I guess, I mean, a few questions come come out of it, one of which is, why would Russia use these guys? Why use Dr. Nefario and the Minions?

[David McCloskey]

I mean, lots of benefits, right? They're cheap, they're expendable, clearly very expendable. And they can provide real value, even if it's amateur hour a lot of the time. Right. I mean, to me, the expendability part is. Is critical. I mean, just, you know, for a few hundred thousand euro, you have a group of people you don't have to protect, you don't have to get into any kind of diplomatic incident over. These are not Russian intelligence officer who might need to be swapped back if they're caught doing something or whatever. I mean, these are people you can just cut loose and cut them some minor checks that in the grand scheme of things are nothing. And they might give you intel on, you know, Ukrainian air defense systems? Potentially, yeah.

[Gordon Carrera]

So another reason I think is that it has got harder for Russia to use its regular spies in Europe, particularly in the last, I guess since 2018. You know, if you go back to the Salisbury poisoning is the first time you start to get real pressure on Russian embassies in Britain, but also across Europe, in which Russian diplomats, diplomats, but also spies are expelled in huge numbers. And that really accelerates after the invasion of Ukraine in 2022. And you get I think 600 expulsions of Russian diplomats who are basically spies from different European countries. So suddenly the Russians cannot carry out espionage in the same way from their embassies. You know, they can no longer use them as platforms. They can no longer, you know, run agents out of them. They can no longer task people or do any of those things. So you've got a lot of pressure, I think, over this period on those regular Russian spy networks in Europe which might have been the people running this in the past. And then you get pressure on the so called illegal networks which are the kind of people under deeper cover, not under diplomatic or legal cover, but illegal cover. So these are people posing as businessmen or students. And we've seen lots of those arrested as well and picked up after the, the invasion of Ukraine in 2022. So I think that, that what you see is Russia turning to people like these Bulgarians. You see them turning to proxies and criminals and others to do their dirty work.

[David McCloskey]

I'm of two minds on this because I do think what you're saying is right, that particularly post Ukraine, it's a lot harder for the Russians. Let's take what happened when the GRU was surveilling Sergey Skripal in Salisbury and they used GRU officers to, you know, actually deliver the nerve agent to conduct the surveillance they flew in and out of the uk. That's much harder to imagine now because of, I mean, in part because of groups like Bell and Cat and people like Christopher Zev who have, who have exposed those kind of operations, but also because it's just a lot harder for Russians to operate in Western Europe since 2022. So I think that is very clearly part of this case. I mean, the other side of it though is that from the standpoint of what kind of attributes do you want your unilateral surveillance network to have or group to have? This Bulgarian group, I think 10 years ago would have still been valuable to them because they can move around Western Europe. They live in the uk Maybe we don't Blend in. Exactly. But they're not Russians being dispatched from Moscow. So this is exactly the kind of group that a spy agency would want to recruit and use, because again, you don't want to be using Russian intelligence officers for a lot of this work. And I think that's true even 10 years ago. One thing that probably is new is that the, the leadership of it, the management of it, is being done remotely by Jan Marsalic in Moscow, because the Russians don't have this sort of espionage presence in the UK that they would have 10 years ago. I'd imagine 10 years ago, if you're running these Bulgarians, you might have someone in the residentura in London who is managing them, overseeing them, running them and then reporting it back to Moscow, whereas now you've got to do it remotely because you don't have the ability to really run it from the uk. So I think there's a bit here where it's like nothing has changed. And there's another piece of it where groups like this are maybe even more important to the Russians because of how much pressure there has been.

[Gordon Carrera]

Yeah, I think that's right. And I think out of necessity, there's a looser relationship, isn't there? Because you can't run them directly on the ground, they're being run from Moscow, but through Marsalek, who's a kind of cutout. It's a looser model than you might have seen in the past. More like a contractor relationship that we were talking about, the kind of gig economy thought they're filling a gap in the market. Masalek is also trying to kind of work his contacts over there. It's a much looser network. And I think we are seeing that more with Russia now, where it's also reaching out remotely over telegram this network to criminals, to other people in Britain and saying, hey, go carry out this act of arsenal sabotage and we'll pay you some cryptocurrency to do it. And those people might say, oh, we didn't realize it was for the Russian state, so you get back to that question. But you can suddenly task people and pay them remotely to carry out acts of espionage and sabotage on that kind of gig economy remote model, a looser model than the formal intelligence relationship of the past.

[David McCloskey]

It made me think, you know, as we were, we were talking here about a lot of the recent spy cases involving the Iranians running assets inside Israel, where a lot of these people are recruited totally remotely. Right. By the Iranian intelligence services or cutouts to essentially complete particular acts inside Israel. But it's all run remotely without, you know, these sort of street meetings or any of the kind of classic pictures you'd have of espionage. Right. So it's not just happening in the Russian context either. I mean, there's another question here, which is, you know, we've been using Minions references quite liberally. I would say perhaps too liberally throughout these two episodes. I mean, and I guess there's a question of whether these Minions are sort of, are they clowns playing at spies or something much more dangerous.

[Gordon Carrera]

A question you often get with these Russian spy cases. Because sometimes you can play up the comedy value, the ineptitude. I mean, you've seen that with all kinds of the characters in lots of these operations. And that's definitely the case here. I mean, there is an element of absurdity, of black comedy, of the minions, of the weird relationships, of the slight, grubby, slow horses aspect to this. And yet I think it's easy to overstate that and lose sight of the fact that it still could have been dangerous. They're carrying out surveillance on people who were the targets for the Kremlin and who could have got killed based on the surveillance reports, or kidnapped based on the surveillance reports supplied by this group, or Ukrainians who could have been killed because the air defences were taken out as a result of the work of this group. So you can be stupid, you can be amateur hour in some of your activities, you can have all of those things and yet you can still be dangerous. And I think that's one of the things that's, you know, sometimes a bit tricky to get your heads around with these groups. But I definitely think they were a serious spy ring. A really serious spy ring, even if they were also the Minions.

[David McCloskey]

And I guess, though maybe, Gordon, before we go, we should mention that listeners should join us on Monday when we will have a very special announcement.

[Gordon Carrera]

Top secret for the moment.

[David McCloskey]

Top secret.

[Gordon Carrera]

Top secret for the moment. Highly classic.

[David McCloskey]

That's right. That's right. A highly classified announcement will be totally declassified on Monday.

[Gordon Carrera]

We're starting a new series on the subject of Edward Snowden. So see you on Monday.

[David McCloskey]

Thanks for listening. We'll see you next week.