Treason charges against Russian cyber experts linked to seven-year-old accusations

Treason charges brought in December against two Russian state security officers and a cyber-security expert in Moscow relate to allegations made by a Russian businessman seven years ago, according to the businessman and a source connected with the investigation.

They said the arrests concern allegations that the suspects passed secrets to U.S. firm Verisign and other unidentified American companies, which in turn shared them with U.S. intelligence agencies.

Ruslan Stoyanov, head of the computer incidents investigation team at Russian cyber-security firm Kaspersky Lab, was arrested and charged with treason in December along with two officers of Russia’s Federal Security Service (FSB), since identified as Sergei Mikhailov and Dmitry Dokuchayev.

Authorities have given no public explanation for the arrests, which, as Reuters has previously reported, caused a chill in cooperation between Russians and U.S. researchers in the cyber crime-fighting field.

The source connected to the investigation said the arrests were a result of accusations first made in 2010 by Pavel Vrublevsky, a Russian businessman and founder of ChronoPay, an online payments company. Vrublevsky told Reuters he had also learned that the arrests were a response to his allegations: that Stoyanov and Mikhailov had passed secrets on to American firms.

A representative for Stoyanov’s defense team declined to comment for this article. Reuters was unable to locate representatives for Mikhailov or Dokuchayev.

Verisign denies that it received information that was secret. The firm’s iDefense unit compiled dossiers on cyber crime for clients including private firms and government agencies that include U.S. intelligence services, but it says its research did not contain classified information.

Its employees have said they knew Stoyanov, a former Russian police cyber crime official who later had a career as a consultant.

“Nothing like the arrangement as described by Pavel Vrublevsky ever took place,” said Kimberly Zenz, a former analyst at Verisign’s iDefense unit who knows Stoyanov.

Verisign Vice President Joshua Ray declined to comment on Stoyanov specifically, but said his company acquired information in unclassified ways and does not believe its reports to government agencies and other customers included state secrets.

Stoyanov’s employer, Kaspersky, declined to comment, but referred back to an earlier statement in which it said the charges against Stoyanov related to a period before he joined the company in 2012.

Russian authorities, including the FSB, have declined to comment on the case. The Kremlin has said only that President Vladimir Putin is aware of reports about it. Reuters received no reply to requests for comment from the FSB and Kremlin for this story.

NO ACTION FOR YEARS

Until now, the Russian authorities had taken no action over the allegations made by Vrublevsky against Stoyanov and Mikhailov.

December’s arrests came shortly after the United States accused Russia of trying to influence its presidential election through computer hacking, an accusation Moscow denies.

Reuters has reported in the past that researchers in the cyber security field in both countries believe Moscow intended the arrests as a signal, in response to the U.S. hacking accusations, that it would now take action against forms of cooperation that it previously tolerated.

That conclusion is likely to be reinforced by the apparent resurrection of the seven-year-old Vrublevsky allegations, which the Russian authorities previously did not follow up on.

“I can confirm we (Chronopay) expect to be part of this case. In 2010 we provided the FSB and other important Russian agencies with evidence that at least one FSB employee, as well as several other people, were involved in treason,” Vrublevsky told Reuters, referring to his past allegations against Stoyanov and Mikhailov.

After Vrublevsky first made his allegations against Stoyanov and Mikhailov, he was arrested and convicted on charges of organizing a cyber attack on a rival Internet payments firm that competed with ChronoPay. He is now free on parole and has always denied guilt.

He has long said the charges against him were brought by Russian authorities in part as a result of information about his business activity that was illegally leaked by FSB officer Mikhailov to Stoyanov, who worked in the private sector as a consultant and had contacts with Western firms including Verisign.

Vrublevsky said he believed Mikhailov and Stoyanov also passed secrets to other firms, although Verisign is the only firm he has identified.

Vrublevsky and the source connected to the investigation also disclosed that a fourth person had been arrested in the case. They identified him as Georgy Fomchenkov, although they did not say how he was connect with the treason allegations.

The source connected to the investigation said Fomchenkov was a former FSB officer. Reuters was unable to contact Fomchenkov or a representative of him, find any further information about his identity from publicly available sources, or determine what role he was accused of playing in the case.

Public documents available online show Stoyanov and Fomchenkov both had appeals against their detention rejected by the Moscow District Military Court on Feb. 15. Two days later, Mikhailov lost an appeal at the same court, which often hears sensitive cases relating to state security.

Neither Vrublevsky nor the source connected with the investigation offered an explanation as to why they believe the Russian authorities would resurrect such an old case seven years after the allegations were first made.

However, the source said he believed the case may not be the sole reason why Russian authorities had decided to arrest the men now: in his experience, he said, Russian authorities at times use old cases as a way of charging people suspected of later crimes.