Serving Moscow

The presidential elections and the national referendum on European integration held in the Republic of Moldova in October-November 2024 were heavily influenced by the Russian Federation. The country that attacked and is waging war against Ukraine acted in the Republic of Moldova through a network of tens of thousands of people, coordinated from Moscow by oligarch Ilan Shor, a former member of the Moldovan Parliament who fled the country after being sentenced to 15 years in prison for involvement in the largest banking fraud, which led to the disappearance of one billion US dollars from the Moldovan banking system. 

Ziarul de Gardă (ZdG) managed to prove this significant interference in Moldova’s elections by infiltrating this network and publishing a two-part investigation, chronologically detailing the events. For four months, reporters Măriuța Nistor and Natalia Zaharescu documented the activities of the Shor network from the inside, using hidden cameras and false identities. The journalists revealed how propaganda messages spread, particularly targeting the European integration referendum, how money circulated within the network, and how people were recruited and lured to work for Ilan Shor, in the service of Moscow, using Telegram and funds from a Russian bank. 

Both reporters had accounts opened for them at the state-owned Russian bank Promsvyazbank, which is under international sanctions, for the purpose of being paid to vote NO in the referendum and vote for a presidential candidate dictated by the network from Moscow. Măriuța Nistor received 30,000 rubles in two installments. Natalia Zaharescu was instructed whom to vote for a day before the election and was pressured to vote NO in the referendum on the day of the election, 20 October. 

The first to infiltrate the Shor network was journalist Măriuța Nistor. She started documenting from so-called “protests” held by supporters of the Shor group, who faithfully accompanied the group’s leaders to court hearings. The group faced trial for the illegal financing of the former Shor Party, declared unconstitutional in June 2023.

“People come because (Shor’s team, editor’s note) still pays. If they weren’t paying, you wouldn’t see anyone here.”

26 June. Outside the Chișinău courthouse, where the trial regarding the illegal financing of the former “Shor” party was taking place, a protest was set to occur in support of Ilan Shor’s allies. Reporter Măriuța Nistor made up a story, chose a new name—Ana Nastas—and began her infiltration among people working in the service of Moscow.

Under the pretext of having been invited to a protest for the first time, reporter Măriuța Nistor, aka Ana Nastas, tried to learn about the organization and payment arrangements from the people already at the protest site.

One of the protesters told the ZdG reporter: “Even if someone asks you for an interview, don’t talk!”

A man nearby joined the conversation and revealed the real reason he was at the protest: “People come because (Shor’s team, editor’s note) still pays. If they weren’t paying, you wouldn’t see anyone here.”

The same argument came from the woman.

Protester: “There used to be more people; now, there are very few, I don’t know.”
ZdG: “Maybe they’re not paying?”
Protester: “Well, if they don’t pay, I won’t come anymore. I left work…”
Protester: “A thousand (lei, n.r.). That’s the fee. Later, it will be three thousand.”

8 July. Another court session in the case of the illegal financing of the “Shor” party. Măriuța Nistor began talking again with people at the demonstration. One of them assured her that the monthly payment would increase starting 1 August, from one thousand to three thousand lei.

Protester: “In short, 1000 lei, whether you come or not, they’ll give it to you.”
ZdG: “But if I come to the protests, how much will they give me?”
Protester: “Still 1000. That’s the fee for them. Then, starting 1 August, they’ll give three thousand. Some get six, some three… something comes out…” 

Residency permit

After a few minutes of discussion, the protester introduced the ZdG reporter to Raisa—his “boss” from Dobrogea, a village near Chișinău.

Protester: “Aunt Raisa, can we have her join our group? We know each other.”
Raisa: “Where is she from? If not from Dobrogea, we can’t. We need a ‘propiskă’ (residency permit).”
ZdG: “What if I change it?”
Raisa: “If you change it, welcome.”

In order to join the group coordinated by Raisa, Măriuța Nistor had to move her residency to an address in the village of Dobrogea.

Raisa: “You know, we’re all about residency. You need to find someone to make you a temporary resident. I’m from Dobrogea. I’m the president. I’ll take you and others, but you must have residency here, at least temporary. Anyway, you won’t vote for Maia Sandu.”

With the help of ZdG’s technical team and image editing software, we created a fake ID card. Ana Nastas was now a “legally recognized” character. Once the fake ID was perfected, the ZdG reporter sent a copy to Raisa to be registered in their database. 

“You’re not from PAS, right? I know they’re spies. You’d better not be with the police”

24 July. Raisa called the ZdG reporter to Dobrogea, where a meeting of her group with one of Raisa’s superiors was to take place. Măriuța Nistor was greeted with doubts and many questions.

Raisa: “Ana, I am surprised. But do you know why? There were so many people there, and you approached us. I don’t want problems with my group. You’re not from PAS (note: Party of Action and Solidarity, the ruling party), right? No, I’m asking you. If you are, then say so.” 

ZdG: “No, no, no, aunt Raisa. I want to thank you. But do you know why? Because you’re the one who told me to do this. I’m telling you, everyone else was saying I needed a permit, but no one told me, ‘Go, girl, and get yourself registered.’ No one told me that. But you told me that I need a permit, and you said, ‘Go get it.'”
Raisa: “Everything is normal here, the whole group is friendly. And if you’re an honest girl, we’ll take you into the group. You’d just better not be with the police.”

Later, Raisa introduced her to the group and informed Măriuța Nistor that “I don’t know when money will come, but it will… eventually. Because we don’t get it every month, we get it like this, when it’s been a month…, but we get it.”

Monthly salary

An hour later, which seemed to be normal, the man for whom Raisa had gathered the activists in Dobrogea—Alexandru—finally arrived. Unhappy that people were afraid to give their ID details, Alexandru offered a few explanations: “We need your passport to write a contract. Now, it’s not Raisa who’ll be giving out the money,’ but every month, from the 1st to the 10th, starting from August, you will receive 3000, as activists. If you meet the activist plan—3+3, meaning 6 for the month. We don’t know the plan yet, but you’ll get a call about it.”

Surrounded by activists, whose role is to recruit sympathizers—the lowest level of the political pyramid, with Ilan Shor at the top, Alexandru went over the latest indications from Moscow.

Raisa: “The question everyone has is, when will the payment be?”
Alexandru: “Raisa brought it. She went to Moscow and brought you the money. You should have received payment for January and February, but we gave you a bonus for February because we didn’t work. I decided with the leadership to give you that bonus. And for March too. You should have received three. Now I’m telling you, it’s for July. In April, we didn’t work, we were all in Moscow. In June and May, no one worked, no newspapers, we were in Moscow. You’re all listed in contracts, anyone who submitted their passport on time. But in July, no one worked either. The protests are included in the payment you received—1000 lei.” 

Account with the Russian bank “Promsvyazbank”

6 August 2024. Ana Nastas, i.e. the false identity of the ZdG reporter, was registered in the database of the Russian bank “Promsvyazbank.” This Russian bank, under sanctions, opened an account for the undercover reporter based solely on a fake identity card and without her submitting any request. 

7 August 2024. Măriuța Nistor was invited back to Dobrogea for another gathering. Most of the activists were elderly, and they arrived reluctantly with their phones and IDs in hand, as instructed, to register in a Telegram chatbot.

Raisa tried to explain: “Everyone must have a phone. If you want to get the money, you need to have a phone.” 

After Alexandru arrived, they began registering the activists in the Telegram chatbot. Right after accessing the chatbot, they were asked to send a photo of their ID.

Raisa: “Why do we need to give our IDs?”
Alexandru: “So each of you can have a card. I’m not going to fly to Moscow 20 times. It costs 1000 euros each time for both you and me, plus hotel and living expenses. That’s a problem for everyone.”

Alexandru: “What, are you all just here for the money?” Raisa: “Of course, they’re here for the money.” 

Another discussion followed about money vs. loyalty to the party. People were honest with their leaders and told them that what mattered was the money.

Alexandru: “Why are you asking me for money for the rally? You want money?”
Activist: “What do you mean? I just walked and ran for nothing?”
Alexandru: “What about you, are you here just for the money?”
Raisa: “Of course, we’re here for the money, Sasha. They won’t tell you that, but yes, we’re here for the money.”
Alexandru: “Is it hard to come for the cause?”
Activist: “Of course, it’s complicated.”
Alexandru: “Then why do we need you in the team if you’re here just for the money?”
Activist: “Well, just like everyone else comes for the money, so do we.”

First “salary”—15,000 Russian rubles in a “Promsvyazbank” account

26 August 2024. After registering in the chatbot, 15,000 rubles (equivalent to 2,700 Moldovan lei) were transferred from the Russian bank “Promsvyazbank” to the ZdG reporter’s account, under the activist name Ana Nastas. This was the promised payment for activist work. The only problem was that the Promsvyazbank app couldn’t be accessed because Moldova’s Information and Security Service (SIS) had instructed mobile operators to block it.

In one of many conversations with contacts in Moscow, the ZdG reporter was given a solution to bypass the SIS blockade and access the Promsvyazbank app in Moldova—a Romanian VPN. 

Raisa: “You must come because you work with us.”

Each following day involved calls from “commander” Raisa, who persistently urged the ZdG reporter to complete various tasks.

Raisa: “Listen, there’s a reason for this—you received money in your account, so you must work. There’s a reason—you need to come and distribute papers to people, there’s a reason—you need to take photos. You need to come to me today.”
ZdG: “I understand. But if there are more people, I think I can manage.”
Raisa: “There are more, but even if there’s just one, you must be there. You must come because you work with us. And I don’t understand why you didn’t answer—you were online at 5:00 AM. I called you, and you didn’t pick up; Nadia called you, and you didn’t pick up. What does that mean, Ana? You must always keep your phone near you. When I call, you must answer.”
ZdG: “Okay, okay, Auntie Raisa.
Raisa: “Okay, okay… this is not how work is done. You came for two days, got 3,000 lei, and didn’t work at all. I’m expecting you at 5:00 PM.” 

ZdG reporter forced to hand out anti-EU leaflets

After being scolded in the morning, on the evening of 2 September, the ZdG reporter went to Dobrogea, where she helped two activists register in the Telegram chatbot. Later, she was instructed to distribute leaflets containing falsehoods about the European Union and praise for the Eurasian Economic Union. Since journalist Măriuța Nistor decided it was wrong to spread disinformation, she went home without distributing the leaflets. Because she didn’t send photos proving she had handed them out, Raisa scolded her again. She was then forced to return to Dobrogea to distribute the leaflets. 

“Here’s 1,000. And here’s another 300. 1,000 stays with me.”

21 September 2024. The ZdG reporter was called back to Dobrogea. Upon arriving at the meeting, she learned that she would be participating in a cash conversion operation through an intermediary named Oleg. 

Oleg, addressing the ZdG reporter: “You have 15,000 rubles. When we transfer it to my account, I receive 14,700 rubles—the bank takes 300. Then, I transfer it through two more banks, each taking 2.5%, so we lose another 5%. That leaves 13,965 rubles. Multiply by the exchange rate—0.665. That gives us 2,300 lei. Understood?” 

Monday, 23 September. Reporter Măriuța Nistor was called to Dobrogea to collect the money. However, of the promised 2300 lei, she only received 1300. In addition to the commission charged on bank transfers, Raisa charged her own “commission” of 1,000 lei. 

Raisa: “You barely did anything, did you? Absolutely nothing for our work.”
ZdG: “What do you mean nothing? I did what you told me.”
Raisa: “Come on! We’ve been running around… Long story short, I’m giving you 1,000 lei now…”
ZdG: “But I received it on my card…”
Raisa: “So what if you did? Did you deserve this money? Tell me! Did you deserve this money?”
ZdG: “Well, I did what you told me.”
Raisa: “What did you do? You handed out two or three papers, you went to the demonstration once and that was it.”
ZdG: “And every time you called me… every time you called me, I went to see Auntie Nadia.”
Raisa: So what? That just showed that you were part of the group.”
ZdG: “Well yes, but you told me I would get…”
Raisa: “1,2,3,4,5. Here’s 1,000. And here’s another 300.”
ZdG: “But you told me I would get 2,300…”
Raisa: “No… 2,300 was transferred to your card. 1,000 stays with me.” 

Second salary, 15,000 roubles in the Promsvyazbank account

4 October 2024. The ZdG reporter receives her second salary: another 15,000 roubles, about 2,700 Moldovan lei.

5 October 2024. At the invitation of her bosses, the ZdG reporter attends a training session, where she participates in a propaganda lesson. A speaker addresses the audience, rattling off multiple falsehoods about the European Union: 

“We go abroad, but we don’t work in our fields. Excuse me, does anyone here have relatives working as teachers or… unfortunately, no. They give us the most miserable jobs. We can’t say that Europe cares about us and will offer us a bright future. If Europe wanted to help us, it wouldn’t cost them anything to turn our country into a ‘success story,’ but that’s not the EU’s goal. The EU’s objective is to give us loans and turn us into beggars.”

These claims, made by Svetlana Stanchevici, a former journalist, reflect another false narrative promoted by Shor and Russia. 

Second infiltration. Election campaign, elections and referendum

The second part of the investigation was carried out by ZdG journalist Natalia Zaharescu, who infiltrated the network under the code name “Irina Zahar.” The opportunity to infiltrate Shor’s network arose in September 2024, 10 days before the start of the election campaign.

10 September 2024. In the Botanica district of Moldova’s capital, a group of people was waiting for something—or someone. In the distance, former Shor Party MP Marina Tauber, one of the leading figures of the Victory Bloc, appeared. She approached the group and delivered a speech, thanking them for their participation “on behalf of Ilan Mironovich Shor and the entire team.”

At this gathering, the ZdG journalist met a Russian-speaking woman named Iustina, though everyone called her Iulia. The woman eagerly offered to register the journalist as a supporter, the first level within the network. 

Registering with the office and “bonuses” for recruiting supporters

16 September 2024. The ZdG reporter met with Iustina, who took her to a Victory Bloc office in Chișinău. On the way, Iustina explained to Natalia (operating under the code name Irina) that she would be registered not just as a supporter but as an activist, so that she, too, could recruit supporters.

Iustina immediately emphasized that the main target was the referendum on European integration and explained how information about the preferred presidential candidate would be relayed. 

ZdG: “When I talk to someone, should I tell them upfront…?”
Iustina: “That we are against the referendum.”
ZdG: “And against Maia Sandu?”
Iustina: “Not against her. For anyone—just not for her. The last day of elections is Sunday, and on Saturday, they will call us and say, ‘Vote for this person.’ Then you have to call your people and tell them.”

Iustina urged the ZdG journalist to recruit as many supporters as possible:

“First, you’ll get bonuses because you brought them in. You will receive more. Bonuses are money, you understand? But we don’t say money, we say bonuses. If you bring people in as an activist, you’ll get more bonuses.”

At the office where Natalia was registered as an activist, a young man entered her code name (Irina Zahar) and phone number into a computer. She became the 30th person on the list for what they called Sector 20. He also registered her in a Telegram chatbot named Botanica 4 35/2 (Botanica is a district in Chișinău, the capital of Moldova). To complete this step, the ZdG journalist provided a photo of a fake ID with modified personal data, stored on her phone. 

In the office, several people, most of them elderly, lined up to be registered, while the office staff collected their data and entered it into computers. The discussions revolved around lists and supporters, who were in high demand and critical to an activist’s career. Each activist was instructed to register at least ten people.

A woman named Irina, who had also attended the meeting with Marina Tauber a few days earlier, seemed to be the coordinator of that office. She showed the ZdG reporter how to register people using the Telegram chatbot and instructed her to ask them to take photos of their ID cards and upload them into the chatbot. The final registration step was for each person to take a selfie with their phone. 

“We are the Victory Bloc. We are against the European Union, against Maia Sandu, and in favour of uniting with the Russian Federation. The most important thing is for people to show up on election day and vote for unification with Russia. All registered supporters will receive bonuses. Right now, they should be getting 10,000 roubles,” Irina told the ZdG journalist. 

24 September 2024. Four days after the start of the election campaign, journalist Natalia, known in the network by her code name “Irina,” was invited to attend a meeting of activists, which was to take place at a different office. She went there with Iustina, the one who had recruited her, and met in person with the head of the activist group she had been registered in, a woman named Ana Ivanovna (following the Russian naming convention). When they were introduced, the woman, also a Russian speaker, summarised how the network’s hierarchy worked: “She is your boss,” she said, pointing at Iustina. “And I am her boss, and over there are my bosses,” she added, gesturing towards the office. 

At the new office, the activists were met by a new leader who introduced herself as Xenia. Speaking in Russian, she reprimanded those present for failing to bring enough supporters: “Each activist was supposed to bring two supporters to this meeting. Where are your supporters? Where are they?” Xenia also explained that the identity card data collected was being used to open bank accounts in Russia.

In the following days, the undercover ZdG reporter took part, alongside other network members, in a protest outside the Central Electoral Commission over the fact that too few polling stations were being opened in Russia. She was also handed propaganda leaflets with anti-EU messages and was encouraged to distribute them to people on the street. 

4 October 2024. ZdG reporter Natalia Zaharescu was asked by the head of the activist group, Ana Ivanovna, to attend an election meeting with a candidate for the presidency of Moldova, Victoria Furtună, who was officially running as an independent. That same day, Măriuța Nistor, also undercover, attended a meeting with the same candidate but in a different location. A few days later, on 7 October, the ZdG reporter Natalia Zaharescu was invited to yet another voter meeting with the same candidate, Victoria Furtună. 

PSB message: “You can only make transfers through Transnistrian banks”

During the first electoral meeting with Victoria Furtună, the ZdG reporter received an SMS titled “PSB” from the Russian state bank Promsvyazbank, which is under international sanctions. The message informed her that a bank account had been opened in her name. It also included a phone number, which, when called, was answered by a woman claiming to be a bank representative based in Moscow. When asked how the money could be withdrawn from the card, she explained: “You can transfer money via the mobile app, you can transfer to Visa and MasterCard from this card. And you can only make transfers through Transnistrian banks.” Transnistria is a separatist region in Moldova, supported by the Russian Federation. 

 

“Payment will be made the next day. You can invite friends and acquaintances”

16 October 2024. ZdG reporter Natalia Zaharescu was contacted by another woman from the network, whom she had previously met, named Iulia. Through a message on Telegram, she invited her to attend a “conference:” “Payment will be made the next day. You can invite friends and acquaintances,” Iulia wrote. Over the phone, Iulia explained that each person would receive 400 lei (approximately 20 euros). 

The so-called “conference” was in fact an election meeting of another presidential candidate: Vasile Tarlev, running for the Future of Moldova Party. The speakers criticised Moldova’s socio-political situation, accusing the current government of worsening relations with Russia and other CIS states. Candidate Tarlev urged attendees to vote for him. 

400 lei, handed to the ZdG reporter right in the city centre. “To others I gave almost 4000”

18 October 2024. Around 5 pm, the ZdG reporter met again with Iulia, right in the centre of the capital. Iulia boasted about having a wallet stuffed with money, saying she had to distribute payments to several people right there, in the middle of the crowd and in full view of everyone. When the ZdG reporter arrived, Iulia was talking to a young man who had also come to collect his money—around 4000 lei—because, as Iulia later told the ZdG reporter, he had brought nine people to the electoral meeting with Vasile Tarlev. Iulia then handed “Irina Zahar” the promised 400 lei. The payment was made just two days before the elections.

Falsehoods about the European Union: “By the age of nine they already have to have sex in schools”

The ZdG reporter asked Iulia if Vasile Tarlev was the one to vote for. Instead of a direct answer, the woman launched into an astonishing series of myths about the European Union and the referendum: “Vote for whoever you want, just not for Sandu. Because we will have war, simple as that. And if the referendum passes, there will be changes to the Constitution, and then the lands that belong to us will have to be returned to the Romanians who lived here in the ’30s, ’20s, and ’10s. It will be terrible! God forbid! They will change the Constitution regarding sexuality. Homosexual propaganda will be allowed. There is a programme for children’s sexual development from the age of three. By the age of nine, they will already have to have sex at school,” Iulia passionately claimed. 

“That’s what they said from Moscow”

19 October 2024. One day before the elections, on the day of silence (under Moldovan law, election campaigning is prohibited on the day before the vote, known as the “day of silence”), Ana Ivanovna informed Natalia Zaharescu, alias “Irina,” that the decision had been made to support Victoria Furtună for the presidency of Moldova. 

She also mentioned that an observer would be monitoring the election process and would report to her every three hours on the number of people who had voted. “I already know how many supporters there are in my sector, and we need to reach that number. If we don’t hit the target, it means people are lying. Do you understand? Don’t call me again, because today is the day of silence—we don’t want anyone listening in on our conversation,” Ana Ivanovna warned. 

A couple of hours later, the ZdG reporter received a call from Iustina, the person who had recruited her into the network. The woman suggested a backup plan in case Victoria Furtună were out of the race: “In the worst-case scenario, Vasile Tarlev. But the most important thing—make sure to say NO in the referendum.” 

Election Day message: “what matters is that the referendum result is NO”

20 October 2024. The messages didn’t stop on election day either. In the morning, sector chief Ana Ivanovna sent a Telegram message to ZdG reporter Natalia Zaharescu: “The way we and our supporters, relatives, neighbours, and friends vote will determine how we live. Hurry your supporters to the polling stations.” 

By midday, Ana Ivanovna sent another message, this time in a commanding and authoritarian tone: “Every activist must report how many of their supporters will have voted by 3:45 PM. This is MANDATORY. Their turnout will be proof of how well you have worked. Should I call you, or will you message me? Is everything clear?” 

At around 3:00 PM, she followed up with a voice call on Telegram, asking the ZdG journalist how many people had voted “on her side.” She also reiterated that they needed to vote “against” in the referendum: “I need exact numbers because I’m required to provide exact data. Maybe you can convince someone else to go and vote. It doesn’t matter who they vote for—what matters is that the referendum result is NO. Do you understand?” This was Ana Ivanovna’s message on election day, 20 October. 

After the first round of voting, a call from headquarters: “Ilan Shor’s position hasn’t changed. Anyone but Sandu”

24 October 2024. After the first round of the presidential election resulted in a runoff between pro-European incumbent Maia Sandu and former Prosecutor General Alexandr Stoianoglo, the candidate backed by the Socialist Party of ex-pro-Russian president Igor Dodon, Natalia—alias “Irina Zahar”—received a call from a number linked to the central office of the “Victory” Bloc. A man who introduced himself as Gheorghi spoke to her in Russian, stating that he was calling “on Ilan Shor’s personal instruction:” “I congratulate you on the successful referendum result and on the fact that President Maia Sandu, who is against the people, failed to win outright in the first round. Soon, the leadership of the ‘Victory’ Bloc will devise a strategy for the second round to secure our victory.”

29 October 2024. A week before the second round of the presidential elections on 3 November, Natalia received another call from the same number, this time from a different man named Vladimir, who also spoke in Russian. He informed “Irina” of Ilan Shor’s stance regarding the candidate they should support in the second round.

Vladimir: Ilan Shor’s position hasn’t changed. Anyone but Sandu (Maia Sandu). That is the most appropriate position. Do you understand?
ZdG: What does that mean?
Vladimir: It means that we should not boycott the elections. We should not spoil the ballot. Try to pass this message on to whoever you can—supporters, friends, acquaintances—that they should not boycott. Instead, they must turn out on 3 November and vote against Sandu. For whoever the other candidate is, but not Sandu.
ZdG: But there is only one second candidate: Stoianoglo, right?
Vladimir: Yes, yes.
ZdG: Does that mean we have to vote for him?
Vladimir: Yes, yes. This is the most important position now.

Reaction from those involved

After completing both parts of the investigation, ZdG journalists confronted those involved in Shor’s network, informing them that their activities had been documented in an undercover journalistic investigation.

Alexandr Stoianoglo, the Socialist Party’s presidential candidate supported by Ilan Shor’s network, did not respond to ZdG’s calls and messages. However, his representative denied any connection between Stoianoglo and the Shor network. 

Marina Tauber, MP, secretary general of the “Victory” Bloc: “I don’t know what you’re trying to ‘discover.’ Your questions don’t affect me. If you think you’re going to rattle me, you should know that you’re only giving us free publicity—so thank you very much.” 

In October 2024, Moldovan police and prosecutors announced that they were investigating this network, leading to multiple arrests and detentions. Official data released by the authorities showed that approximately 140,000 people had been recruited into the Shor network. 

Maia Sandu won the presidential election. In the referendum on European integration, the YES option won. As a result, the Constitution of the Republic of Moldova was amended and European integration was declared a strategic objective.

Further Credits: 

The Silent Battle Between Putin and the West Over a Crucial Oil Pipeline

Oil pipeline runs across Kazakhstan and Russia

As well as being shareholders in the pipeline, the four western oil companies had invested millions in the Kazakhstani oil fields. Their own oil was supposed to flow through their own pipeline. Why isn’t the pipeline working, Mr Gorban, they asked in exasperation in the letter. And the grievances didn’t end there. How did there come to be an oil spill last year for the first time in decades, one that could cost them $75 million? Why were fines incurred for water pollution and inadequate emergency protocols?

The shareholders were stressed. A few weeks earlier Russian president Vladimir Putin had invaded Ukraine and the West announced a series of sanctions packages against Russia. What if the flow of oil dried up not just from Russia, but from Kazakhstan? The pipeline was no drop in the ocean: one out of every 100 litres of oil shipped around the world ran through it.

Global markets were extremely nervous too. On March 23, 2022, the morning after the supply was shut off, the price of oil soared by 5 per cent.

The timing of such a strange turn of events raised eyebrows. The oil companies suspected a powerplay by Putin. If the West was going to sanction Russian oil, Russia would make sure the flow of oil from Kazakhstan stopped, seemed to be the message.

But they couldn’t tell what was really going on. Communication with the state-owned company Transneft, the Russian shareholder that controlled the day-to-day running of the pipeline, was patchy. The official explanation for the suspension of the pipeline was that there was a problem with the floating buoys that oil tankers moor against to pump oil from the pipeline into their storage tanks. First buoy number 3 was damaged: something to do with the floating hose used to pump oil into the ship. To be fair, it was a stormy night on the Black Sea and things can break in high waves and gusty conditions. But the next morning an “inspection” suddenly uncovered damage to the floating hose on buoy 2. And then buoy 1 went out of service.

They had no idea if it was true. All the western oil giants could do was look on with gritted teeth. In the years beforehand they had lost control of the pipeline. Their frustration was palpable between the lines of the letter. Their colleagues had not been welcome in the Russian port for two years, the oil companies wrote; they were not allowed any involvement in the day-to-day management. “We request that CPC provides regular updates,” they wrote. They wanted to take back control.

A slow-burning battle

Putin is not just waging war in Ukraine, where he drops bombs on Sumy and sends troops to Kramatorsk. Quietly he is fighting another battle behind the scenes, in boardrooms and shareholders’ meetings. It is a slow-burning battle to seize control of crucial transport routes and important sources of income for the state.

The focus of this battle is the CPC pipeline, worth some $700 million in profit and taxes per year to the Russian treasury as well as being a strategic asset for the West – the reason why the pipeline was kept out of the sanctions regime.

The pipeline belongs to the Caspian Pipeline Consortium, owned by the Russian and Kazakhstani states and western oil companies, including the British and Dutch-based Shell. The largest shareholder is the Russian state-controlled company Transneft, which holds a quarter of its shares and has been headed for the last 17 years by Nikolai Tokarev. He is an old associate of Putin who worked with him in Dresden for the Russian secret service KGB. Tokarev was placed on the European sanctions list because of his support for the leaders of the war against Ukraine.

NRC, together with the International Consortium of Investigative Journalists ICIJ, reconstructed how western oil companies lost control of this crucial pipeline to the Russians. It has made the pipeline a “very impressive and powerful political tool” for Russia, according to the exiled opposition leader Vladimir Milov, who was deputy minister for energy under Putin for a few months at the beginning of the century.

NRC read internal correspondence and minutes of CPC board meetings, studied annual reports from Dutch, Russian and Cypriot chambers of commerce, combed through contracts, shipping registers and Russian bank transactions, investigated court documents, data from ship trackers and satellite images, and spoke to dozens of sources in the Netherlands and abroad.

The research shows how western oil companies spared no expense in trying to hold on to the strategic pipeline, and in doing so repeatedly gave in to Russia’s corrupt demands. But they failed. Since the war against Ukraine Russia has turned off the tap twenty times and the pipeline has become a way to exert pressure. Russia’s official version of events is that the pipeline had to be closed because of technical issues. But Arseny Pogosyan, a former press officer for the Russian deputy minister for energy, told ICIJ that Russia turned off the tap for longer than necessary in March 2022 “to scare the West”.

The consequences are also being felt in the Netherlands, whose dependence on Kazakhstani oil increased because of the sanctions against Russia. Out of every 10 oil tankers leaving Novorossiysk, at least one goes to the Netherlands, which by now is importing more oil from Kazakhstan than from Saudi Arabia.

The investigation shows that the western oil companies lost more than leverage: they also lost money that was siphoned off through shadowy routes to private offices in Cyprus or the construction of a megalomaniac estate on the clifftops by Novorossiysk nicknamed “Putin’s palace”.

A single route via Russia

In desparation, the managing director of Rotterdam-based towing and salvage company Smit Lamnalco wrote to high-ranking officials in the Kremlin and the Dutch ambassador to Moscow, Ron Keller, in 2012, asking if they could do anything about the “constant intimidation” that employees at his company were being subjected to in Novorossiysk harbour. The situation has become intolerable, he said.

Salvage company Smit had been working for the Caspian Pipeline Consortium in the Russian port city for 12 years. Smit carried out maintenance for CPC on the buoys that float in the sea at the end of the pipeline and which oil tankers moor against to take in oil. The company also piloted large oil tankers to and from the buoys. A source said: “It was a great contract.”

It was also an important contract, because a working CPC pipeline is vital to its owners. They had invested billions in developing three gigantic oil reservoirs in Kazakhstan. The pipeline is the only route taking oil out of the country, and it had to keep flowing.

This fragile construction was the brainchild of a Dutchman, John Deuss, an oil trader from Nijmegen who did business with South Africa during the apartheid regime and was imprisoned in 2006 for large-scale VAT fraud. During the chaotic years after the fall of the Soviet Union, Deuss struck a deal with Kazakhstani officials. Together with one of his contacts, the Sultanate of Oman, and the Russians he gained permission to lay a pipeline from the large oil fields in the Caspian Sea to Novorossiysk.

Illustration XF&M

The construction of a single route, nota bene through Russia – was regarded in the United States as so vulnerable that the White House had bumper stickers printed that American diplomats had to distribute among the people living round the Caspian Sea. “Happiness is multiple pipelines,” it said.

The influence campaign failed. The American journalist Steve Levine described in his book, The Oil and the Glory, how Bill Clinton, who personally intervened in the matter, quietly pushed out Deuss. But all subsequent efforts to draw up routes bypassing Russia came to nothing. Whenever a plan came to the table, Russia simply turned off the tap somewhere else. Oil supplies were cut to a smaller pipeline in the region belonging to Chevron for a month. And it worked. In 1996 the Russian president, Boris Yeltsin, and oil companies in Moscow signed off on the construction of the CPC pipeline. In 2001 the 1,500 km-long pipeline was finished and the first oil tanker was fully loaded in Novorossiysk.

“They know where your family live”

Smit’s managing director suspected that Transneft was behind the intimidation when he wrote to the ambassador in 2012. As well as Smit, a competitor was active in Novorossiysk harbour: Transneft Service, a subsidiary of Transneft that specialises in maritime services, headed by a Russian named Sergey Kireev.

Kireev had had the maintenance contract with Smit in his sights for two years. When CPC wanted to put the contract out to tender again in 2010, Kireev was determined to win it. But he also knew that Shell, Exxon and Chevron saw his company as lacking the necessary knowledge and expertise. He tried entering into a collaboration with Smit.

Smit’s staff in the Netherlands thought a merger between the companies was an excellent idea, according to a source from the time: “plenty of travel, developing local things”. But a report that landed on the managing director’s desk at Smit ruled it out. Its conclusion was crystal clear: Transneft Service was “very aggressively” trying to gain a stranglehold on power in the port of Novorossiysk. And within the company it said there appeared to be “very high corruption”.

Moreover, colleagues at Smit who had worked with Kireev described him as untrustworthy. “Money laundering,” one source recalled: “he was surrounded by financial chaos.” That was true. A few years earlier one of Kireev’s companies had been under criminal investigation for VAT fraud and a regional court found one of Kireev’s companies guilty of stealing from another company in Novorossiysk harbour.

Smit was awarded the maintenance contract again, as it was merging with Saudi company Lamnalco. Kireev lost the race.

And then the harassment began.

Immediately Smit Lamnalco were visited by the Russian state labour inspectorate and the ministry of transport. Were their diving certificates in order? Did they have enough Russians on the payroll? Was their fire safety in order? Unannounced raids, checks and inspections followed one after another. Staff members were subjected to hostile questioning, safety certificates were withdrawn, ships were branded unseaworthy. Fines were imposed and investigations ordered into breaches of contract and tender fraud, Russian court documents show. A director of Smit Lamnalco was told on site: “They know where your family live”, one source said.

In 2011 Kireev managed to grab a slice of the cake. His Transneft Service obtained a share of another contract with CPC for $28,000 a month to respond to oil spills at the pipeline buoys. The company that Smit rejected because it was too corrupt and aggressive had found a way to do business with the pipeline consortium.

But the bullying continued unabated. A formal complaint against Smit Lamnalco came out of nowhere, claiming its tugboats were made of the wrong materials and unable to go out in high waves. To make things worse, CPC abruptly stopped its payments to Smit Lamnalco. The towing company’s employees thought all this was happening under pressure from Transneft. And the management at CPC thought the same: “Transneft threatened Lamnalco,” it said in a presentation at the time to Chevron’s board. “Lamnalco constantly facing pressure, inspections that threaten a halt to loadings.”

The ambassador to Russia at the time, Ron Keller, later recalled “the two-page letter with a map of the pipeline” from Smit Lamnalco’s managing director. He took it up with the deputy prime minister of Russia, but it made little difference.

The following year the harassment suddenly stopped – like a cloud passing across the sun.

The reason, sources say, can be found in the minutes of the pipeline consortium’s board meeting on November 13, 2013, which NRC has obtained.

Item four on the agenda concerned the renewal of a contract for oil spill response with Transneft Service. Under that contract, the minutes state, Transneft Service would not receive $28,000 a month from CPC, but $895,000 a month ¬ nearly 32 times as much, for seven years. The total value was nearly $76 million. It was an absurd increase. A source said: “There was absolutely no way to explain this price rise.”

The harassment and obstruction that had gone on for years paid off: all the oil companies voted in favour. Only the delegation from Shell voted against. Their reasons are not recorded in the minutes.

The oil companies allowed a few half-hearted remarks to be noted in the minutes. “Purely to cover themselves,” said a source. They wanted written assurances from the managing director of CPC to all parties that the sum of $895,000 a month reflected “reasonable contract rates and commercial terms”. And that a check on the ultimate owners of the tugboats had been “conducted by CPC to its satisfaction”.

A dubious money trail

A close study of the contract reveals why the boss of Transneft Service had it in his sights: he profited from it personally.

Research by NRC and ICIJ has uncovered a dubious money trail that ran to Cyprus via a number of tugboats. The contract seen by NRC names three ships that Transneft Service wanted to use for its oil spill response for CPC. They are the Panda, the Leopard and the Bars, three red, blue and white tugs, each of them nearly 31 metres long. They turn out to be owned by three Cypriot companies. Every year the three companies receive a total of $7.5 million for the lease of the boats.

Illustration XF&M

After a few years Transneft Service added four ships to its fleet in Novorossiysk: bright red tugs fitted out like bumper cars with thick black rubber round the bows. Their names were Aliot, Antares, Arktur and Altair, and every one of them was also owned by Cypriot companies. In a commemorative album for an oil consortium they were photographed as “CPC Service Fleet” and on every oil spill exercise they dutifully sailed out to the buoys, as recorded by transponder signals transmitted by the ships.

These boats also brought money to Cyprus. In 2016, ¬ the year when the four new ships were launched ¬ the companies in Cyprus received a total of $2.6 million for renting the ships, after which no annual reports were published.

The seven companies, one for every tug, had something in common. They all had strong links with one Cypriot financial services provider, Fortress Nominees. The companies are all housed in the same building, Tonia Court II in Limassol. They have been run for years by the two founders of Fortress and the review of the annual accounts is carried out by Fortress Audit & Accounting.

The Dossier Center, an investigative website run by the Russian dissident oligarch Mikhail Khodorkovsky, looked up who else was behind Fortress. A detailed article shows that this was two influential families with close ties to each other. The first is the family of Sergey Kireev of Transneft Service and his son Evgeny, who has a number of Fortress’s businesses registered in his name. The second is the family of Marat Khusnullin, whose daughter is married to Evgeny Kireev. The two lead lives of luxury in a Cypriot villa. Khusnullin is the Russian deputy prime minister for construction and regional development and has been on the European sanctions list since February 2022 because he is responsible for Russian building projects in Crimea and other occupied territories.

A one-stop shop for the whole family, with its own board of management, its own trust office and its own accoutants is popular among the super-rich. A private office offers more confidentiality and more security. Isabel dos Santos, the daughter of Angola’s ex-president, had her own financial office and even her own bank; the Russian oligarch Roman Abramovich also has his own financial services provider in Cyprus.

The Fortress family office is a useful way of concealing Kireev’s interest in the tugs that he rents himself as managing director of a state-run company. Tens of millions of dollars, paid by the oil companies.

“It’s a snake pit”

Russian players using force and intimidation to drive through a contractual amendment was no isolated incident: it was a pattern.

The pattern was increasingly visible during a major extension of the pipeline, a billion-dollar project that ran from 2007 to 2017. The shareholders of CPC were developing new oil fields in Kazakhstan and needed to raise the capacity of their pipeline considerably as a result. New pumping stations had to be built, thicker pipes laid and a new buoy placed in the harbour. The project could not be delayed, because where else could the oil go?

Transneft exploited the urgency. If they didn’t like a plan or a contract, the Russian state-run company would refuse to sign and sent threatening letters to foreign employees, Chevron staff reported in a presentation to their bosses as early as 2010. Transneft twisted the facts to win contracts for Russian companies and refused western staff access to a building where bids for tenders were decided. “Collectively we thought it was a snake pit”, one staff member at a western oil company wrote in an email to his boss. “Transneft is taking full advantage.”

The costs exploded in those years. NRC obtained via ICIJ a report from a whistleblower at the American stock exchange regulator SEC. It shows how the budgets for the expansion in 2010 – initially estimated at $1.5 billion – grew to $5.4 billion, more than three times as much. The American lawyer for the whistleblower sent a letter in 2011 to the chair of Shell’s audit committee in The Hague. He wrote that Transneft “was initially strongly against the expansion, but became a firm proponent once additional billions were added to the budget.” The money could be going to Russian companies, the whistleblower claimed.

But Transneft wanted more than just money: it wanted power. “Transneft has recently displayed behaviours that suggest its primary driver is to maximise its control of the expansion project and CPC in general,” the Chevron employees wrote in their presentation to management. They said Transneft “inserted unqualified and inexperienced staff into CPC for the purpose of executing Transneft objectives”. And they warned: “Transneft appointees will always be under threat if TN [Transneft] desires are not carried out”.

In 2016, when the extension of the pipeline was almost finished, relations on the project turned sour, former staff members told NRC and ICIJ. It was if Russia felt the prize was within its grasp. In the same year Transneft president Nikolai Tokarev nominated a new general director of CPC: Nikolai Gorban, who would receive the scathing letter in 2022 that this report began with. In 2016, just after being installed, he had his office renovated immediately for $1 million, with dark-brown panelling and imitation antique furniture. “He was anti-Western in the extreme,” said a former CPC staff member. “He didn’t want expats in his organisation.” Another said: “He appointed friends of Transneft everywhere.”

It became increasingly hard for western staff members to do their jobs. “I had to extend my visa. The paperwork was made extremely difficult,” one former staff member said. “Pure bullyboy tactics.” The western companies disliked the situation with Transneft, one former senior manager at CPC said. “But what could we do?” They didn’t want to quit: the oil had to keep flowing.

At Shell’s headquarters they knew that some of the contracts were suspect, like the contract for oil spill response with Transneft Service that suddenly became 32 times more expensive. “Shell suspected a kickback arrangement,” one source said, whereby people were paid for the contract. “The scheme went to the tugboats in Cyprus and ultimately to the British Virgin Islands.” The oil company followed the trail to an office on the Virgin Islands. “It aroused suspicions that Transneft’s people were behind the contract.” That investigation was the reason why Shell voted against amending the contract.

But in practice it made no difference, because the other oil companies signed anyway. They made a different assessment of the risk, a source said, and wanted to get Transneft off their backs.

Sidelined

Leave now. Pack your bags, get out, go home.

Foreign CPC workers were given pressing instructions in May 2020 to leave Russia within a few days. The regional labour inspectorate had ruled that the papers of 20 foreign managers and specialists at CPC were invalid and they were therefore working in Russia illegally. As a result, the consortium had cancelled their contracts with immediate effect. It was an alarming situation: what would the authorities do? The managers fled the country in the last days of May 2020.

CPC’s foreign shareholders panicked. At a board meeting two months earlier they had lost virtually all their power. On March 4, at the start of the coronavirus pandemic, the nomination of a new board was on the agenda, usually a formality. Shortly after the previous board stepped down, but before the new one was installed, the Transneft delegates walked out of the meeting. The state-run company refused to nominate new board members, according to a document seen by NRC. CPC now had no board of directors and under the statutes the sitting general director assumed full control. That was the Russian, Nikolai Gorban, of Transneft.

Gorban – whose aversion to computers increasingly became a problem during the first lockdown – wielded absolute power from his expensive office. “You couldn’t communicate with him if you weren’t in the building,” one former manager said. Two months later Gorban banished all western personnel from the country. It was “the final blow”.

The shareholders were in dire straits, but what could they do? After a few weeks they were shut out of the IT systems as well.

One of the main points of contention was the maintenance contract for the buoys, which was still in the hands of Smit Lamnalco. The new contract still had to be awarded. Just like 10 years ago, shareholder Transneft wanted to give the job to its own company Transneft Service, but this time the western shareholders fought tooth and nail against it. Giving a major maintenance contract away to an incompetent player would make the operation vulnerable, which could cost money.

Shareholders of CPC pipeline

After Transneft Service’s bid got rejected the harassment resumed, just like the last time in 2010. And this time the western shareholders had no say in the matter, following Transneft’s coup. The only thing left for them was to write begging letters. One such letter was sent by a high-ranking manager at oil giant ExxonMobil on June 4, 2020, to the managing director of Transneft Service. “Transneft Service should not sign the Marine Services Contract until Transneft Service has received express written confirmation” from at least two directors, the manager wrote. Otherwise ExxonMobil would “take all necessary legal and other steps”.

It is not known if Exxon took any legal steps, but the letter had no effect. A month later CPC gave the job to Transneft Service. Again, the new contract was worth considerably more than the old one, Russian transaction records seen by NRC reveal. Kireev’s company received around $1 million per month more than what Smit Lamnalco received for the same work. Once again it was the oil companies who paid.

A suspicious oil leak

It took less than a year for things to go wrong. On August 7, 2021, the oil tanker Minerva Symphony moored up to buoy 1 at the CPC terminal to load up with Kazakhstani oil. Shortly before 5pm one of the parts sprung a leak. An expansion joints between the buoy and the floating hose broke apart under pressure, causing a thick stream of oil to spray into the sea.

It wasn’t a big spill, the consortium wrote immediately afterwards in a message playing down the incident on its website. The situation was under control again by 10.45pm. Shortly afterwards several new oil tankers moored against the other buoys.

But researchers from the Russian Academy of Sciences saw something very different on satellite images in the days that followed. The oil had spread across an area of more than 80 square kilometres; the leak was a thousand times larger than the consortium claimed. The World Wide Fund for Nature warned of widespread damage to sea life in the Black Sea.

How could this have happened? It was the first oil spill in 25 years, the four western shareholders wrote in their furious letter to “dear Mr Gorban” in April 2022. This incident and others “further erode confidence and elevate existing concerns with whether the maritime service provider, Transneft Service has the required experience and equipment to ensure safe and reliable operations,” they wrote. One week before the oil spill Transneft Service had carried out maintenance on buoy 1. What did they miss? What did they break? Even after Russian prosecutors began an investigation straight after the spill, sources say the cause was never fully established.

And what was the situation with the oil spill response with Transneft Service’s tugs that had cost the shareholders 32 times the original price? Not good. Readings from the ships’ transponders from the evening and the night after the oil spill showed that the tugs basically did nothing. At around 11pm, while the oil was floating away, the Arktur returned to port instead of containing the oil leak. The weather was bad, the waves were high. The Antares, Aliot and Altair pulled out two hours later. They did not go out again until the following morning.

Navalny’s discovery

The large oil slick that flowed from the broken hose on buoy 1 on August 7, 2021, drifted slowly during the following night south towards the Black Sea. If the wind direction had been different, the oil would have drifted along the coast, past an enormous estate high on the clifftops. And the person sitting in his ultra-luxurious sitting room, carved out of the cliff face, would have watched the waves being slowly but surely covered in a shiny thin black layer of film.

Illustration XF&M

Three years before he died in a prison camp, opposition leader Alexei Navalny posted a video online. That was in January 2021, six months before the oil spill. In a few days the film was viewed more than 100 million times. The subject of the film was the construction of a highly luxurious complex of 68 hectares on a high cliff in Gelendzhik bay in Krasnador, near Novorossiysk.

The documentary used photos, drone footage, 3D reconstructions and eyewitness accounts from builders to show the opulence of the complex, which Navalny estimated to be worth more than $1 billion. The complex was home to several helicopter platforms, a casino, a covered ice hockey arena, a theatre, a private church, a function room with pole dancing poles, a cinema, a bathhouse, a wellness complex, a private bakery, an amphitheatre, a private energy plant and a lift to the beach, endless marble halls and function rooms and a separate 2,500 square metre dacha. The grounds contained large vineyards with winemaking facilities. Navalny and his team found receipts for Italian occasional tables for $56,000, couches for $27,000 and toilet brushes for $700.

Navalny’s research team were able to establish that the complex was built for president Putin. It is “Putin’s Palace”, although Putin himself has denied it. They were also able to chart which oligarchs in the president’s circle helped to pay for the luxury complex on the cliffs and what financial routes they used. One of them was the oligarch Nikolai Tokarev, the president of state-controlled company Transneft.

Bank transactions obtained by Navalny’s team showed that two subsidiaries of Transneft paid a total of 4.3 billion roubles ¬ equivalent to around $58 million at the time – in a few years for the construction of the presidential palace. The amounts were recorded in the accounts as “rent” for a meeting venue on the grounds of the palace. According to the European Commission, Transneft was “one of the main sponsors” of Putin’s palace. One of the two subsidiaries through which Transneft financed the palace is Transneft Service, the company that was able to secure a powerful position for itself within CPC. ICIJ and NRC were able to trace a total of $19 million in transactions from Transneft Service to Putin’s palace.

The hand on the tap

The man sitting in his palace on top of the cliff is also playing an intricate power game with western money just 50 kilometres along the coast. A game that he is winning.

Because Putin has his hand on CPC’s tap. Since the invasion of Ukraine the pipeline has been completely or partly shut off at least twenty times. Once because Second World War bombs were found on the seabed, other times because of maintenance work or a storm. It was not unusual for the tap to be closed after new sanctions were mooted or Kazakhstan leaned towards the west.

The pipeline is indispensable for western oil companies Shell, Exxon, Chevron, BP and ENI, but they were forced to surrender their authority. Once foreign shareholders’ personnel had been driven out and the maintenance contract given to a Russian state-run company, the Kremlin put its own people in charge. The money that Putin earns day in, day out from the pipeline funds his war, and himself.

About this investigation

This investigation was carried out as part of the Caspian Cabals project, an international research project examining the power games around the CPC pipeline and the Kazakhstani oil fields connected to the pipeline. The research is co-ordinated by the International Consortium of Investigative Journalists (ICIJ). As well as NRC, journalists from Proekt (Russia), Vlast (Kazakhstan), Radio Free Europe, Der Spiegel (Germany) and L’Espresso (Italy) took part in the investigation.

NRC spoke with dozens of sources in the course of this research, often on background for reasons of confidentiality, and collated documents supporting claims made by sources. ICIJ also shared documents within the consortium and records of interviews compiled by other journalists.

Reactions

NRC and ICIJ sent detailed questionnaires to all parties concerned. Shell did not respond to questions and referred us to CPC. A spokesman said Shell does not tolerate bribery. Chevron did not respond to questions, but made a general statement saying that “Chevron is committed to ethical business practices, operating responsibly, conducting its business with integrity and in accordance with the laws and regulations of each of the jurisdictions in which it operates.” CPC did not respond to questions despite repeated attempts to contact them. Transneft, Transneft Service, Sergey Kireev, Egveny Kireev and Fortress also gave no response. Nikolai Gorban, the general director of CPC, said in a press conference last January that the pipeline had never been suspended for political reasons. “All the stoppages were connected to technical causes, or to the weather,” he said. “We are in no way connected to politics.”

Further Credits:

Further Publications:

Profil, De Tijd, Knack, Oštro, Radio Free Europe, Der Spiegel, Standard, Paper Trail Media, Reporters United, Indian Express, Shomrim, L’Espresso, Vlast, Reporter.lu, Istories, Proekt, ICIJ, El País, La Sexta, Tamedia, DW Turkey, BBC, Mother Jones, Cyprus Investigative Reporting Network