美国国家公共电台 NPR Meet The Internet Researchers Unmasking Russian Assassins

AILSA CHANG, HOST:

It turns out that the two Russian operatives behind the U.K. nerve agent attacks had their identities blown by a team of Internet researchers. NPR's Geoff Brumfiel has this story of who they are and how they did it.

GEOFF BRUMFIEL, BYLINE 1: OK, so here's the one thing you need to know for this story. Everything is on the Internet.

(SOUNDBITE OF ARCHIVED RECORDING)

UNIDENTIFIED PERSON: Our prime minister said there is no alternative conclusion other than the Russian state was culpable 2 for the attempted murder...

BRUMFIEL: Back in September, British authorities held a press conference. They released passport photos and names used by two men they believe tried to kill a former Russian spy with nerve agent.

(SOUNDBITE OF ARCHIVED RECORDING)

UNIDENTIFIED PERSON: It is likely that they were traveling under aliases 3, and these are not their real names.

BRUMFIEL: To a guy like Aric Toler, that sounded like a challenge. Toler works for a group called Bellingcat. His job is so unusual even he doesn't know how to describe it.

ARIC TOLER: Something like digital researcher, digital investigator 4, digital something - probably works.

BRUMFIEL: Toler and his friends are very, very good at finding all kinds of things online. They've used commercial satellite images to track Chinese air bases, watched security operations unfold on social media in Venezuela, pinpointed 5 the locations of chemical weapons attacks in Syria. The true identity of a Russian spy...

TOLER: It's tough because this guy's, you know, a military intelligence officers. So it's not going to be easy to find this guy just on Facebook.

BRUMFIEL: But remember everything is on the Internet these days, including photos of a military academy that trains intelligence officers taken by Russian tourists.

TOLER: When you look at these photos - they're all on our on our website - it's just a bunch of Russians - just random 6 Russian guys going through and kind of sightseeing at this like military academy.

BRUMFIEL: These tourists visit the academy. And one thing they like photographing is its wall of fame, with pictures of notable graduates.

TOLER: This is a year before the poisoning. Some totally random innocuous normal Russian person uploaded a photo that shows our boy, Anatoliy Chepiga, up on the wall.

BRUMFIEL: Col. Anatoliy Chepiga, the spitting image of the man in the photo released by the British - right there on the wall with his name spelled out for all to see. And Bellingcat turned up a lot more. It turns out if you're willing to risk getting a nasty computer virus, you can download all sorts of Russian databases.

TOLER: Things like insurance databases and driver's licenses 7, voter database, things like that - this stuff isn't 100 percent legal, but it's out there.

BRUMFIEL: And in those databases, they found way more photos and details about their man Chepiga - old phone numbers and addresses, including one that linked him to a local military intelligence headquarters. This week they also IDed Chepiga's fellow spy, a guy they think is named Alexander Mishkin. Mishkin came from a small town in Russia's far north. Once they found him, Bellingcat worked with Russian journalists to send someone up there.

TOLER: And they had his picture, they were showing it to random people in the town. They're like, oh, yeah, that's our - that's Sasha. Alexander in short in Russian is Sasha. That's Sasha Mishkin over there. He's a good - you know, he's a good boy. He's a good lad. His grandma - 92-year-old grandma also shows us a photo of him receiving a medal from Putin.

BRUMFIEL: Russian President Vladimir Putin probably didn't give Myshkin a medal for being such a good grandson. Bellingcat has 10 full-time 8 researchers scattered 9 across the globe. Toler works out of Kansas City. Others are in the U.K., the Netherlands and elsewhere. They say they're funded by a combination of grant money and money from classes they run. Christiaan Triebert is another member of the group.

CHRISTIAAN TRIEBERT: We firmly believe that it's so important that more people are aware of how to do these kind of things. And most of the times, it's not too hard.

BRUMFIEL: I caught up with him and Toler during a training they were doing near Washington, D.C.

TOLER: Today we're going to start with how do you determine approximately or exactly when a photograph or video was taken.

BRUMFIEL: The students include journalists, law enforcement types, human rights workers. Triebert says getting a lot more people to do this stuff is what Bellingcat is all about. The name Bellingcat comes from one of Aesop's fables 10 about a group of mice who decide to put a bell on a stealthy cat in order to expose its presence. Triebert says that's how they see this new kind of work.

TRIEBERT: I hope the group of mice keeps growing, and I hope we can bell more cats.

BRUMFIEL: The truth these researchers believe is on the Internet. You just have to know how to look. Geoff Brumfiel, NPR News, Washington.