On 23 August 2019, Zelimkhan Khangoshvili, a Georgian asylum-seeker of Chechen origin, was assassinated on his way back from Friday mosque service in a park near Berlin’s Kleiner Tiergarten. The killer had been captured by German police after running away from the murder scene on a bicycle, and after two teenagers saw him dispose of his wig and clothes and silencer into the Spree river. He has been in custody since, and has claimed innocence.

An investigation by Bellingcat, The Insider and Der Spiegel has confirmed the existence of a second Russian national who traveled from Russia to the European Union in the eve of the assassination, using the fake identity of Roman Davydov, born in 1981. Significant hallmarks of this cover identity overlap with the fake identity issued to Vadim Krasikov, implying that they were working as part of the same, or a closely-linked, government program.

Furthermore, based on passport number proximity search and intelligence data from Czechia cited in the German indictment, we were able to connect this person to a group of other Russian FSB-linked spies who in turn were connected to the murder of another Chechen national in Istanbul in 2015.

Our findings indicate that at least one, but more likely several more FSB operatives traveled to Germany to prepare and assist Khangoshvili’s assassination. These findings also strengthen the link of the Berlin murder to a previously reported “wanted list” of nineteen Soviet-born individuals, most of them of Chechen descent, which was shared by the FSB with German’s intelligence services in 2012.

“Roman Davydov”, photo from Slovak visa application.

Roman’s Holiday (or Roman who was built in a day)

On 29 July 2019, a travel agent holding a Russian travel passport in the name of Roman Davydov, born in St. Petersburg (then Leningrad) on 9 October 1981, showed up at the visa center of the Slovak General Consulate in St. Petersburg and requested a one-year multi-entry visa  for her client to the Schengen area. According to the client’s Russian visa application documents, he was a local native: he lived at Bogatirskiy Prospect 32, corpus 2 in St. Petersburg, and worked as a construction engineer at a local company. He was planning to visit Bratislava as a tourist, and had a booking for a flight to Vienna on the following day – 30 July, and a hotel booking for the mid-range Falkensteiner Hotel in downtown Bratislava where he would stay from 2 August onward. He was requesting a one-year, multi-entry visa, and he needed it urgently, as he was planning to fly the very next day.

In fact, none of this was true. The visa applicant in fact lived in Moscow under his real, different name. The exact residential address he had listed on the application did not exist – there is no corpus 2 at Bogatirskiy Prospect 32, and the people living at the only apartment number at this address matching his application address had never heard of him.

The man calling himself Roman Davydov was a digital newborn. A person with his name and birth date could not be found in thousands of leaked residential and passport databases of Russian residents consulted by Bellingcat. Roman Davydov had only just appeared in the Russian passport and tax database. In fact, the identity of Roman Davydov was created a mere eleven days prior to this visit to the Slovak consulate: his international passport was issued on 18 July 2019, in the Western Russian town of Bryansk. He was first registered in Russia’s tax registry on 23 July 2019 – at the age of 39. The letter from his employer which he had to submit to the consulate was from a company that had been in restructuring for several years prior, and had submitted zero-employee payroll tax files since 2016. Also, “Davydov” had no real plans to visit Slovakia.

Excerpt from open-source corporate registry, showing the company ZAO RUST, in reorganization, only had one employee as of beginning and end of 2019.

None of these data gaps were noticed by the Slovak consulate, and his multi-entry visa was issued – albeit with a 2 day delay, allowing him unrestricted travel rights to 45 counties in Europe, Latin America and Asia.

“Roman Davydov” was not the only person who, on that day, filed an application at an EU consulate in Russia seeking to travel under a fake identity. On that same day, 29 July 2019, a travel agent – from the same company, this time represening “Vadim Sokolov”, 49, walked into the French consulate in Moscow and requested a multi-entry Schengen visa for his client.  Like “Davydov”, “Sokolov” was also a digital newborn, with a travel passport issued in Bryansk on the same date ten days earlier.

The passports of “Davydov” and “Sokolov” were only 35 digits apart from one another, showing that these personas were manufactured at the same time. Both of them had been entered into the tax registry on the same date, on 23 July 2019. Even more, both had produced employment letters from the same St. Petersburg company: ZAO “RUST”, where they both worked as “construction engineers” (the CEO of this company initially told us he had never heard of Vadim Sokolov, and when confronted with the fact that both Sokolov and Davydov had submitted employment letters signed by him, he said “this is nonsense” and hung up).

“Vadim Sokolov”, despite, too, being a digital newborn working for an empty shell of a company, similarly received a multi-entry visa from French consulate. He would be arrested by German police three weeks later, just after he fatally shot Khangoshvili in Berlin. “Roman Davydov” is, to the best of our knowledge, currently back in Russia.

The Road Trip

“Roman Davydov”‘s role in preparing the Berlin murder is still unclear, yet his fake identity, the multiple documentary overlaps with “Sokolov”, and his prior link to a murder of another Chechen were sufficient for the German prosecutor to name him as a person of interest in Vadim Krasikov’s indictment. His true identity has not yet been uncovered.

Our investigation into border crossing records (based on data from a whistle-blower with access to Russia’s centralized border database) show that a person with this name and birthday crossed the Russian border only twice: once on 3 August 2019, when he crossed by car the Belarus – Polish border at the Bruzgi (Grodno) checkpoint, and again 4 days later when he crossed back from Poland into Belarus at the same place (there is no controlled border between Russia and Belarus). There is no information about his movements once he entered Poland, which is part of the Schengen area and has no hard borders with Germany. Assuming his destination had been Berlin, this would have been an 8-9 hour drive from the Belarus-Polish border. He would have thus have had not more than two-and-a-half days in Berlin – not long enough for reconnaissance and trailing of the target, but sufficient for delivering or procuring locally the equipment needed for the assassination, as well as the murder weapon. The killer had arrived from Warsaw to Berlin in the afternoon of 22 August, and the assassination took place just before noon the next day – not enough for Krasikov to source his tools on his own. He would have needed to obtain a bicycle. According to the indictment, a high-end e-scooter that is not sold in Germany had also been found parked along the killer’s escape route (a resident had observed it be deployed and locked in place a day before the murder). The assassination was carried out with a modified Glock 26, which has been traced to an Estonian owner who had reported it stolen.

There is no question that Krasikov had help in his task, the only question that remains is how much of this help “Davydov” had been responsible for.

The border crossing records included the license plate of the car “Davydov” drove. Using an open-source Telegram bot that provides car details and ownership data, we found that the car was a blue Infinity Q50 and belonged to a Russian car-leasing company. We contacted the company but received no response as to who had used the car in August 2019.

The Infiniti Case

The Infiniti Q50 used by “Roman Davydov”, photo from a traffic camera (December 2019)

Using publicly accessible data from traffic violations combined with leaked data from Moscow’s pervasive traffic surveillance systems, we were able to reconstruct key moments of the “Davydov”s car movements in the days before and after his trip. These times and locations allowed us to match them against known movements of Vadim Krasikov in the days before he left Russia on 17 August 2019, which we reconstructed based on his cell phone metadata.

The most frequent overlaps occur in the area of one of Krasikov’s known residences, near Osennaya Street. Several times during July 2019, the Infiniti car is captured near his apartment, where it stays for no longer half an hour before moving on. In many cases, Krasikov’s phone also moves away from his home at the same time, suggesting a pick-up along “Davydov”‘s way.

Notably, on the way back from the Belarus border on 8 August 2019, “Davydov”‘s car drives straight to Krasikov’s location, where it arrives at 6:05 pm. It moves on at 6:30. Krasikov’s phone is last geo-located to his home at 5:25pm when he receives a text message from an anonymous SMS gateway. Following this overlap, likely a pick-up, Krasikov’s phone is switched off for four full days, until 12 August 2019. The last spotted location for the Infiniti that evening is on the road towards Balashikha a town outside Moscow. Balashikha is the location of a FSB Spetznaz training facility where Krasikov’s telephone was geolocated for long periods of time during July and August, thus our working assumption is that “Davydov” drove him there for pre-mission training or organizing.

“Davydov”‘s car can be spotted moving between Moscow and Balashikha several times in the following few days. On 14 August – three days before the trip – Krasikov’s phone is again switched off for the day. On this date Davydov makes his last trips to and back from Balashikha. Below, further corroboration of this trip can be found through a speeding ticket (accessible through an open, state Russian database) issued at 4:44pm on 14 August 2019 to “Davydov”‘s Infiniti car in Balashikha.