Analysis: HUMINT insights from the Muller/Cherkasov case

AIVD HollandAT A TIME WHEN dozens of countries are routinely expelling record numbers of Russian intelligence officers, news of the unmasking of yet another Russian spy is barely newsworthy. However, the case of Sergey Cherkasov/Victor Muller is different. That is because, unlike the vast majority of Russian spies with blown covers, he did not operate under diplomatic protection. This is not necessarily uncommon —in fact, there are probably dozens of Russian case officers operating internationally without diplomatic cover. What is unusual is that one of them has been publicly unmasked. What is more, the case offers some interesting pointers for those interested in contemporary human intelligence (HUMINT).

The Facts

According to the Netherlands General Intelligence and Security Service (AIVD), which publicized the case last week, a man using a Brazilian passport attempted to enter Holland in April of this year. His passport had been issued under the name Victor Muller Ferreira, allegedly born to an Irish father and a Spanish-speaking mother in Niteroi (near Rio de Janeiro) on April 4, 1989. However, according to the AIVD, the man’s real name is Sergey Vladimirovich Cherkasov, a citizen of Russia, who was born on September 11, 1985. Based on the information released by Dutch intelligence, Cherkasov is an intelligence officer of the Main Directorate of the Russian Armed Forces’ General Staff, which is commonly known as the GRU.

The AIVD claims that the reason for Cherkasov’s visit to the Netherlands was to join the International Criminal Court (ICC) in The Hague, as a paid intern. He eventually planned to transition into full-time employment in the ICC, where he “would be highly valuable to the Russian intelligence services”. The AIVD reportedly notified the Dutch Immigration and Naturalization Service, which detained Cherkasov upon his arrival at Amsterdam’s Airport Schiphol. The Dutch government declared the alleged GRU officer persona non grata and promptly expelled him back to Brazil “on the first flight out”.

Cherkasov’s Cover and Legend

Cherkasov arrived in Holland with a cover, a term that refers to a fake operational identity used for purposes of espionage. It is unlikely that his cover was natural, meaning that he is probably not Brazilian by birth —though it is possible that at least one of his parents was/is not Russian by birth. What is more likely is that Cherkasov’s cover is contractual, meaning that it was crafted especially for him by the GRU after he was hired as an intelligence officer. This likely happened as many as 10 years ago, when Cherkasov was in his early 20s.

The next stage in Cherkasov’s career required him to enter a cosmopolitan lifestyle, designed to introduce a degree of opaqueness into his personal history. According to information released by the AIVD, the alleged spy’s parents —indeed most of his extended family— were allegedly dead by the time he was in his late 20s. That would have shielded his cover with an extra layer of protection, since no family members would be around to contest his claims. Cherkasov worked as a travel agent in Brazil before moving to Ireland in 2014, where he majored in political science at Trinity College Dublin. He then went on to complete a Master’s degree at Johns Hopkins University’s School of Advanced International Studies, which he received in 2020.

Throughout that time, Cherkasov muddled his background, built his fake persona of a motivated political science student, and severed all ties to Russia. He also carefully curated his online profile via social media platforms such as Twitter and Facebook, as well as through blogging on geopolitics. In doing so, he appears to have gone out of his way to express views critical of the Kremlin, while at the same time espousing pro-Western positions on a wide range of topics. It is worth noting that, based on information that has surfaced since his unmasking, Cherkasov’s contacts in Ireland, the United States and elsewhere did not suspect that he had any ties to Russia, let alone Russian intelligence.

The reason why Cherkasov managed to avoid suspicion by those around him was that he was able to craft a multi-level legend. The term refers to an entire universe of informational and physical artefacts that support one’s cover. These include an operative’s digital profile, as well as their biographical details, family life, educational history, personal interests, etc., that breathe life to their cover. Furthermore, building a legend encompasses the meticulous memorization of minute details, anecdotal stories and memories of one’s life, as these have the ability to strengthen the authenticity —and therefore credibility— of one’s cover. This can be seen in Cherkasov’s draft autobiographical note, which the AIVD somehow managed to acquire, and which it publicized last week in Portuguese, Dutch and English.

Some observers referred to this document as “extraordinary”. That is true, but only in the sense that it has been made available to the public. In reality, this document is typical of the kind of detailed biographical sketches that deep-cover operatives are required to produce —usually in the language of their cover— while building their legend. The document appears to be an early biographical sketch produced by Cherkasov in the process of creating his fake identity. He would have shared this draft with his support operations officer, seeking detailed feedback. He would then have repeated this process until the information contained in the document was convincing even to someone who grew up in the very neighborhood of Rio de Janeiro that Cherkasov/Muller claims to have lived.

Remaining Questions

Just how that AIVD came to be in possession of this fascinating document remains unknown. There is also the question of just how the AIVD became aware of Cherkasov’s links with the GRU. Given that the spy lived in Ireland and the United States in the past several years, it is likely that operational carelessness on his part could have raised suspicions among people around him, thus triggering a counterintelligence investigation. It is also possible —though not likely— that his ICC internship application resulted in a detailed examination of his background by the AIVD, which is aware of attempts by foreign countries to embed spies on Dutch soil through the ICC and other international organizations based in Holland.

Perhaps the biggest question, which also remains unanswered, is why the Dutch did not arrest Cherkasov, choosing instead to send him back to Brazil “on the first flight out”. One would imagine it is not every day that a Western intelligence agency gets its hands on a deep-cover Russian operative. Cherkasov’s background, training and mission details would have been of interest to a host of Western government agencies. Did the Dutch already know everything they needed to know about him? Would it have been difficult to legally justify Cherkasov’s detention without exposing —and thus endangering— the source or information that led to his unmasking? Or could it be that the Dutch government did not wish to enter into a prolonged tit-for-tat contest of expulsions with Moscow, which might weaken its own intelligence presence inside Russia? These questions are among several that are unanswered, and are likely to remain so for the foreseeable future.

* Dr. Joseph Fitsanakis is Professor of Intelligence and Security Studies at Coastal Carolina University. He specializes in intelligence collection involving SIGINT and HUMINT.

Author: Joseph Fitsanakis | Date: 20 June 2022 | Permalink

6 Responses to Analysis: HUMINT insights from the Muller/Cherkasov case

  1. We estimate that over the last two decades there must be tens of thousands of false identities being curated by intelligence agencies all over the world. After all, a post on social media in 2022 celebrating an exam success you were meant to have achieved 15 years ago looks a tad odd!

  2. F. Adams says:

    Anyone interested in learning a thing or two about contemporary HUMINT and why lack of adaptation equals extinction should read this article. Things have changed since the cold war but like my granddad used to say, the more things change the more they stay the same, right down to using a non-aligned movement member state’s passport to move illegal officers around with. I’m just very surprised they tried to use Brazil and not Indonesia or Mexico. Whoever decided that must not know Brazilian history too well. There was a time within my lifetime that in most major Brazilian cities you could still get disappeared for supporting the PT, much less anything actually communist or Russian.

    The only way this could get more 1960s is if he was going to be operating in (West) Berlin, Nice, or Stockholm.

    This is a more MI reading of this than what a civilian intelligence officer will probably get out of it but I really think the GRU (and to a lesser extent the FSB) illegals really need to learn basic tradecraft, and the agency itself has a real need to update their TTPs. This particular instance was all kinds of bad, a professional wouldn’t have had AIVD catch him on day zero unless they’re the unluckiest intelligence officer in the world. However, given the current state of the Russian Federation’s armed forces writ large as well as zeroed in on GRU itself, with the sorry state of the GRU Spetsnaz (and their sister units in the VDV) I’m not surprised at all that they’re not good at what they supposedly used to excel at. They got to the point where they started believing their own BS about how they’re the best and unstoppable. The institutional wisdom gained from bleeding in actual warfare in Afghanistan is long gone and what replaced it are people who “fought” in Chechnya against all those unarmed civilians, and maybe an actual incompetent terrorist here and there. Their Army didn’t learn from the Battle of Grozny and clearly their intelligence agencies have yet to learn from any of their mistakes in Donbas or in Syria.

    Perhaps if the Ukrainians neutralize enough of them it’ll be a blessing in disguise for the Russian intelligence complex. Maybe not. You’d figure they’d start to care when every month more of their officers and operations get burned, but it really doesn’t look to be the case since it seems to be like clockwork lately.

  3. Iconoclast XIII says:

    Tricky, tricky. You people are _so_ tricky. Here is a chance to surveil the tar out of a real deep cover officer and he is just sent back home. Uh, “home.” Could the Dutch be receiving something very special in return?

  4. Pete says:

    Another excellent article from Joseph. Looking at the 6th paragraph at “based on information” brings us to the bellingcat article https://www.bellingcat.com/news/americas/2022/06/16/the-brazilian-candidate-the-studious-cover-identity-of-an-alleged-russian-spy/ .

    Scrolling 5/6s down this bellingcat article brings us to a photo of Victor MULLER/CHERKASOV in Russian Army uniform with the caption “Screenshot from a Telegram post about Cherkasov, with the photograph on the left supposedly showing Cherkasov in a military uniform.”

    I would say CHERKASOV’s identity first came under question during his Masters at Johns Hopkins’ SAIS programme (2018-20) time. At that American university CHERKASOV was exposed to the Western world’s most sophisticated scrutiny, ie. by US security and intelligence services.

    Reading past cases Russian illegals highest priority is attempting to rise into the FBI, CIA or linguist at NSA. At US universities illegals often act very popular, doing much networking and sometimes raise flags by overdoing it. MULLER/CHERKASOV may have expressed interest to tutors/professors that he was interested in joining, or of being of help to, US security and intelligence services

    This may well have triggered a complex, well resourced US security vetting process. But MULLER/CHERKASOV was knocked back with no reasons needing to be given, because:

    The NSA has a much more sophisticated photo matching databases than Google. This could have brought up MULLER/CHERKASOV’s face in his Russian Army uniform, revealed at bellingcat and known much earlier by the NSA-FBI.

    When compared to US visa application photos and Johns Hopkins student photos this was enough to class MULLER/CHERKASOV as a Russian illegal while in the US, and before he then tried to move to the Netherlands.

  5. Sergey from Moscow says:

    There is a lot of unanswered questions, strange details in this case.It was reported that mr.Muller/Cherkasov waits for the trial in Brazil but there is no any information about it in Brazilian mass media. The man just has vanished. The notes with the ‘legend’ are remarkable. No one known Russian agent was keeping them. Also all Russian agents knew language of their false Motherland on a level of native speaker.But it is claimed in the notes that mr.Muller/Cherkasov ‘has forgotten’ Portugese.All known Russian agents with faked documents were detained for a long period (at least to question them) and each time Moscow confirmed that it is Russian agent.
    There is simple explanation that makes the case crystal clear. mr.Muller is an American and CIA agent sent to be infiltrated into the ICC. Unfortunately there was (allegedly) Dutch border guard with Portugese roots who found it strange that a Brazilian doesn’t speak Portugese. As a result mr.Muller (it could be his real name) had to contact with the CIA resident in the Netherlands. So he was just deported to Brazil and soon appeared in the USA. At the same time a lot of people in the Netherlands became aware about strange ‘Brazilian’. So CIA elaborated this half baked version and asked Dutch secret services to make it public. As for Cherkasov then it’s likely just random Russian surname.

  6. Alex Peeters says:

    Always nice to see some ‘Sergey from Moscow’ trying to twist establish facts. Sorry guys, that isn’t working anymore. You lost your last piece of credibilitylong ago.

We welcome informed comments and corrections. Comments attacking or deriding the author(s), instead of addressing the content of articles, will NOT be approved for publication.

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: