Russia has extensive signals intelligence equipment on the roofs of its embassies in Europe, Expressen can reveal in cooperation with a group of European journalists. Satellite images and close-ups with telephoto lenses reveal the equipment.
Intelligence sources tell how mobile phones can be tapped and how the security police's encrypted radio communications can be tracked.
The Russian embassy in central Stockholm is the starting point for Russian espionage in Sweden. A large part of the embassy's diplomats are in fact spies, according to the Security Police. And from the embassy, signals intelligence is conducted according to the head of Säpo's counterintelligence, Daniel Stenling.
- I don't want to go into more detail, because then we would reveal what we know and make our work more difficult. But what we can say is that you have the technical capacity from the Russian Embassy to conduct technical acquisition - that's right.
And you do that too?
- Yes, says Daniel Stenling.
In collaboration with European journalists, Expressen has mapped the Russian signals intelligence in European capitals. On the roofs of embassy buildings in a large number of European capitals are antennas and equipment for signals intelligence, satellite images show.
It involves a series of different antennas to capture radio signals in a wide spectrum. Parts of the equipment are open and visible from the air, other parts are hidden in sheds of fiberglass sheets built up on the roofs. The sheds are known by Western security services to hide spy equipment.
An analysis of satellite images shows that in eleven EU countries there are such sheds on the roofs of Russian embassies or buildings connected to the embassies.
The largest is the facility on the roof of the Russian embassy in Madrid, where the shed covers the entire roof and in practice constitutes an extra floor.
Other countries where such sheds have been erected are, apart from Sweden and Poland, Belgium, Bulgaria, the Czech Republic, Germany, Greece, Malta, Portugal, Romania.
In the Polish capital Warsaw, the journalists from Expressen's partner FrontStory find what is described as an extensive spy center on the roof of a detached residential building belonging to the Russian embassy, a 12-story building on Ludwig Van Beethoven street in southeast Warsaw. The journalists have taken part in a drone film showing the roof and equipment.
According to sources and experts who analyzed the video, the Russian security and intelligence services can conduct surveillance covering up to 30 km around Warsaw from the roof.
- This roof is the nest of Russian signals intelligence, emphasizes a former high-ranking officer from a Western intelligence service, who has seen the drone video.
- The Russians can listen to everything that goes on the radio, that is, radio communications, walkie-talkies, police frequencies. They also monitor GSM networks, a former senior Polish intelligence official said.
In his opinion, it is highly likely that the equipment is active and in use.
Code Name "Zenith"
According to the sources, the shelter on the roof should be fully equipped to control the signals intelligence equipment.
“The Russians strictly guard the entrance to it - apart from the military residency, only the GRU officer delegated to manage the electronic intelligence post had access to this part of the roof. The position is codenamed Zenith.” says the source.
The Russian embassy in Sweden is across the street from Expressen's editorial office on Gjörwellsgatan in Stockholm. Using a telephoto lens, we photographed the antennas in detail. Based on the images, experts have since been able to identify the antennas and estimate the frequencies within which each antenna can capture or transmit radio signals.
According to the experts, the equipment looks worn and the installation gives a partly sloppy impression. Just like in Poland, the building in Stockholm has sheds of fiberglass sheets on the roof. From the antennas, cables can be seen going in through the wall to one of the two sheds.
Journalists at Belgian partner De Tijd show images from the Russian embassy in Stockholm to an expert in signals intelligence. One of the antennas in particular piques his interest, it consists of four horizontal cross-shaped elements in addition to a vertical mast.
“You can see on this antenna that it has been 'shortened' with coils. It should actually consist of a much longer mast to optimally receive a certain frequency range, but this is often not feasible. You can't tell exactly what frequencies it is, but you can see here that it's tuned for a certain, specific application. The horizontal part tells me that the reception is focused on relatively short distances, less than 500 kilometers or so.”
"One of the possibilities with such an antenna would be to intercept maritime communications," the expert told De Tijd.
Disk antennas which, depending on the configuration, cover the band 30 – 500 Mhz. Within these frequencies is the state encrypted radio system RAKEL, which is used by the police, Säpo and other authorities. It is a normal antenna for listening, but also works as a transmitting antenna. “Because of the frequencies they receive, they are more suitable for local signals. Taxi companies use them, you can use them to receive communications between pilots and the control tower near an airport and pick up the - now encrypted - radio signals from the police. Embassies can also use them to communicate with staff outside the embassy area via their own encrypted radio link,” says a Belgian expert who reviewed the images.
Diamond antenna intended for the shortwave range 3 – 30 Mhz. A vertical antenna part is missing that should sit on top, which means that the range of use in terms of frequency is somewhat reduced. According to the Swedish Post and Telecommunications Authority's frequency plan, there are several military channels in this area, but also channels for amateur radio and shipping. A Belgian expert states that one of the possibilities of such an antenna would be to intercept maritime communications.
The vertical antenna is a broadband antenna intended for 38 to 75 MHz. The wires from the sides of the vertical antenna are ground planes that are needed for the antenna to function optimally. According to the frequency plan, there are both license-free channels for short-range radio but also for military use and radio astronomy.
A so-called Russian antenna that looks like fishing gear. An older type of antenna that can be used to transmit and receive signals over very long distances up to 500 miles. Today, they have often been replaced by satellite transmitters. "But since it is such a flexible antenna and with which you can both receive and transmit, it is actually impossible to say what a Russian embassy does or has done with it." says a Belgian expert who analyzed the images.
Subject to Russian FSB
How the equipment is actually used is more difficult to determine from images, but with the help of current and former active intelligence and security service personnel from several European countries, we have been able to create a picture of what capabilities the Russians have.
- We intensively monitor, visually and in other ways, what equipment is at the Russian embassy. Every time they install something new there, we immediately send pictures to our allies and consult with them about what it is and what it's for. We take passive measures, that is, we monitor it. But also active measures, says a person connected to the Slovak security service.
One of the systems is for detecting and tracking possible surveillance against one's own spies, so-called counter-espionage. The system has a range of 25 to 30 kilometers.
A former officer at a Central European intelligence service says that the surveillance system of Russian embassies is managed by technical personnel subordinate to the Russian security service FSB.
In Sweden, both the Russian civilian foreign intelligence service SVR and the military intelligence service GRU are active. The Russian security service FSB also has operations in Sweden. Among other things, they provide support to personnel from SVR and GRU during operations.
The technical equipment detects radio traffic around the embassy and in a way they can detect the work of local counterintelligence.
- The counterintelligence that keeps an eye on the Russian embassy usually communicates via radio or mobile phone. The Russians are trying to discover both. So if they see radio traffic around their buildings, cars or agents increasing, they immediately stop their operations to avoid being compromised, says a former officer at a central European intelligence agency.
According to a source within Swedish intelligence, it has been discovered that this system is also used in Sweden.
In Sweden, government personnel, police and security police use radio equipment in the Rakel system. The traffic is encrypted, but this does not prevent the Russian equipment from positioning the devices.
Even mobile phones can be positioned and also intercepted from the Russian embassy.
- In my country's capital, in the 2010s, they could carry out radio reconnaissance in a radius of 25-30 kilometers and also intercept telephone calls. This can sometimes make counterintelligence operations impossible. The spies had to change cell phones frequently because if any of those numbers were identified and placed around the embassy, the Russians knew they were being monitored, said the former officer at a central European intelligence agency.
A method that Russian intelligence uses is called "zoning" - the city where an operation is to be carried out is divided into zones of five and six kilometers. Before a secret meeting, the spy walks through the zones according to a predetermined route, while the technical staff at the embassy monitors which mobile phones and which radio traffic moves through the zones.
"If the operational support team locates one of the counterspies' mobile phones and sees that this phone moves between areas, appears in another area and follows the Russian spy, they immediately suspend the operation to avoid capture."
According to the source, the Russian defector Sergei Skripal, whom Russian intelligence tried to poison with the nerve agent novitjock in Salisbury in 2018, has contributed a lot of knowledge about how these systems work.
"Along with his British handler, he toured Europe and gave lectures to professionals working in this field," says the source.
It is already known that Skripal, among other things, met and helped the Estonian intelligence service.
Another method that Russian intelligence uses is a mobile device to capture which mobile phones are in a certain area - so-called IMSI-catchers. The aim is to identify the mobile phones of interesting people. Every mobile phone has a unique IMEI number, which is the basis for secure identification in the face of possible interception.
Christer Olsén, with a background from both FRA's and the Security Police's previous signals intelligence, explains how it can work:
- If we take a theoretical example that the Russians want to identify which mobile phone ÖB has in order to see how he moves and to be able to hack the phone. Then you get into a car near ÖB's workplace and you register all the IMEI numbers that are nearby. Then you do the same in other places where you know that ÖB usually is. Then the different measurement results are run against each other to identify the wanted mobile phone, says Christer Olsén.
The phone can then be hacked remotely – today there are several well-known systems for eavesdropping on everything that happens on a phone.
- These days, people are so aware of this risk that no sensitive conversations are conducted over the phone, not even on encrypted apps, but you see each other in person, he says.
Over 400 suspected spies deported
After the start of the Russian war of aggression against Ukraine last year, EU countries expelled over 400 suspected Russian spies from embassies around Europe.
In Sweden, three diplomats were expelled - Expressen revealed their identities already in April last year. In addition to the three diplomats who were sent home, Swedish security services are said to have identified another twelve Russian diplomats who are in fact spies. Daniel Stenling at Säpo says that they are trying to keep as good an eye as possible on the Russian diplomats.
- It is very difficult for us to have complete control over all individuals, even if we have a good idea of what they are doing in total. But it takes significant resources from the Security Police to follow these intelligence officers, he says.
Despite the Russian war of aggression against Ukraine, Russian espionage in Sweden has continued with unchanged strength.
- They have reorganized a lot of resources for Ukraine, and this also applies to intelligence resources. What we have been able to establish is that they have nevertheless maintained their intelligence activities and their intelligence pressure on Sweden. That says something about how interesting Sweden is anyway, says Stenling.
The fact that more diplomats have not been expelled from Sweden - despite the fact that the Security Police knew they were spies - is due to political considerations.
Sweden deported relatively few compared to other countries. What is it due to?
- It is entirely a decision from the Ministry of Foreign Affairs and the government. That question must be asked there.
But can Sweden form a base for espionage in other countries because we have expelled fewer?
- In theory it is, and we have also seen it in practice that intelligence officers can move between countries. And it is something that we follow very closely, because of course we do not want intelligence officers in Sweden to be used to run illegal intelligence activities in other countries.
- Of course it occurs, it is possible and it is something we follow closely, he says.
Technical staff were expelled from Poland
In other countries, such as Belgium, significantly more were deported. Journalists at the Belgian newspaper De Tijd have seen the intelligence service's documents for the expulsions, which show that priority targets were people with technical skills, staff from SVR's technical department and people who handle crypto and IT support.
Something that the country's Minister of Justice Vincent Van Quickenborne also confirms for the newspaper.
- 21 Russian intelligence officers who were active in our country under diplomatic cover were declared Persona Non Grata. In doing so, we weakened the position of the Russian intelligence services and thwarted possible signals intelligence operations. After all, quite a few technicians were deliberately included on this list.. Such personnel are essential in technical intelligence operations such as hacking and data capture.
An examination of the expelled diplomats' background, which journalists at Expressen's partner Dossier Center did, shows that more countries may have had the same priority.
Many of them have technical training – of the 45 Russian diplomats expelled from Poland last year, around 20 were technical staff who lived in the house on Beethoven Street.
Of the three Russian diplomats who were expelled from Sweden last year, at least one has a clear technical profile according to research from the Dossier Center. And in 2021, Sweden also expelled one of the Russian embassy's technicians who was judged to be participating in hacker operations.
Together with the other media in the collaboration, Expressen has sought the Russian Ministry of Foreign Affairs in Moscow - they have not heard back.