In October 2016, Ukrainianhacker group CyberHunta leaked over a gigabyte of emails and other documents alleged to belong to Russian political operative and senior Kremlin official Vladislav Surkov. Known as Russia's "grey cardinal", Surkov served as a political adviser to President Vladimir Putin and is the architect of Russia's ideology of sovereign democracy. The document leak included over 2,300 emails from Surkov's inbox. The emails illustrate Russian plans to politically destabilize Ukraine and the coordination of affairs with major opposition leaders in separatist east Ukraine. The release included a document sent to Surkov by Denis Pushilin, former Chair of the People's Soviet of the Donetsk People's Republic, listing casualties that occurred during 2014. It also included a 22-page outline of "a plan to support nationalist and separatist politicians and to encourage early parliamentary elections in Ukraine, all with the aim of undermining the government in Kiev." The Kremlin has said that the leaked documents are fake.
Authenticity
Washington think tank Atlantic Council's Digital Forensic Research Lab conducted an analysis of the emails. They determined that they were genuine, based partially on the routing information. Russian entrepreneur Yevgeny Chichvarkin confirmed that his emails from the document dump were authentic, saying "Yes, this is my original text." Russian journalist Svetlana Babaeva also verified that her three emails from the leak were genuine. Kremlin press secretaryDmitry Peskov suggested that the emails did not belong to Surkov, saying that he "does not use email." Oleksandr Tkachuk of Security Service of Ukraine stated that they had managed to "authenticate a number of documents in the release" but could not confirm the authenticity of the entire batch of documents.
Publication
On 23 October 2016, Ukrainian hacker group CyberHunta published correspondence that it alleged was from Surkov's office email account. Volunteers from the open-source intelligence initiative Inform Napalm requested additional evidence from an alliance of hacker groups that includes CyberHunta, RUH8, FalconsFlame, and TRINITY. They secured the release of a 1GB Microsoft Outlook data file. Inform Napalm reported that the hackers also were in possession of documents from 2015 and 2016 that were being analysed by intelligence agencies and were not released due to their operational value. New batches of emails from the leak were further published in November 2017 and April 2018.
Contents
The document leak was a Microsoft Outlook data file that included 2,337 emails from the inbox of Surkov's prm_surkova@gov.ru. The released material covers a period from September 2013 to November 2014. The email address appears to have been an office account run by Surkov's aides, including "Masha" and "Yevgenia". Among the documents were scans of Surkov's and his family's passports. While the vast majority of the emails comprise routine briefings and schedules, a small handful are of geopolitical significance or potentially incriminating. These emails illustrate Russian plans to politically destabilize Ukraine and the coordination of affairs with major opposition leaders in separatist east Ukraine. An email sent to Surkov and others on 14 June 2014 by Denis Pushilin, the former Chair of the People's Soviet of the Donetsk People's Republic, contains a document listing casualties that occurred from 26 May to 6 June 2014. The list of casualties includes a row for an unnamed soldier listed as "VDV Pskovsky", a designation for a deployment of Russian Airborne Troops from the city of Pskov. Paratroopers based in Pskov were thought to be among the first of Russia's covert casualties in Ukraine in 2014. The Pskov-based 76th Guards Air Assault Division was awarded the Order of Suvorov by Putin for unspecified tasks in August 2014. An email sent to Surkov from a Russian government account on 18 June 2014 detailed the practicalities of Russia absorbing a portion of Ukraine. An email attachment included a briefing paper titled "On the Risks of an Economic Blockade of the LNR and DNR". The paper noted that 30% of the Donbass electrical supply comes from power plants in Zaporizhzhya. The document includes suggestions to supplement electrical supply in Donbass with power from the Rostov Nuclear Power Plant in Russia. The document's author also suggested increasing iron ore shipments and connecting Donbass to the Voronezh Oblastelectricity grid. One of the emails to Surkov from Konstantin Malofeev contained a list of recommended candidates for positions in the separatist government prior to their appointments. The documents also included a spreadsheet containing the budget for a newspaper in Donetsk. On 25 August 2014, a Russian official forwarded an email to Surkov from Russian Reporter editor Vitaly Leybin. The email bore the title "corrections in the text" and concerned a letter to the Ukrainian government from the "public representatives of the Donbass." A nearly identical article, purportedly from citizens living in Ukraine, appeared in Russian Reporter days later with only minor changes. Within the week, the letter had appeared on Russia Today and other Russian websites. One of the documents included in the leak was a 22-page outline of "a plan to support nationalist and separatist politicians and to encourage early parliamentary elections in Ukraine, all with the aim of undermining the government in Kiev."
