In spite the fact that sentence regarding this case, lasting already a
whole year, has not been pronounced. One of the defendants that was
suspected in organization summer ddos-attack on the Russian payment
"Assist" system in 2010 is arrested again for another 6 months. On June
5th, 2013 in the courtroom located in the northeast of the capital, in
Tushino, Russian financier, Pavel Vrublevsky, was taken into custody.
The consent given by Judge Natalia Lunina to satisfy the petition of the
prosecutor Sergey Kotov, who asked to change a sanction such as
recognizance not to leave to arrest, indicates that the state accuser is
planning to bring the case to a home straight.
The version of the public prosecution side would look more convincing if there were proofs that "Aeroflot" plans to continue business cooperation with "Asisst". Actually, in July 2010 when "Aeroflot" held tender regarding the choice of payment decisions, the "Assist" was not among the competing contestants. As "Aeroflot" expected to choose a provider of payment services which could offer the unified scheme (processing) valid for all its management departments and structural divisions, the probability that "Assist" could keep the contract without participating in this tender is extreme small.
On the contrary, “Chronopay” participated in the tender, and it’s impossible that its employees did not know that "Assist" was absent among participants.
One year passed. Vrublevsky had an opportunity to leave the country for holidays and never come back to Russia, but he behaved as if he did not realize an approaching danger. In July 2011, when he and his family, wife and three juvenile children, were coming back from Maldives Islands, he was arrested in the Sheremetyevo airport located to the north of Moscow.
Suspected of technical realization of a hacker attack programmer Igor Artimovich was released after two months in custody, but, at first, he received a doubtful pleasure of physical influence that is commonly used by Russian investigatory bodies. This young man in his thirties does not make an impression of the person with the athletic build and, moreover, does not look ready to bear physical pressure. Medical report attached to case files that was made by doctor Fedorov in the city station of medical aid located in Petersburg, in the presence of two witnesses, proves that the physical pressure was implemented. According to his experience, it’s clear that it is not required to be the lawyer Magnitsky that authorities allow to apply physical force towards suspect. On June, 9th 2011, after conducting medical examination in office №6 of Petersburg and Leningrad Regional Department of FSB, Dr. Feodorov estimated that Artimovich had «bruised head in parietal-temporal area and scratches in his forearms [1]».
By the autumn 2010 everyone had confessed (it should be noticed that in March 2012 Igor Artimovich refused statements giver earlier). According to the Russian standards, existence of these statements was enough to identify suspects and consider the case proven; therefore, the court would pronounce a fair sentence.
However, as hearings began in May 2011 it became clear that evidences from the prosecution side had essential shortcomings and contradictions, as well as, forensics were far from ideal; as a result, proceeding already lasts whole year.
Journalists who are following the developments on the case, can find different explanations to numerous contradictions and falsifications in this case, however, to neglect their presence would mean to simplify the occurred situation.
The main dispute between lawyers and
public prosecution was declassification of the materials on special
investigation activities, made in May 2011. Defense noticed that
numbering for the declassified FSB documents that appeared during
investigatory process do not coincide with their initial record numbers.
Numbers under which documents appeared in the resolution of
declassification did not coincide with their numbers in the resolution
on their submission to the investigation, and in some cases - with the
numbers under which documents have been attached to the case materials
[2].
So, for example, the inquiry №147/ОU/2-2063 was transformed to the document №147/ОU/2-1500; №147/ОU/2-2317 - it was also found under №147/ОU/2-1503, №147/ОU/2-1502; the inquiry №147/ОU/2/2164, concerning electronic e-wallet owned by one of the suspects, was stated as inquiry №147/ОU/2-1504 in one of the resolutions.
Lawyers have counted in total 10 discrepancies like that and «has drawn a conclusion that the materials appeared in Russian Investigatory Department of FSB that was attached to the materials of criminal case are OTHER documents, than those that have been declassified; therefore, those that have been declassified are absent in case materials» [3]. Under the lawyers' statement, the documents passed to the investigators by special investigative unit, «were not declassified in compliance with respect to the order established by the law; also there are no data on a source that originated and presented this information, dates of reception are also unknown».
Assuming that these documents are declassified with violation of declassification rules, in January 2013 lawyers asked authorization to exclude these 10 inquiries from the criminal case [4] connected to special investigation activities towards suspects. Lawyers asked to exclude these documents from the evidence material as it «was received with violation of criminal procedure legislation».
The main argument of lawyer Ajvar was that the decision from May 12th, 2011 regarding declassification of the materials from special investigation activities and the judgment made by the Moscow State Court on September 30th, 2010 regarding operational procedures «declassified and presented material to the Investigation Department of FSB with essential violations of the CPC RF: as the documents contained the state secret, [they] could not be declassified by the head of the unit which is carrying out special investigation activities». At the same time article №13 «concerning the state secret» allows to declassify the resolution made by judge only on the basis of the judicial decision.
Lawyers also were concerned regarding how the dates were put down. Instead of the figure specifying a calendar year that the document should be dated, composers of inquiries wrote «present year» that complicates to define when the inquiries have been actually made.
Judging by the fact that public prosecutor has
asked court to make a pause in hearings to find out the reasons of these
divergences, what led to the judicial session to be postponed for 3
weeks, this contradictions were unexpected for the state accuser. This
fact indicates that prosecutor probably did not pay much attention for
such detail while studying evidences.
The way the crime investigators dealt with classified documents can be named illegal and has created almost comical situation. The screenshot that shows the access to the Topol-Mejler control panel appeared to be a part of confidential evidences - the inquiry №147/ОU/2-1501 from May 12th , 2011. At the same time before this inquiry was officially declassification, the same screenshot was published by journalist, Brian Krebs[5].
The public prosecutor requested an explanation from FSB. In the official document dated 1/24/2013 №147/ОU/2-222 given by the deputy chief of the Operations Control Center of Information Security of the FSB, col. Zhestkov, stated that «after declassification of the materials of special investigation activities those documents were assigned with different serial number in respect to the original numbering of (before confidential) documents» [6]. This document even had not been sealed with a stamp.
It's unclear what happened with the initial numbers (confidential numbers). The lawyers themselves did not see the original documentation on the basis of which the declassified certificates have been made. Meanwhile, the Russian legislation allows court to consider results of the special investigation activities (such as, records of conversations and the data obtained from communication channels) as evidence, but not the documentation made on a basis of these evidences.
Nevertheless, judge Lunina agreed with an argument of the public prosecutor, having rejected the lawyers' petition to exclude 10 inquiries from the case materials.
From 10th till 27th of September 2010 a group
was engaged in the scrutiny of the CD. These dates were specified in the
conclusive statement written by the employee of the Group [8]. However,
the Moscow State Court has authorized to carry out special
investigation activities allegedly to obtain this CD, only on September,
30th [9] 2010 (authorization №ОРМ 558k/s/2010.
It seems to be that the CD has been received without the official sanction of court, and employee of Information Security Center FSB, Lutikov, backdated the document as on September 8, 2010 he could not be aware that on September 30th, in 3 weeks time, the Moscow State Court will authorize the decision to carry out special investigation activities. Hence, if this document was made, ostensibly, on 8th of September Lutikov precisely specified number of the statement that was authorized by the Court on 30th of September. This letter dated 8th of September was written after 30th of September and the date has been specified intentionally incorrect to give visibility of legality to actions of inspectors.
This trick has allowed inspectors to legalize illegally “the evidence material”, the CD №5101№09250046318 (originally numbered differently), therefore, permitted to be taken as a basis for the charges.
When lawyers found out about this falsification, on 5/13/2013 they addressed the powerful Investigatory Committee with the request to check thoroughly the circumstances of the case.
Expert from KL came to a conclusion that initial codes obtained from the laptop of the accused include all program functions that presumably attacked the server of the "Assist".
However, lawyers doubted regarding the choice of the Laboratory as expert authority. The defense claimed that the Laboratory can be considered as privy due to the fact that KL cooperated with the "Assist", therefore, it’s possible that judgment could be affected by personal interest. Also Kaspersky Laboratory is commercial entity; as a result, its neutrality could be affected by commercial interests. The public prosecutor, as well as judge Lunina had disagreed with this point of view, and examination remained in the case files. Though, the public prosecutor explained that Anufriev has participated as expert like private individual, the text of the examination had been assigned with Laboratory stamp.
Lawyers were surprised that examination, in their opinion, was short, and there was no interim results or/and calculations attached. Without any exaggeration considering a huge volume of the data which expert was forced to analyze, such as, laconism, as well as, his statement that certain calculations he could reckon in his mind, looked appropriate for private discussion, rather for judicial hearings.
Independent experts approached by lawyers with the request to analyze Laboratory's expertise, found shortcomings unlike the public prosecutor.
The Russian legislation demands that expert must specify a technique used to conduct research or examination. This requirement allows other experts to check the results of expertise by reproducing experiment. Grigory Anufriev did not specify the technique he used, as well as, special references where the methods of similar examinations would be developed and presented.
In particular expert Igor Yurin, a head [11] of so-called «The National Centre for the fight against crimes in the sphere of high technologies» acted in court as a guest expert, insisted on methodical discrepancy between examination of Kaspersky Laboratory and the task which had been set by inspectors. He stated that no expertise can prove injuriousness of any Software as court is the only authority that entitled to do so, and that there are no techniques of research regarding binary vand initial code of the programs based on reading the Bible and disassembly in mind.
In the courtroom expert Yurin has complained that during familiarization with Anufriev's examination he was not sure whether this file somehow had been investigated. Though, Anufriev also had mentioned that the file was detected by Kaspersky's antivirus, he did not specify the file codes, also nothing was said in regard to the presence or absence of overlay hinged protection. According to Yurin, the examination made in Laboratory did not display any code sections or any functional or other identifying signs.
Speaking in court, Yurin has compared the conclusions from the Anufriev’s examination and the document made for the investigators by GroupIB and found contradiction. Judging by hash, appeared in the document of experts from GroupIB, the investigated object called dropper: the variation of a program which itself does not pose any special destructive functions (such programs extract other file, place them on a hard drive, register file in the system, and, at last, start files. This is the only what dropper is capable of).
There are also other remarks regarding examination of Grigory Anufriev that have been noticed by expert Yurin in courtroom:
- Experts from Group IB, were specifying the value of hash while showing the exact data object (script - X) that was examined. To compare, Anufriev's examination did not mention neither hash, file size, nor the information on last access to an investigated file.
- The expert of Laboratory had admitted confusion, having specified that he used disassemble IdaPro 6.0 released “Datarescue”. It's important to notice that version 6.0. had been released by another company.
- Whoever released program 6.0., this program does not allow to recreate precisely the initial text of the program using high level language, but allows to obtain only a certain text in assembler language, except some primal case when the program consists of several lines, consequently, it is possible to obtain version close to the original. The reasons is that during compilation the names of variables, constants, functions are lost, at the same time some instructions are replaced by similar ones for optimization, that is to say the program obtains significant changes.
As for the public prosecutor, the judge and the lawyers who are not quite familiar with programming and are not experts in this field of high technologies, such details, certainly were difficult enough to examine. There is a risk that the court taking into account examinations and experts' statements will draw the conclusions based not so much on mathematical accuracy but on intuition and general impressions. Nevertheless, one of the comments from expert Yurin presented in the courtroom had to be understood identically by everyone: expert who analyses the results, can be tempted to make definitive conclusions, though, it is known that «even if he/she is well qualified in this programming language, it does not mean that he/she can properly understand and identify the initial code of the program written in the same language. It is especially relevant to the projects where considerable quantity of experts participated. There is a possibility that in such cases the developer can be confused in understanding what is going on in the program».
Hearings in 2011:
The judge refuses to consider case because of a poor quality of indictment, but the highest authority court cancels this decision.
The first attempt to carry out hearing was unsuccessful, then on 6/13/2012 judge Olga Alnykina satisfied the petition of the lawyer, Lyudmila Ajvar [12], and has decided criminal case
«to be returned to General Attorney of the
Russian Federation [13] in order to eliminate the obstacles that prevent
the following legal investigation» and «to oblige the General Attorney
of the Russian Federation to eliminate violations». The judge justified
her decision as follow: «indictment does not have significant foundation
for the accusation: the ambiguity of primary attributes of law edition
on the basis of which the charges were laid. The above-stated
circumstances display the presence of obstacles / …/, that exclude
possibility for the court to reach legitimate and justified verdict or
reach other decision on the basis of the drawn conclusion» [14].
As judge Alnykina explained, «the bill of particulars does not meet the requirements of paragraph 5 of Part 1 of Art. 220 Code of Criminal Procedure RF»: instead of revealing the evidence and to clarify its indication, investigation unit «discloses [only] the list of evidence».
The judge has rejected the indictment not only because it did not correspond to the requirements of the Criminal Procedure Code of Russia but also because inspectors accusing all four suspects «in committing a crime under Part 2 of Art. 272 of the Criminal Code and Part 3. 33 [and] Part 1 of Art. 273 of the Criminal Code of the Russian Federation "», have referred, for some inexplicable reason, to the Russian federal law №28-FЗ from the March 8th, 2011, devoted to agreement ratification between the former Soviet Republics of Azerbaijans, Kirghizia, Russia, Tajikistan, Turkmenia and Uzbekistan «which is dedicated to creation of the Central-Asian regional information coordination centre against illegal circulation of narcotics, psychotropic substances and their precursors». Having found inappropriate reference, judge Alnykina has specified that it «does not regulate changes in criminal and criminal-procedure legislation» in Russia.
Public prosecutor Kotov was trying to convince the judge to disagree with the lawyers' request, claiming that due to "technical error" charge had been brought in improper edition of the law №28-FЗ from March 7th, 2011, but his arguments had been rejected. Further the public prosecutor repeatedly explained [16] various contradictions in investigatory documents as «technical errors» and «the human factor». However, these explanations compel to ask a question: what kind of challenges the court faced with: with a systemic defect and shortcomings of the Russian public prosecutor body that presumes that numerous errors regarding evidences do not disturb a judicial legal investigation, or with low-qualified young inspectors of the Investigatory Department of FSB.
Nevertheless, the Judicial Board on criminal
cases of the Moscow State Court, where the public prosecutor addressed
his protest, cancelled the decision of judge Alnykinoj and returned the
case in Tushinsky Court to carry out preliminary hearings [17].
Because the Russian judicial system cannot be considered independent by the European standards, the higher the judicial hierarchy the more dependent position. And if the district court decision can be sometimes unpredictable for the authorities and the public, it’s unlikely to expect surprises from courts of higher instances. And the decision which has been reached by the Moscow State Court in August, 2012 on the given case confirms the rule.
Despite that the court turns a blind eye on new amendments in the Article 272 CC and left accusation based on old (non-operational version of article of the Criminal Code) as relevant, lawyers still have an opportunity to achieve a charge to be requalified.
The defense that invited a several experts, whose arguments showed all ambiguity of the charges pressed against Vrublevsky and discrepancy of all examinations and expertise collected by investigation department, was convincing enough.
In March the CEO of the "The National Centre
against crimes in the sphere of high technologies" PLC, Igor Yurin,
questioned methodical correctness of the examination conducted by the
expert of «Kaspersky Laboratory» LLC, Grigory Anufriev, regarding the
analysis of the information collected from the suspect's laptop and
disks.
Later executive director of Consulting Group "Aspect", Anton Genkin, who was an expert back in 2010 invited by the company "Aeroflot" to conduct a tender in order to choose payment decisions system, had doubts whether “Aeroflot” was planning to continue business relations with the payment system "Assist". He mentioned that "Assist" did not take part in the tender conducted by “Aeroflot”, thus, the statement of the prosecution that Vrublevsky could organize ddos-attack to show weakness of the security system of competitors, therefore, to compromise them, is groundless.
Back in April Leonid Raev, an expert-graphologist, who graduated from the faculty of criminology of the Volgograd Higher Investigatory School of the Ministry of Internal Affairs, testified in court. Having made a reservation that he had opportunity to familiarize only with digital images and photocopies of investigatory reports and not with originals, he could not use the special techniques to investigate documents. Raev pointed out for the court numerous different interpretations in signatures of the same individuals. As a result, he stated that in some cases signatures have been put not by the individuals on whose behalf the document was signed.
Having noticed that signatures from the reports had a feature of slowness regarding their execution, in contrast, with mechanicalness, that is distinguishing feature as individual put his\her, though the years developed, signature. Raev ascertained essential distinctions between the samples of signatures from investigatory reports and other documents (in particular, in the judicial summons and examination sheet). In order to draw a certain conclusion, it is necessary to receive from inspector Dadinskij a list of signatures that were made on behalf of those individuals whose signatures were falsified by Dadinskij. Meanwhile, it can be assumed that all autographs belong to one person as they have common features, such as a wavy side of the endings and a triangular stroke with the termination located on the left.
In the interview made by lawyer, Igor Feldman
[18], on 29th of May, witness Yevseyev states that he can have an
infinite number of signatures. The expert, without suspecting that
quotation was literally reproduced in the courtroom, had ironically
noticed that it indicates mental disorders of the individual.
Assuming that the person can possess an infallible memory, Raev has noticed that his arguments is possible to check, having asked «to examine around five» signatures. Reluctance of Yevseyev and Tisljuka and the inspector Dadinsky to provide the samples of the signatures, convinced graphologist that he is right regarded, as «plus to [the expert] conclusion», confirming, «that the expert is right».
Extremely ambiguously, considering that graphologist has found resemblance between handwritings that allegedly belong to the witnesses and handwriting of the inspector, on 5th of May inspector Sergey Dadinsky stated that in Russia «the witness institute is badly developed», that «people are afraid to go somewhere and participate in something»; «it is difficult to find individual who will be willing to spend with you as much time is needed», [preparing investigatory reports].
For now graphologist's estimations and some witnesses' testimonies suggest that the participation of Nikita Yevseyev as a witness who also with according to the religious canons is a relative to the inspector, is not accident. It allowed the inspector Dadinsky to issue many reports as ostensibly assured by Yevseyev, and then during private conversation to advise to write a petition which authenticity can be questioned.
On 29th of June public prosecutor Kotov has referred to Yevseyev's statements and petitions where he claimed that on 29th and 30th of April Vrublevsky ostensibly tried to bribe him and threatened him during the telephone conversations. These unsubstantial statements, perhaps, would sound plausibly but the defense offered a number of proofs showed that Yevseyev mislead the court while testifying on 29th of May.
It is important to notice that his statement contradictes with a number of statements made by the witness Anastasiia Kurochkina and the inspector Dadinsky who appeared in court on 5th of May as a witness. Yevseyev denied any contacts with inspector of The Investigation Department of the FSB that would not be relevant to the investigation process but Dadinsky described their relationship as friendly relationship, though he did deny any relations, for example, based on religious practices or ceremonies.
Meanwhile, lawyer Pavel Zajtsev [19] also provide the court with documents to be put with the case materials, such as the letter, from 5/30/2013, made by the archpriest of the Epiphany Cathedral, Alexander Ageykin, confirming that the inspector Dadinsky became a godfather of Nikita Yevseyev's son. Earlier on 29th of May, Yevseyev himself stated he is devout Muslim.
After these remarks were quoted in court Dadinsky did not made any statements denying the accuracy of the quotes.
It can be noticed that the behavior of 29-year-old Anastas Kurochkin was more courageous compare to the behavior of inspector Dadinsky, and other witnesses: Yevseyev and Tisljuka. She was the only one interrogated on 29th of May and on 5th of June who agreed to give to court the sample of her signature. Also unlike Dadinsky, she was tactful towards her former close friend and did not give any personal assessments about him. This courageous behavior is corresponds more to officer ethics, rather than negation, by the inspector, of the facts which have proved to be true in court.
Vrublevsky already was in custody, when Kurochkina has informed court that she received strange calls, also, including calls from detective agency. Unknown individuals called also to her work, asking, whether she has "office romances". Someone also called to her mother, assuring her that her daughter is blackmailer. As a result of such pressure, the witness has made decision to resign.
It is still unclear if Investigatory Committee and FSB undertook any actions regarding the request made by Kurochkina on 30th of May asking to give her the state protection and to clarify the circumstances of occurred false signatures made on her behalf.
As judge Lunin clarified her decision to change restrictive measure by arguing that «there is no grounds to doubt Yevseyev's statements», and that they «are objective and there are solid ground for imprisonment», the whole complex of contradictions and the absurdities containing in certificates of Yevseyev, provoked lawyers openly to declare to the court a presence of convincing evidence that not only Yevseyev, but also the inspector Dadinsky in some cases committed perjury. Lawyers Lyudmila Ajvar, Pavel Zajtsev and Igor Feldman did not hide the intention to get authorization to obtain the materials in order to prove that inspector Dadinsky violated the law, as well as, to build a separate criminal case against the witness on a basis of committing perjury.
In first half of hearings while Vrublevsky has not been arrested yet, lawyers had presented to court the texts, assured by notary Afanaseva, that were obtained from two mobile phones owned by Vrublevsky showing sms-massage exchange between defendant and witness Yevseyev who testified earlier. According to lawyer Ajvar, calm tone of these messages does not give any grounds to believe that Vrublevsky resorted to any threats.
The press covering this news, positioned Vrublevsky as owner of payment system company "Chronopay". Actually, the company has co-owners, though, Vrublevsky founded the company back in 2003, within last two years he has completely departed from company affairs. At the time of last arrest Vrublevsky did not hold a position of CEO in "Chronopay" and did not participate in any activities on behalf of the company. His full attention was directed to created in 2012 fund RNP.
The defense found the punishment unreasonably strict, as a result, lawyers files a petition to change the sentence from 6-months imprisonment to house arrest where his movements and possibility to use communication facilities would be limited.
Representing Pavel Vrublevsky's interests the defender Lyudmila Ajvar mentioned that witness' statements on which basis the financier was taken into custody were based substantially on guesses and assumptions and, consequently, cannot have legal validity according to the current legislation.
Public prosecutor Kotov traditionally objecting the petitions of the defense finished debates with the exclamation: «Are we waiting until he will organize liquidation of the witness?!» Considering the fact that witness Yevseyev who on 30th of April asked court to grant state witness protection because he found in the remarks of Vrublevsky reasons to be afraid for his safety, still did not receive state protection. Therefore, prosecutor’s observation regarding organization someone's "liquidation" looks rather comical and hardly convincing.
Nevertheless, judge Lunina has agreed with the public prosecutor that another measure of punishment (not connected with imprisonment) will not provide unobstructed judicial process and upheld the decision passed the day before on arrest of Vrublevsky.
From expertise that lawyers were planning to adduce by filing the petition on 6th of June, but the judge agreed to attach to the case materials only one, the expertise made by expert-graphologist, Raev. According to Lunina, even that graphologist testified 1.5 months earlier, he was so detailed by telling the court about the studied signatures that his observations represent obvious interest for the lawsuit.
Written by experts of NO «The Commonwealth of experts of the Moscow State Law Academy of the Kutafin» Gleb Shamaev and Anastasiia Semikalenova review regarding the examination of Kaspersky Laboratory, Grigory Anufrievs, judge Lunina has refused to attach to the case materials, having referred that the necessary "aspects" on this question have been considered by her earlier, and she does not see a necessity to use this review.
In second half of the hearing 6th of June lawyers and figurants of the case in the presence of the invited experts to scrutinize some electronic storages attached to evidences of the case, however that they did not have some technical devices necessary to conduct procedure methodically correct. Continuation will take place on Friday at 12:00.
Beforehand the defense expressed concern towards the invited candidate - employee of Laboratory Kaspersky, Grigory Anufriev - as an independent expert. Main objection for lawyers was the fact that Anufriev might be interested in acknowledgement made by him before as an expect, that he has interest to prove his previous statement made in court earlier insisting that all defendants are guilty. However, the public prosecutor managed to convince court that Anufriev will exercise only additional role: only «promoting realization of technical action». Participation simultaneously of two experts in acquaintance with contents of electronic devices was caused by the agreement taken in previous sessions between defense and prosecution to use one expert from each party to make sure that of the parties could affect the result in accordance with their interest.
Lawyer Ajvar, knowing possible objections that could be announced by the state accuser while attempting to remove the expert that could be seen as expert from the prosecutor's side, has opposed the other invited candidate, CEO of company "Chronopay" with the higher technical education Alexey Kovyrshin. When public prosecutor Kotov claimed that Kovyrshin can be seen as expert employed by Vrublevsky, company founder explained to the state accuser that Kovyrshin is the CEO and does not depend on shareholders such as Vrublevsky.
On 7th (?) of June lawyer Ajvar has submitted to the Moscow State Court the appeal on arrest of Vrublevsky. This appeal will be considered within 10 days.
The expert of Kaspersky Laboratory, Grigory Anufriev, invited by prosecution, and expert Alexander Andriishin who works as programming engineer in "Information Innovation Company" LLC, invited by the defense, on termination of detailed examination of electronic devices (two laptops and a DVD-disk) testifying have solidary confirmed that the program has been created on 17th of September, and written down on a DVD-disk 5 days later, on September, 22nd, 2010. This information can affect a court course as on this disk, according to the state accuser, the virus program is written down.
Earlier state accuser asserted that this virus was obtained during special investigative activities from technical communication channels used by programmer Dmitry Artimovich up to August 11th, 2010. However, after lawyers with the assistance of the invited experts established that the virus program had been created on 17th of September, and then written down on a disk on 22nd of September 2010 - more than in a month after it has been ostensibly extracted by inspectors during special investigative activities, previously declared version of vents from side of investigation appears to be unpersuasive.
The answers which were given by both experts differed only in regard with phraseology, but not sense. So Grigory Anufriev, carefully selecting each word, explained that on 17th of September the program has been assembled in an executed file from initial texts. PETools program shows date of compilation of a virus file - 17th September. Alexander Andriishin in another words said that the date of 17th September is shown as the date when the program has been created from initial files.
Certain interest was represented also by checking whether one of the laptops obtained from Igor Artimovich have been switched on after confiscation. Expert Anufriev and expert Andriishin have agreed that on June 9th, 2010 before a search took place the laptop was switched off, but there are obvious signs that next day - 10th of June, it was used.
Lawyers tried to understand, whether Artimovich somehow could program his laptop so that it would start working automatically on next day.
Alexander Andriishin has confirmed that «it is almost improbable», but it is "theoretically possible".
Grigory Anufriev has expressed less unequivocal opinion, having noticed that he did not experiment with the PGP-program during examination. «If the computer has been switched off, and then someone wanted to log in, that, I believe, the password [nevertheless] was necessary, but, considering that I did not carry out experiment, I cannot exclude possibility of non-standard inclusion».
The nearest judicial hearings on concerning this case are planned on 10th of June, at 13:00, and from June, 18th the judge plans to begin interrogation of defendants. Judging by many signs, the case is reaching its finish line.
The defendant is arrested again despite that there was no judgment delivered after a year of court hearings.For such unexpected turn in the case of Vrublevsky, Permyakov and brothers Artimovich little was done. Witness form the prosecution side Nikita Yevseyev claimed that Vrublevsky, who called him by mobile telephone on April 29th and 30th, was trying to bribe and frighten him; as a result, prosecutor Kotov requested an arrest of the suspect. Absence of any convincing evidence regarding the fact that Vrublevsky tried to affect the witness, were ignored by both the prosecutor, and the judge.
Is the case of Russian financier Pavel Vrublevsky reaching a finish line?
Psychological warning or a sign of coming conviction?
Background
According to the investigation, Vrublevsky acted as initiator of the ddos-attack, having passed its technical implementation to the former employee of FSB, Maxim Permyakov, and programmers Dmitry and Igor Artimovich. The motive of the ddos-attack by Vrublevsky according to judicial scrutiny was an attempt to expose the competing company "Assist", by showing its vulnerability and inability to protect business partners from cyberattacks. From July 15th to July 24th , 2010 during the summer when the capital was literally filled with smoke because of the fires on peat bogs near Moscow, ddos-attack paralyzed "Assist’s" business operation. That time "Assist" was one of the companies provided electronic payments for the largest Russian airline "Aeroflot", whose controlling stake belongs to the state. Representatives from “Assist” declared that the damage caused to the company equaled 15 million rubles (about $500.000). But "Aeroflot" estimated that the losses (more precisely missed profit) reached the amount of 146 million rubles (a little less than 5 million dollars).The version of the public prosecution side would look more convincing if there were proofs that "Aeroflot" plans to continue business cooperation with "Asisst". Actually, in July 2010 when "Aeroflot" held tender regarding the choice of payment decisions, the "Assist" was not among the competing contestants. As "Aeroflot" expected to choose a provider of payment services which could offer the unified scheme (processing) valid for all its management departments and structural divisions, the probability that "Assist" could keep the contract without participating in this tender is extreme small.
On the contrary, “Chronopay” participated in the tender, and it’s impossible that its employees did not know that "Assist" was absent among participants.
One year passed. Vrublevsky had an opportunity to leave the country for holidays and never come back to Russia, but he behaved as if he did not realize an approaching danger. In July 2011, when he and his family, wife and three juvenile children, were coming back from Maldives Islands, he was arrested in the Sheremetyevo airport located to the north of Moscow.
Suspected of technical realization of a hacker attack programmer Igor Artimovich was released after two months in custody, but, at first, he received a doubtful pleasure of physical influence that is commonly used by Russian investigatory bodies. This young man in his thirties does not make an impression of the person with the athletic build and, moreover, does not look ready to bear physical pressure. Medical report attached to case files that was made by doctor Fedorov in the city station of medical aid located in Petersburg, in the presence of two witnesses, proves that the physical pressure was implemented. According to his experience, it’s clear that it is not required to be the lawyer Magnitsky that authorities allow to apply physical force towards suspect. On June, 9th 2011, after conducting medical examination in office №6 of Petersburg and Leningrad Regional Department of FSB, Dr. Feodorov estimated that Artimovich had «bruised head in parietal-temporal area and scratches in his forearms [1]».
By the autumn 2010 everyone had confessed (it should be noticed that in March 2012 Igor Artimovich refused statements giver earlier). According to the Russian standards, existence of these statements was enough to identify suspects and consider the case proven; therefore, the court would pronounce a fair sentence.
However, as hearings began in May 2011 it became clear that evidences from the prosecution side had essential shortcomings and contradictions, as well as, forensics were far from ideal; as a result, proceeding already lasts whole year.
Journalists who are following the developments on the case, can find different explanations to numerous contradictions and falsifications in this case, however, to neglect their presence would mean to simplify the occurred situation.
What did FSB declassified?
|
So, for example, the inquiry №147/ОU/2-2063 was transformed to the document №147/ОU/2-1500; №147/ОU/2-2317 - it was also found under №147/ОU/2-1503, №147/ОU/2-1502; the inquiry №147/ОU/2/2164, concerning electronic e-wallet owned by one of the suspects, was stated as inquiry №147/ОU/2-1504 in one of the resolutions.
Lawyers have counted in total 10 discrepancies like that and «has drawn a conclusion that the materials appeared in Russian Investigatory Department of FSB that was attached to the materials of criminal case are OTHER documents, than those that have been declassified; therefore, those that have been declassified are absent in case materials» [3]. Under the lawyers' statement, the documents passed to the investigators by special investigative unit, «were not declassified in compliance with respect to the order established by the law; also there are no data on a source that originated and presented this information, dates of reception are also unknown».
Assuming that these documents are declassified with violation of declassification rules, in January 2013 lawyers asked authorization to exclude these 10 inquiries from the criminal case [4] connected to special investigation activities towards suspects. Lawyers asked to exclude these documents from the evidence material as it «was received with violation of criminal procedure legislation».
The main argument of lawyer Ajvar was that the decision from May 12th, 2011 regarding declassification of the materials from special investigation activities and the judgment made by the Moscow State Court on September 30th, 2010 regarding operational procedures «declassified and presented material to the Investigation Department of FSB with essential violations of the CPC RF: as the documents contained the state secret, [they] could not be declassified by the head of the unit which is carrying out special investigation activities». At the same time article №13 «concerning the state secret» allows to declassify the resolution made by judge only on the basis of the judicial decision.
Lawyers also were concerned regarding how the dates were put down. Instead of the figure specifying a calendar year that the document should be dated, composers of inquiries wrote «present year» that complicates to define when the inquiries have been actually made.
|
The way the crime investigators dealt with classified documents can be named illegal and has created almost comical situation. The screenshot that shows the access to the Topol-Mejler control panel appeared to be a part of confidential evidences - the inquiry №147/ОU/2-1501 from May 12th , 2011. At the same time before this inquiry was officially declassification, the same screenshot was published by journalist, Brian Krebs[5].
The public prosecutor requested an explanation from FSB. In the official document dated 1/24/2013 №147/ОU/2-222 given by the deputy chief of the Operations Control Center of Information Security of the FSB, col. Zhestkov, stated that «after declassification of the materials of special investigation activities those documents were assigned with different serial number in respect to the original numbering of (before confidential) documents» [6]. This document even had not been sealed with a stamp.
It's unclear what happened with the initial numbers (confidential numbers). The lawyers themselves did not see the original documentation on the basis of which the declassified certificates have been made. Meanwhile, the Russian legislation allows court to consider results of the special investigation activities (such as, records of conversations and the data obtained from communication channels) as evidence, but not the documentation made on a basis of these evidences.
Nevertheless, judge Lunina agreed with an argument of the public prosecutor, having rejected the lawyers' petition to exclude 10 inquiries from the case materials.
Falsification of evidence
Lawyers also detected falsification of investigatory documents. They managed to find out that first chief deputy of Operations Control Center of Information Security of the FSB, Lutikov backdated the letter №ОU/2/389/1-49 made on September 8, 2010 [7], in order to give «visibility of legitimacy for the actions conducted by employees of FSB RF and obtaining information on CD №5109№09250046318. Together with the letter, Lutikov was meant to send to the CEO «Information Security Group» LLC this CD.
|
It seems to be that the CD has been received without the official sanction of court, and employee of Information Security Center FSB, Lutikov, backdated the document as on September 8, 2010 he could not be aware that on September 30th, in 3 weeks time, the Moscow State Court will authorize the decision to carry out special investigation activities. Hence, if this document was made, ostensibly, on 8th of September Lutikov precisely specified number of the statement that was authorized by the Court on 30th of September. This letter dated 8th of September was written after 30th of September and the date has been specified intentionally incorrect to give visibility of legality to actions of inspectors.
This trick has allowed inspectors to legalize illegally “the evidence material”, the CD №5101№09250046318 (originally numbered differently), therefore, permitted to be taken as a basis for the charges.
When lawyers found out about this falsification, on 5/13/2013 they addressed the powerful Investigatory Committee with the request to check thoroughly the circumstances of the case.
Debates around the examination conducted by the employee of Kaspersky Laboratory
One of the most significant document among other evidences is examination of the files which had been withdrawn from one of the confiscated laptops belonged to one of the accused. This expertise was conducted by Grigory Anufriev - the young expert of the well-known Kaspersky Laboratory that is engaged in manufacture of anti-virus programs [10].Expert from KL came to a conclusion that initial codes obtained from the laptop of the accused include all program functions that presumably attacked the server of the "Assist".
However, lawyers doubted regarding the choice of the Laboratory as expert authority. The defense claimed that the Laboratory can be considered as privy due to the fact that KL cooperated with the "Assist", therefore, it’s possible that judgment could be affected by personal interest. Also Kaspersky Laboratory is commercial entity; as a result, its neutrality could be affected by commercial interests. The public prosecutor, as well as judge Lunina had disagreed with this point of view, and examination remained in the case files. Though, the public prosecutor explained that Anufriev has participated as expert like private individual, the text of the examination had been assigned with Laboratory stamp.
|
Lawyers were surprised that examination, in their opinion, was short, and there was no interim results or/and calculations attached. Without any exaggeration considering a huge volume of the data which expert was forced to analyze, such as, laconism, as well as, his statement that certain calculations he could reckon in his mind, looked appropriate for private discussion, rather for judicial hearings.
Independent experts approached by lawyers with the request to analyze Laboratory's expertise, found shortcomings unlike the public prosecutor.
The Russian legislation demands that expert must specify a technique used to conduct research or examination. This requirement allows other experts to check the results of expertise by reproducing experiment. Grigory Anufriev did not specify the technique he used, as well as, special references where the methods of similar examinations would be developed and presented.
In particular expert Igor Yurin, a head [11] of so-called «The National Centre for the fight against crimes in the sphere of high technologies» acted in court as a guest expert, insisted on methodical discrepancy between examination of Kaspersky Laboratory and the task which had been set by inspectors. He stated that no expertise can prove injuriousness of any Software as court is the only authority that entitled to do so, and that there are no techniques of research regarding binary vand initial code of the programs based on reading the Bible and disassembly in mind.
In the courtroom expert Yurin has complained that during familiarization with Anufriev's examination he was not sure whether this file somehow had been investigated. Though, Anufriev also had mentioned that the file was detected by Kaspersky's antivirus, he did not specify the file codes, also nothing was said in regard to the presence or absence of overlay hinged protection. According to Yurin, the examination made in Laboratory did not display any code sections or any functional or other identifying signs.
Speaking in court, Yurin has compared the conclusions from the Anufriev’s examination and the document made for the investigators by GroupIB and found contradiction. Judging by hash, appeared in the document of experts from GroupIB, the investigated object called dropper: the variation of a program which itself does not pose any special destructive functions (such programs extract other file, place them on a hard drive, register file in the system, and, at last, start files. This is the only what dropper is capable of).
|
- Experts from Group IB, were specifying the value of hash while showing the exact data object (script - X) that was examined. To compare, Anufriev's examination did not mention neither hash, file size, nor the information on last access to an investigated file.
- The expert of Laboratory had admitted confusion, having specified that he used disassemble IdaPro 6.0 released “Datarescue”. It's important to notice that version 6.0. had been released by another company.
- Whoever released program 6.0., this program does not allow to recreate precisely the initial text of the program using high level language, but allows to obtain only a certain text in assembler language, except some primal case when the program consists of several lines, consequently, it is possible to obtain version close to the original. The reasons is that during compilation the names of variables, constants, functions are lost, at the same time some instructions are replaced by similar ones for optimization, that is to say the program obtains significant changes.
As for the public prosecutor, the judge and the lawyers who are not quite familiar with programming and are not experts in this field of high technologies, such details, certainly were difficult enough to examine. There is a risk that the court taking into account examinations and experts' statements will draw the conclusions based not so much on mathematical accuracy but on intuition and general impressions. Nevertheless, one of the comments from expert Yurin presented in the courtroom had to be understood identically by everyone: expert who analyses the results, can be tempted to make definitive conclusions, though, it is known that «even if he/she is well qualified in this programming language, it does not mean that he/she can properly understand and identify the initial code of the program written in the same language. It is especially relevant to the projects where considerable quantity of experts participated. There is a possibility that in such cases the developer can be confused in understanding what is going on in the program».
Hearings in 2011:
The judge refuses to consider case because of a poor quality of indictment, but the highest authority court cancels this decision.
The first attempt to carry out hearing was unsuccessful, then on 6/13/2012 judge Olga Alnykina satisfied the petition of the lawyer, Lyudmila Ajvar [12], and has decided criminal case
|
As judge Alnykina explained, «the bill of particulars does not meet the requirements of paragraph 5 of Part 1 of Art. 220 Code of Criminal Procedure RF»: instead of revealing the evidence and to clarify its indication, investigation unit «discloses [only] the list of evidence».
The judge has rejected the indictment not only because it did not correspond to the requirements of the Criminal Procedure Code of Russia but also because inspectors accusing all four suspects «in committing a crime under Part 2 of Art. 272 of the Criminal Code and Part 3. 33 [and] Part 1 of Art. 273 of the Criminal Code of the Russian Federation "», have referred, for some inexplicable reason, to the Russian federal law №28-FЗ from the March 8th, 2011, devoted to agreement ratification between the former Soviet Republics of Azerbaijans, Kirghizia, Russia, Tajikistan, Turkmenia and Uzbekistan «which is dedicated to creation of the Central-Asian regional information coordination centre against illegal circulation of narcotics, psychotropic substances and their precursors». Having found inappropriate reference, judge Alnykina has specified that it «does not regulate changes in criminal and criminal-procedure legislation» in Russia.
Public prosecutor Kotov was trying to convince the judge to disagree with the lawyers' request, claiming that due to "technical error" charge had been brought in improper edition of the law №28-FЗ from March 7th, 2011, but his arguments had been rejected. Further the public prosecutor repeatedly explained [16] various contradictions in investigatory documents as «technical errors» and «the human factor». However, these explanations compel to ask a question: what kind of challenges the court faced with: with a systemic defect and shortcomings of the Russian public prosecutor body that presumes that numerous errors regarding evidences do not disturb a judicial legal investigation, or with low-qualified young inspectors of the Investigatory Department of FSB.
|
Because the Russian judicial system cannot be considered independent by the European standards, the higher the judicial hierarchy the more dependent position. And if the district court decision can be sometimes unpredictable for the authorities and the public, it’s unlikely to expect surprises from courts of higher instances. And the decision which has been reached by the Moscow State Court in August, 2012 on the given case confirms the rule.
The short chronicle of judicial hearings for the first half of the year 2013
The aim for the hearings that took place on May 29 and June 5 was to reach the decision whether the punishment for Vrublevsky will be changed. The integrated witnesses, signatures authenticity of whom were disputed by expert-graphologist, became more intense for last months. At the same time, litigation had new unexpected turn in its development, thanks to a number of expert evaluations that had been announced from March till May, as well as to certificates of the interrogated experts. During the trials held between Aeroflot and bank VTB 24 that carried out financial transactions the distribution of forces began to change. In the first half of the year the court perceived the financial damage proclaimed by “Aeroflot”, according to the company, as a result of ddos-attack at the beginning of April when Aeroflot could not appeal against judicial decision passed by The Moscow Arbitration Court according to which the airline claim towards VTB24 was rejected, as a result, the charges against Vrublevsky and brothers Artimovich could be questioned. Even if VTB gained a political support, the fact that lawyers of “Aeroflot” could not prove a presence of a financial damage, cause the doubts regarding whether Vrublevsky is guilty in respect with paragraph 2 of Art. 272 CC that assumes obligatory presence of a considerable material of the (financial) damage.Despite that the court turns a blind eye on new amendments in the Article 272 CC and left accusation based on old (non-operational version of article of the Criminal Code) as relevant, lawyers still have an opportunity to achieve a charge to be requalified.
The defense that invited a several experts, whose arguments showed all ambiguity of the charges pressed against Vrublevsky and discrepancy of all examinations and expertise collected by investigation department, was convincing enough.
|
Later executive director of Consulting Group "Aspect", Anton Genkin, who was an expert back in 2010 invited by the company "Aeroflot" to conduct a tender in order to choose payment decisions system, had doubts whether “Aeroflot” was planning to continue business relations with the payment system "Assist". He mentioned that "Assist" did not take part in the tender conducted by “Aeroflot”, thus, the statement of the prosecution that Vrublevsky could organize ddos-attack to show weakness of the security system of competitors, therefore, to compromise them, is groundless.
Back in April Leonid Raev, an expert-graphologist, who graduated from the faculty of criminology of the Volgograd Higher Investigatory School of the Ministry of Internal Affairs, testified in court. Having made a reservation that he had opportunity to familiarize only with digital images and photocopies of investigatory reports and not with originals, he could not use the special techniques to investigate documents. Raev pointed out for the court numerous different interpretations in signatures of the same individuals. As a result, he stated that in some cases signatures have been put not by the individuals on whose behalf the document was signed.
Compromised selection of witnesses and falsification of signatures as a basis for the bill of particulars
On 5th of June graphologist, Raeva, testified one more time. During May he made a detailed analysis of the new samples of the signatures collected by lawyers what became additional argument that demonstrated the falsification of the signatures from investigatory reports. This expert estimation added persuasiveness to the statement made on 29th of May where witness, Anastasia Kurochkina, argued that her signatures contained in several investigatory reports, have been forged, and that she has never participated in any investigatory actions neither on the case of ddos-attack, nor on other criminal cases.Having noticed that signatures from the reports had a feature of slowness regarding their execution, in contrast, with mechanicalness, that is distinguishing feature as individual put his\her, though the years developed, signature. Raev ascertained essential distinctions between the samples of signatures from investigatory reports and other documents (in particular, in the judicial summons and examination sheet). In order to draw a certain conclusion, it is necessary to receive from inspector Dadinskij a list of signatures that were made on behalf of those individuals whose signatures were falsified by Dadinskij. Meanwhile, it can be assumed that all autographs belong to one person as they have common features, such as a wavy side of the endings and a triangular stroke with the termination located on the left.
|
Assuming that the person can possess an infallible memory, Raev has noticed that his arguments is possible to check, having asked «to examine around five» signatures. Reluctance of Yevseyev and Tisljuka and the inspector Dadinsky to provide the samples of the signatures, convinced graphologist that he is right regarded, as «plus to [the expert] conclusion», confirming, «that the expert is right».
Extremely ambiguously, considering that graphologist has found resemblance between handwritings that allegedly belong to the witnesses and handwriting of the inspector, on 5th of May inspector Sergey Dadinsky stated that in Russia «the witness institute is badly developed», that «people are afraid to go somewhere and participate in something»; «it is difficult to find individual who will be willing to spend with you as much time is needed», [preparing investigatory reports].
For now graphologist's estimations and some witnesses' testimonies suggest that the participation of Nikita Yevseyev as a witness who also with according to the religious canons is a relative to the inspector, is not accident. It allowed the inspector Dadinsky to issue many reports as ostensibly assured by Yevseyev, and then during private conversation to advise to write a petition which authenticity can be questioned.
On 29th of June public prosecutor Kotov has referred to Yevseyev's statements and petitions where he claimed that on 29th and 30th of April Vrublevsky ostensibly tried to bribe him and threatened him during the telephone conversations. These unsubstantial statements, perhaps, would sound plausibly but the defense offered a number of proofs showed that Yevseyev mislead the court while testifying on 29th of May.
It is important to notice that his statement contradictes with a number of statements made by the witness Anastasiia Kurochkina and the inspector Dadinsky who appeared in court on 5th of May as a witness. Yevseyev denied any contacts with inspector of The Investigation Department of the FSB that would not be relevant to the investigation process but Dadinsky described their relationship as friendly relationship, though he did deny any relations, for example, based on religious practices or ceremonies.
Meanwhile, lawyer Pavel Zajtsev [19] also provide the court with documents to be put with the case materials, such as the letter, from 5/30/2013, made by the archpriest of the Epiphany Cathedral, Alexander Ageykin, confirming that the inspector Dadinsky became a godfather of Nikita Yevseyev's son. Earlier on 29th of May, Yevseyev himself stated he is devout Muslim.
|
Did inspector forge the signature of his girlfriend?
More dramatic episode, than Vrublevsky's arrest, was the statement made by witness Kurochkina and stenographic expertise provided by lawyer Ajvar deciphered from audio record with conversation that was recorded between Dadinsky and Kurochkinoj on 20th of May. These citations indicate that the inspector tried to mislead the witness with regards to the accusations towards Vrublevsky, brothers Artimovich and Permjakov. Dadinsky asserted that the charges he pressed against suspects were connected with drug traffic, apologizing that he didn't let her know and put himself signature on her behalf. Nevertheless, the inspector considered admissible to ask Kurochkina to make a statement in which she would recognize these false signatures as her own, then he suggested not to appear in court on 29th of May claiming arrangement with the judge and the public prosecutor already have been reached.After these remarks were quoted in court Dadinsky did not made any statements denying the accuracy of the quotes.
It can be noticed that the behavior of 29-year-old Anastas Kurochkin was more courageous compare to the behavior of inspector Dadinsky, and other witnesses: Yevseyev and Tisljuka. She was the only one interrogated on 29th of May and on 5th of June who agreed to give to court the sample of her signature. Also unlike Dadinsky, she was tactful towards her former close friend and did not give any personal assessments about him. This courageous behavior is corresponds more to officer ethics, rather than negation, by the inspector, of the facts which have proved to be true in court.
Vrublevsky already was in custody, when Kurochkina has informed court that she received strange calls, also, including calls from detective agency. Unknown individuals called also to her work, asking, whether she has "office romances". Someone also called to her mother, assuring her that her daughter is blackmailer. As a result of such pressure, the witness has made decision to resign.
It is still unclear if Investigatory Committee and FSB undertook any actions regarding the request made by Kurochkina on 30th of May asking to give her the state protection and to clarify the circumstances of occurred false signatures made on her behalf.
Themis blinded in both eyes?
The Vrublevsky arrest occurred on 5th of June in a hall of Tushinsky District Court of Moscow became possible substantially because prosecutor Kotov ignored obvious infringement by the inspector Dadinsky at selection of witnesses paragraph 2.2 Article 60 CPC, forbidding all kind of relatives to participate in the role of witnesses in the criminal proceedings during lawsuit.As judge Lunin clarified her decision to change restrictive measure by arguing that «there is no grounds to doubt Yevseyev's statements», and that they «are objective and there are solid ground for imprisonment», the whole complex of contradictions and the absurdities containing in certificates of Yevseyev, provoked lawyers openly to declare to the court a presence of convincing evidence that not only Yevseyev, but also the inspector Dadinsky in some cases committed perjury. Lawyers Lyudmila Ajvar, Pavel Zajtsev and Igor Feldman did not hide the intention to get authorization to obtain the materials in order to prove that inspector Dadinsky violated the law, as well as, to build a separate criminal case against the witness on a basis of committing perjury.
In first half of hearings while Vrublevsky has not been arrested yet, lawyers had presented to court the texts, assured by notary Afanaseva, that were obtained from two mobile phones owned by Vrublevsky showing sms-massage exchange between defendant and witness Yevseyev who testified earlier. According to lawyer Ajvar, calm tone of these messages does not give any grounds to believe that Vrublevsky resorted to any threats.
Vrublevsky's arrest: false associations with Chronopay
For judge Natalia Lunina two incomplete days of hearings were enough that on 5th of June to make the decision on, whether to satisfy the petition of public prosecutor, Sergey Kotova, who asked on 29th of May to change punishment to Russian financier, Pavel Vrublevsky, from recognizance not to leave on 6-month's arrest.The press covering this news, positioned Vrublevsky as owner of payment system company "Chronopay". Actually, the company has co-owners, though, Vrublevsky founded the company back in 2003, within last two years he has completely departed from company affairs. At the time of last arrest Vrublevsky did not hold a position of CEO in "Chronopay" and did not participate in any activities on behalf of the company. His full attention was directed to created in 2012 fund RNP.
The first attempt to attain freedom
On 6th of June it was the first hearing that arrested a day earlier Vrublevsky watched from behind bars.The defense found the punishment unreasonably strict, as a result, lawyers files a petition to change the sentence from 6-months imprisonment to house arrest where his movements and possibility to use communication facilities would be limited.
Representing Pavel Vrublevsky's interests the defender Lyudmila Ajvar mentioned that witness' statements on which basis the financier was taken into custody were based substantially on guesses and assumptions and, consequently, cannot have legal validity according to the current legislation.
Public prosecutor Kotov traditionally objecting the petitions of the defense finished debates with the exclamation: «Are we waiting until he will organize liquidation of the witness?!» Considering the fact that witness Yevseyev who on 30th of April asked court to grant state witness protection because he found in the remarks of Vrublevsky reasons to be afraid for his safety, still did not receive state protection. Therefore, prosecutor’s observation regarding organization someone's "liquidation" looks rather comical and hardly convincing.
Nevertheless, judge Lunina has agreed with the public prosecutor that another measure of punishment (not connected with imprisonment) will not provide unobstructed judicial process and upheld the decision passed the day before on arrest of Vrublevsky.
From expertise that lawyers were planning to adduce by filing the petition on 6th of June, but the judge agreed to attach to the case materials only one, the expertise made by expert-graphologist, Raev. According to Lunina, even that graphologist testified 1.5 months earlier, he was so detailed by telling the court about the studied signatures that his observations represent obvious interest for the lawsuit.
Written by experts of NO «The Commonwealth of experts of the Moscow State Law Academy of the Kutafin» Gleb Shamaev and Anastasiia Semikalenova review regarding the examination of Kaspersky Laboratory, Grigory Anufrievs, judge Lunina has refused to attach to the case materials, having referred that the necessary "aspects" on this question have been considered by her earlier, and she does not see a necessity to use this review.
In second half of the hearing 6th of June lawyers and figurants of the case in the presence of the invited experts to scrutinize some electronic storages attached to evidences of the case, however that they did not have some technical devices necessary to conduct procedure methodically correct. Continuation will take place on Friday at 12:00.
Beforehand the defense expressed concern towards the invited candidate - employee of Laboratory Kaspersky, Grigory Anufriev - as an independent expert. Main objection for lawyers was the fact that Anufriev might be interested in acknowledgement made by him before as an expect, that he has interest to prove his previous statement made in court earlier insisting that all defendants are guilty. However, the public prosecutor managed to convince court that Anufriev will exercise only additional role: only «promoting realization of technical action». Participation simultaneously of two experts in acquaintance with contents of electronic devices was caused by the agreement taken in previous sessions between defense and prosecution to use one expert from each party to make sure that of the parties could affect the result in accordance with their interest.
Lawyer Ajvar, knowing possible objections that could be announced by the state accuser while attempting to remove the expert that could be seen as expert from the prosecutor's side, has opposed the other invited candidate, CEO of company "Chronopay" with the higher technical education Alexey Kovyrshin. When public prosecutor Kotov claimed that Kovyrshin can be seen as expert employed by Vrublevsky, company founder explained to the state accuser that Kovyrshin is the CEO and does not depend on shareholders such as Vrublevsky.
On 7th (?) of June lawyer Ajvar has submitted to the Moscow State Court the appeal on arrest of Vrublevsky. This appeal will be considered within 10 days.
The virus program has been written down on a DVD-disk when he was present at expertise in Group-IB.
During hearings on 10th of June lawyers managed to receive convincing information that the virus program blocked the payment system, according to the investigation, written down on a DVD-disk considered by court, as basic proof against programmer, Dmitry Artimovich, on September 22nd, 2010 when the disk, according to evidences, was at Group-IB - as they say on the website, «one of the leading international companies on prevention and investigation of cybercrimes and fraud using high technologies» where it have been sent for research from Investigatory Department of FSB.The expert of Kaspersky Laboratory, Grigory Anufriev, invited by prosecution, and expert Alexander Andriishin who works as programming engineer in "Information Innovation Company" LLC, invited by the defense, on termination of detailed examination of electronic devices (two laptops and a DVD-disk) testifying have solidary confirmed that the program has been created on 17th of September, and written down on a DVD-disk 5 days later, on September, 22nd, 2010. This information can affect a court course as on this disk, according to the state accuser, the virus program is written down.
Earlier state accuser asserted that this virus was obtained during special investigative activities from technical communication channels used by programmer Dmitry Artimovich up to August 11th, 2010. However, after lawyers with the assistance of the invited experts established that the virus program had been created on 17th of September, and then written down on a disk on 22nd of September 2010 - more than in a month after it has been ostensibly extracted by inspectors during special investigative activities, previously declared version of vents from side of investigation appears to be unpersuasive.
The answers which were given by both experts differed only in regard with phraseology, but not sense. So Grigory Anufriev, carefully selecting each word, explained that on 17th of September the program has been assembled in an executed file from initial texts. PETools program shows date of compilation of a virus file - 17th September. Alexander Andriishin in another words said that the date of 17th September is shown as the date when the program has been created from initial files.
Certain interest was represented also by checking whether one of the laptops obtained from Igor Artimovich have been switched on after confiscation. Expert Anufriev and expert Andriishin have agreed that on June 9th, 2010 before a search took place the laptop was switched off, but there are obvious signs that next day - 10th of June, it was used.
Lawyers tried to understand, whether Artimovich somehow could program his laptop so that it would start working automatically on next day.
Alexander Andriishin has confirmed that «it is almost improbable», but it is "theoretically possible".
Grigory Anufriev has expressed less unequivocal opinion, having noticed that he did not experiment with the PGP-program during examination. «If the computer has been switched off, and then someone wanted to log in, that, I believe, the password [nevertheless] was necessary, but, considering that I did not carry out experiment, I cannot exclude possibility of non-standard inclusion».
The nearest judicial hearings on concerning this case are planned on 10th of June, at 13:00, and from June, 18th the judge plans to begin interrogation of defendants. Judging by many signs, the case is reaching its finish line.
No comments:
Post a Comment