Open source forensic research on how the attack was carried out

On May 9, while the so-called “Russian world” celebrated Victory Day, Latvian Minister of Foreign Affairs Edgars Rinkevics tweeted about an attack on the Latvian embassy in Moscow.

Embassy of Latvia in Russia was attacked this evening, two persons have been detained, Latvia strongly condemns such provocations and demands Russia to fully ensure security of Latvia’s diplomatic missions in accordance with international law

— Edgars Rinkēvičs (@edgarsrinkevics) May 9, 2018

The unregistered National-Bolsheviks party “Drugaya Rossiya” (Другая Россия) in Russia took responsibility for the attack after posting a video on their VKontakte (ВКонтакте or VK) page of smoke bombs being thrown at the embassy.

https://www.youtube.com/watch?v=X1kXjoa7eyA

Using open source evidence, @DFRLab was able to pinpoint the scene of the attack. The buildings visible in the video matched with the buildings on the Google Street View near the Latvian Embassy in Moscow.

The damage on the façade (pink box) appears on the right side of the video footage as the cameraman turns a corner in the beginning of the video. This suggested the person who filmed the attack stood around the corner by the open gates of the pink building on the right.

Later, “Drugaya Rossiya” posted a photo of two National-Bolsheviks, Olga Shalina and Gleb Buvanenko, on its Facebook page, confirming the fact that the two were detained by police. The post also suggested that the attack was carried out as a response to the detention of Valdimir Linderman on May 8 in Riga, Latvia. Linderman is a Latvian pro-Kremlin activist and a member of the National-Bolshevik party since 1997.

The post read:

NAZBOLS SHALINA AND BOVANENKO REMAIN INTO POLICE CUSTODY UNTIL THE COURT

National Bolsheviks Olga Shalina and Gleb Buvanenko, were detained for a protest at the Latvian embassy, ​​and charged according to the Article 20.1 of the Administrative Code of the Russian Federation (petty hooliganism).

Activists will stay the night in Basmanny police station before the trial.

At about 18:00 the National Bolsheviks attacked the Latvian Embassy in Moscow.

National Bolsheviks threw smoke bombs at the embassy of Latvia.

Yesterday the Latvian Security Police detained Vladimir Linderman, and started a criminal investigation of the All-Latvia Parent Assembly — an open conference at which discussion was held on how to achieve the abolition of the ban on Russian in Latvian schools.

National Bolsheviks protested the detention of a prominent Latvian politician and human rights activist.

According to a Russian journalist and human rights activist based in Finland, Oxana Chelysheva, Lindeman was brutally detained by masked men on May 8.

Chelysheva’s post read:

Vladimir Linderman was kidnapped by men in black uniforms and masks, just now in Imanta. These people drove up to the bus stop, knocked Linderman to the ground and dragged him to a minibus. A few more people sat inside. All in masks. There was no police identification on the bus. This happened at 3 pm.

P.S. At 16:00 it became clear that this was the way the Latvian security police operated. Now Jelena Kvjatkovska is going to see him. A search is carried out at his place. According to the information available, the mask-shows were organized by the investigative team in the criminal case in connection with the Parents’ Assembly, which was organized by the Russian Social-Democratic Party to discuss education in Russian.

P.S.S. Latvians were among the witnesses of the abduction. Both the people and those who stood at the bus stop, and those who ran up, shouting that it was necessary to call the police, were in shock. One said: “In 37th they took at least in night. And these people are ready to do anything.”

The Latvian security police confirmed the detention in a press release on May 8. The cause for detention was a criminal case launched on April 18 for a possible “crime against the country” during an All-Latvia Parent Assembly that took place on March 31. A “crime against the country” implied that a person created a danger for the country’s sovereignty, independence, security, or the country’s economic and political system.

The aim of the All-Latvia Parent Assembly was to prevent the so-called “Russian schools” in Latvia to start teaching in Latvian. @DFRLab first reported about the dissatisfaction with the legal changes on the Russian language community in Latvia in October 2017.

There were at least three smoke bombs thrown at the Latvian Embassy in Moscow.

The visual evidence from the video footage suggested that the smoke bombs were thrown from at least two locations.

The smoke trajectory for the first smoke bomb thrown (the green line and the circle on the left) suggests that the attacker stood by the “Fitospa” (Фитоспа) opposite the embassy building. The second place where the attacker lit the second smoke bomb was located over ten meters further down the road.

Later in the video, a man, presumably responsible for the attack, emerged from the smoke. The image quality did allow us distinguish unique facial features for a positive confirmation; however, the general characteristics matched with Gleb Buvanenko, one of the alleged attackers.

Conclusion

The National-Bolsheviks party “Drugaya Rossiya” confirmed that people who share their ideology were responsible for the attack on the Latvian Embassy in Moscow on May 9. The attackers threw at least three smoke bombs at the embassy from the other side of a street.

Police detained alleged perpetrators, Olga Shalina and Gleb Buvanenko. The man in the video footage released by “Drugaya Rossiya” shared some visual similarities with one of the detainees.

The attack was carried out in protest against the detention of a member of the National-Bolshevik party Vladimir Linderman, who is suspected in a criminal process for a “crime against the country” in Latvia.

Follow along for more in-depth analysis from our #DigitalSherlocks.