# Surkov leaks

In October 2016, Ukrainian hacker group CyberHunta leaked over a gigabyte of emails and other documents alleged to belong to Russian political operative and senior Kremlin official Vladislav Surkov. Known as Russia's "grey cardinal", Surkov served as a political adviser to President Vladimir Putin in the conflict in eastern Ukraine and is the architect of Russia's ideology of sovereign democracy.
The document leak included over 2,300 emails from Surkov's inbox. The emails illustrate Russian plans to politically upset Ukraine and the coordination of affairs with major opposition leaders in separatist east Ukraine. The release included a document sent to Surkov by Denis Pushilin, former Chairman of the People's Council of the Donetsk People's Republic, listing casualties during 2014. It also included a 22-page outline of "a plan to support nationalist and separatist politicians and to encourage early parliamentary elections in Ukraine, all to undermine the government in [Kyiv]."
The Kremlin has said that the leaked documents are fake.

## Authenticity

Washington think tank Atlantic Council's Digital Forensic Research Lab analysed the emails. They determined that they were genuine, based partially on the routing information. Independent website Bellingcat also determined the authenticity of the emails.
Russian entrepreneur Yevgeny Chichvarkin confirmed that his emails from the document dump were authentic, saying "Yes, this is my original text." Russian journalist Svetlana Babaeva also verified that her three emails from the leak were genuine.
Kremlin press secretary Dmitry Peskov suggested that the emails did not belong to Surkov, saying that he "does not use email." Oleksandr Tkachuk of Security Service of Ukraine stated that they had managed to "authenticate a number of documents in the release" but could not confirm the authenticity of the entire batch of documents.

## Publication

The leaked correspondence was obtained by alliance of hacktivists calling themselves the Ukrainian Cyber Alliance. They secured the release of thousands of emails and documents in a 1GB Microsoft Outlook data file. Which were then analyzed by a second group, Inform Napalm, an open-source journalistic investigative group, and finally published online in three batches.
The first two batches, known as 'the Surkov Leaks' were published on the internet on 25 October and 3 November 2016, included correspondence from Surkov's office email account. The third batch was published on 2 November 2017, these contained correspondence from Surkov's first deputy, Inal Ardzinba and Kharkiv Communist Party leader Alla Aleksandrovska. The material made available was from September 2013 to November 2014, when Russia was pursuing its 'Novorossiya' project. Inform Napalm reported that the hackers also were in possession of documents from 2015 and 2016 that were being analysed by intelligence agencies and were not released due to their operational value.
New batches of emails from the leak were further published in November 2017 and April 2018.

## Contents

The document leak was a Microsoft Outlook data file (.PST) that included 2,337 emails from the inbox of Surkov's prm_surkova@gov.ru. The released material covers a period from September 2013 to November 2014. The email address appears to have been an office account run by Surkov's aides, including "Masha" and "Yevgenia". Among the documents were scans of Surkov's and his family's passports. While the vast majority of the emails comprise routine briefings and schedules, a small handful are of geopolitical significance or potentially incriminating. These emails illustrate Russian plans to politically destabilize Ukraine and the coordination of affairs with major opposition leaders in separatist east Ukraine.
An email sent to Surkov and others on 14 June 2014 by Denis Pushilin, the former Chairman of the People's Council of the Donetsk People's Republic, contains a document listing casualties that occurred from 26 May to 6 June 2014. The list of casualties includes a row for an unnamed soldier listed as "VDV Pskovsky" ("ВДВ Псковский"), a designation for a deployment of Russian Airborne Troops (VDV) from the city of Pskov. Paratroopers based in Pskov were thought to be among the first of Russia's covert casualties in Ukraine in 2014. The Pskov-based 76th Guards Air Assault Division was awarded the Order of Suvorov by Putin for unspecified tasks in August 2014.
An email sent to Surkov from a Russian government account on 18 June 2014 detailed the practicalities of Russia absorbing a portion of Ukraine. An email attachment included a briefing paper titled "On the Risks of an Economic Blockade of the LNR and DNR". The paper noted that 30% of the Donbas electrical supply comes from power plants in Zaporizhzhya. The document includes suggestions to supplement electrical supply in Donbas with power from the Rostov Nuclear Power Plant in Russia. The document's author also suggested increasing iron ore shipments and connecting Donbas to the Voronezh Oblast electricity grid.
One of the emails to Surkov from Konstantin Malofeev contained a list of recommended candidates for positions in the separatist government prior to their appointments.
The documents also included a spreadsheet containing the budget for a newspaper in Donetsk.
On 25 August 2014, a Russian official forwarded an email to Surkov from Russian Reporter editor Vitaly Leybin. The email bore the title "corrections in the text" and concerned a letter to the Ukrainian government from the "public representatives of the Donbas." A nearly identical article, purportedly from citizens living in Ukraine, appeared in Russian Reporter days later with only minor changes. Within the week, the letter had appeared on Russia Today and other Russian websites.
One of the documents included in the leak was a 22-page outline of "a plan to support nationalist and separatist politicians and to encourage early parliamentary elections in Ukraine, all with the aim of undermining the government in [Kyiv]."