WASHINGTON _ A Russian major general now believed to be helping lead his country's missile and artillery efforts in Syria was behind the indiscriminate shelling in January 2015 of a Ukrainian town that left at least 29 civilians dead.
Working off of raw video, cellphone intercepts and information gleaned from social media and military websites in Ukraine and Russia, a joint reporting team that includes U.K.-based Bellingcat and McClatchy has identified nine Russian officers _ including Major Gen. Stepan Stepanovich Yaroschuk _ thought to have been directly involved in the military operation that killed and injured scores of civilians.
The shells that rained down on Mariupol came from two Russian artillery batteries transported on the eve of the operation into Russian-controlled territory in Ukraine.
The shelling was part of Russia's hybrid military operation in Ukraine, combining military support to ethnic Russian separatists with direct incursions into breakaway border regions. The goal was to extend Russian control in a country that was flirting with closer ties to Western Europe.
Russia had seized Crimea in early 2014, and its aggressive posture in the area led to strained relations and U.S. and European financial sanctions. The relationship soured further, and diplomatic expulsions followed, after Russia was accused of meddling in the 2016 U.S. presidential election.
Ukrainian President Petro Poroshenko last year brought charges against Russia before the International Court of Justice in the Netherlands, and these Russian military men likely will be dragged into that case. Ukraine must present evidence by June 12.
The identification of the military leaders is key because even if Russia does not extradite them to face justice, their travel abroad will be curtailed because of their penetration into a sovereign nation.
Their legal plight is similar to that of the Russians identified by the reporting team in a story last year as part of the chain of command responsible for downing Malaysia Air Flight 17 on July 17, 2014, over eastern Ukraine. All 298 people on board were killed after the plane was struck by a surface-to-air missile.
In both events, Russia has publicly disavowed responsibility and blamed Ukrainian forces. Its embassy in Washington declined comment for this story.
Bellingcat and McClatchy analyzed a large volume of intercepted calls to and from participants in the Mariupol attack, which lasted from the night of Jan. 23 into the early evening of Jan. 24, 2015.
The Ukrainian foreign ministry shared the intercepts with the reporting team hoping that an independent investigation could be compared against the conclusions the government reached in preparing its detailed court filing.
Many of the Russian officers used code names, and their true identities were learned from clues in the intercepted calls that allowed Bellingcat and its Russian-speaking associates to trace calls back to locations in Russia. The effort involved cross-referencing events, names and locations.
It was aided by simple mistakes, like when the men stationed far from home took calls from wives who called them by their real names, or when the wives posted to social media photos of themselves next to vehicles registered to their military husbands.
Once the commanding Russian officers were identified by Bellingcat, McClatchy worked with the University of Colorado's National Center for Media Forensics in Denver to compare voices on the intercepts to audio of the men found in videos or recordings posted on the internet. In several cases, the results were inconclusive and the team's identification process relied on other factors. But for two main players, the results indicated strong probabilities of a match.
Noisy, short recordings don't provide the best samples for audio analysis, and it is impossible to say with 100 percent certainty that any two speakers are the same. The Denver-based center uses complex algorithms and software to compute voice patterns and compare the voices in question against a broader sample of Russian-speaking voices to determine likelihood ratios.
How it unfolded
The siege on Mariupol began with a series of calls. A Russian colonel with the call sign Gorets, stationed in Ukrainian city of Donetsk, supervised the operation in the eastern border region with Russia. He received orders the morning of Jan. 23 to target sites in Mariupol and had to coordinate several artillery batteries.
The reporting team has identified Gorets as Alexander Iozhefovich Tsapliuk, 53, who was identified by Russian state media in June 2015, months after Mariupol's shelling, as the new head of a military institute with specialized artillery training in Penza, almost 900 miles southeast of Moscow.
The website PenzaInform.ru described Tsapliuk at the time as a veteran of several Russian operations in "hotspots," and said he received a special medal for "services to the fatherland." The website for the military institute includes photos of Tsapliuk, who after Mariupol was promoted to the rank of major general.
After comparing audio from publicly available videos of Tsapliuk with the intercepts of Gorets, the experts at the University of Colorado-Denver concluded that "it is 330 times more likely that the unknown speaker in the video is the known speaker Gorets than being another speaker."
The initial operation was to involve two Russian artillery batteries and a couple of local batteries that were part of the ethnic Russian separatist group known as the Donetsk People's Republic, or DNR. The Ukrainian government has designated DNR a terrorist group.
The phone intercepts show that Russian military units 08275 and 23626, each with six missile launchers, were ordered to move into eastern Ukraine under cover of darkness on Jan. 23 via the Ukrainian town Kuznetsi, to return after the daylong assault ended. (Later, international inspection of craters in Mariupol would determine the missiles were fired from Russian Multiple Rocket Launcher Systems.)
The Russian military units were joined by a Russian-supplied separatist battery unit from Donetsk. The shelling was to begin at 7:30 am on Jan. 24, but one of the two Russian batteries got lost overnight and crossed into Ukraine late.
Two transport vehicles from the other battery collided, effectively knocking out two of its six missile launchers.
At 8 a.m. Russian commander Gorets (Tsapliuk) ordered the shelling to begin with just the local separatist unit and one partial Russian battery firing on the town. The second Russian unit began firing on the town around 10:30 am.
But the intercepted calls show that by 10 a.m., before the second Russian unit opened fired, there were already reports residential areas had been hit and that there were issues with coordinates provided. Video posted by residents on YouTube show the chaos, with charred bodies covered by blankets and apartment buildings on fire, even a nursery school with its windows blown out.
Yet the attack continued for hours.
About 2 p.m. the commander of the Southern Russian Military District, referred to in calls as Stepan Stepanovich and identified fully as Major Gen. Stepan Stepanovich Yaroschuk, called Gorets (Tsapliuk) and ordered a halt to the shelling due to the unexpected arrival of a monitoring team from the Organization for Security and Cooperation in Europe, a 57-country security organization. Later that day, the OSCE issued a statement saying the missiles came from separatist-held territory.
The Ukrainian Defense Ministry alleges that later in 2015 Yaroschuk was sent to Syria to help coordinate Russian and Syrian artillery attacks in support of strongman Bashar al-Assad in the protracted Syrian civil war. That could not be independently verified.
The architect of the siege
At the time, Yaroschuk was artillery commander of the Southern Military District in Rostov, and officers in intercepts refer to him as the chief commander, or by the monikers The First and The Number One.
It's likely that a Russian officer above Yaroschuk would also have been involved in the Mariupol siege. In one intercepted call, Gorets (Tsapliuk) tells another person that Stepan Stepanovich's superiors are pressuring him for progress reports.
In another call, Gorets (Tsapliuk) complains that his opponents are having greater success.
"Whenever Ukrainian artillery fires, they always hit their target. Whenever DNR (separatists) artillery starts firing they can't get closer than 300 meters," he complains.
After receiving his orders from Yaroschuk to stand down, Gorets (Tsapliuk) can be heard on intercepts ordering that the mobile missile launchers be hidden in hangars and the equipment used to transport them, along with personnel, be hidden in surrounding forest until nightfall, when the battery units would head back into Russia.
Then, without explanation, the order was quickly reversed and battery units were told to return to positions and resume firing. Between 4 p.m. and 6 p.m., the Russian battery units then crossed back into Russia where they were believed to have met in early evening with Yaroschuk.
The other commander identified in part through audio analysis was Col. Sergey Ivanovich Lisai, the most senior ranking officer escorting the Russian battery units into and out of Ukraine. At the time Lisai was the artillery commander of Russia's 36th Army in Russia's Far East. The University of Colorado center's analysis of Russian news videos featuring Lisai and the phone intercepts led to the conclusion of "that it is 30 times more likely that the unknown speaker is the known speaker Lisay than being another speaker."
Identifying the others
The intercepts show several other Russian officers involved in the planning and carrying out of the attack. The reporting team identified them through means other than audio analysis.
_ A Russian colonel who went by the call sign San Sanich was sometimes referred to in calls as Alexander Alexandraovich, but in one key call is referred to by his patronym, Alexander Anatolevich. The intercepts show San Sanich supervised the parallel shelling by separatists, and was actually Alexander Anatolevich Muratov. He was identified by an intercepted call from his wife, whose phone was traced back to a Russian medical officer whose husband was an artillery commander at the same base, Muratov.
_ Another lieutenant colonel, identified by the team as Maksim Vladimirovich Vlasov, went by the call sign Yugra and was sometimes referred as Maks. He was identified by intercepted birthday calls on Feb. 15, including one from a hockey coach in remote Chebarkul in Chelyabinsk Oblast. The phone number for Vlasov's wife traced back to the same town, and social media profiles show Maks was stationed there, became a lieutenant colonel in 2012 and was a goalkeeper on a local hockey team.
_ A third Russian, identified as Lt. Col. Sergey Sergeyevich Yurchenko, was the man who used the call sign Voronezh and helped guide the Russian missiles fired at Mariupol. A March 2015 phone call to him from a woman using a Russian number led to discovery of her social media profile and evidence that she lived near the same base where Vlasov was normally stationed. A photograph of her standing next to two cars led the reporting team to pull the registration records on one of the cars, which belonged to her husband, Yurchenko.
_ Multiple intercepts reference a Colonel Klimenko, who made a birthday call to Gorets (Tsapliuk) on Jan. 16 and is addressed as Dmitry. He is now Major Gen. Dmitry Klimenko, but in February 2015 was a colonel in charge of artillery for the Eastern Military District in Khabarovsk.
_ Another call traces to a woman with the surname Gruncheva, allowing the team to identify first her and then her husband, Alexander Valeryevich Grunchev, an artillery officer in charge of a battery that shelled Mariupol. His call sign was Terek, and his wife is in photos with a car registered to him.
Intercepts show calls from an officer referred to as Oleg Leargievich. His surname is Kuvshinov, and he's identified in 2017 Russian military photographs as a major general.
Two of the individuals identified by McClatchy and its reporting partners seem to have faked their own deaths. Intercepts captured a call from a Russian mercenary using the alias Shram. He is Grayr Manukovich Egiazaryan. According to news sites in separatist territories, he was killed in fighting on Feb. 27, 2015. But he appears in YouTube videos dated October 2015 and one of his social media account remains active.
Then there's the man who went by the call sign Pepel. He was identified by a captured "spotter" for the Russian forces as Alexander Mikhailovich Evtody.
Media reports on Feb. 2, days after Mariupol, said he was killed on the battlefield.
The reporting team identified eight social-media profiles for Evtody, and he logged in to three of them between Feb. 2 and early April 2018.
Bellingcat set up an account on the Russian social media site VK, using a photo of Pepel's former commander and a random name. Then the fake account sent a request to Evtody's VK account asking to be added to Evtody's contact list. Seeing the photo of his former commander, Evtody contacted the fake profile and provided his new phone number.
Bellingcat called the number and asked Evtody for an interview. He said he'd consider it, hung up and has been unreachable since.
