Russian diplomatic facilities serve as SIGINT nests in Europe

Budapest: Baikonur-like antennas on the roof

On February 24, 2023, just like in Warsaw, protesters gathered in Budapest near Russia’s embassy on Bajza Street. Hungarian citizens rejecting both Russia’s invasion of Ukraine and the Hungarian government’s pro-Kremlin policies were joined by many Ukrainians who had fled their country.

The building, close to the tourist landmark Heroes’ Square, became the Russian embassy after the 1945 Soviet occupation of Hungary. Just across the street, the Russians have set up their trade representation (Rustrade); moreover, a Russian cultural center was opened just a few blocks away. 

According to multiple former Hungarian security officers, all three locations are well-known to local counterintelligence as nests of Russian espionage. Antennas not only pop up on the embassy compound’s roofs, but, from time to time, atop the Rustrade building too.

“When there’s a protest nearby, Russians are capable of monitoring phone traffic and collecting the data and identifiers like IMEI numbers of nearby mobile phone devices,” said one former counterintelligence officer. 

According to the officer, Russians have taken full advantage of this technology. Combining their electronic communication interception abilities with the embassy building’s CCTV cameras, they monitor protests to identify and gather sensitive data on their Hungarian critics. More recently, on local Ukrainian groups too.

These activities date back years. Six years ago, when a small protest titled “Let’s stop Moscow!” took place in front of the Bajza Street embassy, a national security expert commenting for a news site anonymously warned protesters about invasive electronic surveillance operated on Russian embassy grounds.

“You can’t really do anything [about it], it’s Russian territory. At most, turn off or leave the phone at home when you see that their rooftop looks like Baikonur,” the expert said at the time, comparing the antennas bristling from the roof of the Russian embassy to the famous Russian spaceport.

Pictures taken by us in late March 2023 show that the Budapest embassy’s roof still looks like a miniature version of the Baikonur Cosmodrome. There were around 10 visible devices, mostly star-shaped so-called discone antennas, and a container similar to those spotted on other Russian embassy rooftops. The one in Budapest seems to be made of wood.

“It’s the garden shed-looking container that’s most interesting. Those are suspected of hiding a sophisticated GSM mobile phone signal surveillance device as well as radio wave activity reconnaissance equipment,” said a former Hungarian intelligence officer with knowledge of the embassy’s SIGINT capabilities. The source added that it’s nothing new, similar surveillance containers hiding such tools have constantly been present on the Russian embassy’s rooftop. 

According to this source and other former counterintelligence officers, for many years the Russians have been able to surveil radio wave activity within a radius of about 30 km from their Bajza Street outpost.

Budapest embassy rooftop with wooden shed. Source: Vsquare

This covers the entire larger Budapest area with government and military institutions and the country’s main airport. Their equipments’ reach stretches to more distant locations frequently used by Russian intelligence for secret meetings, such as the town of Szentendre and the woods of the Pilis Mountains. Besides, they also have technology to eavesdrop on GSM mobile phone conversations with a wide radius.

Meanwhile, a governmental foreign policy research institute is based right next door to the embassy, and the main headquarters of PM Viktor Orbán’s governing Fidesz party is just two blocks away. Hungary’s government did not respond to our media request.

Bratislava: photos of every new device are shared with allies

In Bratislava, the Russian embassy stands behind a high fence and a landscaped park on a street renamed after Boris Nemtsov, the murdered Kremlin critic. The yellow villa, surrounded by a large plot of land, is within a few hundred meters of Slovakia’s National Council, the Office of the President, and the Prime Minister’s Office.

Many antennas of different types and shapes are installed on the embassy compound’s roofs. In April 2023, our Slovak partner Investigative Center of Jan Kuciak (ICJK) counted four parabolic antennas, several discone antennas, a long dipole antenna, and several vertical antennas. However, experts interviewed by ICJK point out that the most important devices are installed under the roof, and cannot be seen.

In Bratislava, not only the main building of the embassy has a pitched roof, as do the buildings of the Russian trade representatives and the cultural center. ICJK’s sources close to Slovak intelligence services confirm that these three buildings can be used for Russian espionage purposes.

“First of all, it serves as a kind of communication system for their staff. We found out that they [Russian agents with diplomatic cover] always have some devices for some kind of protective purposes. And what is on that roof is related to that. But it also monitors our radio waves, and communication on our territory,” a source close to Slovak intelligence told.

And not just “our territory,” the source said, pointing out that Bratislava’s Russian embassy is also close to Austria, the Czech Republic, and Hungary. And then there is the alleged NSA SIGINT station on Konigswarte, a hill in neighboring Austria just 7 km away from Slovakia’s capital.

“Of course, we are not naive and we know very well what, in what way, and with which technology representatives of the Russian intelligence services operate under diplomatic cover, and we would be naive if we did not take adequate countermeasures,” Minister of Defense of the Republic of Slovakia Jaroslav Naď told ICJK.

The source close to Slovak intelligence gave some examples of what Russian technology they managed to identify. “Monitoring of GSM networks, IMEI, but in theory, I can imagine that there could also be systems for intercepting calls. These days, however, they use a system similar to Pegasus [the Israeli spyware capable of secretly hacking mobile phones and turning them into covert listening devices], but they handle that from Moscow,” the source explained.

Antennas on the rooftop of the Russian embassy in Bratislava. Source: Vsquare

As the Russian embassy rooftop antennas and containers look very similar everywhere, there is a lot of cooperation and intelligence sharing within the NATO alliance. “We monitor intensively, visually and otherwise, what facilities are at the Russian embassy. Really, every time they install something new there, we immediately send photos to the allies and consult with them about what it is, and what it is for,” the source close to Slovak intelligence said. 

Another Central European intelligence community source specified that they conducted helicopter flights above the local Russian embassy and took aerial photos multiple times a year. Previously, the country’s foreign intelligence was told by a partner organization that the Russians had installed equipment on the roof that could intercept and record phone conversations. 

“Intel shared by a NATO ally suggested that it’s the very same equipment that’s turning up in other countries, the same stuff,” the source explained. 

And why the need for those shed-like containers on top of embassy roofs? One reason is to hide the equipment from helicopter or drone reconnaissance flights, according to the source. Containers, according to Western intelligence agency sources, can also be used to hide the direction of eavesdropping antennas. 

Hijacking satellite communications and other practices

The Russian embassy building in the center of Warsaw is surrounded by a dense park. Its fence borders a building of the Polish Defense Ministry on Klonowa Street. “We had been issuing instructions over the years to Defense Ministry officials not to hold any important talks there from the point of view of security,” says one former Polish intelligence officer. A special bunker was to be used for meetings of special importance, while the main MOD headquarters is located in a different part of the city.

Photos of the roof of the Russian embassy building in Warsaw show a few types of antennas – similar antennas are visible on the roofs of Russian embassies in Bratislava, Stockholm, Brussels and other European capitals. We asked Western SIGINT experts about specific antennas we found in different countries.

Container on the roof of the embassy in Stockholm. Source: Mattias Carrlson/ Expressen

“They are ‘classics’ when it comes to diplomatic communication, precisely because they are widely applicable. This means that you can use one and the same antenna at different frequencies and, therefore, for different types of communication, without having to make adjustments to the antenna itself or its position. At the same time, it also ensures that you can limit the number of antennas,” explains an expert interviewed by journalists from our Belgian partner De Tijd.

What types of eavesdropping can be carried out using such antennas? 

According to the expert, they collect mainly signals from geostationary satellites, though telephone signals could also be intercepted with such equipment, for example, from the Thuraya system.

Thuraya is a satellite system that uses only a few satellites, each covering a large part of the world. The Thuraya 2 satellite serves all of Europe and parts of Africa and Asia (to maximize capacity, signals are distributed in more than 200 regional cells). 

Some cities, like Brussels, lie at the intersection of these cells. In Belgium, it is therefore technically possible to eavesdrop on the conversations of users from the Benelux, Switzerland, large parts of Germany, France, and the UK (as already shown by the Snowden leak).

In October 2022, journalists from De Tijd and the Dutch Nieuwsuur described the behind-the-scenes operation of the Russian embassy in Uccle, a district of Brussels. They pointed out the large satellite dishes on the rooftops of buildings within the outpost. Based on analysis of photos and data, as well as interviews with sources in the Belgian and Dutch services, they concluded:  “They are used for more than just watching Russian state television. The embassy is a mini village with a communications center and technological facilities for Russian intelligence services.”

The Uccle outpost has also played an important role in Russian clandestine operations outside Belgium.

In Warsaw, on the roof of the building on Beethoven Street, or in Hungary, Sweden  or Brussels, you can also see so-called discone antennas, with a short central mast with numerous conical branches. According to a Belgian expert, “They can also be used fairly flexibly, but because of the frequencies they receive they are more suitable for local signals. Taxi companies use them, you can use them to receive communication between pilots and the control tower near an airport and catch the (nowadays encrypted) radio signals from the police.” Embassies could also use them to communicate with staff outside the embassy grounds via their own, encrypted radio.

In Budapest, the many discone antennas of the Russian embassy are mainly used for the encrypted communication of Russian intelligence, but can also be used for eavesdropping, according to former Hungarian intelligence officers.

Discon antenna on the roof of the Stockholm embassy. Source: Mattias Carrlson, Expressen

We also find a less typical antenna on the roof of the Russian embassy in Stockholm, with four crossed arms. The Belgian expert continued, “You can see from this antenna that it has been ‘shortened’ with coils. It should actually consist of a much longer mast to optimally receive a certain range of frequencies, but that is often not feasible. You cannot find out exactly which frequencies these are, but you can see here that it has been set up for a certain, specific application.

“The horizontal part tells me that reception is aimed at relatively short distances, less than 500 kilometers approximately.” That is much less than the distance between Stockholm and Moscow and therefore suggests that this is not about communication with the home base. “One of the possibilities of such an antenna would be to intercept shipping communications,” the expert assesses. 

What activities can the Russians carry out from the embassy in Stockholm? Daniel Stenling, counterintelligence chief with Sweden’s National Security Service (SAPO), told Expressen’s reporter “I don’t want to go into more details because then we’d sort of reveal what we know and make our work more difficult. But I can say that the Russian embassy in Stockholm has the technical capacity to conduct technical surveillance – that’s the way it is.”

Antennas and surveillance equipment need operators, too. In some places, surveillance equipment at Russian embassies is run by technical support staff under control of the Federal Security Service (FSB), the successor to the KGB.

According to a former intelligence officer from a Central European country, “This technical staff also supports the intelligence operations, for example by controlling the radio activity detection equipment. This is for defense and operational security purposes: the technical staff is trying to identify radio wave activity around their embassy or other important objects, so that they can detect the work of the local counterintelligence. 

“So-called counterintelligence surveillants, or watchers, who are keeping an eye on the Russian embassy and its diplomats, usually communicate through radio or mobile phone. The Russians try to detect both. So if they see that the radio traffic around their buildings, cars, or agents is increased, they immediately stop their operation to avoid being compromised,” the source explains.

Ferenc Katrein, former operations director of Hungarian counterintelligence, confirmed the FSB dominance in overseeing technical staff. “FSB is responsible for the protection of [Russian] embassies and its staff, and operational security,” he added.

Baltics: Spying from land, air and sea

When it comes to Russian SIGINT operations in Baltic countries, things get more complicated. 

A good example is the Russian embassy in Tallinn’s Old Town, a large compound between Pikk and Lai Streets. According to the investigation of our partner Delfi Estonia, a white square satellite communication antenna and at least four satellite dishes are visible on the roof. However, Delfi Estonia confirmed from two different sources that the Russians are keeping some more advanced equipment hidden in the attic under the roof.

Without naming the exact technology or equipment, sources told Delfi Estonia that the Russian embassy’s tools are used both for securing their own intelligence operations and detecting Estonian counterintelligence presence. Like in Hungary and other places, these may include the detection of radio signal activity as well as collecting all possible data on mobile phones active nearby, like IMEI identifiers and phone numbers.

The roof of the Russian embassy in Tallin, Estonia. Source: Holger Roonemaa, Delfi

In Vilnius, the Russian embassy’s roof doesn’t reveal too much. However, multiple experts suggested to our partner Lithuanian National Television (LRE) that it doesn’t necessarily mean there’s nothing there. “Russians tend to hide the most sensitive equipment inside their embassy compound, and not put it on the roof anymore,” a former senior Lithuanian security officer said. 

Another expert, a former Lithuanian military counterintelligence officer, agrees. “Note the slope of the roof. […] The roof of the Russian embassy in Lithuania is pitched. It is possible to hide sensitive SIGINT equipment under it,” the source said. 

From at least the mid-2010s, Russian intelligence also used movable equipment for electronic surveillance of the most important targets. Western intelligence knows to “‘look for a microbus’ as Russians use microbuses for that sort of SIGINT equipment,” the former Lithuanian senior security officer told LRT. 

But in the Baltic region, main SIGINT threat is not necessarily coming from local Russian embassies.

“We confirm information that Russia is conducting signals intelligence against the Baltic States from Russian and Belarusian territory. The FSB and GRU radio-electronic intelligence centers are deployed in Russia’s Kaliningrad region to assist Russian intelligence services in gathering information from telecommunications networks on Lithuanian citizens, civil servants and other persons of interest to Russia,” Lithuania’s State Security Department told our partner Lithuanian National Television (LRT). 

“In countries more distant from Russia and Belarus, intelligence services use fixed SIGINT installations on the roofs of Russian embassies and other diplomatic missions,” they added.

Lithuania’s State Security Department specifically named the settlement of Verbnoye in the Kaliningrad region where part of the FSB’s SIGINT capabilities are deployed. Our partner Delfi Estonia also mentions Krasnoye Selo near St Petersburg as a second, and Neyolovo, near Pskov, as a third FSB SIGINT station. 

The FSB station in Neyolovo is just 25 kilometers from the Estonian border and a few hundred meters from the Petseri-Pskov road. According to satellite photos, it is equipped with at least nine satellite dishes – the largest is up to 20 meters wide – but radio masts and very likely internet cables also connect to the station. Sources told Delfi Estonia that the FSB is suspected of directly spying on Estonia and the other Baltic states with their SIGINT capabilities. But given Neyolovo’s alleged advanced space intelligence capabilities, their target area may be even wider.

It is not only the FSB that’s involved in such operations. Security expert Gintaras Bagdonas, a retired Lithuanian colonel, told LRT that Russia’s military intelligence, the GRU may target the Baltic country with its hardware from the Kaliningrad region, the Baltic Sea and Belarus. Moreover, even the Russian army’s electronic warfare, air defense and artillery units stationed in the proximity of the Baltic region can be used for SIGINT collection since they are equipped with suitable technology, the security expert says.

He also highlights the possible use of Il-20 and Tu-214R reconnaissance aircraft, which are equipped with more sophisticated ELINT (electronic intelligence) and SIGINT technology. “The Il-20, commonly referred to as the Coot, (…)  is commonly used in the Baltic States to spy on NATO member states and is believed to have operated in Syria. The aircraft can be used to collect communications and signals information from a hostile country,” Bagdonas explains. 

The latest Russian Tu-214R aircraft is not only enhanced with sensors for ELINT and SIGINT tasks, but all-weather radar systems and electro-optical sensors for ground imaging. It can intercept and analyze signals from almost everything, and collect imagery and locate targets, even if camouflaged, the retired colonel adds. However, this aircraft is still rare. According to open sources, Russia only had two such aircraft in 2022, both manufactured for the GRU. 

A former Lithuanian military counterintelligence officer confirms this to LRT: “The Russians also use surveillance planes. They are in service and based on Belarusian territory, take off from there and then follow a route along the Polish border and the Baltic Sea.” 

Then there are the surveillance ships. Russia’s “Alpinist and Vyshnia class electronic intelligence vessels carry out espionage missions in the Baltic Sea, picking up electronic signals from NATO ships and attempting to intercept sensitive information,” the source added. And when a more serious operation or military exercise is underway, the Russians combine all that they have – stationary radars, intelligence vessels and surveillance planes.

Crackdown on Russian espionage – and SIGINT

In response to Russian aggression against Ukraine, European countries have expelled more than 400 Russian diplomats working undercover for their intelligence services.

A recent report by Estonian internal security service KAPO (Kaitsepolitseiamet) says that “some expelled selected diplomats, while others terminated, to the greatest extent possible, the presence of Russian intelligence officers in the country or closed down Russian diplomatic missions altogether. Expelling diplomats is not simply a non-military response to Russia’s military activities; it significantly inhibits Russia and its intelligence services’ access to information, forcing them to use other, more expensive and less effective intelligence methods.”

Was the largest expulsion of Russian diplomats from European capitals to date also aimed at targeting the technical capabilities of Russian services? 

Belgian Justice Minister Justice Vincent Van Quickenborne, in response to questions from our partner De Tijd, admits that for the Belgian services, this was one of their main goals. “By declaring 21 Russian intelligence officers operating under diplomatic cover in our country ‘persona non grata’, we weakened the information position of the Russian intelligence services and thwarted possible SIGINT operations. There were a lot of technicians on the persona non grata-list provided by our state security. Such profiles are crucial in technical intelligence operations such as hacking and data capture.”

As the Belgian justice minister admits, the Belgian service has determined that the amount of equipment on the rooftops of the Russian embassy in Brussels is significant. “It is also a large embassy, having more accredited staff than Russia has for other countries with similar populations and diasporas. This is not surprising, given the presence of NATO and the EU on our territory,” the minister said. De Tijd’s research shows that the Russian embassy in Brussels (Uccle) has a total of 17 satellite dishes on the roofs of two buildings. This is the largest number in all of Europe. 

In Estonia, among the three expelled diplomats from Russia’s Tallinn embassy at Pikk Street there is at least one connected to the Kremlin’s SIGINT operations. Our partner Dossier Investigative Center found out that former attaché Nikita Petrov, now 31, attended a Ryazan military school and studied communications and communication systems. Dossier also located Petrov’s registered home address in Vatutinki, the Moscow suburb village where the GRU’s Space Intelligence Directorate is headquartered. (Petrov’s father is also a GRU officer who served as head of military unit number 30258.)

“A man with such an education is not an ordinary cipher officer [dealing with encrypted communication] or an operator who just listens to phone calls or frequencies,” an expert source told Delfi Estonia. According to the source, Petrov, the expelled diplomat, also has to be a technical professional capable of setting up and repairing the equipment.

For years, more than 70 diplomats worked at the Russian embassy in Bratislava. But after the invasion of Ukraine, Slovakia decided to cut their number in half. “Slovakia has capped the number of employees at the embassy of the Russian Federation at 34 people (in the structure of 15 diplomatic employees and 19 administrative-technical employees),” Slovakia’s foreign ministry wrote to our partner ICJK without further details.

“In the case of Russian embassies, almost 100 percent, really, every single person who is in Slovakia is originally an intelligence operative who only has a diplomatic cover,” Minister of Defense Jaroslav Naď claims.

Meanwhile, Hungary’s government opted not to expel a single Russian diplomat in recent years, further increasing Budapest’s importance as a regional hub for Russian intelligence. 

In early 2023, 42 diplomats with full privileges and immunity served at Russia’s embassy in Budapest. That’s more than the number of Russian diplomats combined in all other Visegrád region capitals. Currently, there are 15 Russian diplomats in Bratislava, 12 in Warsaw and 6 in Prague (plus spouses), according to openly available foreign ministry diplomatic lists.

However, according to a senior European diplomat with extensive knowledge of Russian intelligence presence in Hungary, when also counting in administrative and technical personnel, the total workforce at the Russian embassy in Budapest is 115. This auxiliary staff enjoys diplomatic immunity too, albeit a somewhat limited type.

We tried to officially confirm many details about the Russian embassy’s staffing, but the Hungarian Ministry of Foreign Affairs and Trade rejected our freedom of information request. In their refusal they cited, among others, privacy and personal data protection reasons.

In Poland, in stark contrast to Hungary, Russian intelligence under diplomatic cover suffered a serious blow. According to sources close to the Polish government, more than 20 names from the list of 45 diplomats expelled from Poland last year were working in the technical field. Almost half of the expelled diplomats lived in the block of flats on Beethoven Street.

Block of flats for Russian diplomats at Beethoven 3 str. in Warsaw. Source: Vsquare

The building, the Polish Foreign Ministry told us, formally belongs to the Polish State Treasury, meaning the property is owned by the city of Warsaw. “The property is used for diplomatic purposes and is a residential building for employees of the Embassy of the Russian Federation.” 

According to data we obtained from the Polish Ministry of Foreign Affairs, in 2021, the building was occupied by 31 diplomatic staff members and 13 administrative and technical personnel. In 2022, it was 29 members of diplomatic staff and 13 members of technical staff, while now (in 2023), among the tenants of the block, 9 are members of diplomatic staff and as many as 26 – technical personnel. 

What is the reason for this recent increase in the latter category? The Polish Foreign Ministry explains that it does not have detailed knowledge.

According to our sources close to Polish intelligence, the Polish secret services had known about the roof of Beethoven Street 3 for several years. They were also aware that the container once hid a fully equipped SIGINT station. Allegedly, the container was to be lined with styrofoam on the inside. The Russians were strictly guarding access to the container – in addition to the military attaché, access to the “radio” part of the roof was allegedly granted only to a GRU officer delegated to operate the position, codenamed “Zenit.”

“The Russians were able at that time to use it to listen to everything that goes over the radio – radio communications, walkie-talkies, and police frequencies. Also, to listen to GSM networks,” says one former intelligence officer. In his opinion, too, it is likely that the equipment is still in use.

We confirm these findings with several independent sources. One former senior government official said, “It turned out at the time that the Russian services were quite comfortable here and were fishing extensively, collecting large-scale data from communications listening, police data, and then processing it.”

Allegedly, the discovery of the container and SIGINT nest on Beethoven Street coincided with the case of Colonel Zbigniew J., who worked in the Polish MOD and was detained in 2014 on charges of spying for Russia. At the time, Poland expelled four Russian diplomats.

Anastasiia Morozova contributed to the story

Infographics: Dossier team, Anastasiia Morozova