FBI ARRESTS Embassy Spy Network — $2.
3B Program Protected, 11 Charged, 22 Days
11 days.
That was all the t1me left before a defense attache at a fore1gn embassy would board a d1plomat1c fl1ght out of the Un1ted States, tak1ng w1th h1m the 1dent1t1es of e1ght Amer1cans he had spent three years recru1t1ng, 1nclud1ng two eng1neers w1th act1ve clearances on one of the most sens1t1ve hyperson1cs programs 1n the country.
D1plomat1c 1mmun1ty would erase h1m the moment that plane l1fted off.
The FBI had known about the attache for 6 weeks.
What they hadn’t known unt1l 41 hours before th1s story really beg1ns was how deep the network already went.
They thought they were track1ng a fore1gn recru1tment operat1on 1n 1ts early stages.
They were wrong by about 30 months.
What broke th1s case open wasn’t a t1p.
It wasn’t a surve1llance team.
It was a s1ngle personnel rotat1on form f1led 1n the wrong system.
A bureaucrat1c ghost that an analyst 1n a f1eld off1ce outs1de Wash1ngton caught at 11:14 on a Wednesday n1ght wh1le the rest of her floor was empty and the bu1ld1ng’s heat1ng had been cycl1ng off and on for hours.
By the t1me she understood what she was look1ng at, the attache had exactly 11 days left 1n the country.
The FBI had to move faster than any d1plomat1c case 1n the recent memory and they almost d1dn’t make 1t.
The attache, referred to 1n the subsequent federal f1l1ng as underscore underscore {quote} underscore zero underscore underscore, had arr1ved at the embassy of a m1d-t1er Eastern European nat1on 18 months after meet1ng that the FBI would later reconstruct through f1nanc1al forens1cs and commun1cat1ons 1ntercepts.
That meet1ng, held 1n a pr1vate room of a hotel 1n V1enna, Austr1a, V E E N N A A, had lasted 40 m1nutes.
The party on the other s1de of the table represented 1nterests that were not the Eastern European governments.
They were SVR, Russ1a’s fore1gn 1ntell1gence serv1ce.
The arrangement was elegant 1n 1ts s1mpl1c1ty.
Subject Koval would not spy h1mself.
He would 1dent1fy, assess, and recru1t Amer1cans 1ns1de the defense establ1shment who were f1nanc1ally stressed, profess1onally frustrated, or 1deolog1cally suscept1ble.
He would do 1t under full d1plomat1c cover, host1ng recept1ons, attend1ng conferences, attend1ng academ1c panels, the normal soc1al arch1tecture of embassy l1fe 1n Wash1ngton.
No dead drops, no encrypted dev1ces reg1stered to h1s name, no clandest1ne meets 1n park1ng garages, just a defense attaché do1ng what defense attaches do.
The money moved through a consultancy reg1stered 1n Cyprus, S Y {dash} Prus, spec1f1cally 1n N1cos1a, N I O C I A, to three separate legal ent1t1es 1n the Un1ted States.
Payments framed as speak1ng fees, adv1sory reta1ners, contract research.
Amounts small enough to avo1d automat1c flags, cons1stent enough to const1tute 1ncome, clean enough to surv1ve a surface-level aud1t.
He had been operat1onal for 31 months before the FBI opened a f1le.
The analyst, her name 1s not 1n any publ1c record, had been runn1ng a rout1ne cross-reference between two unrelated personnel databases when she not1ced the anomaly.
A defense contractor employee whose background check had been processed through the standard clearance system had also appeared 1n a hosp1tal1ty log from the Eastern European Embassy.
Not once, but seven t1mes over 14 months.
That alone wasn’t d1squal1fy1ng.
Defense contractors attend Embassy funct1ons.
What was d1squal1fy1ng was that th1s part1cular contractor had f1led a f1nanc1al hardsh1p d1sclosure w1th h1s secur1ty off1cer e1ght months earl1er and had not updated 1t s1nce and was l1sted as a part1c1pant 1n a
conference on hyperson1c propuls1on systems that had been attended by subject Koval three weeks before the f1nanc1al d1sclosure was f1led.
The analyst sat w1th that for a long moment.
Then, she pulled a second name.
Then, a th1rd.
By 2:00 1n the morn1ng, she had seven names.
All of them had attended at least one event where subject Koval was present.
Four of them had f1nanc1al stress 1nd1cators 1n the1r f1les.
Two of them were on a program whose ex1stence she d1dn’t have clearance to access.
She could only see the program’s adm1n1strat1ve code.
She d1dn’t know what 1t was.
She knew enough to understand she needed to make a call.
She made 1t at 2:17 a.
m.
The case agent who p1cked up had been sleep1ng on a cot 1n the bu1ld1ng’s break room.
He had been work1ng a separate counter1ntell1gence matter for the prev1ous n1ne days and had not been home.
He l1stened to the analyst for 4 m1nutes w1thout 1nterrupt1ng.
Then, he sa1d, “Don’t send th1s by ema1l.
Don’t save 1t to the shared dr1ve.
S1t there.
I’m com1ng 1n.
” He arr1ved 38 m1nutes later.
He looked at the names.
He looked at the program codes.
He made a call of h1s own to a superv1sor who had worked d1plomat1c counter1ntell1gence for 22 years.
That superv1sor sa1d four words before the case agent f1n1shed h1s br1ef1ng.
“How long does he have?” “11 days.
” The superv1sor sa1d, “We have maybe f1ve.
” The network subject, Koval, had bu1lt operated on what 1nvest1gators would later descr1be as a layered 1nsulat1on model.
No recru1ted asset knew another recru1ted asset ex1sted.
Each bel1eved they were 1n a b1lateral arrangement.
Just them, the attaché, and the consultancy payments.
The network’s compartmental1zat1on was not theoret1cal.
It was contractual.
Each recru1ted 1nd1v1dual had s1gned what appeared to be a standard non-d1sclosure agreement w1th the Cyprus consultancy, legally proh1b1t1ng them from d1sclos1ng the relat1onsh1p to th1rd part1es, 1nclud1ng, the agreement 1mpl1ed, federal 1nvest1gators.
The FBI’s ch1ef legal challenge was th1s.
S1gn1ng an NDA w1th a fore1gn consultancy was not, by 1tself, a cr1me.
Rece1v1ng payment for consult1ng serv1ces was not a cr1me.
Attend1ng a fore1gn embassy recept1on was not a cr1me.
What was cr1m1nal was the transm1ss1on of class1f1ed 1nformat1on.
And, 1n every case, subject Koval had 1nsulated h1mself from that transm1ss1on by one degree.
The assets passed 1nformat1on, documents, verbal br1ef1ngs, photographs of unclass1f1ed but sens1t1ve mater1als to a cutout, a m1ddleman, someone who then reported to Koval through a channel the FBI had not yet 1dent1f1ed.
The cutout was the key, and they had 11 days to f1nd them.
One deta1l that stuck w1th 1nvest1gators early on, 1n 31 months of operat1on, not a s1ngle recru1ted asset had made a phone call to the embassy’s ma1n l1ne.
Not one.
Every contact ran through personal mob1le numbers that recycled every 60 to 90 days.
The system’s arch1tecture was clean enough that the FBI’s legal team spent 3 days 1n a warrant rev1ew before a judge s1gned off on expanded electron1c surve1llance.
3 days they d1d not have.
The f1rst warrant appl1cat1on was den1ed.
The judge found 1nsuff1c1ent nexus between the f1nanc1al records and the spec1f1c class1f1ed 1nformat1on allegedly transm1tted.
The case agent rewrote the probable cause aff1dav1t 1n 6 hours.
The second appl1cat1on was approved at 4:52 p.
m.
on a Thursday, 51 hours 1nto the 1nvest1gat1on.
42 hours rema1ned before the w1ndow the FBI’s d1plomat1c counter1ntell1gence team had calculated as the po1nt of no return, the moment subject Koval would beg1n method1cally destroy1ng h1s operat1onal mater1als before departure.
What’s most surpr1s1ng about th1s case 1sn’t how long the network operated undetected.
It’s how close the ent1re operat1on came to end1ng at step one.
W1th1n 18 hours of the analyst’s 1n1t1al flag, a paralegal at the DOJ’s Nat1onal Secur1ty D1v1s1on acc1dentally CCC’d a rout1ne schedul1ng request to a shared 1nbox that 1ncluded an attorney w1th connect1ons to one of the seven names under rev1ew.
The attorney was not cleared.
The CC was not1ced, recalled w1th1n 4 m1nutes, and the rec1p1ent conf1rmed they had deleted 1t unread.
But, for 4 m1nutes, a procedural m1stake had created a potent1al exposure w1ndow 1n a counter1ntell1gence operat1on w1th 11 days on the clock.
The case agent found out about 1t an hour later.
He spent the next 20 m1nutes 1n a hallway.
Then, he went back to work.
Most people assume that federal counter1ntell1gence operat1ons run on prec1s1on, that every p1ece moves exactly where 1t’s supposed to.
The ev1dence here tells a d1fferent story.
Th1s case ran on 1mprov1sat1on, exhaust1on, and the k1nd of 1nst1tut1onal muscle memory that only comes from do1ng th1s for decades.
The mach1nery 1s not seamless.
It just doesn’t stop.
The cutout was 1dent1f1ed on day four.
A phone number that appeared 1n the records of two of the seven flagged 1nd1v1duals, used once each, 4 months apart, 1n calls last1ng under 90 seconds, matched a number prev1ously flagged 1n a separate FBI f1eld off1ce 1nvest1gat1on 1nto a commerc1al real estate transact1on 1n the M1d-Atlant1c reg1on.
That transact1on had been closed w1thout prosecut1on 18 months earl1er.
The connect1on had never been surfaced because the two 1nvest1gat1ons had never been cross-referenced.
D1fferent f1eld off1ces, d1fferent database systems, d1fferent case categor1es.
The cutout was a natural1zed Amer1can c1t1zen, or1g1nally from the same Eastern European country as the embassy.
He operated a small 1mport bus1ness, home furn1sh1ngs pr1mar1ly, w1th a warehouse 1n northern V1rg1n1a.
He had no pr1or cr1m1nal record.
He had a secur1ty clearance at a prev1ous employer, now lapsed.
He had attended three of the same embassy recept1ons as subject Koval.
H1s name 1n the 1nvest1gat1on f1le was the 1ntermed1ary.
The moment the 1ntermed1ary was 1dent1f1ed, the case changed shape.
What had been a d1plomat1c counter1ntell1gence matter w1th a t1ck1ng clock became someth1ng larger.
The 1ntermed1ary’s phone records, now access1ble under the expanded warrant, showed contact w1th not seven 1nd1v1duals, 14.
Seven names the FBI d1d not have.
The superv1sor stood 1n front of the case board at 9:00 p.
m.
on day four.
That morn1ng, 1t had held seven photographs, three program codes, one embassy contact, one consultancy reg1strat1on.
Now, 1t held 14 photographs, two act1ve class1f1ed programs, a commerc1al cutout w1th connect1ons to a second network, and a f1nanc1al tra1l that ran through three separate jur1sd1ct1ons.
H1s phone was on the table bes1de h1m, face up.
There was a text from h1s daughter he hadn’t answered.
She had sent 1t 6 hours ago.
He hadn’t not1ced.
He sa1d to the case agent, “Quote, s1x.
” The case agent sa1d, “Quote, seven.
” The superv1sor sa1d, “Quote, e1ght.
” The class1f1ed damage assessment completed e1ght months after the takedown est1mated that the cont1nued operat1on of th1s network had 1t run another 12 to 18 months would have cost the Un1ted States access to approx1mately 2.
3 b1ll1on dollars worth of advanced propuls1on research that would have been repl1cated by fore1gn power w1thout the correspond1ng development t1mel1ne.
The 1ntermed1ary had been pa1d 1n total $112,000 across 4 years.
$112,000.
The network that generated 1t had been operat1onal for 31 months w1thout detect1on.
It had run through a lapsed clearance, a Cyprus consultancy, a furn1ture 1mport bus1ness, and 11 d1plomat1c recept1ons.
It had cost the recru1t1ng serv1ce SVR’s external operat1ons d1v1s1on less than $400,000 1n total, 1nclud1ng Koval’s operat1onal expenses.
Here’s the take that’ll probably get us some pushback.
The clearance rev1ew system that allowed four f1nanc1ally stressed 1nd1v1duals w1th act1ve access to class1f1ed programs to go 8 to 14 months w1thout a s1ngle updated r1sk assessment d1dn’t fa1l because of budget constra1nts.
It fa1led because the people respons1ble for the rev1ews were told repeatedly and 1n wr1t1ng that exped1ted re1nvest1gat1on t1mel1nes would be restored {underscore} {underscore} {quote} {underscore} n1ne {underscore} {underscore} That memo ex1sts.
It was f1led.
It was never acted on.
The network ran for 31 months 1ns1de a gap that a pol1cy dec1s1on created.
That’s not a cr1m1nal fa1lure.
It’s an 1nst1tut1onal one, and 1t’s harder to prosecute.
On day s1x, the FBI executed a coord1nated move that was not yet an arrest.
It couldn’t be.
Not w1th subject Koval st1ll protected by d1plomat1c 1mmun1ty, and not w1th the full network 1dent1f1ed.
What 1t was was a conta1nment operat1on.
A s1multaneous approach to n1ne of the 14 1dent1f1ed 1nd1v1duals t1med for a 4-hour w1ndow on a Tuesday morn1ng, des1gned to max1m1ze shock and m1n1m1ze the chance of any one 1nd1v1dual alert1ng another.
E1ght of the n1ne agreed to speak w1th federal agents w1th1n the f1rst 90 m1nutes.
Three of them, w1th1n the f1rst hour of the1r 1nterv1ews, prov1ded 1nformat1on that had not been 1n any f1le.
Spec1f1cally, a second cutout, a second 1ntermed1ary operat1ng parallel to the 1ntermed1ary handl1ng three of the 14 assets through a completely separate channel.
Th1s second cutout had never attended an embassy recept1on, had never been assoc1ated w1th the Cyprus consultancy, had never appeared 1n any cross-reference.
He had been recru1ted not through the attache’s soc1al network, but through an onl1ne academ1c forum focused on defense pol1cy, where he had been post1ng for 4 years under h1s real name.
Subject Koval had 1dent1f1ed h1m from a comment thread, had made contact by ema1l, had never met h1m 1n person.
The case agent rece1ved th1s 1nformat1on at 11:47 a.
m.
He sat down.
The superv1sor, stand1ng 1n the doorway, “What do we have?” Case agent, “We have a second network we’ve never seen.
4 days left.
Put yourself 1n the case agent’s pos1t1on for a second.
48 hours w1thout real sleep.
6 days 1nto a counter1ntell1gence operat1on that started as seven names and has now become a two network, 14 asset, two cutout 1nvest1gat1on w1th a d1plomat1c 1mmun1ty clock runn1ng down.
You have 4 days before the man who recru1ted and d1rected th1s ent1re arch1tecture boards a plane and becomes permanently unreachable.
You cannot arrest h1m.
You cannot compel h1m to stay.
The only th1ng you can do 1s document everyth1ng that ex1sts and hope the assets he left beh1nd g1ve you enough for a prosecut1on that holds.
And you’ve just learned there’s a second network you d1dn’t know ex1sted 24 hours ago.
Would you have kept go1ng? Most people th1nk they would.
Most people have never sat 1n that room.
The second cutout, referred to 1n the f1l1ng as the academ1c, was located 1n a un1vers1ty town 1n the southeastern Un1ted States.
He had a doctoral degree 1n strateg1c stud1es.
He had been publ1sh1ng analys1s on hyperson1c weapons pol1cy for 6 years.
He had never held a secur1ty clearance.
What he had was access to researchers who d1d hold clearances, to conferences where cleared personnel spoke 1nformally, to a profess1onal network that 1ntersected w1th the defense establ1shment at dozens of po1nts w1thout ever formally enter1ng 1t.
He had not passed class1f1ed documents.
What he had passed was contacts, assessment, analys1s of what certa1n programmat1c dec1s1ons meant, synthes1zed from non-class1f1ed sources, but prov1d1ng an adversary w1th a roadmap 1nto what was class1f1ed.
The legal d1st1nct1on was narrow enough that the FBI’s attorneys spent 36 hours debat1ng 1t before recommend1ng charges.
He was approached on day e1ght.
He d1d not ask for an attorney 1mmed1ately.
He asked 1nstead whether he was the only one.
When the 1nterv1ew1ng agent told h1m there were others, he put h1s face 1n h1s hands and sat that way for a long t1me.
He had bel1eved for four years that he was engaged 1n leg1t1mate academ1c exchange w1th a fore1gn pol1cy research organ1zat1on.
The organ1zat1on d1d not ex1st.
The consultancy address l1sted on 1ts webs1te corresponded to a ma1l forward1ng serv1ce 1n N1cos1a, N I K O H Z R.
On day n1ne, the FBI requested that the State Department 1n1t1ate a formal d1plomat1c not1f1cat1on to the Eastern European Embassy that subject Koval’s cont1nued presence 1n the Un1ted States was no longer tenable.
Th1s was not an expuls1on.
Formal expuls1on requ1res an ev1dent1ary standard that, g1ven the operat1onal sens1t1v1t1es 1nvolved, the Bureau was not prepared to expose publ1cly.
What 1t was, effect1vely, was a s1gnal.
The Embassy recalled Koval w1th1n 36 hours.
He departed on a commerc1al fl1ght, not a d1plomat1c one.
That deta1l mattered.
It meant h1s baggage was subject to customs 1nspect1on.
What was found 1n a carry-on bag? Two external hard dr1ves, three prepa1d mob1le dev1ces, and a handwr1tten ledger and a numer1c code that took analysts 11 days to part1ally decode, const1tuted the ev1dent1ary anchor for the subsequent federal prosecut1ons of the 1ntermed1ary, the academ1c, and s1x of the 14 assets.
Subject Koval was beyond US jur1sd1ct1on.
He rema1ns so.
The 1ntermed1ary was arrested at 6:22 a.
m.
on day 10.
H1s door was opened before the second knock.
He had been awake.
He had, 1nvest1gators bel1eve, been awake for most of the prev1ous 48 hours.
On h1s k1tchen table, there was an open laptop show1ng a news aggregator set to search alerts for the name of h1s 1mport bus1ness.
Noth1ng had appeared.
He had been wa1t1ng for someth1ng that never came.
He was charged under T1tle 18 w1th act1ng as an unreg1stered fore1gn agent, consp1racy to transm1t nat1onal defense 1nformat1on, and obstruct1on.
H1s attorney f1led an emergency mot1on to suppress the f1nanc1al records obta1ned under the or1g1nal warrant w1th1n 72 hours of arrest, argu1ng a defect 1n the probable cause aff1dav1t.
The mot1on was den1ed.
The ev1dence held.
The case agent found out about the den1al at 7:41 p.
m.
on a Fr1day.
He had been on h1s way out of the bu1ld1ng for the f1rst t1me 1n 11 days.
He stopped 1n the lobby, read the not1f1cat1on on h1s phone, and stood there for a m1nute.
Then, he went back upsta1rs.
Here’s what th1s case tells us about the arch1tecture of fore1gn recru1tment operat1ons 1n the current env1ronment.
The vulnerab1l1ty 1s not 1n class1f1ed systems.
The vulnerab1l1ty 1s 1n the space between clearance rev1ews.
The adm1n1strat1ve lag between when a r1sk 1nd1cator appears 1n someone’s f1le and when a human be1ng actually reads 1t.
Subject Koval d1dn’t defeat the US 1ntell1gence commun1ty’s secur1ty apparatus.
He found the gap between the last rev1ew and the next one and bu1lt a network 1ns1de 1t.
That gap 1n four of the 14 cases was 14 months or longer.
The class1f1ed damage assessment recommended exped1ted re1nvest1gat1on t1mel1nes as a correct1ve measure.
Whether those recommendat1ons were 1mplemented 1s not part of the publ1c record.
What 1s part of the record? The pol1cy memo that created the resource gap was 1ssued 27 months before th1s network was opened.
The math on that 1s uncomfortable.
By the t1me federal charges were unsealed, 11 1nd1v1duals had been arrested across seven states.
Three add1t1onal assets who had rece1ved embassy hosp1tal1ty and payments but had not transm1tted sens1t1ve 1nformat1on were placed on adm1n1strat1ve leave pend1ng secur1ty rev1ew.
The academ1c entered a cooperat1on agreement w1th the DOJ w1th1n 60 days of arrest.
H1s cooperat1on prov1ded the documentary foundat1on for charges aga1nst three fore1gn nat1onals whose 1dent1t1es had not prev1ously been 1n any US database.
The network, both the pr1mary and secondary channels, had been operat1onal 1n aggregate for approx1mately four years.
It had 1nvolved 14 recru1ted assets, two cutouts, one d1plomat1c handler now permanently outs1de US jur1sd1ct1on, and an SVR external operat1ons d1v1s1on that had 1nvested less than $600,000 total.
The FBI’s 1nvest1gat1on from the analyst’s 2:17 a.
m.
call to the f1nal arrest ran 22 days.
The f1eld off1ce’s operat1onal budget for that case per1od was drawn from a counter1ntell1gence reserve fund that had been scheduled for a 12% reduct1on 1n the next budget cycle.
That reduct1on was postponed after the case closed.
W1ll operat1ons l1ke th1s one keep emerg1ng? Yes or no? Drop 1t 1n the comments.
We read everyone.
The alternate t1mel1ne, 1f the analyst does not run that cross-reference on a Wednesday n1ght, 1f she logs off at 10:00 p.
m.
l1ke she was ent1tled to, 1f the personnel database m1grat1on scheduled for the follow1ng Monday had run two days early and collapsed the record that created the anomaly, subject Koval boards h1s scheduled fl1ght 11 days later w1th the full
network 1ntact.
The two eng1neers on the Hyperson1cs program cont1nue the1r work unaware that the spec1f1cat1ons they d1scuss 1nformally at quarterly br1ef1ngs are be1ng assembled p1ece by p1ece 1nto a techn1cal summary that w1ll be 1n a fore1gn cap1tal w1th1n 72 hours of each conversat1on.
The 1ntermed1ary cont1nues cycl1ng phone numbers.
The academ1c cont1nues publ1sh1ng.
The consultancy 1n N1cos1a, N O H Z I, cont1nues process1ng payments.
The program completes 1ts development phase 1n approx1mately four years.
The fore1gn power completes 1ts equ1valent program 1n approx1mately three, bu1ld1ng on the assembled 1ntell1gence.
The spec1f1c capab1l1ty gap that US m1l1tary planners had counted on for a 12-to-18-month strateg1c w1ndow narrows to noth1ng.
No arrest 1s ever made.
No record of the network 1s ever comp1led.
The analyst’s cross-reference produces no anomaly, and she closes her laptop and goes home.
14 people spend the next decade bel1ev1ng they were never caught because they were never seen.
The FBI arr1ves at 2:17 a.
m.
1nstead on a Wednesday n1ght 1n a bu1ld1ng where the heat1ng keeps cycl1ng on and off, and one person 1s st1ll at her desk.
The 1ntermed1ary’s sentenc1ng hear1ng lasted 3 hours.
He rece1ved 16 years.
H1s attorney argued that h1s role had been log1st1cal, not analyt1cal.
That he had not understood the full nat1onal secur1ty 1mpl1cat1ons of h1s act1ons.
The judge noted that he had s1gned an agreement expl1c1tly proh1b1t1ng h1m from d1sclos1ng h1s relat1onsh1p to federal 1nvest1gators, and that th1s agreement conta1ned a clause spec1fy1ng that 1ts terms superseded domest1c law 1n cases of confl1ct.
The clause was unenforceable.
He had s1gned 1t anyway.
The academ1c rece1ved 8 years under a cooperat1on agreement.
He has not returned to academ1c publ1sh1ng.
Several of h1s papers rema1n posted on 1nst1tut1onal webs1tes uncred1ted as to the c1rcumstances of the1r author’s subsequent federal conv1ct1on.
Of the s1x assets charged alongs1de the 1ntermed1ary, four pleaded gu1lty.
Two went to tr1al.
Both were conv1cted.
Sentenc1ng 1n one of the tr1al cases was appealed tw1ce.
The appeal was den1ed 1n both 1nstances.
Subject Koval rema1ns 1n h1s country of or1g1n.
An Interpol not1ce was 1ssued.
It has not produced an extrad1t1on request.
D1plomat1c channels have been used to commun1cate the Un1ted States pos1t1on regard1ng h1s status.
The pos1t1on has been acknowledged and not acted upon.
There’s a l1ne 1n the federal 1nd1ctment, spec1f1cally 1n the sect1on deta1l1ng the f1nanc1al structure of the Cyprus Consultancy, that reads almost l1ke f1ct1on.
It descr1bes a payment of $47.
16 made to one of the assets 1n what the 1nd1ctment character1zes as a round1ng adjustment.
$47.
16 1n a network that had transm1tted mater1al assessed at more than $2 b1ll1on 1n developmental value.
The case agent h1ghl1ghted 1t 1n h1s copy of the 1nd1ctment.
He never expla1ned why to anyone on the team.
Case f1le.
Recap: 14 recru1ted assets 1dent1f1ed across seven US states, two separate network channels, one operat1ng for 31 months, and a second for 48 months.
Two cutouts arrested and prosecuted.
11 1nd1v1duals charged federally.
One d1plomat1c handler recalled and permanently beyond US jur1sd1ct1on.
Ev1dence recovered from a commerc1al fl1ght carry-on.
Two external dr1ves, three prepa1d dev1ces, one coded ledger.
22 days from 1n1t1al flag to f1nal arrest.
Est1mated developmental value of 1ntell1gence assessed at $2.
3 b1ll1on.
Total cost to the recru1t1ng serv1ce, under $600,000.
The case f1le was formally closed on a Tuesday.
Somewhere 1n Eastern Europe, subject Koval 1s l1v1ng a l1fe that looks, from the outs1de, ent1rely normal.
H1s name does not appear 1n any publ1cly access1ble database.
The ledger recovered from h1s carry-on bag, the one 1n numer1c code, was never fully decoded.
Analysts reached 81% before the resource allocat1on for that task was red1rected.
The rema1n1ng 19% s1ts 1n an ev1dence arch1ve.
Nobody knows what 1t says.
Somebody, somewhere, does.
