Foreign Policy Research Institute A Nation Must Think Before it Acts Will Alexandar Vučić’s Presidency Explode? Botched Agent Running, Corruption Allegations Imperil Putin’s Balkan Ally
Will Alexandar Vučić’s Presidency Explode? Botched Agent Running, Corruption Allegations Imperil Putin’s Balkan Ally

Will Alexandar Vučić’s Presidency Explode? Botched Agent Running, Corruption Allegations Imperil Putin’s Balkan Ally

In this pressure cooker, in which the sour broth of our current history boils, the current government has not even left a safety valve open to reduce the growing pressure. That’s why an explosion is the logical progression of events, after which it will be difficult to pick up the pieces of what used to be our country.[1]

                                                                                                                          – NIN[2] December 2019

I don’t care about the world stage. I care about Serbia and the Balkans. Period.[3]

                                                                                                                            – Alexandar Vučić

Serbian President Alexandar Vučić (credit: Direktno)

It is no small irony that a Belgrade brewpub named the “Black Sheep” should be the site of an artless Russian intelligence operation, the exposure of which, at one and the same time, reinforced Alexandar Vučić’s image as a Putin stalwart in the Balkans, and evinced that not-so-covert Russian intelligence operations are afoot across Europe. The former is hardly a revelation—BALK’s Silvester Varga quipped about Vučić’s undoubted determination that “not even a herd of black sheep” will disrupt Serbian-Russian relation. But if Sinisa Ljepojevic is correct that the “battle for the Balkans”—to eliminate Russian influence in Serbia—is “intensifying,”[4] it is puzzling why Russia would jeopardized Vučić’s tenuous political standing with a low-grade agent running operation of dubious value.

European NATO members certainly are not strangers to Russian intelligence operations on their territory: witness a December 2019 Le Monde report about a fifteen-person special unit of Russian military intelligence (GRU) found to have been operating a logistics base in eastern France’s Haute-Savoie region since at least late 2018 or early 2019.[5] The GRU “has become an instrument of [Russian] foreign policy”[6] implicated in destabilization operations in Crimea and Moldova, a failed coup in Montenegro, and interference in the Catalonia independence referendum, among other active measures (aktivnye meropriyatiya) in the Balkans and the Black Sea littoral.

That said, Andrzej Łomanowski argues, “The GRU’s successes in Crimea became the cause of later failures.”[7] Poor tradecraft has exposed GRU operations outside the perimeter of traditional military intelligence, such as the nerve agent poisonings of Sergei Skripal and Emilian Gebrev.[8] GRU personnel have been unveiled by sloppy security practices: using routine automobile registration records, Bellingcat[9] identified 300 GRU officers by name, all of whom (for tax avoidance) registered personal vehicles at their workplace, Komsomolsky Prospekt 20, which is the Moscow address of the GRU’s cyber warfare Unit 26165.[10] Bungles like these no doubt animate “Putin’s increasing coldness toward military spies.”[11]

What Grzegorz Kuczyński called “Putin’s spies’ bad luck streak”[12] (Zła passa szpiegów Putina) has enmeshed Serbian President Alexandar Vučić in unwelcomed political controversy. Nominally neutral but traditionally aligned with Russia, Serbia is congenial ground for Russian intelligence operations in the Balkans. Those operations usually target Serbia’s neighbors—especially Bosnia and Herzegovina, Montenegro, and North Macedonia—in pursuit of Russian aspirations of a Balkan “ribbon”[13] of militarily neutral (read: non-NATO) countries.

The Case of a Mysterious Video: Who Produced It and To What End?

GRU operations rarely target Serbia overtly. On 17 November 2019, however, a video posted on a YouTube account belonging to “Kdjuey Lskduf” with this message under the title “Russian Intelligence Officer Meeting Serbian Spy—Watch This”[14]:

Russian spies are corrupting Serbia. This is video of the Russian military main intelligence directorate (GRU) officer Colonel Georgy Viktorovich Kleban paying his Serbian agent who is senior Serbian official. Kleban works in Russian Embassy in Belgrade. This is what the Russians do to us.[15] [sic]

That same day, “Kdjuey” created a new Twitter account and tweeted a link to the YouTube video[16], followed by tweets stating, “What will @avucic do about this?”[17] and “This is what the Russians do to us, there [sic] ‘friends’.”[18] After three more tweets tagging mostly Balkan news portals, “Kdjuey” went silent.

Later that same day, Christo Grozev, a Bulgarian journalist writing for Bellingcat (one of the portals “Kdjuey” tagged in his final tweet) also began tweeting about the video.[19] The first media portal to pick up the story was the United States government-funded RFE/RL, something that fed a narrative (mostly in Serbian and Russian language commentaries) that a Western intelligence agency made the video, then waited nearly a year before posting it to YouTube.[20]

What the video shows is not in dispute: an individual identified as a GRU officer, Georgiy Kleban, hands  a shopping bag to another individual identified only by the initials “Z.K.” While “Z.K.” has so far not been named in open sources, the Serbian tabloid Pravda teased readers, “We know who’s on the video, but . . .”[21] Kleban was an assistant military attaché in Belgrade from 2016 until June 2019 according to the Serbian Foreign Affairs Ministry, which reputedly declared him persona non grata and forced him to leave the country. He is identified as “Lieutenant Colonel Kleban” in an October 2017 Serbian Defense Ministry press release, and appeared in an accompanying photograph (wearing the blue uniform, on the right).[22]

(credit: Serbian Defense Ministry)

The incident occurred almost a year earlier, on 24 December 2018. The location is easily identified: after Kleban hands the shopping bag to “Z.K.”, both are seen entering the Brewpub Crna Ovca (“Black Sheep Brewpub”) located in Belgrade’s Zenum neighborhood. “Z.K.” is seen later in the video sitting in a parked automobile, where he removes a liquor bottle from the bag along with an envelop containing cash, which he proceeds to count.[23] 

Serbian intelligence (BIA) confirmed the video’s authenticity within a few days.[24] Analytics chief Relja Željski announced that the BIA “established unequivocally”[25] (nedvosmisleno ustanovljeno) the identity of “Z.K.” and details of what was exchanged, but declined to elaborate either.[26] Asked if the incident had anything to do with recent events in Kosovo and Metohija—the ethnic Serb autonomous province in neighboring Kosovo[27]—Željski responded, “Nowadays, everything in the security domain has to do with Kosovo” and “attempts to divert Serbia” from its traditional neutrality.[28] A commentary published in the pro-government tabloid Informer declared, “The West released this clip to turn public opinion against Russia” and said it was intended to “pull Serbia into closer alignment with the Western military alliance [NATO] as quickly as possible!”[29]

BIA’s Relja Željski (credit:

The same day Željski gave his remarks, the government-aligned Politika dismissed the video as “several years old,” writing that while “Z.K.” is alleged to be “a Serbian official with the rank of officer,” he in reality does not belong to any Serbian security agency.[30] It speculated, “Most likely, ‘Z.K.’ is a civilian selling commercial information.”[31] A few days hence, Zeljski was quoted by the Serbian government news agency Tanjug identifying “Z.K.” as “a retired Serbian lieutenant colonel.”[32] He said the BIA was aware of earlier contacts between Kleban and “Z.K.”[33] “You’d be amazed how often this happens on the streets of Belgrade and other large cities around the world,” Zeljski said.[34] Orhan Dragaš of the Belgrade-based International Security Institute called the Kleban video “a rather unpleasant situation, which confirms the notion that there are no friendships in international relations, just interests.”[35]

In a press conference following a National Security Council meeting called to discuss the video, Vučić said, “Our security services have concluded that a retired military officer, Lieutenant Colonel Z.K., met Kleban in Zemun, around 6 pm that day.”[36]

Lieutenant Colonel Z.K. has been a person of interest since 2012, when he was discovered to have contacts with Croatian intelligence, which led in turn to the discovery of his contacts with Russian agents.[37]

Vučić said the BIA was aware that Kleban had contact with three different Serbian sources on ten different occasions, three of which involved the exchange of money. The BIA also identified nine other Russian intelligence sources within Serbia’s armed forces, he said.

In an interview with Serbian broadcaster RTS, Russian Ambassador Alexander Bocan-Harchenko dismissed the video as “the sort of provocation [that] often occurs before high level diplomatic meetings.” He said relations between the two countries would not be harmed by “scandalous stories about the alleged recruitment of a Serbian soldier by a Russian soldier.”[38] Downplaying the video as “several years old,” Russian presidential spokesman Dmitry Peskov said, “We’ve yet to figure out what sort of incident it was.”[39] A Russian Foreign Ministry spokesperson echoed Bocan-Harchenko, calling the video a “provocation” which, while recorded a year earlier, only appeared online just as Vučić and Putin were scheduled to meet in Sochi.[40]

Changing tactics, Vučić, started downplaying the incident. “We have many intelligence officers here [in Serbia] from all the major world powers as well as the region,”[41] he said in a Ćirilica interview broadcast on Nacionalna Televizija Happy. Vučić singled out Western intelligence agencies, saying, “For years, Serbia has faced an extremely aggressive intelligence offensive by various foreign intelligence services.”[42] He singled out Austria, Germany and Bulgaria, decrying “military envoys that visit Sandžak in uniform and openly discuss political solutions that would ruin Serbia.”[43] The BIA’s Željski said, “Although it sounds like a conspiracy theory, “major powers like the United States, Great Britain and France” and “regional players including Croatia and Albania” are “extremely active in pursuit of their interests in Serbia.”[44]

Serbian legislator Milovan Drecun was less temperate. Drecun, who chairs the Parliamentary Committee for Kosovo and Metohija, said the video demonstrates how “for a long time, hybrid operations have repeatedly been directed at Serbia to influence the direction of its policies, both at home and abroad.”[45] While he “could speculate” who was behind the video, Drecun told Pravda, “He [Bellingcat’s Grozer] claims not to know who made it [the video] but there seem to be channels [through which] certain individuals and [intelligence] services are able to access information, which they then disseminate to the public.”[46] Speculating who might have an interest in releasing the video—which Drecun warned “could harm Serbian-Russian relations”—he pointed to the Bulgaria government, which earlier that month strenuously objected to the presence in Serbia of Russian S-400 (the first ever training deployment outside Russia) and Pantsir S missile defense systems for the Slavic Shield 2019 (Slovenski štit) military exercises.[47]

Dracun decried “the establishment of a covert site in Skopje [the North Macedonian capital] which is home to intelligence operatives from neighboring countries, including North Macedonia, Croatia, and Bulgaria.”[48] He called out the Bulgarian government once again, this time for running a spy network inside Serbia, and for threatening Serbia’s territorial integrity through its support for Kosovo’s independence, in league with Germany and Austria. Allegations run in both directions, however: Bulgarian political leaders including former Foreign Minister Solomon Passy call Niš—Serbia’s third-largest city, near its borders with Macedonia, Bulgaria, Kosovo, and Montenegro—”a Russian spy center.”[49] The claim centers on the Russian-Serbian Humanitarian Center[50], a suspected Russian intelligence cutout that holds itself out as a Niš-based disaster relief and assistance organization.

Vučić quickly picked up Dracun’s theme. “We’ve stepped up [counterintelligence] measures,” he said, “and I especially want to commend the BIA and VBA for thwarting these very serious active measures, in which various [foreign intelligence] agencies are complicit.”[51] Vučić added on Ćirilica that while the BIA had Kleban and “Lieutenant Colonel Z.K.” under surveillance as the incident unfolded, “the recording is not ours.”[52] The Bosnian news portal Blik claimed, “According to information we obtained, the recording was most likely released by the United States [intelligence] service.”[53]

Rather than criticize the Russian government, Vučić said plaintively ”I have only one question for our Russian friends: Why?”[54] He would not “rule out the possibility the Russians are correct,” agreeing that the video was indeed a “typical provocation.”[55] He added, “There’s no thought of returning again to 1948 and seeing Russia as Serbia’s enemy.”[56] 

We will continue to fight for our neutrality and our independent path. We will not consent to be ruled by others . . . We will not alter our policy towards Russia. I’m sure President Putin wasn’t informed about this affair.[57]

Asked whether he would discuss the video with Putin at an upcoming meeting, Vučić said, “I’m not one of those politicians who like to brag, but I told him [Putin], ‘What I’m going to say is for the two of us alone, we’ll discuss it between ourselves.”[58] Within a fortnight, Bocan-Harchenko declared the Kleban matter “all behind us.”[59]

Russian intelligence operations in the Balkans are anchored by the Russian Institute of Strategic Studies[60] (RISI), which opened a Belgrade office in October 2013. The Belgrade Center for Security Policy calls Serbia “the Kremlin’s most important bridgehead in the Balkans”[61]: Russian and Serbian intelligence agencies openly collaborate on matters of common interest, notably North Macedonia. In April 2018, Vučić officially received the Director of the Russian Foreign Intelligence serviced (SVR) Sergey Naryshkin (whose predecessor , Mikhail Fradkov, moved to the RISI[62]) to discuss BIA-SVR cooperation. Afterwards, Vučić’s office said the two leaders discussed “the security situation in the Balkans, Europe, and the world.”[63] The official SVR communiqué took a different tack, stating, “Both parties stressed the need to comply with standards of international law while solving regional conflicts.”[64]

Neither statement likely reflects what was actually discussed. Though little noticed outside Serbia, in May 2017 Deputy Prime Minister and Minister of Internal Affairs (MUP) Nebojša Stefanović and General Dimitrij Kochnev of Russia’s Federal Guard Service (FSO) signed an Agreement on Cooperation and Joint Action.[65] As Saša Đorđević of the Belgrade Centre for Security Policy notes, the FSO’s authority is much broader than the MUP’s, which led Blic to ask “Will this collaboration go ‘too far’?”[66] The agreement’s Article 4 is perhaps its most interesting section as well as its most ambiguous. It provides for the MUP and the FSO “to exchange information on matters of common interest”[67] (razmenjuju informacije o pitanjima od zajedničkog interesa) without elaborating that purposefully ambiguous term. While formally a bilateral agreement, it was first proposed[68] as a memorandum of understanding, consistent with MUP practice. When Nikolai Patrushev, Secretary of the Russian Security Council,[69] visited Belgrade in October 2016, he downplayed the agreement, which “would not have a legally binding character or the status of an international treaty.”[70] That would be consistent with the understanding that treaties bind governments, not as here, a governmental ministry (the MUP) and an executive unit (the FSO). Moreover, Serbian law requires treaties to be approved the National Assembly before taking effect (which it was several months after the fact, in March 2018). All this led the news portal Peščanik to question:

[W]hy it was decided to sign a binding international treaty [and] exactly what information will the Russian side have access to? . . . [T]he agreement allows the MUP and the FSO to exchange information on ‘issues of common interest,’ which again, is truly open ended.[71]

The agreement’s Article 8 binds both intelligence agencies to abide by the host country’s domestic laws (of which Kleban’s actions were a clear breach). No doubt hoping to deflect public attention from Kleban, Vučić reverted to his theme of foreign intelligence predations:

[T]here are numerous foreign [intelligence] agencies operating on Serbian territory for two purposes—first, to gather intelligence and other information in order to influence or change some aspect of Serbian policy; and second, to assess Serbian intelligence capabilities comprehensively in order to identify means to exploit vulnerabilities.[72]

Their objective, he said, is to “destroy Serbia’s arms industry,” without which “Serbia could not survive as a neutral, militarily powerful country.”[73] The most significant outside pressure, he said, was being exerted against Krušik[74], a Serbian state-owned arms manufacturer. Krušik is at the center of another political scandal in which a whistleblower, Aleksandar Obradovića, implicated Branko Stefanović, father of the MUP’s Nebojša Stefanović, in a scheme to purchase munitions from Serbian state-owned enterprises at below-market prices.[75]

Serbia’s Arms Industries Under Pressure

Branko Stefanović was accused of acting as a middleman for GIM[76], a Serbian company owned by Goran Todorovic. NiN reported a 2016 transaction in which Branko Stefanović acted as GIM’s middleman involving the purchase of Krušik mortar shells and long-range missiles for $7.2 million, which GIM immediately flipped to “Saudi buyers” representing Rinad Al Jazira[77] for $12.5 million.[78] Vučić appeared untroubled by the practice of flipping arms purchased at a discount from state-owned firms, dismissing it as “one, two or three percent lower” and adding that it was “unimportant” because “it is important for [Serbia] to sell arms.”[79]

United BG[80] (cofounded by Branko Stefanović and Todorovic) quickly re-filed organizational documents with Serbian regulators after the Krušik matter broke and declared Todorovic as its sole owner. The authoritative Balkan Investigative Reporting Network (BIRN) disclosed visa and other documents identifying Branko Stefanović as a “legal adviser” to GIM and Todorovic in arms sales to Saudi Arabia .[81] In 2018, GIM purchased 12,500 Krušik mortar shells[82] and resold them at a 79 percent markup according to GIM invoices issued to the Saudi Ministry of Defense.[83] BIRN disclosed another 2018 transaction in which GIM purchased 17,400 Krušik mortar shells[84] and GIM resold them at twice the price the following year to a Saudi partner.[85]

Nebojša Stefanović was adamant that his father had no connection to GIM or Todorovic. “My father’s not affiliated with GIM in any way. So there’s no connection to GIM,”[86] he said. Vučić sought to minimize the matter, but ended up contradicting Nebojša Stefanović when he insisted Branko Stefanović “was just a GIM employee”[87]:

I asked Nebojša whether he [Branko Stefanović] is [GIM’s] owner, whether he’s a director, what is he? He says ‘he’s nothing’.[88]

A few days later, Nebojša Stefanović declined to answer “the same questions again” about his father’s association with GIM, stating that he was not going to help journalists “write today’s headline.”[89] That same day, the Association for the Protection of Constitutionality and Legality (UZUS[90]) requested Prime Minister Ana Brnabić initiate proceedings to dismiss Stefanović as a government minister.[91]

Vučić’s political problems with arms dealing extend beyond GIM and the Stefanovićs to allegations about illegal shipments to Libya when he was Defense Minister (July 2012-September 2013).[92] The notorious Serbian arms dealer Slobodan Tešić—another sometimes business partner of Branko Stefanović—allegedly attended meetings in Libya between Vučić and Khalid al-Sharif[93], who at the time was Libya’s Deputy Defense Minister. The Serbian newspaper Danas reported that Tešić, through his Cypriot-registered company, Charso[94] Limited, was brought into negotiations with the Libyans about an arms transaction worth close to $100 million. Tešić also allegedly sold weapons as a middleman for BelTechExport CJSC, a Belarus government-owned intermediary.[95] Tešić is a charter member of the United States government’s Specially Designated Nationals (SDN) blacklist under its Global Magnitsky (GLOMAG) program.[96] His SDN blacklisting followed imposition of a United Nations travel ban in May 2005 for violating a UN arms embargo.[97] In December, political fallout from Vučić’s ties to Tešić widened when Tawazun Holding[98], an Abu Dhabi sovereign offset fund, acquired a 26 percent stake in a defense contractor, International Golden Group (IGG).[99] IGG reportedly financed Tešić’s arms sales in Libya, where he reputedly is the main supplier to Field Marshal Khalifa Belqasim Haftar’s Libyan National Army.

The final straw may turn out to be allegations championed by Marinika Tepić of Serbia’s opposition Party of Freedom and Justice[100] (SSP) regarding munitions that ended up in eastern Ukraine, where they were used against pro-Russian separatists. Vučić claims Krušik sold munitions—thirty thousand M73 60 mm HE mortar shells (the munitions implicated in GIM’s resale to Saudi Arabia)—to Tehnoremontis, formerly a Serbian state-owned enterprise that repaired combat vehicles before its sale to an arms exporter, CPR Impex. CPR’s owner, Petar Crnogorac[101], responded, “Call me next week” and hung up the telephone when he was asked to comment on the matter by Danas.[102] Tehnoremont exported the munitions to a declared end-user in Poland, Nattan Spółka z ograniczoną odpowiedzialnością via a Cypriot middleman, Petralink Limited.[103] According to its Cypriot corporate registration, one of Petralink’s owners is Volodomyr Petenko, a former official with the Ukrainian state-owned arms trading company Ukrspetsexport. The munitions, however, never went to Poland, but ended up in eastern Ukraine. Arms Watch republished this photograph of a Krušik M73 60 mm HE mortar shell that was recovered along with other  munitions by the Donetsk People’s Republic Defense Ministry.

(credit: Arms Watch)[104]

Nebojša Stefanović blamed Poland, saying, “If a third country sells our weapons to Ukraine, what can we do about it?”[105] Retired General Waldemar Skrzypczak, who once served as Poland’s Deputy Defense Minister, dismissed Stefanović’s disavowal, saying, “I don’t believe the Serbs didn’t know where these weapons went. They’re just trying to save face now with the Russians.”[106] Regardless of who knew what, writes the influential Polish daily Dziennik Gazeta Prawna, “Poland at this moment looks like an alibi and a scapegoat,” continuing, “All this occurred right under the nose of the [Polish] Military Counterintelligence Service.”[107]


I told you . . . I tried to explain to you . . . Did we not understand each other?[108]

                                                                                                                                         – President Vučić to reporters

Boško Obradović, who founded and leads the nationalist Serbian Movement Dveri[109] said, “The Krušik case in tantamount to the vivisection of the [Vučić] government.[110] Serbia, said Vučić,  “finds itself in a difficult situation because of a frightening smear campaign waged against it.”[111] He shows no signs of backing down, however, and his supporters take every opportunity to wrap themselves in the flag. The Krušik accusations, he said, “have caused great damage to Serbia. We have to fight, to stand up for Serbia, for the defense industry, to protect 11,000 workers and to drive Serbia forward.”[112]

“By some miracle, ‘Operation Krušik’ started in Bulgaria,” Defense Minister Aleksandar Vulin said sarcastically. He called the Krušik matter a “hybrid operation intended to attack the government—specifically Interior Minister Nebojša Stefanović—although the ultimate target is President Aleksandar Vučić.”[113] Vulin took a swipe at critics of Serbian arms exports, saying, “And why are weapons found on the battlefield? What are mortar shells used for? The point is, that’s why they’re made.”[114]

The pro-government Kurir condemned “those who by concocting scams over many years, have tried to destabilize our institutions in order to bring about the current government’s removal.”[115] Vladanka Malović—she runs Vučić’s Serbian Progressive Party’s news portal, SNS Serbia—called Dilyana Gaytandzhieva, the Bulgarian investigative journalist who published documentary evidence about Krušik munitions ending up in eastern Ukraine, “An intelligence cesspool, even worse than the cesspools who sent you the documents.”[116]  

Not all Serbs see it this way, however. The final word goes to Nenad Milosavljević, whose satiric editorial perhaps captures many Serbs’ frustration with Vučić’s evasions:

In future, Alexandar Vučić will answer all questions about the Krušik case in Chinese, according to his cabinet. The president decided to take this step because he has said everything he has to say about the affair in Serbian, but journalists did not stop asking questions about it, so he was forced to begin using another language in order to say something new . . . Unofficially, the president has already begun studying several languages in order to respond to all future affairs, and so far has learned the basics of Icelandic as well as Punjabi, Zulu, Igbo and Gujarati.[117]

The translation of all material is by the author unless noted otherwise. The essay’s title is adapted from “Serbia Will Explode” (Srbija će eksplodirati), a 12 December 2019 editorial published in the influential Serbian newsweekly, NIN [see footnote (1)].

Acronym glossary:

BIA: Serbian Intelligence
GRU: Russian Military Intelligence
SVR: Russian Foreign Intelligence Service
RISI: Russian Institute of Strategic Studies
FSO: Russia’s Federal Guard Service
MUP: Serbian Ministry if Internal Affairs
SSP: Serbia’s Party of Freedom and Justice

[1] “Srbija će eksplodirati.” NIN [published online in Serbian 12 December 2019]. Last accessed 27 December 2019.

[2] NIN is the acronym of Nedeljne informativne novine (“Weekly Newsletter”), an influential Serbian current affairs magazine.

[3] “Serbiens Präsident Vucic: ‘Ich würde in Brüssel gehängt’.” Der Spiegel [published online in German 22 November 2019]. Last accessed 7 December 2019.

[4] Siniša Ljepojević: (2020). “Bitka za Balkan je bitka za Srbiju.” Iskra [published online in Serbian 11 February 2020]. Last accessed 22 February 2020.

[5] “La Haute-Savoie, camp de base d’espions russes spécialisés dans les assassinats ciblés.” Le Monde [published online in French 4 December 2019]. Last accessed 13 January 2019.

[6] “Chłód Władimira Putina wobec wojskowych szpiegów.” Rzeczpospolita [published online in Polish 6 November 2019]. Last accessed 20 January 2020.

[7] Ibid.

[8] This has included exposure by Western as well as Russian investigative reporting. See, for example: “The Dreadful Eight: GRU’s Unit 29155 and the 2015 Poisoning of Emilian Gebrev.” Bellingcat [published online 29 November 2019]. Last accessed 20 January 2020. Also: “Tretiy russkiy. V dele Skripalya mogut poyavit’sya novyye familii.” Fontanka [published online in Russian 10 October 2018]. Last accessed 20 January 2020.

[9] Bellingcat is a self-described “independent international collective of researchers, investigators and citizen journalists using open source and social media investigation to probe a variety of subjects is an investigative journalism.” See: Last accessed 27 January 2020.

[10] “305 Car Registrations May Point to Massive GRU Security Breach.” Bellingcat [published online 4 October 2018]. Last accessed 20 January 2020.

[11] Rzeczpospolita (6 November 2019), op cit.

[12] “Zła passa szpiegów Putina.” Dziennik Zwiazkowy [published online in Polish 30 December 2019]. Last accessed 20 January 2020.

[13] Republic of North Macedonia Ministry of Internal Affairs (2017). “Report on a meeting between Macedonian foreign ministry official Nenad Kolev and Russian Ambassador Oleg Shcherbak” (in Macedonian). Last accessed 27 January 2020.

[14] Last accessed 7 December 2019. Some translations reference “Jutjub,” the Serbian transliteration of “YouTube”.

[15] Ibid.

[16] Last accessed 24 January 20120.

[17] Last accessed 24 January 2020.

[18] Last accessed 24 January 2020.


[20] RFE/RL is the acronym of Radio Free Europe/Radio Liberty, a United States government-funded organization controlled  by the U.S. Agency for Global Media. See: Last accessed 22 January 2020.

[21] “NAČELNIK BIA TVRDI: Na teritoriji Srbije deluje veliki broj bezbednosno-obaveštajnih sistema! Znamo ko je na snimku, ali. . . .” Pravda [published online in Serbian 20 November 2019]. Last accessed 24 December 2019. Nemanja Stefanović, who holds a controlling ownership stake in Pravda, in the brother of Deputy Prime Minister and Interior Minister, Nebojša Stefanovi, who figures prominently later in this essay.

[22] “Odata počast stradalim pripadnicima Crvene armije.” Serbian Defense Ministry press release dated 21 October 2017. Last accessed 22 January 2020.

[23] “Sırp savcılar, Sırbistan’da bir ay önce ortaya çıkarılan Rus casusluk skandalını soruşturmuyor.” QHA Media [published online in Turkish 15 December 2019]. Last accessed 24 December 2019.

[24] “BIA potvrdila autentičnost snimka.” b92 [published online in Serbian 20 November 2019]. Last accessed 7 December 2019.

[25] “Načelnik analitike BIA: Obaveštajni subverzivni rad na teritoriji Srbije ne treba vezivati samo za Rusku Federaciju, i druge velike sile intenzivno rade na ostvarivanju svojih interesa.” Novosti [published online in Serbian 20 November 2019]. Last accessed 4 December 2019.

[26] “Otkriveno ko je Srbin na snimku sa ruskim obaveštajcem.” Novosti [published online in Serbian 21 November 2019]. Last accessed 7 December 2019.

[27] Formally, the Autonomous Province of Kosovo and Metohija [Serbian transl.: Autonomna Pokrajina Kosovo i Metohija]

[28] Pravda (20 November 2019), op cit.

[29] “’RUSKI ŠPIJUNI’ GURAJU SRBE U NATO! Strogo poverljiva obaveštajna afera trese državu! Informer [published online in Serbian 21 November 2019]. Last accessed 24 January 2020.

[30] Serbia’s main national security agencies are the BIA, the Defense Ministry’s Military Intelligence Agency (Serbian transl.: Vojnoobaveštajna Agencija, “VOA”) and the Serbian General Staff’s Intelligence and Reconnaissance Directorate (Serbian transl.: Uprava za obaveštajno-izviđačke poslove) also known as the J-2 Directorate.

[31] “Bezbednosno-informativna agencija potvrdila autentičnost snimka sreda,.” Politika [published online in Serbian 20 November 2019].Политика-сазнаје-шпијунски-снимак-стар-је-неколико-година-и-на-њему-није-српски-официр. Last accessed 7 December 2019.

[32] “Željski: VBA utvrdila šta je bio predmet primopredaje.” Tanjug [published online in Serbian 23 November 2019]. Last accessed 7 December 2019.

[33] Ibid.

[34] ” NAČELNIK BIA TVRDI: Na teritoriji Srbije deluje veliki broj bezbednosno-obaveštajnih sistema! Znamo ko je na snimku, ali….” Pravda [published online in Serbian 20 November 2019]. Last accessed 24 December 2019.

[35] “BIA potvrdila autentičnost snimka na kojem je ruski obaveštajac.” Radio-televizija Vojvodine [published online in Serbian 20 November 2019]. Last accessed 24 December 2019.

[36] Vučić identified the officer in question as a “former member of the VS,” the acronym of Vojska Srbije or “Serbian Armed Forces”.

[37] “VUČIĆ O AFERI “RUSKI ŠPIJUN” Potpukovnika Vojske Srbije sa snimka naše službe pratile su još 2012.” Blic [published online in Serbian 21 November 2019]. Last accessed 8 December 2019.

[38] “Bocan-Harčenko za RTS: Sada nije najpovoljnija situacija za obnovu pregovora.” RTS [published online in Serbian 23 November 2019]. Last accessed 4 December 2019.

[39] “Otnosheniya Moskvy i Belgrada ne postradayut iz-za vozmozhnogo intsidenta s uchastiyem sotrudnika posol’stva RF – Peskov.” Interfax-Azerbaijan {published online in Russian 21 November 2019]. Last accessed 7 December 2019.

[40] “Vuchich potvŭrdi, che videoto s agenta na GRU e istinsko Belgrad razpolaga s informatsiya i za drugi sluzhiteli na ruskite spetssluzhbi.” Blitz [published online in Bulgarian 22 November 2019]. Last accessed 8 December 2019.

[41] “Vučić: Ovde ima mnogo obaveštajaca koji pripadaju svim svetskim silama.” Grad Zvornik [published online in Serbian 25 November 2019]. Last accessed 8 December 2019.

[42] “Vučić: Ruskog ambasadora samo sam pitao – zašto.” Radio Televizija Srbije [published online in Serbian 21 November 2019]. Last accessed 16 December 2019.

[43] “Dojče vele, BBC i Gardijan opširno o obaveštajnoj aferi u Srbiji.” Radio-televizija Vojvodine [published online in Serbian 22 November 2019]. Last accessed 16 December 2019. The reference is to Sandžak (its name literally means “Ottoman province”), a majority Bosniak (i.e., ethnic Muslim) historical region that straddles modern day southwest Serbia and northern Montenegro in which an active separatist movement is led by the Bosniak National Council (BVA).

[44] Ibid. After the BIA filed espionage charges against Nikola Kajkic, a suspended Croatian police investigator and chief of the Croatian National Police Union, and accused him of operating a spy network inside Serbia, Croatia’s Security and Intelligence Agency (SOA) released a statement that said “[W]e emphasize that this is a criminal complaint designed to divert domestic and international attention away from serious matters inside Serbia, including  two recent incidents involving  suspected corruption and illegal arms trading involving Serbian weapons, and the publication of a recording in which a Russian a intelligence officer in the GRU is seen handing over money to a Serbian military  officer.” See: “SOA žestoko odgovorila srpskoj tajnoj službi: Izmislili su špijunažu da bi skrenuli pažnju sa šverca oružjem i korupcije u Srbiji.” [published online in Croatian 30 November 2019]. Last accessed 22 January 2020.

[45] “DRECUN DIGAO SRBIJU NA NOGE: Protiv naše zemlje vodi se niz hibridnih operacija! Ovo je glavni cilj!.” Pravda [published online in Serbian 21 November 2019]. Last accessed 24 December 2019.

[46] Pravda (21 November 2019), op cit.

[47] The Bulgarian government has its own challenges with Russian intelligence, having recently expelled a Russian diplomat and refused to issue a visa to an incoming Russian defense attaché. In September 2019, the Bulgarian government charged Nikolai Malinov, a former parliamentary deputy from the Bulgarian Socialist Party with espionage—the first person so charged since 1978—and laundering money for Russian organizations including RISI.

[48][48] Ibid.

[49] . Last accessed 28 December 2019. Last accessed 24 December 2019.

[50] Niš is reputedly also the location of training centers for several Serb paramilitary groups, including Srbska čast (“Serbian Honor”), a Serbian separatist group active in Republika Srpska, one of the two constituent parts of Bosnia and Herzegovina.  According to the investigative news portal Žurnal, Russian paramilitary instructors have trained Srbska čast members at the RSHC. See: “UZ POMOĆ RUSKIH I SRBIJANSKIH SPECIJALACA: Milorad Dodik formira paravojne jedinice u Republici Srpskoj!” Žurnal [published online in Serbian 12 January 2018]. Last accessed 28 December 2019.

[51] Radio Televizija Srbije (21 November 2019), op cit.

[52] Grad Zvornik (25 November 2019], op cit.

[53] ” AFERA “RUSKI ŠPIJUN” TRESE SRBIJU Bilo je 50 POKUŠAJA da snimak ugleda svetlo dana, ali je ruska služba svaki osujetila.” Blic [published online in Serbian 21 November 2019]. Last accessed 8 December 2019.

[54] “Vučić: Srbija je slobodna zemlja, nikad nećemo dozvoliti da nama drugi upravljaju.” RINA [published online in Serbian 21 November 2019]. Last accessed 17 December 2019.

[55] Radio Televizija Srbije (21 November 2019), op cit.

[56] Ibid.

[57] RINA (21 November 2019), op cit.

[58] The literal translation of what Vučić said is “talk in four eyes” (četiri oka ćemo razgovarati), which translates idiomatically to the English “discuss it between ourselves” and is intended to convey a private conversation between two persons.

[59] “Špijunska afera je iza nas, poručuje Bocan-Harčenko.” Politika [published online in Serbian 10 December 2019]. Last accessed 17 December 2019.

[60] RISI’s Belgrade office was opened in October 2013 by Leonid Reshetnikov, a Balkan specialist and retired head of the Russian Foreign Intelligence Service’s (SVR) Analysis & Information Department. After Serbian authorities detained GRU operatives suspected of involvement in a failed October 2016 coup in Montenegro, RISI replaced Reshetnikov with Mikhail Fradkov, who directed the SVR from 2007-2006.

[61] Predrag Petrovic (2017). ” Serbia is the most important bridge-head for Kremlin in the Balkans.” Last accessed 28 December 2019.

[62] RISI replaced Reshetnikov as head of the Belgrade office after Serbian authorities detained a group of GRU operatives suspected of involvement in a failed October 2016 coup in Montenegro. His replacement was Mikhail Fradkov, the SVR’s Director from 2007-2006.

[63] “Vučić razgovarao sa šefom ruske spoljne obaveštajne službe.” b92 [published online in Serbian 16 April 2018]. Last accessed 28 December 2019.

[64] “Szef SWR w Serbii. Co knuje rosyjski wywiad?” Warsaw Institute Russia Monitor [published online in Polish 25 April 2018]. Last accessed 28 December 2019.

[65] Sporazum između Ministarstva unutrašnjih poslova Republike Srbije i Federalne službe obezbeđenja Ruske Federacije o saradnji i zajedničkom delovanju, zaključen u Moskvi, dana 23. maja 2017. (“Agreement between the Ministry of Internal Affairs of the Republic of Serbia and the Federal Security Service of the Russian Federation on Cooperation and Joint Action, signed in Moscow on 23 May 2017”). Last accessed 13 December 2019.

[66] “Sporazum o razmeni podataka sa Putinovom tajnom službom. Ima li razloga za paranoju?” Blic [published online in Serbian 16 March 2018]. Last accessed 26 December 2019.

[67] Ukaz Prezidenta Rossiyskoy Federatsii ot 27 fevralya 2018 goda № 89 ‘O vnesenii izmeneniy v Polozheniye o Federal’noy sluzhbe okhrany Rossiyskoy Federatsii, utverzhdennoye Ukazom Prezidenta Rossiyskoy Federatsii ot 7 avgusta 2004 g. № 1013’,” op cit.

[68] “Srpske i ruske bezbednosne službe jačaju saradnju.” N1 [published online in Serbian 26 October 2016]. Last accessed 13 December 2019.

[69] The Security Council of the Russian Federation coordinates and implements presidential defense and national security decisions pursuant to Russia’s National Security Strategy.

[70] “Sporazum MUP-a Srbije i ruske Federalne službe obezbeđenja.” Magazin Odbrana i Bezbednost [published online in Serbian 19 March 2018]. Last accessed 13 December 2019.

[71] “Tri boje srpsko-ruskog bezbednosnog partnerstva.” Peščanik [published online in Serbian 13 March 2018]. Last accessed 26 December 2019.

[72] Michelle Van Cleave defines strategic counterintelligence as “to go on the offense to degrade hostile external foreign intelligence services and their ability to work against us.” See: Van Cleave (2007). “Strategic Counterintelligence: What Is It and What Should We Do About It?” Studies in Intelligence. 51:2. Last accessed 17 December 2019.

[73] Radio Televizija Srbije (21 November 2019), op cit.

[74] Formally, Krušik Holding Corporation.

[75] Serbian opposition media regularly question the legitimacy of a doctorate degree awarded Nebojša Stefanović by Megatrend University. According to his Belgrade Security Forum biography, “Nebojša Stefanović received his doctorate in June 2013 with the thesis, A New Role of Strategic Management in Managing Local Self-Government.“ [ Last accessed 26 December 2019] However, the Serbian investigative journalist Anđela Milivojević used Serbia’s freedom of information law—known as the “Law on Free Access to Information of Public Importance” [Serbian transl.: Zakon o slobodnom pristupu informacijama od javnog značaja]—to obtain a copy, which she found rife with plagarism. See: “Kako do doktorata? Lako! Slučaj ministra Stefanovića.” Peščanik [published online in Serbian 1 June 2014]. Last accessed 27 December 2019. The day after publishing the story, was struck by a Denial of Service (DOS) attack. The Conference of Universities of Serbia later concluded there was no basis to revoke Stefanović’s degree, although it did note “minor errors” in his dissertation. In July 2019, the opposition Alliance for Serbia [Serbian transl.: Savez za Srbiju “SzS”] filed criminal charges against Stefanović for allegedly forging his undergraduate diploma, which he claimed was awarded by a London- registered entity, “Megatrend International Expert Consortium Ltd”.

[76] When Obradovića was placed under house arrest for “disclosing business secrets,” the tabloid Kurir reported that his mother, Milijana Obradović, had worked for one of GIM’s competitors, CPR Impex, since her dismissal by Krušik in 2017. “OVO JE PRAVA POZADINA AFERE KRUŠIK! Majka „uzbunjivača“ radi za trgovca oružjem!.” Kurir [published online in Serbian 15 November 2019]. Last accessed 28 December 2019. In 2017, however, Tehnoremont partnered with GIM on a large arms sale to the Saudi Defense Ministry

[77] Rinad Al Jazira  is a Riyadh-based company whose business is identified on as  “Military and Tactical Weapon Supplier to the Saudi Defense.”

[78] ” GIM-u milioni evra, oružarima dugovi.” NIM [published online in Serbian 25 December 2019]. Last accessed 27 December 2019.

[79] ” Vučić nikad čuo za Krušik.” Danas [published online in Serbian 25 December 2019]. Last accessed 28 December 2019.

[80] Formally, United BG Consalting DOO Beograd-Stari Grad.

[81] “Branko Stefanović: Pravni savetnik GIM-a u Saudijskoj Arabiji.” Javno [published online in Serbian 2 December 2019]. Last accessed 27 December 2019.

[82] Krušik’s 1M62P8 20mm HE (high explosive) mortar shell.

[83] Ibid.

[84] Krušik’s M73 60 mm HE (high explosive) mortar shell.

[85] Javno (2 December 2019), op cit.

[86] Ibid.

[87] Ibid.

[88] Ibid.

[89] “Stefanović nije želeo da odgovara na pitanja o svom ocu i GIM-u.” N1 [published online in Serbian 27 December 2019]. Last accessed 27 December 2019.

[90] Serbian transl.: Udruženje za zaštitu ustavnosti i zakonitosti.

[91] “UZUS traži smene ministara, Stefanoviću besmisleno da odgovara na ista pitanja.” N1 [published online in Serbian 27 December 2019]. Last accessed 27 December 2019.

[92] Vučić served as Defense Minister (and concurrently as First Deputy Prime Minister) from July 2012 to August 2013 before he stepped down in a cabinet reshuffle.

[93] Khalid Al-Sharif was military commander of the Libyan Islamic Fighting Group (LIFG), a Sunni opposition group established in Libya in 1995 and later affiliated with al-Qaida.

[94] Sometimes spelled as the Serbian transliteration, Kartso.

[95] Part of the Belarus State Authority for Military Industry, BelTechExport is “an authorized state special exporter and an integral part of the Belarusian military-industrial complex.” Last accessed 28 December 2019.

[96] Tešić is one of ten persons named in President Trump’s Executive Order 13818 “Blocking the Property of Persons Involved in Serious Human Rights Abuse or Corruption.” See: Last accessed 2 December 2019. GLOMAG sanctions target persons associated with serious human rights abuse, corruption or the transfer of the proceeds of corruption. President Trump signed EO 13818 on 20 December 2017 pursuant to the Global Magnitsky Human Rights Accountability Act. From 2003 to 2013, Tešić was on a United Nations travel blacklist for violating a UN embargo on arms exports to Liberia.

[97] See: Last accessed 3 December 2019. The United Nations Security Council (UNSC) added Tešić to its travel blacklist based on the findings of an April 2003 Panel of Experts report, which referred to him as “the chief sanctions buster” in the matter of the Liberian arms embargo. See: “Letter dated 24 April 2003 from the Chairman of the Security Council Committee established pursuant to resolution 1343 (2001) concerning Liberia addressed to the President of the Security Council.”

[98] Tawazun Holding is an Abu Dhabi investment company established in 2007 to manage defense contract offset clauses[98] under the Tawazun (the word means “balance” in Arabic) Economic Program (née UAE Offset Program), a countertrade mechanism that requires arms sellers to make a reciprocal investment or “offset” in the country in question.

[99] “Tawazun picks 26% stake in International Golden Group.” Khaleej Times [published online

[100] Serbian transl.: Stranka slobode i pravde “SSP”.

[101] Petar Crnogorac is the son of Svetozar Crnogorac, a director of the Serbian arms manufacturer Zastava Arms [Serbian transl.: Zastava oružje].

[102] “Ko je Petar Crnogorac.” Danas [published online in Serbian 23 November 2019]. Last accessed 28 December 2019.

[103] Last accessed 29 December 2019.

[104] Last accessed 29 December 2019.

[105] “Jak wmontowano Polskę w sprzedaż serbskiej broni na Ukrainę.” Dziennik Gazeta Prawna [published online in Polish 18 December 2019].,18-grudnia-2019/69872,Dziennik-Gazeta-Prawna/708819,Jak-wmontowano-Polske-w-sprzedaz-serbskiej-broni-na-Ukraine.html . Last accessed 29 December 2019

[106] “Będziemy kozłem ofiarnym krzywego dealu.” Dziennik Gazeta Prawna [published online in Polish 18 December 2019].,18-grudnia-2019/69872, Dziennik-Gazeta-Prawna/708820, Bedziemy-kozlem-ofiarnym-krzywego-dealu.html. Last accessed 29 December 2019.

[107] Ibid. Poland’s Military Counterintelligence Service [Polish: Służba Kontrwywiadu Wojskowego “SKW”] is part of the Defense Ministry.

[108] “Vučić o aferi Krušik odgovara sa “pa šta”, stručnjaci kažu – otišlo se predaleko.” N1 [published online in Serbian 22 December 2019]. Last accessed 28 December 2019.

[109] Serbian transl.: Srpski pokret Dveri. The word “dveri” means “doors”.

[110] “Vučić: Jeziva kampanja protiv Krušika svela se na to da me je Stefanović lagao,” Danas [published online in Serbian 22 December 2019] . Last accessed 28 December 2019.

[111] Ibid.

[112] “Vučić: Namenska industrija pretrpela štetu zbog slučaja ‘Krušik’.” RTS [published online in Serbian 27 December 2019]. Last accessed 29 December 2019.

[113] “Vulin: Otkazan veliki broj ugovora za izvoz oružja iz Krušika.” NoviMagazin [published online 29 December 2019]. Last accessed 29 December 2019.

[114] Ibid.

[115] Ibid.

[116] Last accessed 28 December 2019.

[117] “Vučić ubuduće na pitanja o “Krušiku” odgovara isključivo na kineskom jeziku.” Njuz [published online in Serbian 24 December 2019]. Last accessed 28 December 2019.