Spanish Police Arrest Dutch Lawyer of Telecoms Firm Related to Russian Oligarch Fridman Noted in Trump Dossier

On January 16, Reuters published a story (updated January 17) that Spanish police had arrested a prominent Dutch corporate lawyer, Peter Wakkie, at the Madrid Airport as part of an investigation into the insolvency of the Russian-Spanish telecoms firm ZED+.

The story attracted more interest because Russian oligarch Mikhail Fridman has an interest in ZED+, and has also been named in the Trump “kompromat” [compromising material] dossier as one of the top figures involved in the Russian campaign to influence the US elections.

Spanish investigators said the prosecutor wanted to charge Wakkie, who was in charge of digital marketing and mobile commerce for ZED+, with “belonging to a criminal organization” and “making false claims of insolvency.”

Further details were kept secret and the Spanish High Court had no comment.

Reuters said Wakkie’s arrest was not related to an ongoing US-Spanish investigation into Fridman, whose investment firm Letter One indirectly holds a small stake in ZED+, although LetterOne holds 47.85 percent of Vimpelcom, which originated as a Russian company, and Vimpelcom in turn has 5.32 stake in ZED+. 

Wakkie was released after 14 hours, and the matter appeared to be closed.

But as Viktor Cheretsky of RFE/RL’s Russian-language service Svoboda reported, citing the Spanish Internet news site El Confidencial, the arrest may have been connected to Russian corruption.

Wakkie was suspected of unlawful transfer of funds from ZED+ to close relatives of Vladimir Kolokoltsev, the Russian Interior Minister, causing losses for the Spanish investors in ZED+. According to El Confidencial, which cites sources in Spanish intelligence, Wakkie is also related to the hacking of the Democratic National Committee (DNC) in the US before the elections, among others believed to be involved including Mikhail Fridman.

Fridman denies any acquaintance with Wakkie, LifeNews reports.

Wakkie’s arrested followed the publication of the “Trump kompromat dossier”  in which Fridman is said to be one of the middlemen between big business in Russia and President Vladimir Putin.  As with other points, however, the dossier is vague on the exact nature of these relationships, saying only that Fridman is “one of the unofficial advisers of Putin” on issues “related to the US.”

Three dozen policemen were involved in the arrest of Wakkie, and Spanish Prosecutor Jose Grinda Gonzalez, who has made a speciality of prosecuting the Russian mafia, personally supervised it. Wakkie had traveled to Madrid to resolve the issues regarding ZED+. Wakkie’s case was handled by the National Judicial Chamber of Spain, which handles the most serious criminal cases. A representative of the Chamber, Jorge Suarez, confirmed for Svoboda that Wakkie was indeed detained but declined to provide any other details.

But after his release, Wikkie told Reuters that the charges were “fake” and that “Police were not clear about the charges,” Reuters reported.

As Svoboda notes, El Confidencial is the main source for this story. Wakkie was made acting manager of ZED+ when the previous co-president and CEO, Javier Perez Dolset, was removed from the corporation’s board of managers after the London Court of International Arbitration found in 2015 that he had forged documents.

Dolset denied any wrongdoing, and in fact accuses Wakkie of financial crimes for moving 30 million euros from Temafon, the Russian affiliate of ZED+ which caused a financial crisis for the Spanish joint venture and its virtual bankruptcy. Wakkie in turn accused the Spaniards of hindering the free sale of the company to Chinese investors, which was to be in the interest of VimpelCom, a Dutch-registered holding company founded by a Russian scientist, with telecommunication shares in the CIS, Europe, Asia and Africa, including in Vimpel-Communications, a Russian company. VimpelCom is controlled by Fridman, who resides in London. El Confidencial‘s sources say Wakkie had agreed with ZED+ creditors to acquire the holding for a song. Dolset said his personal computer was hacked and his telephone monitored to find out details of his personal life to use to pressure him.

As the Spanish prosecutor Jose Grinda Gonzalez has said, they have learned “from well-informed circles and specialists on Russia” that entrepreneurs engaged in dubious operations “possess a very refined system of information protection, whose specialists can at the same time penetrate other people’s information systems.” El Confidencial‘s sources say Wakkie received 50,000 euros a month for his services. The 30 million euros taken from the Russian affiliate was first sent to a firm called Vstrecha, and then “for unclear services” (believed to be a bribe) to another Russian company owned by the close relative of Interior Minister Vladimir Kolokoltsev, who is not named.

El Confidencial says the FBI is also involved in the investigation of ZED+, which has been active in the US market, but does not claim that this means Fridman is involved in hacker attacks on the US. The FBI has shown a particular interest in VimpelCom, which was forced to pay the SEC a fine of $835 million for bribery of relatives of the late President Islam Karimov of Uzbekistan.

What does this all add up to? A lot of smoke with no fire, so far. Why would Spanish authorities make such a dramatic arrest of a Dutch lawyer related to Russian business, only to let him go within a day?

Spanish prosecutors have been successful in prosecuting the Russian mafia, but only up to a point; last year, Spain issued 12 warrants for figures close to Putin, including Vladislav Reznik, a prominent MP in the ruling United Russia party and his wife, Diana Gindin. They sought the arrest of Nikolai Aulov, deputy head of Russia’s federal narcotics service and Igor Sobelevsky, former deputy head of the Investigative Committee.

The higher-ranking officials were believed to have been helped by the Tambov gang to get their positions; the Tambov and Malyshev gangs smuggled heroin in St. Petersburg when Putin was deputy mayor, and allegedly laundered money through Spanish real estate. They are also accused of murder, extortion and weapons trafficking. The head of the Tambov gang, Gannady Petrov, at one time co-owner of the Bank Rossiya, was tied to several of Putin’s closest allies, and along with Putin, has a dacha in the exclusive Ozero compound near St. Petersburg.

But the Spanish prosecutors have not been able to arrest those targeted, and the prosecution has come at a price; Alexander Litvinenko the former FSB agent who was killed by polonium, had helped the Spanish prosecutors to chase down Russian mafia figures, which is believed to be the motivation for the “probable” order by Putin to assassinate him, as the London High Court ruled.

Opinion diverges greatly as to whether the Trump dossier is believable; those who take it seriously point to the style and format typical of Russian intelligence, not the substance. Fortune magazine found plausible the role described of Fridman and Pyotr Avan, Alfa Bank owners in providing Putin with information through their own network of business context. But Alfa denied the allegations in the dossier as “fake news”.

As the Guardian points out, the fact that Alfa Group was spelled “Alpha” in the report — a mistake that anyone truly knowledgeable about Russian business would not make — suggests that the claims are not first-hand and therefore dubious.

Even before the Trump dossier — discussed for months by journalists and intelligence officers — was released, Franklin Foer of Slate ran an article on October 31, 2016, titled, “Was a Trump Server Communicating with Russia“? The Jewish Forward then put the pieces together and asked the next day, “Is Jewish Oligarch the Cyber Link Between Donald Trump and Russia?“

Foer’s article focused on allegations of physical connections between Trump’s office and Alfa bank discovered by a DNS specialist and malware hunter referred to in the story as “Tea Leaves”. He discovered a bank in Moscow that kept irregularly pinging a server registered to Trump on Fifth Avenue and at first believed it was malicious activity, then concluded that the server lookups “resembled the pattern of human conversation”. But further investigation of the oddities in the server communications by other specialists eventually yielded to the conclusion that the communications were just mailings advertising Trump’s condos. Even so, Tea Leaves and his colleagues believed the communications tracked political events in the US, with more DNS lookups, for example, during the two party conventions. All this attention to the server led the Trump Organization to create a new host name to enable communication by a different route; the first look-up came from the same Alfa server which suggested contact by other means such as telephone.  Such behavior prompted some, including Hillary Clinton, to say that Trump must have something to hide.

Alfa Bank insisted that Fridman and Aven had never met Trump nor had they or Alfa had any business dealings with him. Legions of computer specialists picked the story apart and found all kinds of other plausible explanations for the peculiar behavior of the servers — which the Trump camp attributed to a vendor’s marketing campaign. Then the Trump campaign said that this vendor, Cendyn, had another client which used a meeting management application to coordinate meetings with Alfa, which explained the connection. Foer found it “strange” that Cendyn would used a domain labelled with Trump’s name to handle the business of another client, and also peculiar that Mandiant, the cybersecurity firm hired by Alfa to investigate the incident, wouldn’t have found this other bank and the meeting application and invoked this as an explanation, rather than the one given — that the server activity was only a marketing campaign.

Foer continued to find the explanations given implausible — why would a marketing campaign focus only on one bank in Russia, and a health care company in Michigan (also found in the server records)? Because the server’s access was closed, the scientists investigating them believed they were used for private communications.

Vox reporter Timothy Lee questioned the spiking of traffic around the conventions, and noted that the largest spike occurs in August, which coincided with the end of Manafort’s relationship to the Trump campaign. The Intercept also faulted Foer’s scientist sources saying they didn’t even include their own DNS look-ups on that server in their list, and therefore they couldn’t be sure the look-up list was complete. The scientists resolved that issue by publishing the full set of data. While Snopes published a debunk of the claims about Trump’s servers with remarkable speed the day after Foer’s first article came out, the scientists who originally discovered the activity stand by their original conclusions that the server activity was odd and couldn’t be explained by marketing campaigns but only by “human conversation”. And despite Snopes’ claim that the experts described by Foer were anonymous, in fact they gave their names.