The Russian hackers indicted by the US special prosecutor in July have spent years trying to steal the private correspondence of some of the world’s most senior Christian Orthodox figures, The Associated Press (AP) has found, illustrating the high stakes as Kiev and Moscow wrestle over the religious future of Ukraine.
The targets included top aides to Ecumenical Patriarch Bartholomew I, who often is described as the first among equals of the world’s Eastern Orthodox Christian leaders.
The Istanbul-based patriarch is mulling whether to accept a Ukrainian bid to tear that country’s church from its association with Russia, a potential split fueled by the armed conflict between Ukrainian military forces and Russia-backed separatists in eastern Ukraine.
Illustration: Mountain People
The AP’s evidence comes from a hit list of 4,700 e-mail addresses supplied last year by Secureworks, a subsidiary of Dell Technologies.
The AP has been mining the data for months, uncovering how a group of Russian hackers widely known as Fancy Bear tried to break into the e-mails of US Democrats, defense contractors, intelligence workers, international journalists and even US military wives.
In July, as part of special counsel Robert Mueller’s ongoing investigation into Russian interference in the 2016 US election, a US grand jury identified 12 Russian intelligence agents as being behind the group’s hack-and-leak assault against former US secretary of state Hillary Rodham Clinton’s presidential campaign.
The targeting of high-profile religious figures demonstrates the wide net cast by the cyberspies.
Bartholomew claims the exclusive right to grant a “Tomos of Autocephaly,” or full ecclesiastic independence, sought by the Ukrainians.
It would be a momentous step, splitting the world’s largest Eastern Orthodox denomination and severely eroding the power and prestige of the Moscow Patriarchate, which has positioned itself as leading player within the global Orthodox community.
“If something like this will take place on their doorstep, it would be a huge blow to the claims of Moscow’s transnational role,” said Vasilios Makrides, a specialist in Orthodox Christianity at the University of Erfurt in Germany. “It’s something I don’t think they will accept.”
The Kremlin is scrambling to help Moscow’s Patriarch Kirill retain his traditional role as the head of the Ukrainian Orthodox Church and “the more they know, the better it is for them,” Makrides said.
The Russian Orthodox Church said it had no information about the hacking and declined to comment.
Russian officials referred the AP to previous denials by the Kremlin that it has anything to do with Fancy Bear, despite a growing body of evidence to the contrary.
Ukraine is lobbying hard for a religious divorce from Russia and some observers have said the issue could be decided as soon as this month.
Ukrainian President Petro Poroshenko in April flew to Istanbul in an effort to convince the patriarch to agree to a split, which he has described as “a matter of our independence and our national security.”
Kirill last week flew to Turkey in a last-ditch bid to prevent it.
Hilarion Alfeyev, Kirill’s representative abroad, has said that granting the Tomos could lead to the biggest Christian schism since 1054, when Catholic and Orthodox believers parted ways.
“If such a thing happens, Orthodox unity will be buried,” Alfeyev said.
The issue is an extraordinarily sensitive one for the Ecumenical Patriarchate.
Reached by telephone, spokesman Nikos-Giorgos Papachristou said: “I don’t want to be a part of this story.”
Other church officials spoke to the AP about the hacking on condition of anonymity, saying they did not have authorization to speak to the media.
Bartholomew, who is 78, does not use e-mail, those church officials told AP.
However, his aides do, and the Secureworks list spells out several attempts to crack their Gmail accounts.
Among them were several senior church officials called metropolitans, who are roughly equivalent to archbishops in the Catholic tradition.
Those include Bartholomew Samaras, a key confidante of the patriarch; Emmanuel Adamakis, an influential hierarch in the church; and Elpidophoros Lambriniadis, who heads a prestigious seminary on the Turkish island of Halki.
All are involved in the Tomos issue; none returned AP messages seeking comment.
Spy games have long been a part of the Russian Orthodox world.
The Soviet Union slaughtered tens of thousands of priests in the 1930s, but the communists later took what survived of the church and brought it under the sway of the KGB, with clerics conscripted to spy on congregants and emigres.
The nexus between Russia’s intelligence and religious establishments survived the 1991 fall of the Soviet Union and the KGB’s reorganization into the FSB, Moscow-based political analyst Dmitry Oreshkin said.
“Our church leaders are connected to the FSB and their epaulettes stick out from under their habits,” Oreshkin said. “They provide [Russian President] Vladimir Putin’s policy with an ideological foundation.”
That might make one target found by the AP seem curious: The Moscow Patriarch’s press secretary, Alexander Volkov.
However, Orthodox theologian Cyril Hovorun said he would not be surprised to see a Russian group spying on targets close to home, saying: “They’re probably checking him out just in case.”
Volkov did not return AP e-mails seeking comment.
Hovorun is unusually qualified to speak on the issue. In 2012 he — like Volkov — was an official within the Moscow Patriarchate.
However, he resigned after someone leaked e-mails showing that he secretly supported independence-leaning Ukrainian clergy.
Hovorun has since been targeted by the Russian hackers, according to the data from Secureworks, which uses the name Iron Twilight to refer to the group.
Hovorun said he believes that those who published his e-mails six years ago were not related to Fancy Bear, but he added that their modus operandi — stealing messages and then publishing them selectively — was the same.
“We’ve known about this tactic before the hacking of the Democrats,” Hovorun said, referring to the e-mail disclosures that rocked the US’ 2016 presidential campaign. “This is a familiar story for us.”
The Russian hackers’ religious dragnet also extended to the US and went beyond Orthodox Christians, taking in Muslims, Jews and Catholics whose activities might conceivably be of interest to the Russian government.
John Jillions, the chancellor of the Orthodox Church in America, provided the AP with a June 19, 2015, phishing e-mail that Secureworks later confirmed was sent to him by Fancy Bear.
Fancy Bear also went after Ummah, an umbrella group for Ukrainian Muslims; the papal nuncio in Kiev; and an account associated with the Ukrainian Greek-Catholic Church, a Byzantine rite church that accepts the authority of the Vatican, the Secureworks data show.
Also on the hit list: Yosyp Zisels, who directs Ukraine’s Association of Jewish Organizations and Communities, and has frequently been quoted defending his country from charges of anti-Semitism.
Zisels said he had no knowledge of the attempted hacking.
Vatican officials did not return messages.
Protestants were targeted too, including three prominent Quakers operating in the Moscow area.
Hovorun said Protestants were viewed with particularly intense suspicion by the Kremlin.
“There is an opinion shared by many in the Russian establishment that all those religious groups — like Quakers, evangelicals — they are connected to the American establishment,” he said.
Secureworks’ data show hacking attempts on religious targets that took place in 2015 and 2016, but other material obtained by the AP suggests attempts to compromise the Ecumenical Patriarchate are ongoing.
On Oct. 16 last year, an e-mail purporting to come from Papachristou, who was just being appointed as spokesman, arrived in the inboxes of about a dozen Orthodox figures.
“Dear Hierarchs, Fathers, Brothers and Sisters in Christ!” it began, explaining that Papachristou was stepping into his new role as director of communications. “It’s a very big joy for me to serve the Church on this position. Some suggestions on how to build up relations with the public and the press are provided in the file attached.”
The file was rigged to install surveillance software on the recipients’ computers.
The e-mail’s actual sender remains a mystery — independent analyses of the malicious message by Secureworks and its competitor CrowdStrike yielded nothing definitive.
Church officials told the AP they were disturbed by the hacker’s command of church jargon and their inside knowledge of Papachristou’s appointment.
“The one who made this is someone who knows us,” one official said.
Priests and prelates do not make obvious targets for cyberespionage, but the stakes for the Kremlin are high as the decision on Tomos looms.
Granting the Ukrainian church full independence “would be that devastating to Russia,” said Daniel Payne, a researcher on the board of the J.M. Dawson Institute of Church-State Studies at Baylor University in Texas.
“Kiev is Jerusalem for the Russian Orthodox people,” Payne said.
“That’s where the sacred relics, monasteries, churches are ... it’s sacred to the people and to Russian identity,” he added.
Francesca Ebel and Nataliya Vasilyeva in Moscow contributed to this report.
Saudi Arabian largesse is flooding Egypt’s cultural scene, but the reception is mixed. Some welcome new “cooperation” between two regional powerhouses, while others fear a hostile takeover by Riyadh. In Cairo, historically the cultural capital of the Arab world, Egyptian Minister of Culture Nevine al-Kilany recently hosted Saudi Arabian General Entertainment Authority chairman Turki al-Sheikh. The deep-pocketed al-Sheikh has emerged as a Medici-like patron for Egypt’s cultural elite, courted by Cairo’s top talent to produce a slew of forthcoming films. A new three-way agreement between al-Sheikh, Kilany and United Media Services — a multi-media conglomerate linked to state intelligence that owns much of
The US and other countries should take concrete steps to confront the threats from Beijing to avoid war, US Representative Mario Diaz-Balart said in an interview with Voice of America on March 13. The US should use “every diplomatic economic tool at our disposal to treat China as what it is... to avoid war,” Diaz-Balart said. Giving an example of what the US could do, he said that it has to be more aggressive in its military sales to Taiwan. Actions by cross-party US lawmakers in the past few years such as meeting with Taiwanese officials in Washington and Taipei, and
Denmark’s “one China” policy more and more resembles Beijing’s “one China” principle. At least, this is how things appear. In recent interactions with the Danish state, such as applying for residency permits, a Taiwanese’s nationality would be listed as “China.” That designation occurs for a Taiwanese student coming to Denmark or a Danish citizen arriving in Denmark with, for example, their Taiwanese partner. Details of this were published on Sunday in an article in the Danish daily Berlingske written by Alexander Sjoberg and Tobias Reinwald. The pretext for this new practice is that Denmark does not recognize Taiwan as a state under
The Republic of China (ROC) on Taiwan has no official diplomatic allies in the EU. With the exception of the Vatican, it has no official allies in Europe at all. This does not prevent the ROC — Taiwan — from having close relations with EU member states and other European countries. The exact nature of the relationship does bear revisiting, if only to clarify what is a very complicated and sensitive idea, the details of which leave considerable room for misunderstanding, misrepresentation and disagreement. Only this week, President Tsai Ing-wen (蔡英文) received members of the European Parliament’s Delegation for Relations