The Sword of Damocles over The Black Book. A Belarus security officer spent 10 months undercover in the team behind the effort to de‑anonymise security officers

In July 2021, BYPOL released a video exposing the GUBOPiK agent Artur Gaiko, who helped the Telegram channel Black Book of Belarus in their efforts to de-anonymise security officers by accessing the internal databases and leaking the info on his colleagues.

In February 2022, state channel STV claimed that “from the very first day of the existence of Black Book of Belarus an employee of GUBOPiK was among the administrators of the channel.”

None of these publications sparked a wider public discussion. The story with the GUBPOiK employee seemed to be over. But this autumn, Belsat TV channel conducted its own investigation, confirming that Gaiko did not only pass on security forces data to the BBB, but was one of the administrators of the channel and responsible for “security,” checking files sent by users for viruses.

​​According to Belsat, Gaiko was able to access the data of about 10,000 Belarusians who had contacted the network of BBB channels. Another publication, Zerkalo obtained testimony from a source within the BBB team who specified that Gaiko could potentially have had access to messages from more than 8,000 people. A former employee of BBB confirmed this number to Mediazona.

"Ha-ha. And then it will turn out to be you.” Suspicions

In the spring of 2021, one of the “editors” of The Black Book of Belarus, Volha Vysotskaya, discussed her studies in messages with the computer security specialist, known in the project only by the name, Artur. At that time, she was working on her thesis project, and Artur mentioned that he was taking an IT course part-time. In order “to show that they had complete rubbish, schemes and formulas on the screen,” he shared a screenshot of a study Zoom conference.

At first, the editor did not pay attention to the fact that one of the participants in the call was ‘Gaiko Artur’. But later, says Vysotskaya, she remembered that on The Black Book bot, a user mentioned a man with the same name who had worked as a security guard in a Vitebsk night club, and then got a job at GUBOPiK and left for Minsk. When these messages were forwarded to the chat, Artur replied that his cousin from Vitebsk "is a disgrace to his name.” Vysotskaya wrote: “Ha-ha, and then it will turn out to be you”. Then they both laughed about it.

Vysotskaya later found Artur Gaiko in the database with employee data of the Ministry of Internal Affairs, which had been hacked by the “Cyberpartisans” outfit. But Artur from BBB said that he lives in Minsk, and the supposed cousin Gaiko from the database was still serving in Vitebsk.

“For me, something didn’t feel right, I thought that I had paranoia and had lost my mind,” explains Vysotskaya. According to her, since November 2020, she and the chief editor of BBB Yanina Sazanovich had repeatedly had suspicions about Artur, but the rest of the team convinced them that it was necessary “not to waste time with bullshit, but to work.” Vysotskaya adds that after receiving a Zoom screenshot with Artur Gaiko, she didn’t immediately send it to Sazanovich, because of a personal conflict.

Vysotskaya recalls that at the end of May 2021, after Roman Protasevich’s Ryanair flight from Greece had been diverted, Sazanovich called her and said: “BYPOL and Cyberpartisans believe that there ‘most likely was a rat in their team’.” Then she finally showed the screenshot to a colleague.

When they started digging, they found a mention of one Artur Gaiko, who saved a drowning man, in Vitebskiye Vesti newspaper; the photo file was named “Ment1” which a Russian language slang for “policeman”. Artur from BBB had also told colleagues that he had once saved a drowning man. In May, Vysotskaya transferred everything she had found about Artur to BYPOL, but they, she says, “didn’t pay attention.”

She continued her search and noticed a page with photographs of inspectors on the site of Vitebsk City Council. Among them was a juvenile offenders inspector, Artur Sergeevich Gaiko.

Before that, no one at BBB knew what Artur looked like: he only posted retouched or pixelated photos. “It was like, yeah, I’m a living person, but you won’t see my face,” Vysotskaya explains.

Escape to Kyiv, fighting “over Belarus” at a wedding and seven birthmarks. The cover is blown

On 23 May 2021, a plane flying from Athens to Vilnius made an emergency landing at Minsk airport, carrying a BBB employee Sofya Sapega and blogger Roman Protasevich. According to Vysotskaya, shortly after that Artur said that during one of the interrogations, Protasevich mentioned “Artur the security guy” from BBB, so he needed to leave Belarus urgently.

Yanina Sazanovich says that three hours later he sent a video from Kyiv. This alarmed her.

“He said that he was driving 200 km/h through Belarus. This is impossible. He said that he used some unofficial routes. I ask: ‘And how is your cat?’ He says that he hid the cat. And why did you need to hide your cat if you were moving illegally?” Sazanovich pondered.

On 5 July, Artur was supposed to meet one of the activists in Kyiv in order to confirm his identity. Vysotskaya recalls that she and Yanina were “ready to bet” that Artur would not come.

The day before the scheduled meeting, he stopped communicating. Later, “his wife” wrote to Bogdanovich and said that Artur had been detained—allegedly because he got into a fight “over Belarus” at a wedding. Sazanovich recalls that she thought of calling the police to find out if Artur was really in the precinct, but she did not.

According to Vysotskaya, to her and Yanina the situation seemed more than suspicious, but Bogdanovich and the activist, who was supposed to meet with Artur, asked them not to get wound up.

The next day, after the failed meeting, Artur agreed to a call. Several people gathered at Bogdanovich’s apartment in Vilnius; Artur set the condition that Sazanovich, whom he did not trust, should not be there among them.

“I remember that when I was leaving, Bogdanovich’s girlfriend did some card reading and said: ‘No, the cards show that he [Artur] is good.’ I’m like: ‘Fuck, really?’” Yanina recalls. Bogdanovich mentions the tarot episode in the conversation with Mediazona, although according to his version, the cards showed that Artur, on the contrary, was ‘bad.’ Before that, he says, there was another tarot reading; it alleged that Gaiko was ‘good.’ Shortly after this article was published, Bogdanovich approached Mediazona and asked to emphasise that he did not make any conclusions based on card readings.

During the call, Artur showed his face and passport with the surname Baroev for the first time to his colleagues at BBB. Vysotskaya says that she sent Bogdanovich a photo of Artur Gaiko found on the internet and was surprised when she found out that he showed it to Artur. The former manager of the channel says that he was in a “state of shock.”

“After that, I thought that I probably shouldn’t have [sent the photo] to him, but in the moment it was difficult to control it,” Bogdanovich says. “And he sends me his photo. Like, ‘Look, I don’t look like him’. And I took a screenshot, circled seven birthmarks on his face and said: ‘It does look like you. How’s it not you?’ He says: ‘No, it’s not.’ I say: ‘Okay, maybe I made a mistake’.”

These events took place on 5–7 July 2021. According to Bogdanovich, he wrote about the situation with Artur to the BBB team and a little later to BYPOL. Soon, BYPOL confirmed to the team that Gaiko was an employee of GUBOPiK. On 30 July, the association released an investigation about Artur Gaiko, naming his position, place of work and contact numbers. In the investigation, it is said that he ‘leaked’ the info of his colleagues to the Black Book of Belarus. At the same time, BYPOL kept silent about the fact that Gaiko was among the administrators of BBB and had had access to readers’ messages.

The Sword of Damocles. Infiltration

In mid-September 2020, a user _Damoklov_Sword_ contacted the BBB bot. According to Daniil Bogdanovich, the user said that he was a Belgazprombank’s security manager and showed a request from the Investigative Committee: the department was allegedly interested in the accounts of three women connected to “a criminal case.” Bogdanovich recalls that the case he mentioned was “somehow connected with Stsiapan Putsila,” the man behind Nexta. According to him, two women were in Vilnius a couple of days later. In a conversation with Mediazona, one of them said that she left before this message. Social media accounts of the second woman show that she was in Vilnius at the beginning of September.

Around that time, BBB bot was frequently contacted by users sending malicious links and hidden trackers to reveal the reader’s IP address. “Someone sends something, saying that this is important information. It is not clear how to open it so as not to be exposed yourself,” Bogdanovich explains. He was in contact with Damoklov_Sword, so it didn’t trigger any alarms when he offered his help in checking incoming messages for viruses.

In October 2020, Nexta announced a reward for the database of current GUBOPiK employees. According to Bogdanovich, Damoklov_Sword provided the database and possibly even received the reward. After that, this unknown security manager was a trusted contact; he was added to The Black Book’s work chats.

“Was this verification sufficient? Now, looking back, it seems that it wasn’t enough,” Bogdanovich thinks.

“Later, BYPOL said that it was a police database, and if it had been shown to them immediately, they would have identified it as such, not coming from a bank employee,” says Vysotskaya.

She recalls that at first the new team member used a pseudonym, but in a private message he introduced himself as Artur and said that only Sazanovich and Bogdanovich knew his real name.

“And I understood that he chatted so much with Danik, he knew that he was in Vilnius, that we were classmates, [he knew] who Danik’s girlfriend was,” says Vysotskaya. Then she revealed her real name to Artur.

“If we call an antivirus ‘security’, then he was the ‘security guy’,” Bogdanovich describes the role of the newcomer in the project.

Artur wrote to Vysotskaya that he graduated from ‘legal+economic’, got into a bank and even advised ‘K’ branch, the cybersecurity unit of the police. That’s why, he said, he had access to the databases of the Ministry of Internal Affairs. Since then, Artur claimed that he has had a friend who continued to work “at the top” of one of the security services. Allegedly, it was through him that Artur could find out about the initiation of criminal cases and find out whether a particular person has a travel ban (in fact, you can check if you’re banned from travelling abroad on the website of the Ministry of Internal Affairs in your personal account).

Artur compiled several security guides for BBB employees: he explained which links should not be opened, reminded about two-factor authentication, and asked strangers to send files of unknown origin to him for verification. To streamline the process, Artur was added to all major chats of The Black Book and had access to all messages from users.

“In all bots, people were asked to always use a VPN and send information anonymously. There was a case with me when Artur personally asked a person to change his name in the chatbot and not to write under his own name, because it is dangerous,” says Bogdanovich.

In addition to bots, Artur had access to the admin tools listing all users’ messages, IDs and handles.

Over time, Artur started helping Yanina Sazanovich with her other projects. He received temporary access, “two to three months” to All Violations, a chatbot for a channel doxxing “accomplices to the regime and falsifiers.” Another channel, Karateli Belarusi added him to the chat where messages from subscribers were forwarded to. Three months later, Gaiko left the chats on his own, after Sazanovich reproached him that he “doesn’t do much work.”

Soon, Artur was added to Infopoint, a chat group with administrators of large opposition channels and activists who “wanted to stick together”, Bogdanovich says. According to him, Artur’s only task was to check suspicious files from the suggestions. He does not know if any other admins used Artur’s help.

According to Bogdanovich, Artur trawled for information about criminal cases for about ten people, and “helped” a few activists to leave the country, some of whom were named by Mediazona sources. None confirmed that they had sought Artur’s help, some refused to comment or asked not to mention them in connection with Gaiko.

“A man wants to cross the border, he’s scared, he doesn’t know if he’ll be arrested or not. Then the man turns to Artur for this information. Out of two stories that I heard, both people left,” Bogdanovich says. He admits that he does not know whether criminal cases were actually initiated against these people.

“It seemed plausible. Maybe he actually did have connections in these agencies. If people were indeed leaving safely, then everything was fine,” Vysotskaya says.

“The regime gave up a lot of people who could be locked up now. Like Kostyugova or Shraibman. They let them leave, because it meant a lot of trust in Artur,” Sazanovich believes.

In addition, Artur had access to Hexta, “a joint chat with Nexta,” which was created after the channel announced a reward for information about GUBOPiK employees. This was confirmed by Mediazona and a former Nexta employee Yan Rudik.

Nexta administrators forwarded user messages from their bot to the chat, and BBB admins published info about the officers. If a user signed up with his real name, all the participants of the chat, including Gaiko, saw it. Messages with media files were forwarded with the sender’s Telegram ID. Mediazona counted dozens of messages that were forwarded in such a way. In the Nexta channel, it was not indicated that the messages of subscribers about employees of GUBOPiK could be transferred to third parties.

For work on the BBB project, Artur was paid with crypto. According to Yanina Sazanovich, they paid him between 600 and 800 euros a month. Bogdanovich says that he earned less, 300–500 euros.

Revenge is already here. The art of manipulating people

Apart from the handle Damoklov_Sword, Artur used another one, Revenge iam.

“We’ve been discussing it with Volha: “Just imagine if he’s actually a mole and he’s got ‘revenge’ in his handle. He told us that revenge was already here. We were like: ‘Ha-ha, hee-hee’,” Yanina Sazanovich recalls.

Volha Vysotskaya says that in her relationship with Artur, the professional always intertwined with the personal. He did not show his face to anyone but he was able to build friendly relations with his colleagues at BBB. He poured out stories from his life, about which, later, it turned out that at least one was true, about the saved drowning man.

Artur said that he is from Vitebsk, his mother had stayed there, and he moved to Minsk with his cat. He told Vysotskaya that his father drank heavily and beat him and his mother. The activist points out that at that moment she had a bad relationship with her father—she believes that Artur “either found out on his own, or learned through Daniil” and used it to gain her trust.

According to her, Gaiko communicated with Sofya Sapega before she was arrested and sentenced after the Ryanair plane diversion. They discussed personal stuff, and the “security guy” admitted he “used to be fat” but now that he goes to the gym, he’s lost some weight.

“He started with something what break the ice for each and every one one of us,” Vysotskaya says. He said that he wanted to talk. He said that he can only share about important stuff in his life with you personally. A person from GUBOPiK cannot go around sharing personal stories. If he were an agent, then it must be some kind of joke.”

Artur discussed video games with Daniil Bogdanovich, together they played Dota and World of Tanks. Conversations with Gaiko, former manager of BBB, can be described as “endless small talk,” he says. He recalls that sometimes Artur offered his help with compiling regular reports about the channel.

“Then it did seem strange to me. Of course, I responded: “Come on, you’d better help me with that essay for my studies.” And he wrote it in English for me, it was graded 8 or 9 [out of 10],” Bogdanovich says. According to him, Artur did not get access to the reports.

Conflicts sometimes occurred in the BBB team. Bogdanovich was usually involved in their resolution. But during a quarrel between Yanina and one of the moderators, recalls Volha Vysotskaya, Daniil said that Artur would be the mediator. “Don’t write personally to each other, write through him, set tasks through him,” she quotes Bogdanovich as saying.

“As it turned out later, he told this moderator that Yanina was a fool. And he then said to her that the moderator is a fool. That’s a game on two fronts, and the trust was building up from both sides, because he would support their narrative,” she says.

A similar story with double-dealing has repeated at least once more.

According to Bogdanovich, Artur did not become a proper manager at BBB: he continued to perform his functions as the “security specialist”, but took on “more tasks to resolve conflicts within the team.”

The first detainee, apologising to GUBOPiK and the Office of Tsikhanouskaya

In October 2020, a subscriber sent to the BBB bot a commemorative book marking the 25th anniversary of GUBOPiK. The book contained photos of employees, their surnames and initials. Administrators started to trawl for information about these people.

According to Vysotskaya, one of the informants of BBB volunteered to help. His name is Artsiom Parkhamovich, he works at Beltelecom, a national telecommunications company. He said that during his night shift he could easily “gather information on up to 20 people.” Parkhamovich collected the personal data for all people mentioned in the book, and Vysotskaya passed them onto Artur so that he could find out who is still with GUBOPiK.

According to her, the next day Parkhamovich wrote to her that in the morning a colleague from Beltelecom called him and asked about his nighttime research, and that the police were coming to knock on his door. After that, he vanished.

On Telegram, the informant used his real name. Vysotskaya recalls that Artur wrote in the bot in response to his message that Parkhamovich should rename his account, and continued communication in private.

That same day, Volha wrote to Bogdanovich and told him about the situation. According to her, he advised “not to get paranoid” and reassured her that Artur was a safe person. Artur contacted her in the evening and blamed her for not telling about the arrest earlier. Soon, the Ministry of Internal Affairs posted a video with Parkhamovich: he was describing his cooperation with BBB while having visible bruises on his nose and eyebrows.

Vysotskaya says that this time she directly accused Artur of betraying the informant’s trust; he came up with excuses, saying that he “risked more than anyone else, he still was in Belarus, helping.” Later, she apologised to Artur for calling him “a GUBOPiK.”

Volha believes that Parkhamovich was the first person who was detained cooperating with BBB. Bogdanovich could not recall this story in a conversation with Mediazona. According to him, Artur “from the very beginning spoke about the fact that everyone who is engaged in hacking is in danger, since all requests go on record, so it's better not to ask people to do it”.

Volha believes that Parkhamovich was the first person who was detained after cooperating with BBB. Bogdanovich told Mediazona he did not recall this story. According to him, Artur “from the very beginning warned that everyone who was engaged in hacking was in danger, since all data requests leave traces, so it’s better not to ask people to do it.”

Vysotskaya recalls that on 30 June 2021, the BBB team had a conference call about the future of the project. Artur proposed to refrain from publishing the addresses and telephone numbers of security officers. He said that as a way of putting pressure on the government, this practice had turned out to be ineffective, but it created a toxic reputation for the channel. He claimed that “he met with representatives of the [Sviatlana Tsikhanouskaya’s] Office, and Franak [Viačorka, chief political advisor to Tsikhanouskaya] approved this idea.”

“We just sat and listened,” Vysotskaya recalls. “It’s like hypnosis when you sit and think: ‘Maybe it really does make no difference’.”

Yanina Sazanovich did not agree with Artur, and the Zoom meeting ended in a fight.

“Artur told us that he interacted with the Office. I didn’t know how it really was,” Sazanovich says. According to her, Gaiko mentioned that he was “preparing analytics” for the Office of Tikhanovskaya and wanted to “explain in detail why exposing addresses was ineffective.”

Franak Viačorka, an advisor to Tsikhanouskaya, confirmed to Mediazona that Artur Gaiko corresponded with one of the employees of the Office.

“They were friends, they discussed political matters, perhaps, and matters related to the Office. We found out about it after Gaiko’s cover was blown,” Viačorka said.

He believes that Gaiko had no intention of embedding within the Office, he maintained distance. He also denies that Artur helped to take his colleague out of Belarus, and does not remember having any personal contact with him.

The consultant at the Office, with whom Artur Gaiko corresponded, refused to answer questions from Mediazona and asked not to mention his name. According to Viačorka, he was fined and given limited access to information and the Office.

“Solo performance”. An operative’s game

When the BBB realised who Artur Gaiko was, BYPOL advised the rest of the team to pretend that nothing had happened. Daniil Bogdanovich says that he does not understand why this was necessary. He continued to play video games with Artur.

“BBB employees had to behave as usual, and we would think about how to act later,” Yanina Sazanovich recalls the BYPOL recommendations. The head of the association, Alexander Azarov, and former policeman Matvey Kupreychik, exchanged messages with her but Kupreychik then deleted the messages.

“We were witnessing a solo performance. We pretended that everything was fine, that we hadn’t sussed him out. Considering that Bogdanovich had sent him a photo, he understood that we knew everything,” Sazanovich assured.

According to Bogdanovich, the team launched duplicate feedback bots. “To the old ones to which Artur had access, the employees themselves continued to write from fake accounts,” he says.

“We made it look like the admin panel was broken, that nobody could make contact, that it was lagging,” Vysotskaya adds.

Four days before the BYPOL investigation, Yanina Sazanovich gave an interview to Yan Rudik, the administrator of the popular Telegram channel Belarus Golovnogo Mozga and told him about “a valuable employee who is helping the BBB and is still working for the authorities.” At that time, she was no longer the editor-in-chief of the project, replaced by Vysotskaya.

A few days later, BYPOL released their investigation exposing Gaiko.

“This whole strategy was developed together with BYPOL,” says Sazanovich. “BYPOL told us that it was not necessary to talk about the fact that they may have some information, because it can scare people very much. BYPOL told us that we should not reveal that the agent was embedded so deeply in the command. The idea to talk about a ‘valuable employee’ was the idea of ​​BYPOL. We had to say that we received more information than they received from us.”

Alexander Azarov refused to answer questions from Mediazona. In a comment to the Belsat TV channel, he said that he had not advised the BBB employees to cover up the revelation about the GUBOPiK agent.

Vysotskaya says that she was present at the recording of the interview with Sazanovich and insisted: “We need to say that we had a mole.”

“People must know so that they can leave [the country]. But we’ve been told that we all agreed with BYPOL, so we are sharing only this. And BYPOL will tell the rest,” Volha recalls.

“It’s my fault that she didn’t say anything at that moment in the interview,” admits Sazanovich.

According to Bogdanovich, the informants of the BBB should have been warned about the danger by the editor-in-chief or her deputy.

“I didn’t know personally, I didn’t need information about who our informants were, how many there were. In my opinion, they warned everyone who sent such information,” the former project manager says.

“It seems to me that we wrote to some informants, or simply in the proposals section, so that people were more careful, because there was a security problem. And during the interview, it was announced that all the data of those who had written in BBB were in the archive at the secret services. But, specifically, there were no announcements from The Black Book,” Vysotskaya says.

After the release of the video with the BYPOL investigation, that is, almost a month after the disclosure, Artur Gaiko was removed from all chat rooms of BBB. He wrote to Bogdanovich that “his parents are being held hostage” and that he “can’t just leave like that.”

“And Artur began to go on and on, that you do not understand that I am a hostage to the situation, my mother is being held captive, I was on your side all this time, I helped you as much as I could,” she recalls.

“Was Volha very upset that I was an officer?”

“It seemed like a sigh of relief after it was over. He is no longer with us,” Sazanovich recalls. “None of us understands what the outcome will be of all this.”

“I will not say that the work has stopped. But it is obvious that everyone was in shock and did not understand how to move on after. Naturally, the flow of messages from people has decreased,” Vysotskaya says.

Soon after Gaiko was revealed, a trial began in the case of one of the informants of the BBB. Volha claims that she tried to convince her colleagues to financially support the detainees for sharing information with the channel. “They were detained because we had a GUBOPiK agent,” she insisted.

According to her, Bogdanovich was against it: “We can’t cut employees’ salaries and send them to help detainees.”

“I say that actually we can. He said that I take everything too personally and I just need to work through it,” she recalls. She and Yanina Sazanovich, according to them, transferred their own money to support political prisoners through the BYSOL fund. They asked not to name the amount. When asked about the support of those affected by the agent, Bogdanovich responded that this was the “task for the editor-in-chief.”

In August, Vysotskaya received an Instagram message from Artur. Soon it became known that he was corresponding with Bogdanovich as well. According to Volha, the agent asked whether she “was very upset” when she found out that he was an agent.

“I just look at him: ‘Is this a joke?’” she says.

In the autumn of 2021, she and Yanina Sazanovich left the BBB team. One of the reasons Sazanovich mentions is that Bogdanovich continued to communicate with Gaiko.

Bogdanovich answers that he did not hide his correspondence with Artur from his colleagues in order to show that he has nothing to hide.

“My answers to him were quite simple. It was not very clear to me what he wanted from me. Last time he asked me in the winter which video games I played. I told him that I played Elden Ring. Then someone told me that in this way he was tracking my mood, my identity, and he was adding it to his records. For God’s sake, I hope they will consider the games I played when trying me in absentia. Maybe this will be a mitigating circumstance, because a normal person would not play Elden Ring,” Bogdanovich says.

Yanina Sazanovich admits that she “didn’t fully understand that it would be possible to find people’s names by using Telegram IDs.”

The last post on the BBB channel was published on 31 May 2022. Now the project is closed. On 19 October of this year, after the release of the investigation by Belsat TV channel, Bogdanovich was removed from his job at Infopoint. He did not answer Mediazona’s question about the reasons for his firing. The director of the agency, Sasha Romanova, told Mediazona that Bogdanovich was removed from his post after an internal investigation. According to her, “neither he nor his former colleagues thought it necessary to say immediately” about the number of victims of Artur Gaiko.

On 14 November 2022, the Infopoint team issued a statement warning everyone who wrote to the BBB bot “from 1 September 2020 to the end of May 2021” about the danger and suggested that they change their phone number and, if possible, leave Belarus.

Yanina Sazanovich says that she “didn’t go public before” because she was afraid that she would not be believed.

“We deal with de-anonymisation, but we are not professionals. We are not professionally trained employees. BYPOL says that Gaiko does not have a trove of information, but this is a lie. Azarov countered that this was incorrect as Gaiko had access to messages and archives,” Sazanovich says.

Editors: Anastasia Boyko, Dmitriy Tkachev