Soros-Linked NGOs Fell Victim To A Big, Sophisticated Undercover Operation. Hungary’s Prime Minister Has Benefited The Most.

LONDON — Hungary goes to the polls Sunday after a parliamentary election campaign that has featured dirty tricks, spying allegations, damaging leaks, and a drumbeat of anti-Muslim and anti-Semitic rhetoric.

Dark electoral arts have included a host of sophisticated undercover stings targeting NGOs and individuals linked to the philanthropist George Soros, carried out by people using aliases and working for companies that do not exist.

BuzzFeed News can reveal that the stings, which preyed on seven NGOs and individuals — all but one linked to Soros — in the months leading up to the election are highly likely to have been executed by the same group.

BuzzFeed News cannot be certain what group carried out the operation, or who paid them to do so. Some of the websites created for the front companies in the operation have unusual ties to a string of sites an expert says are aimed at burnishing the online reputation of a Russian oligarch, as well as to an individual based in Israel and a web developer in Romania.

Although there is no evidence to suggest the Hungarian government’s direct involvement with the operation, it is clear who the main beneficiary is: incumbent Prime Minister Viktor Orbán and his anti-Soros agenda.

A spokesperson for the prime minister did not comment when asked via email about who may have given financial backing to the operation, and whether the government had any knowledge of, or connection to, the group secretly recording the meetings with the NGOs and then leaking them.

The spokesperson did, however, say the recordings “prove yet again what the Hungarian government has been emphasizing for long.”

Soros has increasingly become the object of dog-whistle politics and sustained attacks by populists, nationalists, and conspiracy theorists around the world, but nowhere more so than in his native Hungary. Election posters plastered around Hungary currently feature the philanthropist and Orbán’s rival candidates holding bolt cutters after having cut the border fence behind them.

The message is clear. “We will either have a national government, in which case we will not become an immigrant country, or the people of George Soros form a government and Hungary will become an immigrant country,” Orbán told a rally during a campaign visit in the city of Miskolc last month.

Selectively edited covert recordings from the sting operations fed a series of newspaper articles that were dubbed the “Soros Leaks” by pro-government media and journalists close to Fidesz, Hungary’s ruling party. The material was picked up in statements, interviews, and comments by Hungary’s prime minister and his inner circle, and used to add fuel to the central planks of Orbán’s relentless anti-Soros and anti-migrant reelection campaign rhetoric.

In all seven incidents, almost identical methods were employed to ensnare the NGOs, including fake websites created and hosted using the same service, fake LinkedIn pages, and listings on the same startup database, Crunchbase — most traces of which later disappeared.

And in each case, similar tradecraft was used to set up meetings and later leak the details. In at least one instance, the same person took meetings with different NGOs, and in another, the same front company approached two different NGOs.

When Balázs Dénes flew to Amsterdam in mid-January for a meeting with representatives from a Bahraini company that called itself Orion Venture Capital, which claimed to be looking to invest its profits in projects across Europe to help refugees, something didn’t feel right.

Prior to leaving, Dénes, the executive director of Berlin-based NGO Civil Liberties Union for Europe, asked a friend to check out the Bahraini office address the investment firm listed on its website. It turned out to be a construction site. Dénes decided to go ahead with the meeting anyway.

His hosts in the Dutch capital were a white European woman who introduced herself as “Jasmijn Kooij” and an older, Middle Eastern man who gave his name as Ali Mahmoud Alrabie. They had reached out via email to the Soros-backed NGO a month earlier to arrange the meeting. When Dénes asked them why their office address was a construction site, they told him that “the site is one of our investments.”

“They put me at ease, and made a good job of making me feel relaxed,” Dénes told BuzzFeed News during a telephone interview this week. “They were really professional, and the atmosphere was collegial and friendly.”

When BuzzFeed News tried calling phone numbers on Kooij and Alrabie’s business cards this week they were not in service, or were redirected to the voicemail of a UK mobile number. (At least one of the other entities involved in the operation, a Madrid-based company, also had a telephone number redirecting to a UK mobile number when BuzzFeed News tried calling this week).

Two months after the meeting, comments made by Dénes in Amsterdam were published by the Jerusalem Post under the headline “How a Soros-funded NGO lobbied one EU country against another.” The encounter had been covertly recorded, and later leaked to the paper.

The story was picked up within days in a blog post by Zoltán Kovács, a spokesperson for Orbán, as well as pro-government media outlets, as proof of “anti-Hungary operations of the Soros network.”

Dénes told BuzzFeed News that he believes the Jerusalem Post article was not inaccurate, but the newspaper was simply unwittingly used as a “tool” in a wider operation. “From a Hungarian perspective, the Jerusalem Post was the perfect place to publish the article,” Dénes said, as it was published in English in another country, allowing the Hungarian government to say it was unbiased and not anti-Semitic.

BuzzFeed News understands that the newspaper was approached with the story days before publication, and there are suspicions its source had used similar tactics before on other stories.

Despite the warning signs, Dénes says he was surprised to be caught off guard. “I checked the website, and it looked fine,” he said. “It’s a different level of warfare that I am not used to. It’s as simple as that,” he added.

Between December 2017 and March 2018, NGOs and individuals associated with Soros were approached for meetings by at least six separate companies that claimed to be investment firms or boutique consultancies. They said they were based in places such as London, Madrid, Paris, Berlin, and Bahrain, and had websites, LinkedIn profiles, and Crunchbase entries that were often linked prominently in emails sent requesting meetings to explore funding and partnership opportunities.

Using domain registration records, a comparison of the online profiles and tradecraft of the operations, and the fact that in at least one case the same person targeted multiple NGOs, BuzzFeed News has now established that five successful undercover stings, as well as two failed approaches, are highly likely to have been carried out by the same group.

The meetings, some of which have been reported by Politico, were held in Vienna, New York, London, and Amsterdam, with the fake companies offering to cover the travel costs of the NGOs. In one case, they reimbursed a participant in cash and offered to give him additional funds. He declined. In another case, a company purchased business-class flights between Kiev and Vienna for the NGO.

At least four of the targeted NGOs were covertly recorded, and selectively edited snippets of the recordings were subsequently published by pro-government Hungarian media such as Magyar Idők, which said the recordings were the work of a person the newspaper described as an investigative reporter. The author of some of the Magyar Idők articles that include a byline is a founding member of Orbán’s conservative Fidesz party. Last week he interviewed the prime minister and asked him questions about the articles.

“George Soros is not some invention: If I’m not mistaken, you yourself were personally involved in this, writing about how his network revealed its true colors. We heard them describing, in their own voices, how they’re working against the Hungarian government, and that they want to bring it down,” Orbán replied.

Though there is no suggestion of his involvement in the operation, Orbán, who is all but certain to win a fourth term on April 8, will have benefited the most from the media leaks.

The prime minister and his inner circle have cited on multiple occasions the claim that Soros has 2,000 “mercenaries” working for him in Hungary. In reality, the victim of one of the covert stings, Tracie Ahern, former chief financial officer of Soros Fund Management, said that Soros’s Open Society Foundations have around 2,000 people working for them around the world.

Other claims seized upon by Hungarian media range from lobbying the German government to pressure Hungary into reversing controversial laws, to using the Soros-backed Open Society Foundation to “control the European Union,” to suggestions of illegal activities in Hungary. In another case, a report falsely claimed that a recording revealed a Soros-funded organization and the CIA were behind the Ukrainian revolution that toppled former president Viktor Yanukovych.

Laura Silber, chief communications officer for the Open Society Foundations, said the group had “watched with increasing dismay as government-sponsored propaganda in Hungary becomes ever more outlandish, attacking groups that promote transparency, carry out investigative journalism, and protect human rights.

“This latest smear campaign against the Open Society Foundations and civil society organizations using covert surveillance, fake websites, and imposters represents a dangerous new low point for a European government.”

At a press conference in Hungary last month, András Siewert, the director of Migration Aid, the only NGO not associated with Soros implicated in the sting operation, released photographs of a man and woman he said he’d met with in Vienna in December.

Siewert, who explained he secretly took the pictures at the meeting because he was suspicious, said the man he met had presented himself as a partner at a company called Smart Innotech, spoke English with an Israeli accent, and called himself Grigori Alexsandrov.

Other individuals targeted by the stings have described the accents of the various people they met as noticeably French, “Eastern European English,” “Australian or pretending to be Australian,” and “neutral.”

Yevhen Bystrytsky is the former director of the Soros-backed International Renaissance Foundation, and the target of another one of the undercover operations. He said the man in the Migration Aid photo also posed as the CEO of a different company and was deployed in their meeting in Vienna too, using the name Andrej Novak.

Bystrytsky told BuzzFeed News during a telephone interview that he recognized the man after seeing the photo shared by Siewert.

And a man going by the same name of Alexsandrov, representing Smart Innotech, tried an approach on a third organization with a proposal for a joint project to provide a database of migrants and their biometric data, according to Anna Simai of the Hungarian Helsinki Committee, a human rights NGO. That’s the same proposal Alexsandrov used to help secure the meeting with Siewert in Vienna. “We found it very suspicious and did not enter into any joint activities,” Simai said in an email.

None of the organizations he targeted nor BuzzFeed News have been able to identify the man in Siewert’s photo.

A spokesperson for Orbán told BuzzFeed News that the leaked recordings and articles showed “NGOs mainly financed by George Soros work as a network to facilitate illegal migration. The case of Balázs Dénes and the Civil Liberties for Europe lobbying against Hungary and its national interests in Germany was a clear example of the functioning of Mr Soros’ network. We also have knowledge of about 2,000 people in Hungary working for this network. These groups try to help illegal migration with illegal means as shown by the case of Migration Aid, that is why we believe that it is essential to pass the proposed ‘Stop Soros’ bill as soon as possible in order to be able to ensure the security of the Hungarian citizens.”

Alrabie, the executive from the fake Bahraini venture capital firm Orion Venture Capital, also targeted at least one other person aside from Dénes. In March, Alrabie approached William Newton-Smith, the former chair of the Open Society Foundation in London, with the offer of a speaking engagement at a conference to be held in Dubai this summer. The meeting took place with Alrabie and a woman with an Australian accent who went by the name “Helen Van der Berg” at the Rosewood Hotel in London on March 13.

Newton-Smith described Alrabie and Van der Berg as “charming, engaging, and seemingly intelligent.”

He told BuzzFeed News, “They were really smooth. I would never have imagined what was going on.”

During the course of a conversation that lasted more than two hours, Alrabie remarked that he had recently been in Budapest and was very surprised to see all the posters featuring Soros, according to Newton-Smith. “They were very sympathetic to the plight of George being persecuted in Hungary,” he said.

It is not known whether this meeting was recorded. Its contents haven’t surfaced.

In all the cases where an approach was successful, the website of the company set up for the operation was subsequently taken offline. Three of the companies involved rented short-term office space, while others didn’t exist at all. The online presences of all the companies and their employees were created using the same basic template of services and platforms.

Each company built a website using the Wix web platform, created LinkedIn pages and profiles for the company and employees, and also often had an entry in the Crunchbase database. However, profiles for the supposed employees could not be located on other social media platforms, and several companies they listed as previous employers told BuzzFeed News that the people in question had never worked there.

In many cases, the domain registration information for the company website is private. However, the same unique anonymized email address used to register smartinnotech.com is connected to just 11 other domain names. Eight of those websites are about, or mention, Russian billionaire Suleyman Kerimov. Several of the websites are dedicated solely to listing his accomplishments and have domain names such as suleykerimov.info, suleykerimov.net, suleykerimov.online, suleykerimov.site, and suleykerimov.website.

Another site, goldminingrussia.com, promotes the company of Kerimov’s son. Dagestanfan.com promotes the region he is from, while also citing his good works. Like the fake smartinnotech.com site, all of the other active sites registered with the same email address were built using the Wix platform. The fact that they are also registered using the same private email address shows they were registered by the same person or entity.

All of these sites were registered within two days of one another in February. A second group of 16 sites about Kerimov was registered on the same day a month later. All but suleykerimov.com, which like the others exists to extol his “shrewd investment insight and perseverance,” automatically redirect to other Kerimov domains, including those linked to the domain of Smart Innotech, a fake company. The result is a network of sites with domain names based on Kerimov’s name that exist to promote him and his philanthropic and business interests — and which were registered and launched within a few months of him being arrested in France.

A spokesperson at Kerimov’s foundation based in Lucerne, Switzerland, told BuzzFeed News that neither the foundation nor Mr. Kerimov own the websites, and they did not know who built them.

Andy Beal, CEO of Reputation Refinery, a company that helps clients build and repair their online reputation, reviewed the Kerimov sites and told BuzzFeed News that in his view they are an example of spammy and unethical online reputation-building tactics. In this case, they appear to have been deployed to help the Russian billionaire’s reputation.

“If you look at the number of domain names registered and the altruistic nature of the content on each website, it follows a classic superficial approach to repairing a damaged online reputation,” he said. “Registering multiple domain names using a person's name is textbook online reputation management.”

He added, “In a legitimate reputation clean-up campaign, you focus on rehabilitating a reputation, not just whitewashing the internet with fake, positive content.”

Along with the websites, a group of at least five Twitter accounts appear to have been enlisted in the effort to push back against criticism of Kerimov and of Russian oligarchs in general. The accounts were all created in January or February and have been tweeting links to sites in the Kerimov network, including suleykerimov.online, dagestanfan.com, charityspotlightrus.com, and suleykerimov.net.

An account named @NgaweRoger has since February been doing its best to bring positive attention to Kerimov’s works. After a Twitter user criticized a different Russian oligarch, the account replied to note how generous Kerimov is, and he pointed to the official website for the Kerimov Foundation. (That site is registered to a Swiss trust company and is not connected to the other Kerimov sites identified by BuzzFeed News.)

When the Twitter user noted Kerimov is facing charges in France, @NgaweRoger was ready. He shared a link to a blog post on suleykerimov.com and noted, “nothing has been decided in court, i have seen the good work he has done and he has an entire foundation which he uses to give to charity.” The same account has tweeted links to Kerimov websites at high-profile Twitter users such as right-wing commentator Jack Posobiec and former independent presidential candidate Evan McMullin.

Similarly, @Lina__Vovk replied to a tweet from viral #resistance tweeter Seth Abramson to say, “i wish the russian elite would be more like senator kerimov. the guy is a billionaire investor, but is a really good person, too.” She then linked to suleykerimov.info. (A different Kerimov-promoting Twitter account also directed a tweet at Abramson.)

@Lina__Vovk also replied to a tweet from USA Today to offer a similar endorsement: “I wish that the wealthy Russian elite would be more like Senator Kerimov...he's also extremely wealthy but acts according to honesty and strong values.” This time she linked to suleykerimov.website. That account has also tweeted links to suleykerimov.site, suleykerimov.net, suleykerimov.online, dagestanfan.com, and charityspotlightrus.com. It has not shared links to any other websites in its short existence. (BuzzFeed News reached out to these and the other Twitter accounts tweeting links to the Kerimov websites but did not receive a reply.)

There is no evidence to suggest that the Russian billionaire is connected to the operation targeting NGOs. However, the fact that several websites used to help boost his online reputation operation share an owner or an agency with one fake company website used in a sting suggests that it is highly likely that both efforts were undertaken by the same people or entity.

BuzzFeed News’ analysis found that the email address of an Israel-based individual called Dimitri Savin is linked to the domain name of one of the companies, while another domain is linked to a developer in Romania.

Savin told BuzzFeed News in an email that he owns platinatech.com and said “there is nothing to do with the UK company” that was used in the sting.

“I have no connection to the sting you mentioned,” he said in a follow-up message. “This is the first time that I am hearing about this sting and it was yesterday from you. If someone indeed used my domain and represented himself as a representative of my ‘company’, then he was doing it without my knowing and on his own.”

The Romanian developer did not respond to emails or to messages sent to his Skype account.

BuzzFeed News can also reveal that a number of other websites for similar companies, and with the same technological characteristics, are still online and active, indicating the possibility of ongoing or future approaches.

On Feb. 19, the Open Society Foundations office in Budapest received an email approach from someone going by the name of Maya Weiss, claiming to represent Berlin-based FinWaves. Weiss said her CEO, identified only as Mr. Sarmiento, wanted to discuss investing in an electronics factory in Hungary in a way that would benefit migrants and refugees. She said she was seeking advice on how to proceed. The NGO did not respond.

A BuzzFeed News journalist visited the Berlin office address listed on the FinWaves website but found no company with that name on the building’s intercom. Like some of the companies BuzzFeed News looked at for this story, finwaves.com was set up using Wix, has a LinkedIn profile for the company as well as profiles for six employees, and an entry in the Crunchbase company database. Aside from that online presence, searches did not turn up anything else related to the existence of the company.

The owner of the domain as of June 2015 is a Romanian individual, who did not reply to requests for comment from BuzzFeed News. However, the ownership information for finwaves.com was made private as of March of this year or earlier, suggesting he may no longer own it.

Weiss said in an email to BuzzFeed News that FinWaves was a legitimate listed company. No company with the name FinWaves is listed in the “Handelsregister,” the German companies register. Repeated calls to the number on the company’s website went to voicemail.

She went on to say, “In recent months, our firm has witnessed several attempts by unknown elements to discredit our name and reputation, including ridiculous accusations regarding our conduct which we have managed to prove are false.

“We believe this could be the action of a disgruntled former employee, who has taken great effort and resources to stain our firm and has approached several journalists in this matter.”

She added that all the LinkedIn profiles listing the company as an employer, except for hers, were not related to the firm and “probably imposters.”

On her LinkedIn profile she claims to have completed an MBA at the London Business School in 2003–2004. The school told BuzzFeed News that no student called Maya Weiss took the MBA course that year, and added that its MBA course lasts two years, not one.

Weiss offered to meet in London on Monday, the day after the Hungarian election.

BuzzFeed News replied with the suggestion of a meeting this Thursday in Berlin at the office address listed on the FinWaves website.

Weiss said she was unable to meet in Berlin because she was traveling, and that FinWaves was a dynamic company, and partners and consultants were constantly on the road meeting with clients.

She added: “The address on our website, it is solely an administrative formal address for letters, calls and such. Therefore, you will not be able to find our company in the company registrar as it is registered under a different name." She added that she could show BuzzFeed News "all relevant documentation."

In response, BuzzFeed News asked her to provide the name of the registered company, and its registered office.

Weiss didn’t respond.

Another active website that matches the profile of other websites used in the operation is a shop window for a company called Blue Goldminers. It says it focuses on “Eurasian natural resources and energy investments.”

Blue Goldminers did not respond to emails requesting comment, and multiple phone calls to the company went to voicemail.

LinkedIn profiles created as a cover for individuals to pose as employees of active firms are still live on the social network. But these profiles appear to be fake: A number of the companies listed on the individuals’ profiles as former employers told BuzzFeed News on condition of anonymity that nobody by those names had ever been employed by them.

One profile set up under the name Oliver Radke, who claims to be FinWaves’ Frankfurt-based managing director, uses as its profile picture a photo of a sales and marketing consultant in Croatia. The consultant told BuzzFeed News he didn’t know Radke, and that the photo had been taken from his Instagram page.

When asked whether the leaks had overshadowed Orbán’s reelection campaign or damaged trust in the electoral process, the prime minister’s spokesperson said, “We consider them as a result and as part of the intensifying state of public mood, and as such they do not in any way affect the legitimacy of the election process.”

Daniel Drepper in Berlin contributed additional reporting to this story.