Spanish Arrests of Russia-Connected Individuals Illustrate Complex Dynamics of Madrid’s Relations With Moscow

Two arrests in Spain’s two biggest cities have brought to the fore the complex issues of Russian cyber activities in the West and relations between Madrid and Moscow. On January 13, at Barcelona’s El Prat Airport, Spain’s Civil Guard (constabulary-type police force) arrested computer programmer Stanislav Lisov while he was on vacation with his wife (Elmundo.es, January 20). And on January 16, the National Police arrested businessman Peter Wakkie (connected to Russian millionaire Mikhail Fridman) at Madrid’s Barajas Adolfo Suárez Airport, after he had flown in to attend a business meeting (Abc.es, January 16). These developments came soon after the mainstream media in Spain finally began to openly acknowledge Russia’s regular naval presence in Ceuta, a Spanish exclave in North Africa, facing Gibraltar—following years of silence on this matter. Moreover, the arrest auspiciously occurred only days before Russian Deputy Culture Minister Alla Manilova visited Madrid’s Fitur tourism fair, on January 19, at which she said that her government expected Spain to be the third most popular foreign destination for Russian tourists in 2017.

Russian computer programmer Stanislav Lisov, arrested at El Prat Airport on January 13, stands accused of computer piracy and fraud and is wanted by the United States and Interpol (Elmundo.es, January 20). The Civil Guard issued a press release explaining that Lisov had developed, distributed and employed the “NeverQuest” malware, which made it possible to steal bank and credit card details, as well as personal and financial data from computers. For this reason, the US had been investigating him since 2014. NeverQuest is estimated to have cost its victims some $5 million in unauthorized wire transfers (Guardiacivil.es, January 17). Lisov was flying to Lyon (Southern France). Following a video-conference interrogation, National High Court Judge Carmen Lamela remanded him without bail due to his lack of roots (friends or family) in Spain and previous escape from justice in the United States (Lavanguardia.com, January 19).

News of the arrest prompted a negative reaction in Russia, with Kremlin spokesperson Dmitry Peskov underlining that Moscow would not “allow infringement of the interests of Russians, no matter where in the world.” Stronger words came from Alexander Ionov (the vice president of the Russian branch of the International Human Rights Committee), who labeled Lisov’s arrest a “violation of international law.” Noting the “very close relations” between the US and Spain regarding the extradition of third-country nationals, Ionov accused Madrid of simplifying “the rules of international law to the detriment of human rights” (RT, January 19).

According to unnamed Spanish diplomatic sources, the request to arrest Lisov came “from the FBI [US Federal Bureau of Investigation] and Interpol, and Spain simply execute[d] it.” Writing from Moscow, Spanish journalist Marc Marginedas explained that that “Spain belongs to the group of Western countries in favor of a line of rapprochement with Moscow.” The Barcelona-based daily El Periodico’s correspondent further cautioned that “the arrest may poison relations between Moscow and Madrid, which already took a hit following the failed stopover in Ceuta by Aleppo-siege-bound Russian naval ships” (Elperiodico.cat, January 19). For years, Spain has been discreetly providing key logistical support for the Russian Navy at its African exclave of Ceuta, as regularly reported on by the local press but heretofore never mentioned by the national media (see EDM, September 3, 2015). However, in October 2016, a visit was canceled following strong and unusually public pressure from Washington and the North Atlantic Treaty Organization (NATO) (Elpais.com, October 26, 2016). Meanwhile, Emilio Lamo de Espinosa, the president of the Madrid-based think tank Real Instituto Elcano, stated in Moscow that “There is no bilateral conflict… [C]ontrary to other peoples, us Spaniards do not think that Russia is a danger to the world” (Eldiario.es, January 12).

Three days after Lisov’s arrest, Spanish authorities took into custody businessman Peter Wakkie, who was in the country to attend an investors’ meeting for the Dutch-registered holding company Zed+. Wakkie is linked to Russian millionaire and Zed+ shareholder Mikhail Fridman. Zed+ is under investigation for continuously siphoning off funds to opaque corporations, some of them controlled by leading members of the Russian administration, such as Interior Minister Alexander Kolokoltsev (Abc.es, January 16). As he himself admitted, Wakkie drew a large salary from Fridman through Highland Marine Stichting, a Dutch corporation controlled by the latter. After several days, Wakkie was released from jail, charged with fraudulent bankruptcy, membership in a criminal organization and money laundering (Elconfidencial.com, January 18).

While attracting less media attention, another potentially significant development affecting Spanish-Russian relations was the announcement, on December 20, 2016, by Defense Minister María Dolores de Cospedal, that Spain’s Cyber Defense Command would be training Ukrainian personnel. According to military sources, Ukrainian experts have visited Madrid as well as welcomed their Spanish counterparts in Kyiv, in order to “exchange experiences” and explore the potential for cooperation. Spain’s Joint Cyber Defense Command, which was set up in 2013, had prompted great interest in Ukrainian military circles (Elpais.com, December 26, 2016). Ukraine had come under multiple cyber attacks from Russia since the start of the war in early 2014 (see EDM, March 20, 2014; RFE/RL, December 30, 2016).

What will the ultimate impact of the two arrests be—particularly against the background of Spanish-Ukrainian cyber security cooperation? Is Lisov’s capture by law enforcement a shot across the bow aimed at deterring Russian cyber activities in Spain? To date, the two incidents seem not to have prompted any significant diplomatic fallout, at least publicly. And Madrid is still trying to play its difficult balancing act—retaining good relations with Moscow while avoiding any impression of stepping too far outside the West’s consensus regarding Russia. Spanish sources continue to stress the role of Russians and Russia-based actors in cyber incidents (including instances of fraud and other crimes), but this has not given rise to any political narrative in Spain aimed at vilifying Moscow. Madrid’s decision to help train the Ukrainian military in cyber security could well be seen as an attempt to display the country’s abilities in this domain as well as an eagerness to help curb Russia’s power-projection abilities in the latter’s “near abroad.” But taken together, the last several months could be interpreted as Spain seeking a compromise solution between Russia and NATO. Such a stance is likely considered to be a safe one, particularly given the majority view of the Spanish public, which is yet to rank Moscow among the top perceived threats to the country’s security (see above).