Investigators Use Badges to Reveal Structure of Secret FSB Unit

Thanks to the analysis of photos of badges, the OSINT investigators were able to identify 10 units of the secret “Center 16” of the Federal Security Service of the Russian Federation. Before that, only one of them was known to exist.

This is reported by Defense Romania with reference to the investigation of the CheckFirst community.

The structure of the secret FSB unit, which is considered a key center of Russian electronic intelligence and cyber espionage, was revealed by analyzing collectors’ websites and online forums dedicated to military medals.

By analyzing hundreds of publicly available badges, the CheckFirst investigation team was able to map in detail the internal structure of Center 16 and its extensive network of “spy centers.”

The report shows that Center 16 FSB is much more complex than previously thought. By analyzing the symbols, dates of foundation, and abbreviations on the badges, the researchers have established with a high degree of certainty the existence of at least 10 separate departments, denoted by letters: A, B, C, D, K, P, S, SP, ST, and T. Prior to the publication of this study, only the existence of “Department B” was documented in open sources.

Such a detailed structure indicates a significant number of personnel. Based on FSB internal rules, according to which a “department” usually has at least 55 employees, the report estimates that “Center 16” has at least 560 employees.

The images on the icons also provide clues to the specific tasks of these departments. For example, the icon for “Department K” clearly depicts a computer, indicating direct involvement in computer network operations. Whereas the symbols on the ST Department icon – a key placed above three winged lightning bolts – indicate the task of protecting internal communications.

Perhaps the most important achievement of CheckFirst’s investigative analysts is the precise geo-location of 10 electronic intelligence facilities strategically located in Russia, which form an interception network and play an important role in monitoring satellite signals, diplomatic, governmental and military communications.

The geo-positioned network includes important facilities, each of which has a separate strategic role. For example, Unit 03110, located near Sochi, was relocated from the famous Lourdes SIGINT facility, Cuba, after its closure in 2001. Now its likely mission is to monitor the Caucasus and the Middle East.

Another key facility is Unit 83521 in the Kaliningrad exclave. Its strategic location allows it to intercept satellite communications and radio signals over Europe, potentially targeting important NATO military facilities and communications.

As a reminder, a recent investigation revealed that Telegram’s infrastructure is maintained by companies that cooperated with Russian special services, which can be used to monitor users.

In particular, ElectronTelecom provided Telegram with 5,000 IP addresses. This company is a contractor of the FSB and provides installation and maintenance of secure communication systems for special operations.