Covering up the Kompromat Operation. Evidence Fabricated Two Hours After Discussion With Interior Minister Lucian Bode

Emilia Şercan

English Section

07/07/2022

It's Monday, February 21, 3:30 p.m. I enter the headquarters of the General Inspectorate of the Romanian Police (IGPR) on Mihai Vodă Street, no. 6. The officer on duty inquires who I want to see and then asks for my ID. He enters my personal information into a register, then dials a number on the landline.

"Mrs. Șercan for the Inspector General," the man says into the receiver. "Let's go, he's waiting for you," the officer tells me after concluding the brief telephone conversation.

We quickly climb the stairs covered in plush, red carpeting, then head toward the main hallway on the first floor.

I’m well acquainted with the way there because on Friday, February 18, I had been in this building, where I’d met quaestor Benone Matei, the head of the Romanian Police - a meeting facilitated by Lucian Bode, Interior Minister.

The door to the office of the Romanian Police chief is open.

The man in plainclothes in the waiting room gets up from behind his desk and asks me to leave my phone in the safe box on the wall. I take the phone out of my pocket, but just then the police chief appears and tells me I can keep it and invites me into his office.

Quaestor Benone Matei dons a police uniform and a serious expression on his face.

I take a seat at the meeting table by the door, in the same chair I sat in three days earlier.

I ask Quaestor Matei about the result of the internal investigation, which on Friday, February 18, he told me he would request. Its point was to find out the circumstances in which a piece of evidence that I had handed to a policewoman from the Criminal Investigation Section of the Bucharest Police on February 17 was leaked online that very same day.

The evidence was a screenshot of a message I had received from a stranger, attesting that the individual was in possession of five personal photos of me, taken 20 years ago. Upon receiving that message, I was shocked to find that the five photos had been uploaded to several adult content sites.

On the morning of February 18, after receiving a Google alert via email, I made a startling new discovery: the evidence I had given to the police and my five personal photos had been published online the previous day, on February 17, only 40 minutes after I had left the Criminal Investigation Section, to the website realitateadinmoldova.md, registered in the Republic of Moldova.

Since that screenshot only existed in two places - on my own phone and on the policewoman’s - I instantly realized that the only way it could’ve made it to the Internet was by being intentionally leaked by someone in the police force.

Over the past few years, I’ve made quite a few enemies among the ranks of the Interior Ministry and the Romanian Police after writing about the plagiarism committed by several quaestors or senior officers, some of them currently in charge of the public order and national security system; I’ve also written publicly about the widespread imposture and industrial-scale plagiarism at the Police Academy, which eventually led to two doctoral schools being permanently shut down last summer.

From the moment I saw the screenshot on the Moldovan website, it became clear to me that someone within the Police or Interior Ministry had orchestrated a kompromat operation against me.

I publicly denounced the kompromat operation on April 4, in an article published by PressOne. 

***

I am in the office of the Romanian Police chief, anxiously awaiting the result of the internal investigation.

Instead, quaestor Benone Matei tells me he wants to show me the results of an analysis undertaken by "the best specialists within the Romanian Police force," regarding the circumstances in which my screenshot was published on the internet.

He slides a white folder with a large Romanian Police logo across the table in front of me.

I open the folder and start flipping through a few pages of printed material that look like a news story, which features my photos, as well as the screenshot that had become evidence in a criminal case on February 17, at 10:29 am, when I handed it over to a Criminal Investigation Service police officer.

The article in front of me was printed off the website patrianoastra.com. 

"Take a close look at the date and time featured in the metadata," the head of the Romanian Police urges me.

The date and time that quaestor Benone Matei is drawing my attention to are highlighted in bright yellow, both in the article, as well as in the metadata. The time stamps indicate February 17, 2022, at 5:45.

I ask the head of the Romanian Police if the time is in the a.m. or the p.m. and he says it’s 05:45 in the morning.

"Are you saying that the evidence and the photos first appeared on the Patria Noastra website at 05:45--that is, before I had given them to the policewoman?", I ask, utterly puzzled.

"That’s what the analysis indicates! We used the best, emotionally balanced experts, we paid attention to all aspects. I’ll have you know we’re not playing here, Mrs. Șercan!", quaestor Benone Matei stresses.

My analysis indicated that the piece of evidence and my photos were first published by the website realitateadinmoldova.md, on February 17, 2022, at 14:51.

Within four hours, that article had been cited through backlinking by at least 74 other sites, most of them registered in Romania, but none of these dozens of sites had cited or made any reference to patrianoastra.com.

"If this article appeared at 05:45, does this mean that someone stole the screenshot from my phone? Are you implying that I was spied on? If I was spied on, Mr. Matei, it's as serious as when someone in the police force leaked the photo."

Quaestor Benone Matei, the head of the Romanian Police, shrugs.

"Given the circumstances, I expect the Romanian Police to do everything in their power to find out who spied on me!", I tell quaestor Matei.

Three days before, the very same quaestor had assured me that the Police will do everything they can to clarify what had happened and who was responsible for the leak.

Today, faced with his own hypothesis - that my phone was spied on - he shrugs.

Quaestor Matei leads me to the exit of the building and tells me that the Romanian Police doesn’t exactly have the best cyber investigation experts, because those interested in working for state institutions are insufficiently motivated by the low salaries, in comparison to those offered by private companies.

I leave the Romanian Police headquarters after about 40 minutes, in a state of confusion.

Outside, a few rays of sun make it feel like early spring.

I take the phone out of my purse and call my editor, Mona Dîrțu. It’s 4:23 pm. 

The first hints of the cover-up

I asked Mona Dîrțu, with whom I have been working since 2019, to provide her own perspective on what happened on the afternoon of February 21, after I left the office of the Romanian Police Chief.

Below, her account:

"The first thing Emilia told me after leaving the IGPR headquarters was that the Chief of Police had shown her some materials that indicate the ‘zero source’ of the compromise operation against her as not realitateadinmoldova.md, but another website: patrianoastra.com.

As the pages of the analysis she had consulted explained, this latter website allegedly published the screenshot Emilia had taken the night before very early in the morning of February 17, at 05:45.

That makes it nearly 5 hours before she sent it via WhatsApp, at 10:29, to the police officer investigating other threatening messages Emilia had received, when it officially became evidence.

Even during that phone conversation with Emilia, I accessed patrianoastra.com.

My first finding: in the GENERAL section there were two stories dated February 17: one with the ‘explosive revelations’ on Emilia Șercan (which included the screenshot), and another one, titled "Russia gave America the answer about security guarantees in Europe. The Russian MFA website went down immediately afterwards”. Previously, since the beginning of 2022, patrianoastra.com had only posted two other stories, both on matters of external affairs: one on February 7 and another on January 3.

My first thought: a website that only publishes one story per month suddenly posts two articles in one day - both before 6:00 in the morning.

As I’m talking to Emilia, I open the article announcing the ‘explosive revelations.’ The date and time displayed on the website: February 17, 2022, 05:45 am. The page contains a single paragraph, which begins with a lie - ‘among the pictures in Emilia Șercan’s possession, which she provided…’ - followed by five personal photos that had been stolen from her, plus the screenshot, which, on that morning, only existed on her own phone.

I then open the article on Russia. The date and time displayed under the title: February 17, 2022, 05:35 am. Apparently, this article had been published only 10 minutes before the one which the Chief of Police had indicated as ‘source zero.’ I start reading it. I realize, right during the conversation with Emilia, that the article had been pre-dated.

The intro to the text alone - the one allegedly published at dawn on Thursday - mentioned three events that had not yet taken place at that time.

I share my hunch with Emilia: that both of the articles dated February 17 on patrianoastra.com - the one containing her screenshot and the one about Russia - had been pre-dated.

I ask her for a bit of time to retrace the chronology of the external events and fact-check the hours at which they had taken place. According to my phone log, we end the phone call we had started at 16:23 after 15 minutes and 56 seconds. We agree that I call her back when I have collected the evidence.

The fact-checking doesn't take me long. User 'Patriot', under whose name most of the materials on patrianoastra.com are posted, couldn’t have chosen a topic with a timeline that was easier to reconstruct. 

Thursday, February 17, 2022, was a tense day. It was precisely one week before the invasion of Ukraine and several events took place that day, recorded not only by dozens of foreign journalists, but also announced by the official websites and social media accounts of institutions such as the Russian Federation’s Ministry of Foreign Affairs and the US State Department.

Below, in the left-hand column, several paragraphs of the patrianoastra.com article, which refer to events that did occur on February 17, 2022, but after 5:35 am, the alleged time of publication. The right-hand column indicates the hours at which the events actually occurred:

All this evidence shows, without a shadow of a doubt, that the patrianoastra.com story could only have been published after the American diplomat had been expelled, after the Russian Foreign Minister had held his press conference, and after the document it mentions had been published on the website of the Russian MFA. Clearly not at 05:35 in the morning - and clearly not before 17:00.

Further proof: Below the article on patrianoastra.com there is the mention ‘Source: Digi24.’ The link leads to an article on Digi24.ro, which is identical to the one posted on patrianoastra.com down to the very last comma. Date and time displayed on Digi24.ro story: ‘17.02.2022 17:30.’

Therefore, user ‘Patriot’ took the article published by Digi24.ro in the afternoon of February 17, at 17:30, copied it word for word, photos included, and posted it on patrianoastra.com. They then changed the time of publishing to 05:35 in the morning.

I call Emilia. I tell her what I discovered: that the article on Russia was certainly pre-dated, and that we have 5-6 pieces of evidence to prove this.

It’s easy to change the date and time at which an article was published on a WordPress platform like the one patrianoastra.com uses, but it requires intention. You have to change the numbers in the fields showing the initial date of publication and then save the changes.

For instance, here is how the publication date of the article on Prime Minister Nicolae Ciucă’s plagiarism can be changed from January 18, 2022, at 05:25 in the morning, to February 17, 2022, at 05:45 in the morning:

The key question: why did user ‘Patriot’ pre-date an article about Russia so that it appeared to have been published at least 12 hours before?

The only plausible scenario: user ‘Patriot’ pre-dated that article in order to camouflage another pre-dating - that of the article about Emilia.

Thus, we were left with two hypotheses:

HYPOTHESIS 1. If patrianoastra.com did indeed publish the screenshot on February 17, at dawn, as claimed by the head of the Police, based on the technical analysis undertaken by the Police’s ‘best experts’, this meant that someone had spied on Emilia's phone during the nine hours that had elapsed between the evening of February 16, at 20:45, when she took the screenshot, and the morning of February 17, at 05:45.

HYPOTHESIS 2. If patrianoastra.com published the material after realidadeadinmoldova.md and then pre-dated it, it meant that the head of the Romanian Police presented a fabrication to Emilia Șercan - and passed it off as a technical expertise on how the photos had spread over the internet.

The fabrication, however, came with one great advantage: it dispeled the suspicion that evidence from a criminal case had been leaked. In doing so, it also removed the suspicion that a kompromat operation against an investigative journalist had originated with Romanian state authorities.

In addition, it protected both the police employee who had leaked the evidence from the criminal file, as well as their accomplices, who had shared it on the internet. According to the Romanian Criminal Code, the disclosure of professional information that is classified, or not meant for public use, is punishable by 3 months to 3 years in prison, or a fine.

I texted Emilia on WhatsApp with the conclusion I had reached just one hour and 20 minutes after her departure from police headquarters: that the expertise she was presented with is part of a cover-up meant to conceal the screenshot leak.

The time was now 17:37. It had become increasingly clear that the kompromat operation had been initiated by someone within the Romanian Police, who had access to the screenshot, and that the documents the police chief had presented to Emilia two hours earlier as a ‘technical analysis’ had been fabricated”.

Who owns the website patrianoastra.com?

The data available online for the patrianoastra.com website shows that it was registered in Reykjavik, Iceland - a non-EU country - on April 3, 2020 and its operating license was valid until April 3, 2023.

The last update on the website is dated March 4, 2022.

Information on the person, company, or organization that owns this site, as well as the registered email address, is publicly protected by the Withheld for Privacy online service, which automatically generates data to replace its customers’ actual contact information.

During the almost three years of its existence, the website patrianoastra.com, which appeared to be a news platform, had published a grand total of just 47 articles. For comparison, legitimate Romanian news sites, such as Digi24, Libertatea.ro or Hotnews.ro, publish more than 100 articles in a single day.

Here are the conclusions of an analysis of its archive, undertaken before March 10, 2022, the date when the website was deleted:

Who is Benone Matei

Quaestor Benone Matei has been in charge of the Romanian Police since May 2021. He was appointed into office by Minister of Internal Affairs Lucian Bode.

Shortly after his appointment, Bode told news agency Agerpres that Matei is among the best active Romanian police officers.

"Police quaestor Benone Marian Matei’s police career spans 24 years. He graduated from the ‘A.I. Cuza’ Police Academy in 1997, and has 15 years of managerial experience.

He is one of the best policemen that the Romanian Police has today, with good results in his work, being a dedicated, intelligent policeman, a good organizer, one who is well respected in the system and acknowledged as having integrity of character. These are the things that, I think, recommended police quaestor Mr. Benone Marian Matei to be appointed head of Romania’s General Police Inspectorate, with the rank of deputy minister.”

Before his promotion, Benone Matei led the Special Operations Directorate (DOS), the department that handles wiretaps and interceptions. The DOS took on this role after Romania’s Constitutional Court decided to bar the Romanian Intelligence Service from criminal investigation activities.

In a profile published one year ago by the Romanian Free Europe website, sources within the police describe Matei as a good professional, but also one who was catapulted from Bacău to Bucharest by entertaining close relationships with influential figures within the justice and secret service systems.

"He came to Bucharest with the support of prosecutor Codruț Olaru and the head of the Foreign Intelligence Service, Gabriel Vlase. He was the deputy of Organized Crime, then became the head of the department. He was later moved to the DOS as its director," says one source quoted by journalist Virgil Burlă.

The independent expertise

The day after I got hold of the first hints that the two materials on the patrianoastra.com website had been pre-dated in order to cover up the Romanian Police leak, I asked globally reputed cyber security experts to provide two distinct expertises:

I received the first conclusions on March 3, 2022 from Bitdefender, a world leader in cybersecurity.

Bitdefender experts analyzed the time when the images in the two articles had been uploaded online, i.e., the screenshot - the main evidence in my criminal case - and my five personal photos.

The conclusions of the Bitdefender experts, based on metadata associated with the images, show that they were uploaded to patrianoastra.com on February 18, 10:14, even though the article is dated February 17, 5:45.

The conclusions of Bitdefender experts

Bitdefender produced an independent expertise that I will formally submit as evidence to the investigation file registered at the Prosecutor's Office with the Bucharest Court of Appeals, which targets the information leak.

The conclusions of the independent expertise are the following:

In IT-speak, MD5 (Message Digest Algorithm 5) is a one-way hash cryptographic function and is a component in some electronic signature schemes. MD5 hashes also help establish the integrity of online files.

***

In plain English, the Bitdefender experts’ conclusions say a few essential things:

The discrepancy on patrianoastra.com can be explained in two distinct ways, say the Bitdefender experts: either the date and time of publication displayed on the site were manually changed for February 17, or the photos were uploaded on February 18.

Regardless of which scenario is correct, the conclusion remains the same: the screenshot that appears on patrianoastra.com - the evidence in the criminal case - was definitely uploaded on the site 24 hours after I sent it via WhatsApp to the police deputy commissioner.

The Bitdefender expertise implicitly shows that patrianoastra.com is not „source zero” in the kompromat operation, as indicated to me by the head of the Romanian Police.

What happened on February 18?

The difference between the date when the article was published on the patrianoastra.com website and the date when the images were uploaded can be explained through a series of events that took place on the morning of February 18, 2022.

Friday, February 18, 2022, 7:15 p.m. An email Google alert warns me that my name is featured in four online articles.

This is the first sign that, less than 24 hours after I had filed a complaint with the Police, claiming the theft of personal photos, my complaint had become the starting point of a kompromat operation.

All the four articles in the Google alert contained a link to a site registered in the Republic of Moldova, which published the screenshot I had given the day before to the deputy commissioner of the Criminal Investigation Section of the Bucharest Police, as well as the five photos that had been stolen from me.

The website is realitateadinmoldova.md, currently owned by former social-democrat deputy Cristian Rizea, who was sentenced to 4 years and 8 months in prison in March 2019, and who had fled to the Republic of Moldova before being sentenced.

The screenshot published on fugitive Rizea’s website 40 minutes after I left the Police headquarters is without a doubt the same one I had taken on the evening of February 16, because it shows both the time I took it, as well as the network data on my personal phone.

Right after I realized this, I decided to call Interior Minister Lucian Bode and inform him about the leaked evidence in the file. I had his phone number because I had had several discussions with him regarding the situation at the Police Academy.

It's 7:30. Minister Bode does not answer, but calls me back a few minutes after 8:00. In a conversation that lasts about 20 minutes, I inform him that a piece of evidence from a criminal case registered with the police, which he formally commands, was leaked to the press--in order for me to be compromised.

Minister Bode assures me that the Romanian Police will carry out an internal investigation and promises to call me a few hours later, as he is currently en route to the report meeting of the Department for Emergency Situations.

It's 10:14. Just two hours after my discussion with Interior Minister Lucian Bode, the website www.patrianoastra.com quickly uploads - on Friday, February 18, between 10:14 and 10:15 - the screenshot taken by me, the five photos stolen from me, as well as two other photos of me taken from the internet, so that this article would look different from the one on realitateadinmoldova.md. The Bitefender expertise would confirm, however, that the images "have the same MD5 hashes on both www.patrianoastra.com and www.realitateadinmoldova.md."

On Monday, February 21, the head of the Romanian Police presents www.patrianoastra.com to me as the website that published the screenshot before I handed it over to the Police, according to his experts.

When was the website patrianoastra.com deleted

The patrianoastra.com website was completely deleted and has been inaccessible since March 10, 2022.

How is it that the website, which, in theory, would have completely exonerated the Romanian Police from any guilt, has been deleted?

How come the alleged „source zero” of the kompromat operation has been completely „razed” off the face of the Internet? The one website that could have supported the Romanian Police Chief’s hypothesis, according to which the screenshot appeared on the Internet 4 hours and 45 minutes before I gave it to a police officer.

The explanation resides in the sequence of certain events that took place in early March.

For three weeks, I saw how state institutions resorted to a whole set of tactics, in order to delay an investigation in which I claimed a leak of evidence from a criminal case, as well as the Romanian Police Chief’s attempt to mislead me. I then sent a letter to five state officials: President Klaus Iohannis, Prime Minister Nicolae Ciucă, Interior Minister Lucian Bode, Romanian Attorney General Gabriela Scutea, and Romanian Police Chief Benone Matei.

In that letter, I provided the information that, at the time, had led me to believe that the „source zero” indicated to me by the Romanian Police, i.e., the article on the patrianoastra.com website, had been pre-dated.

On March 10, the day after I sent this letter, I found out that the site had been completely deleted.

The most plausible scenario is that, after learning from the open letter that I had discovered the fraudulent pre-dating of the material, the website owners and those involved in the cover-up operation wanted to remove any parsable information from the patrianoastra.com website, which could have provided even more proof on the pre-dating.

Who owns realitateadinmoldova.md 

The current official owner of the realidadeadinmoldova.md website is former social-democrat politician Cristian Rizea, sentenced in March 2019 to 4 years and 8 months in prison, who fled to the Republic of Moldova before the sentence was handed down.

At present, the 2019 request made by the Romanian state for the extradition of the convicted Rizea has yet to be implemented.

Rizea legally changed his name in the Republic of Moldova, and now appears in all official documents as Cristian Mihai.

However, a February 18 check indicated that the realitateadinmoldova.md website was owned at the time by Realitatea-PHG SRL. 

This company is owned by two associates, each with an equal participation of 50%: Cristian Rizea and Iulian Ditcov, who was also definitively sentenced to serve 3 years and 6 months in prison in 2014,  in the "Romanian Postal Service" case. This is the same case in which Maricel Păcuraru was convicted. He is the father of Alexandra Păcuraru, who legally owns the Realitatea Plus television channel.

In fact, 59 of the 74 sites that republished the pictures and linked to Rizea's website on February 17, within four hours, belong to Realitatea Media SA, a company that is part of the media group which also owns the Realitatea Plus TV station.

The official manager of Realitatea-PHG SRL, whose name was featured in its legal documents in early April, was Vladimir Dachi, the president of the NOI Political Party in Moldova.

Last year, Rizea, who was once a social-democrat deputy in the Romanian Parliament, ran in the early parliamentary elections in the Republic of Moldova on behalf of the NOI Political Party, but did so unsuccessfully.

Last month, I filed a criminal complaint against the violation of my private life in the Republic of Moldova, which targets the publication of my personal photos and screenshots on the website realitateadinmoldova.md.

After the complaint was filed, the realitateadinmoldova.md website changed hands, and Cristian Rizea became its sole owner. His relationship with the administrator of Realitatea-PHG SRL, Vladimir Dachi, also broke down.

Earlier this month, Dachi accused Rizea of ​​having stolen large sums of money from him. In turn, Rizea accused Dachi of having threatened him with death.

Three expert reports that refute the spyware hypothesis

Although the quickly discovered evidence, unearthed a few hours after my meeting with the head of the Romanian Police, indicated that the article on the patrianoastra.com site had been pre-dated, I also wanted to have my mobile phone independently assessed, in order to analyze the possibility of my phone having been spied on.

With the help of several Romanian and foreign journalists, as well as of some human rights activists, I got in touch with two international institutions that specialize in uncovering digital security breaches, including signs of spyware and hacking:

According to the experts of the two institutions, who analyzed all of my phone data, no evidence of spyware or hacking was discovered. If discovered, this could have explained the theft of the screenshot from my electronic device on the night of February 16 to February 17.

Also, Bitdefender performed a third analysis of the phone's logs.

A phone log contains metadata, collected from a mobile phone for surveillance or espionage purposes.

According to The Week, metadata can include call duration, the phone numbers of the parties involved in a call, phone ID information, GPS location, call proximity, etc..

At the date of the analysis, the Bitdefender experts were also unable to find artifacts revealing that my mobile phone had been compromised.

Brief timeline of the case

January 19, 2022. I receive a threatening message, as a result of my investigation published the day before, which proved that Prime Minister Nicolae Ciucă (PNL) plagiarized his doctoral thesis.

January 20, 2022. I file a criminal complaint regarding the threat with the Criminal Investigation Service (SIC) within the Bucharest Police.

February 2, 2022. I receive a new threat, for which I file a second criminal complaint.

February 16, 2022. I find a Facebook message from a stranger, which includes five personal photos, taken about 20 years ago by my fiancé at that time, in the apartment we shared at the time. I then find that those photos have been uploaded to multiple adult websites.

At 8:45 p.m., on February 16, I take a screenshot of that message, as  proof that a stranger had sent me those photos.

February 17, 2022. I have a phone conversation with the Police Deputy Commissioner who was already handling the two previous complaints, to ask her if the theft of private photos and their uploading to adult sites is within the jurisdiction of the SIC.

At 10:29, via WhatsApp, I send the deputy commissioner the screenshot I had taken the night before, at 20:45, which feature the sender's name, as well as the messages and photos received from them.

February 18, 2022. At 07:15, I discover via a Google alert that the Republic of Moldova-registered website realitateadinmoldova.md has published both the evidence I had sent the SIC Deputy Commissioner the day before, as well as the five photos that had been stolen from me.

February 19, 2022. I file a new criminal complaint against 64 sites that publish one of the stolen photos, accompanied by texts that link back to the website realitateadinmoldova.md.

February 21, 2022. Quaestor Benone Matei, the head of the Romanian Police, shows me an analysis undertaken by Romanian Police experts, which indicates that the realitateadinmoldova.md website was not the first to publish the criminal case evidence, but that the patrianoastra.com website was.

The Romanian version of this article was published on May 30th, 2022.

Translated by Ioana Pelehatăi