Results of the forensic photo analysis: The suspected murderer "Sokolov," who was arrested in Berlin (1 and 3) and the convicted murderer Stepanov, who is in jail in Russia (2 and 4), are not the same person.

In the case of the Georgian man shot to death in late August in a Berlin park, evidence is mounting that the crime may have been a hit contracted by the Russian state. Reporting by DER SPIEGEL, the investigative website Bellingcat, The Insider and the London-based Dossier Center indicates that Russian state actors actively participated in the creation of a fake identity for the suspected murderer, to the point that it is almost impossible to draw any other conclusion.

"The crime appears to have significant and clear political fingerprints," Norbert Röttgen, chairperson of the Foreign Affairs Committee in the German parliament, told DER SPIEGEL. "It seems incomprehensible that the case hasn't yet been taken up by the German Federal Public Prosecutor." There is nothing to indicate that there was a personal motive behind the murder or that it was the product of organized crime activities, Röttgen said.

The murder is politically sensitive and is reminiscent of the 2018 attack on former Russian agent Sergei Skripal and his daughter in Britain. A murder committed by the Russian secret service on German soil would be nothing short of a diplomatic crisis.

Just one week after the murder, which targeted a Georgian man by the name of Zelimkhan Khangoshvili, DER SPIEGEL and its partners reported that the identity of the alleged perpetrator had been faked. Berlin police arrested a Russian citizen claiming the name Vadim Sokolov shortly after the murder. But there was nobody by that name registered in the Russian passport system. Furthermore, he had provided a false address in his Schengen visa application. His passport had been issued by a division of the Russian Interior Ministry that has also issued passports to agents of the GRU, the Russian military secret service, in the past.

The Georgian victim fought against Russia in the second Chechen war. Later, he spent years working as an informant and intermediary for the Georgian and Ukrainian anti-terror agencies. U.S. officials also profited from his contacts in the difficult-to-access Caucasus region. Following constant threats and an attack on his person, he initially fled to Ukraine and then onward to Germany.

DER SPIEGEL, Bellingcat, The Insider and the Dossier Center are now in possession of information showing that the Russian state may have helped provide the alleged perpetrator with an assumed identity. There are clues within Russian databases that support the conclusion that the "creation" of "Sokolov's" identity took place shortly before the August 23 murder in Berlin.

A note is attached to his entry in the current Russian national identification database, reading: "Person protected by law ... Contact an administrator to obtain this file." Following Bellingcat's identification of the suspect behind the attack on the former Russian agent Sergei Skripal, similar notices were attached to the files belonging to other Russian secret service agents.

The crime scene in the Moabit district of Berlin

An additional clue can be found in the Russian tax database. "Sokolov" only makes his first appearance in the database on June 16, 2019, at the age of 49. Because Russian citizens are automatically registered in this database when they get a job, that means he must only have begun working shortly before turning 50.

It is more likely that the entry was created in order to support his application for a Schengen visa. Only six days after "Sokolov" received a tax number on July 23, 2019, he applied for a Schengen visa at the French Embassy, shortly after receiving his first Russian passport under that name.

Bellingcat

A page from the Russian tax database

This sequence of events indicates that the identity "Vadim Sokolov" was likely only established at significant effort just a few weeks before the murder in Berlin. Although a Russian identification document was allegedly issued in 2015, it cannot be found in earlier, offline ID databases.

Inquiries at the address where "Sokolov" allegedly lived, according to the address listed in his tax file, likewise proved to be a dead end. An elderly man opened the door of the apartment at that address and said he had never heard of a person named "Sokolov" and didn't know if a person by that name had ever lived there.

DER SPIEGEL and its reporting partners received a tip just a few days after the August 23 murder in Berlin indicating who might actually be behind the "Sokolov" identity. A similar tip was apparently provided at the same time to the Office for the Protection of the Constitution (BfV), Germany's domestic intelligence agency.

Reporting by DER SPIEGEL and its partners, however, arrived at the conclusion that the tip is most likely false.

In a New York Times report, the impression was given that "Sokolov's" real name is Vladimir Andreevich Stepanov, a convicted murderer, according to the story.

DER SPIEGEL and its partners had considered that possible identity on several occasions. But a forensic photographic comparison between Stepanov and "Sokolov," performed at the University of Bradford, had not revealed sufficient similarities. Furthermore, statements indicated that Stepanov was still in jail in Russia.

German investigators also don't believe that Stepanov and "Sokolov" are the same person. That particular lead, they say, is most likely "a dead end," with much of the evidence "contradictory." Which means that investigators are still on the search for "Sokolov's" true identity.

A small piece of plastic could be instrumental in that search. On his way to Berlin, "Sokolov" traveled through both Warsaw and Paris, and investigators were able to find a Russian SIM card in his hotel room in the Polish capital. It is now in Germany, and investigators are hoping that it will provide valuable clues.

***Spiegel Staff: Maik Baumgärtner, Christo Grozev, Roman Lehberger, Alexander Sarovic, Fidelius Schmid and Jörg Schmitt