But while most of the international credit for that string of GRU revelations has gone to Bellingcat, Dobrokhotov and his staff have taken on higher stakes. Unlike Bellingcat's researchers, they're Russian and live in close proximity to the very spies and assassins they're exposing. That has allowed them to run down some details of their investigations that Bellingcat never could have otherwise. It also puts them at far greater risk of arrest—or worse—than their international collaborators.

"I'm astonished by their ability. They're extraordinary investigators," says John Hultquist, a former State Department staffer and current researcher at security firm FireEye who has focused for years on GRU hacking. "To do that work from Russia takes a remarkable amount of courage."

Or as Thomas Rid, a cyberconflict-focused professor at Johns Hopkins puts it: "These stories mean more in Russian. The consequences of stepping on someone's toes in Russia can be far graver than they are here."

But when I met up with Dobrokhotov last November in a central Moscow bar—the closest thing the Insider's dozen-person staff has to an office—he told me he has no misgivings about taking on this particular adversary. "The choice is very simple. if you want to be a journalist in Russia, you either choose the real topics, the most important topics, or you’re not a real journalist," he said. "If you write about traffic jams, that’s fine in Switzerland or Sweden. But in Russia you have to work on these topics, because they can change society."

From Dissident to Detective

Long before becoming a journalist, Dobrokhotov spent his adulthood fighting the Russian government's secrecy, censorship, and corruption. He took part in his first protest as a first-year college student, after the Kremlin's takeover of the independent television station NTV in the year 2000. Later he founded the dissident group known as We—created in opposition to the pro-Putin youth group Nashi, which translates to Ours. He also helped organize events like a circle of thousands of people dressed in white, holding hands around the entire center of Moscow in 2012. In a commentary on free speech, he led a group of protesters with white tape over their mouths, standing outside the Russian government building known as the White House with blank signs. Police spent 10 confused minutes trying to decide whether he was for or against Putin, Dobrokhotov recalls, and then arrested him anyway—one of more than 100 times he says he's been detained.

"If he'd been born in 1880, he'd be one of those guys throwing bombs at the czar," says Aric Toler, one of Dobrokhotov's collaborators at Bellingcat.

By 2013, Dobrokhotov had finished his PhD and felt he had outgrown the youth movement. So he made the switch to full-time journalism. "There are many people who can organize big protests," he explains. "As an investigative journalist, I don't have that many competitors."

Before his career as an investigative journalist, Dobrokhotov was a leader in Moscow's anti-Putin youth movement. Max Avdeev

The Insider made some initial ripples with corruption exposés on Medvedev, state oil firm Gazprom, and dozens of high-ranking Kremlin officials. But its first scoop to get the attention of the West came in 2017, when Dobrokhotov started looking into the hacking of En Marche, the political party of French president Emmanuel Macron, whose emails were stolen and leaked just ahead of France's election.

France's own cybersecurity agency, ANSSI, had declared no trace of Russian hackers targeting the campaign. But one of the hacked emails contained metadata that identified a user who had at some point touched the documents: Georgy Roshka. Dobrokhotov and his staff found that same name listed as a representative of the technology firm Eureca at a conference in 2014, but Eureca denied Roshka was an employee. So the Insider staff painstakingly contacted dozens of the conference's other participants until they obtained its attendee list from the previous year---and found Roshka plainly listed as a member of GRU Unit #26165, based at 20 Komsomolsky Prospekt in central Moscow. It would be nine more months before the same unit number and address was revealed in Mueller's indictment of GRU hackers meddling in the US election.

Chasing Assassins

Dobrokhotov's collaboration with Bellingcat began last year, when he responded to a photo on Twitter posted by Bulgarian Bellingcat researcher Christo Grozev, showing what appeared to be a GRU officer in Montenegro. They began sharing information and months later would together identify three GRU agents they believed to be involved in an attempted coup against Montenegro's pro-NATO government.