Soros-Linked NGOs Fell Victim To A Big, Sophisticated Undercover Operation. Hungary’s Prime Minister Has Benefited The Most.

George Soros on a billboard in Budapest last October, with the words "National consultation about the Soros plan".

Attila Kisbenedek / AFP / Getty Images

LONDON — Hungary goes to the polls Sunday after a parliamentary election campaign that has featured dirty tricks, spying allegations, damaging leaks, and a drumbeat of anti-Muslim and anti-Semitic rhetoric.

Dark electoral arts have included a host of sophisticated undercover stings targeting NGOs and individuals linked to the philanthropist George Soros, carried out by people using aliases and working for companies that do not exist.

BuzzFeed News can reveal that the stings, which preyed on seven NGOs and individuals — all but one linked to Soros — in the months leading up to the election are highly likely to have been executed by the same group.

BuzzFeed News cannot be certain what group carried out the operation, or who paid them to do so. Some of the websites created for the front companies in the operation have unusual ties to a string of sites an expert says are aimed at burnishing the online reputation of a Russian oligarch, as well as to an individual based in Israel and a web developer in Romania.

Although there is no evidence to suggest the Hungarian government’s direct involvement with the operation, it is clear who the main beneficiary is: incumbent Prime Minister Viktor Orbán, and his anti-Soros agenda.

A spokesperson for the prime minister did not comment when asked via email about who may have given financial backing to the operation, and whether the government had any knowledge of, or connection to, the group secretly recording the meetings with the NGOs and then leaking them.

The spokesperson did, however, say the recordings “prove yet again what the Hungarian government has been emphasizing for long.”

Soros has increasingly become the object of dog-whistle politics and sustained attacks by populists, nationalists, and conspiracy theorists around the world, but nowhere more so than in his native Hungary. Election posters plastered around Hungary currently feature the philanthropist and Orbán’s rival candidates holding bolt cutters after having cut the border fence behind them.

The message is clear. “We will either have a national government, in which case we will not become an immigrant country, or the people of George Soros form a government and Hungary will become an immigrant country,” Orbán told a rally during a campaign visit in the city of Miskolc last month.

Selectively edited covert recordings from the sting operations fed a series of newspaper articles that were dubbed the “Soros Leaks” by pro-government media and journalists close to Fidesz, Hungary’s ruling party. The material was picked up in statements, interviews, and comments by Hungary’s prime minister and his inner circle, and used to add fuel to the central planks of Orbán’s relentless anti-Soros and anti-migrant reelection campaign rhetoric.

In all seven incidents, almost identical methods were employed to ensnare the NGOs, including fake websites created and hosted using the same service, fake LinkedIn pages, and listings on the same startup database, Crunchbase — most traces of which later disappeared.

And in each case, similar tradecraft was used to set up meetings and later leak the details. In at least one instance, the same person took meetings with different NGOs, and in another, the same front company approached two different NGOs.

Viktor Orbán

Nurphoto / Getty Images

When Balázs Dénes flew to Amsterdam in mid-January for a meeting with representatives from a Bahraini company that called itself Orion Venture Capital, which claimed to be looking to invest its profits in projects across Europe to help refugees, something didn’t feel right.

Prior to leaving, Dénes, the executive director of Berlin-based NGO Civil Liberties Union for Europe, asked a friend to check out the Bahraini office address the investment firm listed on its website. It turned out to be a construction site. Dénes decided to go ahead with the meeting anyway.

His hosts in the Dutch capital were a white European woman who introduced herself as “Jasmijn Kooij” and an older, Middle Eastern man who gave his name as Ali Mahmoud Alrabie. They had reached out via email to the Soros-backed NGO a month earlier to arrange the meeting. When Dénes asked them why their office address was a construction site, they told him that “the site is one of our investments.”

“They put me at ease, and made a good job of making me feel relaxed,” Dénes told BuzzFeed News during a telephone interview this week. “They were really professional, and the atmosphere was collegial and friendly.”

When BuzzFeed News tried calling phone numbers on Kooij and Alrabie’s business cards this week they were not in service, or were redirected to the voicemail of a UK mobile number. (At least one of the other entities involved in the operation, a Madrid-based company, also had a telephone number redirecting to a UK mobile number when BuzzFeed News tried calling this week).

Two months after the meeting, comments made by Dénes in Amsterdam were published by the Jerusalem Post under the headline “How a Soros-funded NGO lobbied one EU country against another.” The encounter had been covertly recorded, and later leaked to the paper.

The story was picked up within days in a blog post by Zoltán Kovács, a spokesperson for Orbán, as well as pro-government media outlets, as proof of “anti-Hungary operations of the Soros network.”

Dénes told BuzzFeed News that he believes the Jerusalem Post article was not inaccurate, but the newspaper was simply unwittingly used as a “tool” in a wider operation. “From a Hungarian perspective, the Jerusalem Post was the perfect place to publish the article,” Dénes said, as it was published in English in another country, allowing the Hungarian government to say it was unbiased and not anti-Semitic.

BuzzFeed News understands that the newspaper was approached with the story days before publication, and there are suspicions its source had used similar tactics before on other stories.

Despite the warning signs, Dénes says he was surprised to be caught off guard. “I checked the website, and it looked fine,” he said. “It’s a different level of warfare that I am not used to. It’s as simple as that,” he added.

Obtained by BuzzFeed News

Between December 2017 and March 2018, NGOs and individuals associated with Soros were approached for meetings by at least six separate companies that claimed to be investment firms or boutique consultancies. They said they were based in places such as London, Madrid, Paris, Berlin, and Bahrain, and had websites, LinkedIn profiles, and Crunchbase entries that were often linked prominently in emails sent requesting meetings to explore funding and partnership opportunities.

Using domain registration records, a comparison of the online profiles and tradecraft of the operations, and the fact that in at least one case the same person targeted multiple NGOs, BuzzFeed News has now established that five successful undercover stings, as well as two failed approaches, are highly likely to have been carried out by the same group.

The meetings, some of which have been reported by Politico, were held in Vienna, New York, London, and Amsterdam, with the fake companies offering to cover the travel costs of the NGOs. In one case, they reimbursed a participant in cash and offered to give him additional funds. He declined. In another case, a company purchased business-class flights between Kiev and Vienna for the NGO.

At least four of the targeted NGOs were covertly recorded, and selectively edited snippets of the recordings were subsequently published by pro-government Hungarian media such as Magyar Idők, which said the recordings were the work of a person the newspaper described as an investigative reporter. The author of some of the Magyar Idők articles that include a byline is a founding member of Orbán’s conservative Fidesz party. Last week he interviewed the prime minister, and asked him questions about the articles.

“George Soros is not some invention: If I’m not mistaken, you yourself were personally involved in this, writing about how his network revealed its true colors. We heard them describing, in their own voices, how they’re working against the Hungarian government, and that they want to bring it down,” Orbán replied.

Though there is no suggestion of his involvement in the operation, Orbán, who is all but certain to win a fourth term on April 8, will have benefited the most from the media leaks.

The prime minister and his inner circle have cited on multiple occasions the claim that Soros has 2,000 “mercenaries” working for him in Hungary. In reality, the victim of one of the covert stings, Tracie Ahern, former chief financial officer of Soros Fund Management, said that Soros’s Open Society Foundations have around 2,000 people working for them around the world.

Other claims seized upon by Hungarian media range from lobbying the German government to pressure Hungary into reversing controversial laws, to using the Soros-backed Open Society Foundation to “control the European Union,” to suggestions of illegal activities in Hungary. In another case, a report falsely claimed that a recording revealed a Soros-funded organization and the CIA were behind the Ukrainian revolution that toppled former president Viktor Yanukovych.

Laura Silber, chief communications officer for the Open Society Foundations, said the group had “watched with increasing dismay as government-sponsored propaganda in Hungary becomes ever more outlandish, attacking groups that promote transparency, carry out investigative journalism, and protect human rights.

“This latest smear campaign against the Open Society Foundations and civil society organizations using covert surveillance, fake websites, and imposters represents a dangerous new low point for a European government.”

At a press conference in Hungary last month, András Siewert, the director of Migration Aid, the only NGO not associated with Soros implicated in the sting operation, released photographs of a man and woman he said he’d met with in Vienna in December.

Siewert, who explained he secretly took the pictures at the meeting because he was suspicious, said the man he met had presented himself as a partner at a company called Smart Innotech, spoke English with an Israeli accent, and called himself Grigori Alexsandrov.

Other individuals targeted by the stings have described the accents of the various people they met as noticeably French, “eastern European English,” “Australian or pretending to be Australian,” and “neutral.”

Yevhen Bystrytsky is the former director of the Soros-backed International Renaissance Foundation, and the target of another one of the undercover operations. He said the man in the Migration Aid photo also posed as the CEO of a different company and was deployed in their meeting in Vienna too, using the name Andrej Novak.

Bystrytsky told BuzzFeed News during a telephone interview that he recognized the man after seeing the photo shared by Siewert.

And a man going by the same name of Alexsandrov, representing Smart Innotech, tried an approach on a third organization with a proposal for a joint project to provide a database of migrants and their biometric data, according to Anna Simai of the Hungarian Helsinki Committee, a human rights NGO. That’s the same proposal Alexsandrov used to help secure the meeting with Siewert in Vienna. “We found it very suspicious and did not enter into any joint activities,” Simai said in an email.

None of the organizations he targeted nor BuzzFeed News have been able to identify the man in Siewert’s photo.

A spokesperson for Orbán told BuzzFeed News that the leaked recordings and articles showed “NGOs mainly financed by George Soros work as a network to facilitate illegal migration. The case of Balázs Dénes and the Civil Liberties for Europe lobbying against Hungary and its national interests in Germany was a clear example of the functioning of Mr Soros’ network. We also have knowledge of about 2,000 people in Hungary working for this network. These groups try to help illegal migration with illegal means as shown by the case of Migration Aid, that is why we believe that it is essential to pass the proposed ‘Stop Soros’ bill as soon as possible in order to be able to ensure the security of the Hungarian citizens.”

Obtained by BuzzFeed News

Alrabie, the executive from the fake Bahraini venture capital firm Orion Venture Capital, also targeted at least one other person aside from Dénes. In March, Alrabie approached William Newton-Smith, the former chairman of the Open Society Foundation in London, with the offer of a speaking engagement at a conference to be held in Dubai this summer. The meeting took place with Alrabie and a woman with an Australian accent who went by the name “Helen Van der Berg” at the Rosewood Hotel in London on March 13.

Newton-Smith described Alrabie and Van der Berg as “charming, engaging, and seemingly intelligent.”

He told BuzzFeed News, “They were really smooth. I would never have imagined what was going on.”

During the course of a conversation that lasted more than two hours, Alrabie remarked that he had recently been in Budapest and was very surprised to see all the posters featuring Soros, according to Newton-Smith. “They were very sympathetic to the plight of George being persecuted in Hungary,” he said.

It is not known whether this meeting was recorded. Its contents haven’t surfaced.

Obtained by BuzzFeed News

In all the cases where an approach was successful, the website of the company set up for the operation was subsequently taken offline. Three of the companies involved rented short-term office space, while others didn’t exist at all. The online presences of all the companies and their employees were created using the same basic template of services and platforms.

Each company built a website using the Wix web platform, created LinkedIn pages and profiles for the company and employees, and also often had an entry in the Crunchbase database. However, profiles for the supposed employees could not be located on other social media platforms, and several companies they listed as previous employers told BuzzFeed News that the people in question had never worked there.

In many cases, the domain registration information for the company website is private. However, the same unique anonymized email address used to register smartinnotech.com is connected to just 11 other domain names. Eight of those websites are about, or mention, Russian billionaire Suleyman Kerimov. Several of the websites are dedicated solely to listing his accomplishments and have domain names such as suleykerimov.info, suleykerimov.net, suleykerimov.online, suleykerimov.site, and suleykerimov.website.

Another site, goldminingrussia.com, promotes the company of Kerimov’s son. Dagestanfan.com promotes the region he is from, while also citing his good works. Like the fake smartinnotech.com site, all of the other active sites registered with the same email address were built using the Wix platform. The fact that they are also registered using the same private email address shows they were registered by the same person or entity.

Suleyman Kerimov

Stanislav Krasilnikov / TASS via Getty Images