Foreign Intelligence Service

Overview

The Foreign Intelligence Service of the Russian Federation (Sluzhba Vneshney Razvedki, SVR) is the principal Russian foreign intelligence service. It is the direct organisational successor to the First Chief Directorate of the Soviet Committee for State Security (KGB), inheriting the Directorate's headquarters complex at Yasenevo on the southern edge of Moscow, the bulk of its personnel, and its archival material relating to foreign operations.¹

The Service operates worldwide and produces foreign-intelligence assessments for the President of the Russian Federation, the Security Council, and the Russian Government on political, economic, military, scientific, and technological subjects. It conducts human-intelligence collection through both legal residencies (officers under diplomatic and other official cover) and illegal residencies (officers operating without diplomatic protection), and conducts cyber operations through Directorate "S" and other elements.²

The Service is led by a Director appointed by presidential decree and is one of three principal Russian intelligence services, alongside the FSB (domestic security) and the GRU/GU (military intelligence).

History & Origins

The SVR was established by Presidential Decree No. 293 of 18 December 1991, signed by President Boris Yeltsin in the immediate aftermath of the dissolution of the KGB. It was the only successor body to take over essentially the whole of its KGB predecessor directorate's institutional structure, with continuity of personnel, headquarters, archives, foreign liaison relationships, and operational doctrine. Yevgeny Primakov, a senior figure of the late-Soviet establishment, was appointed founding Director and served until January 1996, when he became Foreign Minister and subsequently Prime Minister.³

The KGB First Chief Directorate had been responsible for foreign intelligence collection from 1954 until the dissolution of the KGB in 1991. Its lineage extended further back through the Foreign Department of the OGPU, the OGPU's foreign successor in the NKVD, and the Cheka of the founding revolutionary period. The 1990s SVR inherited the institutional culture, networks of foreign agents, and operational doctrine of these predecessor bodies, including a substantial commitment to "illegals" — officers operating long-term in foreign countries under deep, non-diplomatic cover.⁴

The Service's first decade, under Primakov and his successor Vyacheslav Trubnikov, was a period of substantial institutional retrenchment as the post-Soviet Russian state contracted. The 2000s and 2010s saw a sustained expansion of resources and operational tempo. The June 2010 arrests in the United States of ten illegals — the so-called Anna Chapman group — produced the most public single exposure of an SVR operation in the post-Cold War period, leading to a bilateral exchange in Vienna of the ten for four Russian-held individuals including Sergei Skripal.⁵

The 2020 SolarWinds compromise, attributed by the United States Cybersecurity and Infrastructure Security Agency, the FBI, and the NSA to "an Advanced Persistent Threat actor of Russian origin" — with US officials specifically identifying the SVR's APT29 / Cozy Bear unit — produced the most consequential cyber operation publicly attributed to the Service to date.⁶

Mandate & Jurisdiction

The Service's authorities are specified in the Federal Law "On Foreign Intelligence" (Federal Law No. 5-FZ of 10 January 1996), as amended. Its statutory functions are:

• foreign intelligence in the political, economic, military-strategic, scientific-technical, and ecological spheres;
• counter-intelligence operations against foreign intelligence services, where conducted abroad;
• the protection of Russian Federation diplomatic missions and their personnel against the threats of foreign special services;
• support to Russian Government decision-making on foreign and defence policy.⁷

The SVR operates exclusively outside the Russian Federation. The 1996 law specifically distinguishes the Service's foreign-intelligence remit from the FSB's domestic-intelligence and counter-intelligence remit and from the GRU/GU's military-intelligence remit.

Notable Operations

Confirmed Illegals Programme — June 2010 arrests. Following a multi-year FBI counter-intelligence operation codenamed Operation Ghost Stories, ten SVR illegals were arrested in the United States on 27 June 2010 and pleaded guilty to acting as unregistered agents of the Russian Federation. The ten — including Anna Chapman, Mikhail Vasenkov ("Juan Lazaro"), Vicky Peláez, Lidiya and Vladimir Guryev ("Richard and Cynthia Murphy"), and Andrey Bezrukov ("Donald Heathfield") — were exchanged on 9 July 2010 in Vienna for Sergei Skripal, Igor Sutyagin, Alexander Zaporozhsky, and Gennady Vasilenko. The operation confirmed the continuing SVR commitment to long-term, non-diplomatic-cover human-intelligence operations against the United States.⁵

Alleged Cyber operation against the Democratic National Committee (2015–2016). The 2015 intrusion into Democratic National Committee networks, attributed by US government statements and successor reporting to APT29 / Cozy Bear / The Dukes — a cyber-intrusion set linked by US, UK, and other Western governments to the SVR. The intrusion was the first of two distinct operations against the DNC; the second was attributed to the GRU's APT28 / Fancy Bear. The Office of the Director of National Intelligence's January 2017 Background to "Assessing Russian Activities and Intentions in Recent US Elections" report addressed both intrusions.⁸

Alleged SolarWinds compromise (2020). The supply-chain compromise of the SolarWinds Orion network-monitoring platform, identified in December 2020. The intrusion produced unauthorised access to networks of nine US federal agencies and approximately 100 private-sector organisations. The 14 April 2021 White House attribution and concurrent Treasury-issued sanctions specifically attributed the operation to the SVR. The Russian Federation has denied responsibility.⁶

Alleged HPE / Microsoft 2023–2024 intrusions. The intrusions disclosed in early 2024 by Hewlett Packard Enterprise and by Microsoft against their corporate email systems were attributed by both companies — and by the US government — to the SVR-linked APT29 / Midnight Blizzard. Microsoft published successive reports in January and March 2024 describing the operation in detail.⁹

Controversies & Abuses

Alleged Sustained cyber operations against Western governments and infrastructure. The pattern of cyber-intrusion operations attributed by Western governments — APT29 / Cozy Bear / The Dukes / Midnight Blizzard / Nobelium — has been the subject of successive joint advisories by the United States, the United Kingdom, and other Five Eyes governments. The April 2021 joint NSA / CISA / FBI advisory and the April 2024 joint advisory provide the most detailed public-record assessments. The Russian Federation has consistently denied attribution; the operations have not been the subject of Russian court findings.¹⁰

Alleged Influence operations and active measures. The pattern of "active measures" — covert influence and disinformation operations — described in successive United States Intelligence Community assessments (most prominently the January 2017 ODNI assessment and successor reports) is attributed to a combination of SVR, GRU, and other Russian state actors. The line between SVR and GRU influence-operation responsibility in specific cases is contested in the public record.⁸

Confirmed Mitrokhin Archive disclosures. The 1992 defection to the United Kingdom of Vasili Mitrokhin, a senior KGB First Chief Directorate archivist, brought with it more than 25,000 pages of notes copied from KGB archives over a thirty-year period. The Mitrokhin material — published in successive volumes in 1999 and 2005 by Christopher Andrew — produced the most extensive public-record disclosure of First Chief Directorate (and therefore institutional SVR-predecessor) operational history. The Service has not commented on the substance of specific disclosures.¹¹

Notable Figures

• Yevgeny Primakov — Founding Director, December 1991 – January 1996. Subsequently Foreign Minister and Prime Minister.
• Vyacheslav Trubnikov — Director, 1996–2000.
• Sergey Lebedev — Director, 2000–2007.
• Mikhail Fradkov — Director, 2007–2016. Former Prime Minister.
• Sergey Naryshkin — Director, 2016–present. Former Speaker of the State Duma.

Oversight & Accountability

Oversight of the SVR is exercised principally by the President of the Russian Federation and the Security Council; the Federal Assembly's authority over the Service is more limited than over civilian ministries. As with the FSB, the Service is not subject to external civilian audit on the model of comparable Western services.

The Russian Federation's withdrawal from the Council of Europe in 2022 ended the jurisdiction of the European Court of Human Rights over Russian state activity; ECtHR jurisprudence on SVR-relevant matters had been more limited than for the FSB, given the Service's exclusive foreign focus.¹²

Sources & Further Reading

1. Federal Law No. 5-FZ of 10 January 1996, "On Foreign Intelligence," as amended; SVR, "Об СВР России," svr.gov.ru.
2. Andrei Soldatov and Irina Borogan, The New Nobility (PublicAffairs, 2010); Mark Galeotti, Russian Political War: Moving Beyond the Hybrid (Routledge, 2019).
3. Presidential Decree No. 293 of 18 December 1991; Yevgeny Primakov, Years in Big Politics (Sovershenno Sekretno, 1999).
4. Christopher Andrew and Vasili Mitrokhin, The Sword and the Shield: The Mitrokhin Archive and the Secret History of the KGB (Basic Books, 1999); Andrew and Mitrokhin, The World Was Going Our Way: The KGB and the Battle for the Third World (Basic Books, 2005).
5. United States v. Anna Chapman et al. (S.D.N.Y., June 2010); Department of Justice press release, 8 July 2010, on the Vienna exchange; FBI Operation Ghost Stories case file declassified summary, 2011.
6. White House statement on attribution of the SolarWinds compromise to the SVR, 15 April 2021; CISA Alert AA21-008A, "Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments," 8 January 2021; Department of the Treasury Specially Designated Nationals updates, April 2021.
7. Federal Law No. 5-FZ of 10 January 1996, articles 5–7.
8. Office of the Director of National Intelligence, Assessing Russian Activities and Intentions in Recent US Elections, ICA 2017-01D, 6 January 2017.
9. Microsoft Threat Intelligence, "Midnight Blizzard: Guidance for Responders on Nation-State Attack," 25 January 2024 and 8 March 2024 updates; HPE Form 8-K filing on cyber intrusion, 24 January 2024.
10. UK National Cyber Security Centre and US National Security Agency joint advisory, "Advisory: APT29 targets COVID-19 vaccine development," 16 July 2020; CISA / FBI / NSA joint advisory on Russian Foreign Intelligence Service cyber operations, 26 April 2021.
11. Andrew and Mitrokhin, op. cit.; UK National Archives, KGB Mitrokhin Archive papers, partial release.
12. Council of Europe, statement on cessation of Russian Federation membership, 16 March 2022.