Crocus City Hall: incompetence or deliberate failure of Russian security? An OSINT analysis

On 22 March, without any apparent difficulty, four terrorists entered Crocus City Hall, a major music venue in Moscow, where they killed over a hundred people. Afterward, they exited the venue, got into the same car they arrived in, and safely drove away from Moscow, one of the most heavily surveilled cities in the world.

The systemic failure across every security layer, from top to bottom, understandably leaves many observers puzzled, prompting them to question whether it signifies a complete collapse of state security or something else.

How could Russia, one of the most heavily surveilled states in the world, where a single opposition protester with anti-war signs will be swept away in minutes, have committed this glaring failure? Was it permitted to happen or merely a consequence of systemic failure within corrupt intelligence and law enforcement structures?

After all, its police force is one of the largest in the world – 934,011 serving a roughly 140 million population. With nearly 639 officers per 100,000 people, it exceeds China’s fourfold on a per capita basis.

Moreover, Russia’s security structure includes the National Guard,with 400,000 personnel, and around 200,000 employees of the Federal Security Service, a portion of whom are involved in extensive digital surveillance.

The bewildering inaptitude of Russia’s security forces and even more bewildering accusations of Ukraine after the detention of likely ISIS-linked assailants has many asking whether the attack was deliberately allowed by Russia. In any case, Russia is already using the attack and its conjured “Ukrainian link” to escalate its war against Ukraine.

Here is everything we know about the attack.

Russia disregards warnings 

On 7 March, the US embassy in Russia stated that it was monitoring reports of imminent plans by extremists to target large gatherings in Moscow, including concerts, advising US citizens to steer clear of such venues. Additionally, Adrienne Watson, spokesperson for the US National Security Council, stated that the US government had shared this information with Russian authorities in line with its longstanding “duty to warn” policy.

On the same day, one of the perpetrators of the terror attack, Shamsiddin Fariduni, visited Crocus City Hall. The most plausible explanation is that this visit constituted a reconnaissance operation, intended to survey and familiarize oneself with the environment, security measures, and potential routes of movement.

Security camera films Shamsiddin Fariduni visiting Crocus City Hall on 7 March. Source: 112/Telegram

On 19 March, mere days before the attack, Putin, during an FSB board meeting, disregarded the warnings, denouncing them as “provocative” and equating them to “outright blackmail.”

The attack on Crocus City Hall in Moscow

On 22 March, at approximately 19:55, the terrorist assault group arrived near the Concert Hall in a white Renault sedan. This arrival was captured on a dashcam by a passing vehicle. Geolocation data indicates that they parked the car not far from the entrance, locking it before departing.

Google Earth/Airbus © 2024

This detail is significant, as it suggests that the car was unoccupied and there was no driver left inside. Consequently, they would need to return to the parked car at this spot at a later time.

Screenshot from the Dashcam showing the car and departing suspect

Around 20:00 witnesses started to report loud sounds resembling shots. Soon after, videos emerged on multiple Telegram channels, depicting the attackers shooting at people.

State-affiliated outlets such as Gazeta and KP reported that terrorists left the scene at 20:13.

Around 20:30, it was announced that Russian rapid reaction forces were on their way, approximately 17 minutes after the perpetrators had already left the scene.

According to the Telegram channel “Ostorozhno Novosti,” correspondents on-site reported that firefighters were unable to combat the fire as they awaited the arrival of special forces, which had not yet reached the scene. This information was posted at 20:44, nearly 30 minutes after the terrorists had departed.

As a result, the terrorist attack unfolded without encountering any significant obstacles, for a duration of almost 20 minutes. The anti-terror units not only arrived nearly an hour (!) late but also wasted time preparing for the assault and searching for the assailants inside the burning building, who had already escaped.

Such sluggishness and incompetence have raised numerous questions, including whether this delay was deliberate, potentially allowing the perpetrators to evade capture.

What happened to the Russian law enforcement?

As previously noted, Moscow stands as one of the most heavily surveilled cities globally, having one of the highest police-to-population ratios. As the political, military, and economic hub of Russia, Moscow has long been the focal point of Russian law enforcement agencies. With numerous bases and facilities dispersed throughout the city, it houses rapid reaction forces alongside regular armed police units.

Crocus City Hall was not an isolated case. Situated less than 2 kilometers from the Moscow Oblast Government and Moscow Oblast Duma (Council), the area has a notable police presence. A mere 500 meters from Crocus City Hall, across the road, lies the closest police station.

Crocus City Hall and Police Department. Yandex Maps

Further examination via Yandex street view corroborates the existence of the police station, identified as the Pavshyno police department.

The police station near the Crocus concert hall in Moscow. Yandex Street Panorama

Of particular significance to this case is the presence of a sizable National Guard base, situated a mere 10 minutes away from the venue.

This is important given that Rosgvardia, the Russian National Guard, functions as a militarized police unit tasked with maintaining public order, ensuring safety, and combating terrorism and extremism. This unit also accommodates rapid reaction forces, equipped to respond to armed incidents rapidly.

Given the absence of a reported hostage situation, these forces should have been present at the venue. However, as it was discovered earlier, rapid reaction forces, possibly from another unit, were deployed after the attackers had already left.

Google Earth. Airbus 2024

Another overlooked, yet equally significant failure that occurred that evening was the armed guard’s failure to respond.

According to Alexander Khinshtein, a member of the Russian parliament, Crocus City Hall was protected by the private security company “Crocus Profi,” which boasted a rapid response group armed with MP-71 pistols and Saiga-20 KV rifles. Additional verification has confirmed that private security company “Crocus Profi” is indeed registered at Mezhdunarodnaya 6 street – a building located in very close proximity to Crocus City Hall.

Registration information of Crocus Profi, the private security company protecting Crocus concert hall in Moscow. Source: sbis.ru

As rapid reaction forces were en route and firefighters stood by, observing the building engulfed in flames, trapping dozens, the assailants fled from Moscow in the same white Renault sedan. Only after midnight, images of the suspected sedan were released, more than 3 hours after the attackers had left the venue.

Ria Novosti/Telegram

A comparative analysis of the imagery confirms that the perpetrators utilized the same vehicle and license plate numbers to both arrive at and flee from Crocus City Hall.

The fact that Russian authorities took hours to identify the attackers’ vehicle raises many questions. Consequently, it is not surprising that the perpetrators were able to escape the area and reach Bryansk Oblast by that time.

The route from Crocus City Hall to the geolocated detention spot. Google Maps

According to images provided by the Russian media “Agenstvo,” the perpetrators of the attack at “Crocus City Hall” left Moscow via one of the main federal highways — the M-3 highway. The photo provided by them shows that the attackers were driving at high speeds. For instance, at a section with a 90 km/h limit, they were driving at 141 km/h, significantly exceeding the speed limit. This raises further questions, particularly considering that there were no attempts to stop them for hours.

Source: Agents.media

Given these circumstances, many observers struggle to determine whether this is a case of severe incompetence or a deliberate action that allowed the attackers to flee the scene, exit Moscow Oblast, and reach the border region.

Last, but certainly not the least, witnesses reported that the anti-fire systems failed to operate during the fire. Consequently, when the terrorists set the building ablaze, the fire spread rapidly, resulting in numerous casualties from suffocation and burns.

This occurrence is not unprecedented, as similar incidents occurred in the past, resulting in numerous fatalities. For example, in the 2018 fire at the mall and entertainment complex in Kemerovo, at least 60 people perished. The tragedy was caused by blocked fire exits and a malfunctioning fire alarm system during the fire.

The death toll would have been considerably lower if rampant corruption within businesses and regulatory bodies were not so prevalent in Russia.

Taken together, the whole sequence of events raises numerous questions, as every layer of security failed catastrophically:

• The senior leadership dismissed warnings from the US, despite the FSB having extensive powers and a significant budget;
• They failed to identify the terrorists through their agent network or during the gun purchase phase, despite having received warnings about the threat;
• Rapid reaction forces did not arrive for over an hour, local police forces nearby were inactive, and even traffic police and surveillance analysts failed to identify the car promptly, allowing it to escape; it was also not stopped along the route.

Detention of Crocus City Hall attack suspects and their torture

The following day, on 23 March, videos and photos of the detention of suspects began to emerge on the internet. The location was quickly geolocated to be in the Bryansk Oblast, south of the settlement of Komunna, in a forested area. Comparative image analysis suggests that the detained individuals are likely connected to the attack.

Visual analysis of detained suspects

According to the Moscow court hearing, the suspects have been identified as Tajik nationals: Dalerdzhon Mirzoyev, Saidakrami Rachabalizoda, Shamsidin Fariduni, and Mukhammadsobir Faizov.

During the detention in Bryansk Oblast, Russian security forces mutilated Saidakrami Rachabalizoda, forcing him to consume his severed ear. This gruesome incident was captured on video and circulated on various pro-war and pro-Russian patriotic channels.

Screenshot from the video. Выпускайте Кракена!/Telegram

Shortly after, another distressing image emerged on a Russian Telegram channel, depicting another detainee, Shamsidin Fariduni, lying on the floor of a gym with TA-57 field phone wires connected to his genitals. This method of torture, though notorious, is not uncommon in Russia.

One of the Crocus suspects being tortured by Russian law enforcement via electric current to his genitals. Source: Topor/Telegram

On Sunday, 24 March, the individuals accused in the terrorist attack at Crocus City Hall were presented before the Basmanny District Court in Moscow. The detainees exhibited visible signs of recent torture, suggesting that these injuries occurred after their initial detention.

For instance, in the photo depicting Shamsidin Fariduni being subjected to electrocution, there are no significant facial hematomas, indicating that these injuries were likely inflicted subsequent to the detention period.

Compilation of images from the court. Moscow Courts/Telegram

This undermines the credibility of any confessions or statements made by these detainees, given the clear evidence of torture that has been publicly displayed.

While Russia has a long history of torture and extrajudicial executions, it’s noteworthy that typically such incidents were concealed, denied, or buried by the law enforcement system.

We are witnessing a clear indication of the “Wagnerization” of the entire system—a system’s shift where barbaric behavior, akin to the actions of the Wagner Group, is not concealed but openly displayed to society. This mirrors the brazen conduct of Wagner, which openly executed its member with a hammer without facing any legal repercussions.

Such methods have been commonplace since 2022 and continue to be inflicted upon Ukrainian POWs and civilians residing in occupied territories. The Russian invasion of Ukraine not only compromised Russia’s security standing but also normalized extrajudicial executions and torture, desensitizing society to such egregious acts. Unsurprisingly, it has led to the acceptance of tactics reminiscent of those employed by ISIS against its victims.

Editor’s note: Russian methods of torturing prisoners also play a key role in its propaganda machine. Before 2022, scores of Ukrainian hostages of the Kremlin were tortured into giving false testimonies at kangaroo courts serving propaganda purposes – to demonize Ukrainians and create an illusion of a Ukrainian “extremist” and “terrorist” threat to Russia.

The cases of Stanislav Klykh and Mykola Karpiuk, tortured into “confessing” to killing Russians during the second Chechen war and Gennadiy Afanasyev, tortured into confessing about participating in a “terrorist” organization (now killed at the front defending Ukraine) are two notable examples. Therefore, forced “confessions” from the ISIS captives of a Ukrainian trace are all but expected.

Russia blames Ukraine for the attack on Crocus City Hall

Substantial evidence, sourced from multiple sources, including official statements from the ISIS and perpetrators themselves, strongly suggests attacker’s affiliation with ISIS-K, a regional offshoot of the Islamic State, which aims to establish a radical Islamist regime in the historical Khorasan region. Additionally, US authorities have linked the attack to ISIS-K.

The video captured by the attackers themselves was shared through official ISIS media channels, establishing a direct link between the perpetrators and ISIS.

This leaves minimal room for doubt regarding the identities of the perpetrators.

Initially, Russian propaganda attempted to link these attacks to Ukraine, falsely alleging involvement of “Slavic people” or the use of Ukrainian license plates by the suspects. However, subsequent investigations have debunked these claims, revealing no credible connection to Ukraine.

Despite being debunked, the informational campaign had already taken effect: on 25 March, images of Russian bombs inscribed with messages calling for revenge for Crocus City Hall began circulating on Russian social media.

Russian aerial bomb inscribed with a message seeking revenge for Crocus. Fighterbomber/Telegram

It’s clear that Russian authorities will persist in their efforts to link Ukraine to the attack. This deduction can be made based on the statements of infamous Kremlin propagandists such as Simonyan, who stated,

“So, here’s the thing. This isn’t ISIS. These are Ukrainians. And the fact that even yesterday, before the arrests, before the identities of the perpetrators were known, Western intelligence agencies started trying to convince the population that it was ISIS…”

Despite being confronted with facts, Putin’s recent speech left room for ambiguity regarding the mastermind behind the attack, affording himself flexibility in his narrative.

In the absence of evidence, it’s highly likely that Russia will force the captured prisoners into providing confessions that align with the Russian narrative. This could become an invaluable propaganda tool, especially in a situation where narratives about denazification and demilitarization are starting to fail to resonate with the target audience.

One of the largest and most popular Russian military bloggers, Alexander Kots, initiated a poll on his Telegram channel, which has over half a million subscribers. The question posed was: “The FSB has announced the connection of the terrorist group, which massacred defenseless people, with the Kiev regime. We believe that irrefutable evidence will follow. How will this affect the course of the special military operation?”

The three most popular answers were: “There is no Special Military Operation – Only War,” followed by “There are no more red lines for strikes,” and “Zero tolerance towards diasporas in the rear.”

Poll. Sashakots/Telegram

Needless to say, the terrorism claim adds a new dimension to this war – almost reminiscent of the nearly forgotten Global War on Terrorism, with blurred aims and objectives. Unlike denazification, which may seem too abstract, the fight against terrorism carries recent, emotional weight that can deeply resonate with Putin’s supporters, providing a short but powerful emotional boost.

Crocus City Hall attack: Failure of Russian security or deliberately permited?

Over twenty years ago, upon assuming power, Putin secured popularity by adopting a tough stance against Chechen separatists and making promises to eradicate terrorism. This fostered a social contract between Putin and society: citizens would receive livable conditions and safety in exchange for relinquishing certain freedoms and democratic principles.

Over time, this contract expanded, with Putin increasing his own authority and that of intelligence services and law enforcement, while simultaneously curtailing the liberties and democratic rights of ordinary citizens.

Putin’s annexation of Crimea and involvement with terrorist organizations in Eastern Ukraine received widespread approval among the majority of Russians, including some within opposition circles.

Furthermore, the mass destruction of Syrian cities, framed as an anti-terrorism campaign, found overall support within society, as it did not contravene the prevailing consensus and social agreement between elites, society, and Putin himself.

The events of 22 March highlight Putin’s failure to uphold his promise of security. Despite the formidable law enforcement apparatus, dictatorial powers, and decades-long efforts, the incompetence of the entire system was laid bare by a group of four amateurish terrorists.

They managed to perpetrate an attack in Moscow, amidst the watch of tens of thousands of officers, resulting in the largest loss of life in a single terrorist attack since the 2004 Beslan siege.

Such failure is dangerous as it revealed the true state of Russian internal security, inviting even bolder actions from terrorist groups.

This incident, similarly to the Wagner mutiny, shows the fragility of the Russian system to terrorist threats— a bad omen for Putin and his regime. Unless, of course, this attack was deliberately permitted to occur, potentially to be attributed to Ukraine and exploited to reinvigorate support for certain agendas. While these assumptions require stronger evidence for support, they cannot be entirely ignored.

Regrettably, these facts lead to uncomfortable realizations.

On a larger scale, for Ukraine, it makes little difference whether the terrorist attack was intentionally allowed to happen or arose from systemic issues like corruption, incompetence, and strained resources in Ukraine. The outcome remains the same: Russia will blame Ukraine.

Despite the international community’s rejection of Russia’s unfounded claims and the lack of factual evidence, Russia’s propaganda machine targets internal audiences, fueling further hatred towards Ukraine and Ukrainians. This leaves enthusiastic crowds eagerly calling for revenge — a price that will be paid in the blood of innocent civilians in Ukraine, a tragedy unfolding daily for over two years, and something the world has grown accustomed to.

Related: