Maria Mayer and Ludwig Gisch settled in Slovenia’s capital, Ljubljana, in 2017, with their two young children. People who met the couple tended to like them; the new arrivals from Latin America were friendly but never overbearing, inquisitive but never pushy.
Mayer opened an online art gallery, while Gisch ran an IT startup. They told friends that a nagging fear of street crime at home in Argentina had prompted their move to Europe. Peaceful, mountainous Slovenia offered a refreshing change of pace.
In interviews with about a dozen people who knew one or both of the couple, two words kept cropping up: “ordinary” and “nice”. Neighbours insisted the people living at No 35 were a run-of-the-mill family, and said the children could often be heard playing in the garden, shrieking in Spanish.
It therefore came as a shock when, early in December, Mayer and Gisch were the targets of one of the most secretive and well-coordinated police and intelligence operations in Slovenia’s recent history.
Officers swarmed the house, arresting the couple and taking their two children into social care. Police also raided an office owned by the couple. Among the finds, according to a source with knowledge of the investigation: an “enormous” amount of cash; so much, in fact, that it took hours to count.
In late January, Slovenian outlets broke news of the arrests, linking the pair to Russian intelligence. Sources in Ljubljana told the Guardian this week that “Maria and Ludwig” were in fact elite Russian spies known as “illegals”. The arrests came after Slovenia received a tipoff from a foreign intelligence service.
On Thursday, the foreign minister, Tanja Fajon, corroborated these claims, telling reporters the arrested couple were in fact Russian citizens, rather than Argentinians.
Unlike “legal” Russian intelligence officers, who are disguised as diplomats at Russian embassies across the world, the illegals operate without any visible links to Moscow. They are trained for years to impersonate foreigners and then sent abroad to gather intelligence. Many have children, who are raised in the cover identity without any idea that their parents are really Russian.
“The suspects are members of a foreign intelligence service, who used illegally obtained foreign identity documents to live and work in Slovenia under false identities and secretly gather information,” said Drago Menegalija, a police spokesperson.
Numerous other officials also declined to comment, citing the sensitivity of the matter. But, speaking without attribution, two sources with detailed knowledge of the case said Mayer and Gisch worked for Russia’s SVR foreign intelligence service. If the couple are indeed SVR illegals, it will be the first such case aired publicly since 2010, when the FBI rounded up a group of 10 in the US after tipoffs from a mole inside Russian intelligence.
One source with knowledge of behind-the-scenes manoeuvres said that in informal conversations after the arrests, Moscow had quickly accepted the couple were intelligence officers. Even as preparations are under way for a trial in Slovenia, backdoor negotiations are taking place between Moscow and western countries to exchange them for a person or people currently in jail in Russia, said the source.
Slovenia, with a weaker counterintelligence environment than many European countries yet located inside the Schengen free movement zone, was a perfect base for the couple to be able to travel through most of Europe without border checks. “The majority of their activity was not in Slovenia,” said one source.
Since the invasion of Ukraine, western countries have expelled hundreds of “legal” spies, working from embassies across Europe under diplomatic cover. This may have forced Moscow to rely on illegals more, as well as other informal networks. It is hard to say with certainty what kind of activities the Slovenia-based couple might have been carrying out for the SVR, but there may be clues in their work and travel patterns.
The large stash of cash found during the office search could indicate that the pair’s duties involved paying Russian informal agents or informants. Moscow sometimes uses illegals for this kind of task, because intelligence officers working out of embassies could be subject to routine surveillance and thus risk exposing sources.
Mayer’s social media pages show she travelled frequently to promote 5’14 gallery, her online art portal. It is not clear whether she was targeting artistic circles, or merely using the cover job as an excuse to travel and carry out other work. She visited the Zagreb art fair at least twice and also travelled to Britain on several occasions, where she put on a display of works at a gallery inside an Edinburgh shopping mall.
“She was super friendly. She put me in her web gallery, and she also exhibited my work in Edinburgh. This was huge for me, because I rarely get a chance to exhibit my work abroad,” said a photographer based in the Slovenian city of Maribor.
Other artists described meeting Mayer in Zagreb last November. “We had mostly chill talks and funny stuff to kill time,” recalled one Croatian artist who had attended and swapped contact details with her.
Ludwig Gisch used an Argentinian passport that claimed he was born in Namibia in 1984, according to a copy obtained by the Guardian. He ran DSM&IT, a company offering software to organise people’s email inboxes, blocking viruses, malware and spam.
The company’s online footprint is not particularly impressive. Its Twitter profile has only three followers, one of which is Gisch and another the account of his wife’s gallery. A friend of the couple who downloaded the trial version of the software said he doubted anyone would pay for such a service.
“I was not very impressed. It was five years behind current technology in Europe or even anything made in Russia,” said the friend.
Like his wife, Gisch used his job to travel. His social media profiles suggest he attended CloudFest 2022, a conference in Baden-Württemberg, Germany, that describes itself as the “No 1 internet infrastructure event in the world”, and says it attracts thousands of senior executives working on online security. It would have provided remarkable networking opportunities.
Elena Vavilova, a former SVR illegal, said in a 2019 interview that the ideal illegal was someone who was average looking, did not attract attention and did not crave external approval. The couple in Slovenia appear to have fitted this mould perfectly. “She was a grey mouse,” said one Slovenian artist who met Mayer and her children on several occasions. “I don’t believe she could have been a spy.”
The couple spoke Spanish at home and English with most of their social contacts, claiming the consonant constellations of Slovenian were too tricky for them to master. Possibly, they thought a Russian accent might be more noticeable in another Slavic language.
At their former home in Črnuče, a quiet suburb of Ljubljana, a Christmas wreath was still hanging on the front door, even as the magnolia tree in the garden was ready to bloom. A neighbour said she often saw the two children playing in the garden and recalled that the couple often had visitors.
“I speak Spanish well and I could tell she didn’t have an accent in Spanish. They were ordinary nice people, there is no way they were spies. I think it’s all invented by the media,” said the neighbour.
There are signs the couple could be part of a broader SVR illegal network. Shortly after the arrests in Ljubljana, a Greek woman and Brazilian man swiftly departed Athens and Rio de Janeiro respectively. Greek authorities believe the pair were also SVR illegals, according to Greek media reports, and may have fled in fear the couple arrested in Slovenia could blow their cover.
Maria Tsalla, posing as a Greek repatriate but allegedly an SVR illegal named Irina, owned a knitting supplies shop in Athens and ran a photo blog where she posted pictorial reports from various trips, describing herself as “a passionate and restless artist”.
She left Greece on 5 January, telling friends she was going on holiday and to buy yarn for her shop. At the end of the month, she texted an employee at the yarn shop that “something major” had happened in her life, and she would not return. “She said I could take over her company if I wanted to. Otherwise, she would just close it. She said she was in Kyrgyzstan,” the employee said.
Dutch and Norwegian authorities have also apprehended illegals believed to be working for GRU military intelligence in recent months while a security guard at the British embassy in Berlin was jailed for 13 years last month for passing information to the Russians. Late last year an employee of Germany’s BND intelligence agency was arrested on suspicion of providing classified information to Moscow.
The breadth of Moscow’s spying operations made it a unique threat, said Janez Stušek, who was the director of Slovenia’s Sova intelligence agency until June last year. “I believe that the Chinese are mostly interested in economic issues, but for the Russians it’s also political, about the EU and Nato,” he said.
Counterintelligence efforts to look for illegals had intensified recently, said Stušek: “Illegals were always on the agenda, but of course after the invasion the level of attention on this topic has gone up.”
On Thursday, Fajon said authorities had prolonged the initial detention period of the arrested couple, and that she was summoning Russia’s ambassador to Slovenia to discuss the case.
In custody, the pair have said little. “They have taken it stoically. It’s obvious they are pros. But they are not talking,” said one source, adding that negotiations on an exchange were taking place at a high level.
“Now we will see how important these people really are to Russia. This is big game now; it’s clear that Slovenia is just a proxy here.”
Additional reporting by Marja Novak, Pjotr Sauer and Lorenzo Tondo
