Was doping whistleblower Yuliya Stepanova hacked by Russian spies?

In Russia, there is little doubt that Yuliya Stepanova is considered an enemy of the state. The Olympic-level middle-distance runner almost single-handedly exposed the widespread "state-sponsored" doping of Russian athletes, has been pilloried by her country's media and even branded 'Judas' by the country's president, Vladimir Putin.

Since fleeing Russia in 2014, first to Germany, then the United States, Stepanova's location has remained a closely guarded secret. However, after a recent hacking attempt on her personal account at the World Anti-Doping Agency (Wada) – which maintains a record of her whereabouts – she was forced to urgently relocate her family last month amid fears the Russian state was seeking retaliation for its partial ban at the Rio Olympics.

"The only reason somebody would hack [the] account is to find out your exact location," she said at the time. "We decided it was safer to relocate. If something happens to us then you should know that it is not an accident."

At least one expert agrees that such fears are not without merit. According to Scott Stewart, vice president of tactical analysis at Stratfor and a former US State Department terrorism expert, the cyberattack on the Wada system – which specifically singled out Stepanova – was likely the work of Russian spies.

"In light of Russian intelligence's far-flung and often unabashed operations, the Stepanova family is right to fear for its safety, even though it is living in the United States," he wrote in an in-depth analysis published on 25 August.

"That someone's personal information was compromised by a data intrusion is hardly surprising in this age of widespread hacking. It is unusual, however, for hackers to home in on a single person in the course of an attack," he continued.

"The investigation that the runner and her husband incited, and the mass suspension of Russian athletes from the Summer Olympics that it precipitated, was a black-eye for the Russian government. And Moscow does not take kindly to embarrassment."

It was in 2013 that Stepanova was caught with drugs in her biological passport – an electronic system used to monitor athletes for illegal substances. It resulted in a two-year ban from her profession. However, a year later, the runner and her husband, a former Russian Anti-Doping Agency staffer, decided to blow the doping scandal wide open by appearing in a documentary on-the-record.

It was alleged at the time – and later confirmed in an official probe – that Russia's athletes were supplied illegal substances in exchange for 5% of their earnings. The New York Times, in May this year, ran an explosive report that featured the confessions of Dr Grigory Rodchenkov, a doping expert who admitted his part in the state-sponsored plot.

After the Wada employed Professor Richard McLaren to investigate the claims, the story exploded. In the final report, the conclusions were damning. "The State had the ability to transform a positive analytical result into a negative one by ordering that the analytical process of the Moscow Laboratory be altered," it found.

It implicated the FSB, the Russian Ministry of Sport (MofS) and the Russian Anti-Doping Agency. "The MofS directed, controlled and oversaw the manipulation of athletes' analytical results and sample swapping, with the active participation and assistance of the FSB; the Centre of Sports Preparation of National Teams of Russia (CSP); and, both Moscow and Sochi laboratories," it disclosed.

After the report was released into the public domain, Wada recommended an all-out ban for Russian Olympic and Paralympic athletes. The International Olympic Committee (IOC) eventually cleared 271 of the 389 Olympic athletes for competition, while the entire Paralympic team remained barred from taking part.

Despite teasing that Stepanova may be able to appear as a "neutral athlete", the IOC ultimately refused her participation. Other competitors, however, lined up to commend the whistleblower's actions.

"She really thought everyone in the world was doing it. That's what she was told," British athlete Jenny Meadows told The Guardian. "She thought I was doing exactly the same. She was quite shocked when she realised that's not what athletics is about. It was just the Russian system."

It was a shock to Rio officials to find out their computer systems had been targeted by widespread phishing attempts on 11 August – but not a complete surprise. "Unfortunately, like many organisations, Wada is not immune to attempted cyberattacks," it said in a statement. The email phishing was unsuccessful, however, as previously noted, it later emerged that Stepanova was likely the true target in this operation.

In an analysis of the breach, cybersecurity firm ThreatConnect found evidence of Russian involvement. Specifically, it uncovered indicators that Fancy Bear – a state-sponsored group recently implicated in the hack of US Democratic Party – was likely responsible.

It said: "We assess that the phishing and Stepanova's compromise most likely are part of targeted activity by Russian actors in response to the whistleblower and the Wada's recommendation to ban Russian athletes from the Olympic and Paralympic games in Rio de Janeiro, Brazil."

According to Stratfor's Stewart, the hack of Stepanova's account demonstrates how the Kremlin's "massive hacking apparatus" can be used to target enemies of the state – regardless of location. "Hiding from an intelligence agency such as Russia's Federal Security Service (FSB) or Foreign Intelligence Service (SVR) is tricky, even for those who abide by the strict conditions of the witness protection programme," he said.

But what would happen if the FSB actually discovered Stepanova's true location? Stewart believes the answer could be extremely dangerous, if not fatal.

Indeed,a number of Russian officials with links to Rio have already died under what some speculate are suspicious circumstances. The former chairman of the Russian anti-doping agency, Vyacheslav Sinev died suddenly on 3 February. Then, less than two weeks later, 52-year-old Nikita Kamaev, former head of the same agency, died of a "massive heart attack" two months after he resigned his post in seemingly good health.

"Anyone who is considered an obstruction or a liability to the Kremlin is potentially at risk," said Stewart. "Since returning to wetwork in the Putin era, Russian intelligence has encountered very few consequences to deter it from such nefarious activities."

As it turns out, these "nefarious activities" often include politically-tinged and reportedly Kremlin-sanctioned assassinations. The most well-known example in the West is the alleged murder of Alexander Litvinenko in 2006 by two FSB spies. Despite Litvinenko, himself a former Russian agent, being poisoned with polonium-210, and an inquiry finding his death was likely given the green light by Putin, little has changed and no prosecutions have been successful to date.

Yet Litvinenko is not the only example. In 2006, anti-corruption journalist and fierce Putin critic Anna Politkovskaya was shot and killed on her doorstep in an alleged assassination. In 2009, fraud investigator Sergei Magnitsky died in police custody after uncovering police collusion. Boris Nemtsov, another vociferous critic of the Russian government, was gunned down in a Moscow street in February this year only hours after making a public appeal against the war in Ukraine.

While none of the deaths have directly implicated the upper echelons of the government, many remain suspicious. According to Stewart, the Stepanovs now "fall into this category, having blown the whistle on Russia's doping system".

While the athlete is not likely to be targeted at a sporting event – such places are prime examples for Russian agents to use their hacking skills. "Conducting an assassination at a high-profile competition would be a challenge, but the event may provide a good opportunity to install malware on a target's phone or computer that could be used to track them for a later operation," he elaborated.

Recently, the Russian state expanded its surveillance and "anti-terrorism" legislation – issuing a sweeping new law that Human Rights Watch claimed will "take Big Brother surveillance to a whole new level". At the same time, its government-sponsored hacking teams have been implicated in attempting to infiltrate targets from US political parties to The New York Times.

And amid the chaos, Stepanova is still running – in more ways than one.