The Russian M.O.B. (Mail-Order Bride)

A friend of mine started frequenting those "Meet beautiful Russian women looking for husbands!" web sites. One thing led to another, he made two or three trips to Russia, and he soon found himself engaged to Olga from Kingisepp, a small city near Sankt-Peterburg. The following time-line is significant, although we see below that it is incomplete:

Later that same day, probably within the hour, I received an e-mail with the subject HELP!! and the below image beremennaya.jpg attached. The message was:

Can you look deep into the electronic bowels of this picture and tell me anything about when it was taken?

The text of the e-mail he received, which I did not see, claimed that the image had been taken the day it was sent. Click on the image to view or save the original.

beremennaya.jpg

If you haven't guessed, beremennaya, or беременная, is Russian for "pregnant".... My friend had no interest in learning that it is an unusual word — it's an adjective, but unlike most all Russian adjectives, it appears only in the feminine gender. I suppose you could form the masculine adjective for "pregnant" as беременный, although a masculine or neuter form (беременное) of this word would be very illogical. Of course, as you might also have guessed, he wasn't terribly interested in this digression into Russian grammar...

His interest was in finding some indication that the child was not his. He had a very strong suspicion that he was being blackmailed by this Russian MOBster.

Was there any way to tell when the picture was taken? Well, maybe. Using a tool like exif, exif.py, or exiftool on Linux, BSD, or any other Unix-like system, you can view the Exchangeable Image File Format data fields, metadata that can be stored within a JPEG image. Many (most?) digital cameras put EXIF data in images. But did this camera do so?

Yes! Below is the EXIF data from that image (and feel free to play along with the home version of this game, saving the image to your system and extracting the EXIF fields for yourself). I have highlighted the especially interesting lines:

beremennaya.jpg:
Intel format
 IFD 0 (Image) at offset 8:
    Make: (0x010F) ASCII=Canon @ 158
    Model: (0x0110) ASCII=Canon PowerShot S400 @ 164
    Orientation: (0x0112) Short=1 @ 42
    XResolution: (0x011A) Ratio=180 @ 185
    YResolution: (0x011B) Ratio=180 @ 193
    ResolutionUnit: (0x0128) Short=Pixels/Inch @ 78
    Software: (0x0131) ASCII=Adobe Photoshop 7.0 @ 201
    DateTime: (0x0132) ASCII=2005:11:28 16:28:31 @ 221
    YCbCrPositioning: (0x0213) Short=1 @ 114
    Tag 0x1001: (0x1001) Short=2272 @ 126
    Tag 0x1002: (0x1002) Short=1704 @ 138
    ExifOffset: (0x8769) Long=244 @ 150
 EXIF SubIFD at offset 244:
    ExposureTime: (0x829A) Ratio=1/60 @ 598
    FNumber: (0x829D) Ratio=28/10 @ 606
    ExifVersion: (0x9000) Undefined=[48, 50, 50, 48] @ 278
    DateTimeOriginal: (0x9003) ASCII=2005:10:22 17:14:23 @ 614
    DateTimeDigitized: (0x9004) ASCII=2005:10:22 17:14:23 @ 634
    ComponentsConfiguration: (0x9101) Undefined=YCbCr @ 314
    CompressedBitsPerPixel: (0x9102) Ratio=5 @ 654
    ShutterSpeedValue: (0x9201) Signed Ratio=189/32 @ 662
    ApertureValue: (0x9202) Ratio=95/32 @ 670
    ExposureBiasValue: (0x9204) Signed Ratio=0/3 @ 678
    MaxApertureValue: (0x9205) Ratio=95/32 @ 686
    MeteringMode: (0x9207) Short=5 @ 386
    Flash: (0x9209) Short=Fill Fired @ 398
    FocalLength: (0x920A) Ratio=237/32 @ 694
    UserComment: (0x9286) Undefined=[] @ 702
    FlashPixVersion: (0xA000) Undefined=[48, 49, 48, 48] @ 434
    ColorSpace: (0xA001) Short=1 @ 446
    ExifImageWidth: (0xA002) Long=700 @ 458
    ExifImageLength: (0xA003) Long=910 @ 470
    FocalPlaneXResolution: (0xA20E) Ratio=2272000/280 @ 966
    FocalPlaneYResolution: (0xA20F) Ratio=1704000/210 @ 974
    FocalPlaneResolutionUnit: (0xA210) Short=2 @ 506
    SensingMethod: (0xA217) Short=2 @ 518
    FileSource: (0xA300) Undefined=Digital Camera @ 530
    Tag 0xA401: (0xA401) Short=0 @ 542
    Tag 0xA402: (0xA402) Short=0 @ 554
    Tag 0xA403: (0xA403) Short=0 @ 566
    Tag 0xA404: (0xA404) Ratio=2272/2272 @ 982
    Tag 0xA406: (0xA406) Short=0 @ 590
 IFD 1 (Thumbnail) at offset 992:
    Compression: (0x0103) Short=JPEG Compressed @ 1002
    XResolution: (0x011A) Ratio=72 @ 1070
    YResolution: (0x011B) Ratio=72 @ 1078
    ResolutionUnit: (0x0128) Short=Pixels/Inch @ 1038
    JPEGInterchangeFormat: (0x0201) Long=1086 @ 1050
    JPEGInterchangeFormatLength: (0x0202) Long=2823 @ 1062

So, assuming that no one has been messing with the EXIF data to mislead us, we now know:

• The picture was taken with a Canon PowerShot S400.
• It was taken at 17:14:23 on 22 October 2005, according to the camera's internal clock.
• It was processed with Adobe Photoshop 7.0 at 16:28:31 on 28 November 2005, according to that computer's clock.

The October timestamp would indicate that this child was not my friend's, given what we know about human gestation and the fact that he was with her briefly both 7 and 12 months before that time. However, my suspicions and uncertainties were:

• Photoshop! Had the image been altered? Was she really pregnant, or had her head been placed on another woman's body? I was initially suspicious of the region of the image along the jawline, from below her ear through her chin — the image looked like it might have been doctored.
• An image size of 700 pixels wide by 910 tall seems kind of unusual, and small.
  • Is 910x700 a native mode for a Canon PowerShot S400? Maybe we can look this up on the web...
  • Maybe Photoshop was used just for resizing this image for mailing.
• That crucial October timestamp is based on the internal settings of a digital camera somewhere in Russia. As far as I know, there is no reason to believe that her camera has been set up correctly, and so no reason to believe that timestamp.

His reply answered all of these:

• Yes, she really was pregnant. He had learned from a friend of Olga that she was known to be pregnant back in the summer. My suspicions of Photoshop head-swapping were pointless. What I saw was an artifact of the JPEG compression. The friend later verified the timing of the pregnancy and the birth from Olga.
• Yes, the camera was correctly set up, and if he looked through his files he could tell me the precise details on its various image sizes. He used to own a Canon PowerShot S400 that had gone missing some time the previous year, and I believe that his precise words were:
  Hey, that's my camera! That little bitch stole my camera!
  And then used it to try to blackmail him...

So, our timeline can be extended:

I was curious — would he receive a sequence of pictures and e-mails, all of them carefully describing events two months in the past?

No, not really.

While in the US to visit my friend, Olga met her childhood friend Maria who had lived in the US for the past several years. Olga told Maria about her plan.

Olga quickly managed to get Maria very angry with her (imagine that), and Maria told my friend.

Olga made another attempt or two, but she seems to have eventually realized that this mark wasn't going to be fooled. So, no amusing sequence of images and extortion attempts. (amusing to us, if not to my friend)

Later update — Some the the Russian Mail-Order Bride web sites maintain their own "scam lists", and then there are entire sites dedicated to lists of would-be Russian M.O.B.s known to be scam artists. And Olga has appeared on them after complaints by other would-be victims....

She goes by a couple of names: Olga Antonova and Olga Dubovik. Olga herself is still out there, claiming to have no children:

• http://www.your-russian-bride.com/d.cgi?4860K3934364166.249.64.551114982
• http://www.russianbrides.com/asp/russian-brides-from-Kingisepp-Olga-26years-16919.htm
• http://www.russianbrides.com/asp/russian-brides-from-Kingisepp-Olga-25years-54238.htm
• http://www.your-russian-bride.com/sed.cgi?486000003880366.249.64.661116163282

Here are some sites that have listed her for violating their terms regarding asking for money:

• http://www.wwdl.net/women/info41222.htm
• http://205.134.173.4/women/info48346.htm
• http://www.russian-women-scam-list.com/scam_list.htm
• http://www.russian-women-scam-list.com/women/info48346.htm
• http://agencyscams.com/
• http://www.womenrussia.com/blacklist_summary.htm

Even later update — In an email dated Jan. 5, 2008, Olga sent my friend an email, finally confessing that she was pregnant before she arrived at his doorstep. Olga stated:

Yes, I came to you pragnaunt, but I did not know about it, I found out it in New York and I was very afraid to say about it because I was afraid to lose you."

As for the man behind the baby... she stated:

"We did not live together for a long time with my hasband (2 years and a mounth) and just 1 month ago we made up our minds to be together, will see how it is going to be."

When my friend pressed her further for details, she rambled confusingly:

"Why I came pregnant - I made love to another man because I was drank a little and wantes to have sex. Everything is very simple. It was my mistake, but I am finally happy have a baby."

And they (hopefully) lived happily ever after.

Back to:

• The hostile code page
• The information security page

© Bob Cromwell Jul 2008. Created with /bin/vi and ImageMagick, hosted on OpenBSD with Apache.    Root password available here