Johnny on the spot: A hack of ex-Marine-turned-defector John Dougan’s messages reveals the rise and fall of a Russian disinformation asset

When quoted in the original language, the authors’ spelling and punctuation have been preserved.

By midday on July 15, 2022, 49-year-old American John Mark Dougan had already been standing in a corridor at the Sakharovo migration center outside Moscow for three hours. He needed to file documents in order to receive a Russian residence permit: copies of his passport, proof of registration, the names of his family members still in the United States, certificates showing he was HIV-negative, and proof that he had 165,000 rubles (just under $2,000) in a Sberbank account. The money was not his — in fact, he did not have that kind of money. A few days earlier, however, his friend “oligarch Igor” had sent him 70,000 rubles ($840) so he could show the authorities his bank statement. “It's a pity it won't stay there. 🤣🤣,” Dougan joked in a chat with his Moscow friend Alexei Kiristayev, who was helping him collect and file the application.

A few months later, Dougan would turn 50. A year and a half after that, Western outlets would call him a “Kremlin disinformation impresario,” and his name would appear in major U.S. newspapers. “God damn, but I love that photo. Lol,” the former police officer wrote in response to an October 2024 Washington Post article about his cooperation with the GRU. Dougan sent the investigation to all his friends — and even people he barely knew. He became convinced that one of his close friends, former British Army serviceman Mike Jones, who recently became a Russian mercenary, had leaked the information to American journalists. Dougan was so angry with Jones that he even considered suing him.

In 2026, Dougan marked the tenth anniversary of his move to Russia. By then, he was so unhappy that he was ready to rebel. “Whatever these stupid bastards in the Russian government are doing right now to block the internet, if they keep this up, it will shut us off completely. I’m almost ready to call citizens to action to rise up against this extreme censorship. It pisses me off so much… I’m going to start a campaign to turn the public against the Nazis running Roskomnadzor. Their policies are getting people killed,” he fumed in chats with his Moscow friends this past March, after Russia’s communications regulator Roskomnadzor began officially blocking Telegram and stepped up restrictions on VPN services. Valery Korovin, a close associate of ultranationalist ideologue Alexander Dugin, attempted to talk Dougan down, writing that it wasn’t worth moving to Russia “just to end up in prison — you could have done that in America We’ll discuss it when we meet.”

However, Dougan’s standing in the country had clearly deteriorated. Once a fixture on propaganda television, a self-styled “keeper of compromising material on U.S. authorities” and a useful contact for the Kremlin’s security services, he gradually became a largely forgotten — and broke — figure still trying to sell his services to security officials who had grown tired of him.

In the end, Dougan, who claimed to be fighting corruption in America, moved to Russia to avoid prison, befriended the circle around fascist “philosopher” Alexander Dugin, claimed to be the hacker Guccifer 2.0, was eager to “destroy as many Ukrainians as possible,” became a miniature cryptocurrency exchange for the GRU, and “wove a tapestry of disinformation” — all while receiving virtually no money for it.

On the evening of May 19, 2022 — just under three months after the start of Russia’s full-scale invasion of Ukraine —  an officer with the GRU’s Unit 29155 wrote to Dougan: “Hi John!!! How are you?” The author of the message, Yuri Khoroshenky (also known as Khoroshevsky), worked under cover as a deputy director at the Dugin-linked Center for Geopolitical Expertise.

He sent the American two links: one to the channel of Tim Kirby, a host on the nationalist Russian outlet Tsargrad and on state broadcaster RT, and another to Global American Review, a channel with fewer than 1,000 subscribers. “I would like to ask you to post both of them in your telegram channel,” Khoroshenky explained. The stories in question concerned a conspiracy theory that Unit 29155 had been promoting since 2018 — an infamous and long-since debunked story about the purportedly nefarious activities of U.S.-backed scientific laboratories in Ukraine and Georgia. Dougan immediately complied.

In February 2022, Russian propaganda had revived the false claim that the United States was developing biological weapons in secret laboratories in Ukraine, and on March 6 of that year, Russia’s Defense Ministry claimed that “pathogens had been destroyed in biological laboratories in Poltava and Kharkiv.” According to ministry spokesperson Igor Konashenkov: “The Pentagon had serious concerns that secret biological experiments being conducted on Ukrainian territory would be exposed. The documents obtained confirm that components of biological weapons were being developed in Ukrainian biological laboratories in close proximity to Russian territory. The claim was repeated across the U.S. far-right media ecosystem, with former Trump advisor Steve Bannon, whose episode about the supposed biolabs was downloaded by at least 135 million users on Apple Podcasts alone, figuring prominently among the early adopters. The story, unsurprisingly, spread widely among the QAnon community.

Dougan, meanwhile, used his Rumble channel to advertise tours of the supposed biological laboratories, promising to show “the truth the State Department is hiding.” 

Soon thereafter, he became seen as one of the key “sources” for the laboratory claims. In 2021, Dougan had already published his own investigation, which was repeated almost word for word by the Russian Defense Ministry the following March. He then began delivering presentations at Russia’s Public Chamber (a Kremlin-established consultative body) and also joined a Defense Ministry press tour, bringing along his translator, Maria Lelyanova, whom he introduced as a “fierce liberal, anti-war protester” who had apparently changed her views on the issue after touring the Donbas.

Dougan’s moment of triumph came in June 2026, when information from his investigation was endorsed by Tulsi Gabbard, who was serving as director of national intelligence in the Trump administration.

On June 30, a few days after Gabbard “declassified” a geographically dubious map of supposed “U.S. biolabs” that placed Crimea and Kyiv next to Odesa, she resigned, citing her husband’s serious illness as the reason for the career move..

Dougan had known his “friend Yuri” — i.e. Khoroshenky — even before the start of Russia’s full-scale invasion of Ukraine. They appear to have met through the community around the Center for Geopolitical Expertise (CGE). Valery Korovin, an associate of Russian fascist ideologue Alexander Dugin, became one of John Dougan’s closest contacts in Russia. Beginning in 2021, Khoroshenky began transferring small amounts of money through Dougan, some intended for Dougan himself and some for unidentified third parties, about whom the former American cop asked no questions. In November 2021, for example, Khoroshenky complained that Western Union would not allow him to send $200 to a recipient in Costa Rica. “I can send from my American account. But not western union. I can send to a bank account or bank card,” Dougan replied. In effect, the GRU unit responsible for spreading disinformation and organizing sabotage around the world was using John Dougan as a financial cutout to obscure the source of its payments.

In March 2022, Khoroshenky coordinated the first trips to the Donbas for Dougan and other foreign journalists who had settled in Russia. It appears that this was when his GRU handlers remembered that Dougan was a former U.S. Marine and had served as a machine gunner. He was assigned to prepare a presentation on how to use the Javelin anti-tank missile system, hundreds of which had been sent from America to Ukraine in the weeks leading up to Russia’s full-scale invasion. “John, we should to create presentation about using US antitank rocket sistems,” Khoroshenky wrote to him March 26. Dougan replied: “I did. It is done. It just needs translation into Russian. I went through the latest 230 page instruction manual pulled out the most important pieces so they can learn quickly. Because we live in a video game era, they will be able to learn how to shoot this weapon within 4 hours.”

Dougan was eager to go to the front and volunteered to teach Russian troops how to use American weapons. But the trip kept being delayed, and Dougan grew impatient. On the afternoon of March 28, he sent the following message to his closest contacts:

“Guys, I’m leaving tomorrow, with or without your help. I’ll get to Donetsk even if I have to crawl across the border river. And I’m going to take part unless I die. If they won’t take me as a Javelin instructor, I’ll find an AK-74 somewhere and go to the front where I’m needed. I’m not waiting around like a frightened mouse for the conflict to end.”

When Khoroshenky tried to calm him down, explaining that Dougan needed to be a “cyber soldier,” the American responded: “I need to help fight the Ukrainians. I’ve seen what they did to our beautiful Russian boys, and I want to destroy as many as possible. It’s wrong that I’m in Moscow.”

Eventually, after several trips to the Donbas with the Russian Defense Ministry’s press service and foreign journalists, Dougan appears to have accepted the role assigned to him: carrying out requests not only for the GRU, but also for the FSB. His messages contain conversations with at least two handlers from the FSB’s Economic Security Service — Vladislav Yevsyukov of Directorate K and Yevgeny Firsov of Directorate M. Dougan helped FSB officers establish contact with a Swedish source recruited by Ben Stimson, a Briton who had likewise fled to Russia. Dougan also made requests of his handlers, asking them to intervene on behalf of a troll factory manager whom Dougan claimed had previously financed his activities.

In 2018, Dougan published an autobiography — BadVolf: The true story of an American cop’s retaliation against a corrupt system of justice and politics, forcing him to seek political asylum in Russia  — that lays out his version of the events that led him to seek political asylum in Russia. It starts with a chapter called “The Architect of Deception,” where he describes the art of disinformation: 

“An authentic-looking news site needs a dose of reality. Truth laced with lies, facts intertwined with fiction. It's essential to mix the real with the fabricated, create a canvas where your cooked-up story can blend in seamlessly. Picture this: you log onto a site with only one news article. Fishy, right? Now, building a collection of genuine news isn't a Herculean task.”

Dougan was not describing the Russian propaganda websites that would later proliferate across the West, but rather his own activities after leaving the U.S. law enforcement community around 2011 and launching the PBSOTalk forum as part of a personal crusade against his former colleagues. “I became the phantom they feared the most. I duped them all, not just the feds but the media, the public, everyone. I cloaked myself in the guise of a Russian hacker and went on a personal crusade against those who had wronged me. Disinformation, doxing, hacking, fake news - I engaged in the very activities the government loved to pin on foreign adversaries. I did it all, right here on American soil, a single American citizen challenging the might of a corrupt system,” Dougan wrote after he had already applied for asylum in Russia.

Dougan described in detail how he built websites filled through RSS feeds that plucked stories from other outlets (RT prominent among them), effectively the same activity he would formally be accused of in 2024. According to researchers at Clemson University, Dougan is behind the infrastructure supporting a network of inauthentic media sites associated with the Storm-1516 campaign, which comprises hundreds of outlets that purport to be based in small U.S. cities or European capitals but are actually populated using artificial intelligence. Researchers say Dougan and several associates operate the network and that its servers are located in a small Moscow apartment.

Suspicions that Dougan was behind the fake news sites emerged as early as 2024. Researchers at Clemson University, NewsGuard, and Insikt Group had analyzed collections of domain names, hosting infrastructure, and website trackers, concluding that the networks ultimately led back to Dougan and his personal website, BadVolf.com. But that did not stop him from denying his involvement, even as he shared links to each new Storm-1516 investigation with people close to him, adding only brief comments like “damn” or “fuck them.”

In 2026, The Insider obtained access to the Storm-1516 control panel (whichDougan called DarkPulsar).

In his book, Dougan effectively provided instructions on how to make a fake news website appear as credible as possible:

“Propagation of information became my weapon of choice, my way of fighting back against the charlatans who ran the local, state, and federal law enforcement agencies.

My collection of web domains includes DCPost.org, designed to mimic a legitimate news outlet, following the blueprint I'd outlined. With a steady stream of stories from RT news, DCPost teemed with breaking events from around the globe. The site updated automatically, maintaining a credible history that lent authenticity. Amidst this backdrop of reality, I injected tales so outrageous they had to be true. Stories that poked at the seething emotions of the populace, goading them into action. I played the puppeteer, stirring the pot of public unrest.”

The Insider was also able to trace how one of those fabrications was produced.

On the morning of Sept. 24, 2024, Dougan wrote to his assistant, Demid Vakhitov: “Hey, question... You have your exchange student paperwork? And, you want to do an interview as a Lithuanian exchange student?” Vakhitov replied that he could find photographs of the papers. “Great, I want to edit it so that it shows a school kid from Lithuania that went to Waltz school,” Dougan added.

Dougan was referring to Tim Walz, who was running alongside Kamala Harris on the Democratic ticket. In the 2000s, Walz had worked as a high school geography teacher and football coach in Mankato, Minnesota.

At the same time, Dougan was messaging far-right conspiracy theorist Zak Paine, known online as Redpill78: “Hey man, you awake? I got contacted by an exchange student who went to Tim Waltz school. [He] says in 2005, kids were praired for exercises but he was an extra, so he had Waltz. Waltz began trying to plant the idea the kid was homosexual in his mind. Kept telling him it was okay to be gay. During the school year, Waltz kept leering at him and suggesting he just open up about being gay.”

Paine replied — “Wow wtf you can put him in my email I’ll vet him. Should be easy to verify” — and Dougan then began adding pornographic details: “One day in the high school pool, kids were paired up once again. And again he was the extra. He said he never got picked to pair up by other kids because he was kind of an outcast immigrant from Europe that they just didn't accept. Anyway…Waltz had him by the arm and lower back to support him floating. He began moving his hand to his ass to support him. Which, he said wasn't really strange at first, but then Waltz's hand found his way up the leg into his baggy bathing suit and started wiggling a finger into his anus. He said he was really shocked but was kind of in denial, thinking that Waltz didnt realize what his hand was. Because Waltz was looking at him and talking about swimming.” Continuing in the same vein, Dougan concluded: “Dudes a fucking pedo, man. The thing is, lots of kids that are gay, they won't say shit about this kind of thing.” He then promised that the “student” would be willing to speak with Paine and said he would send over the “student’s” documents for verification.

“What a story you created😂😂😂😂,” Vakhitov replied after Dougan forwarded screenshots of the conversation. “Yeah hahaha. Well, shocker, some shit like this happened to me when I was 12. Some swimming coach from France kept trying to finger my ass. I'm just drawing from experience 😂😂,” Dougan responded. (It is worth noting that Dougan drew inspiration not only from memories of his youth but also from pornography websites, where, according to his browser history, he spent much of his day.)

Not long after their initial online conversation, Dougan embellished the story further for Redpill78, adding that his supposed source was in Kazakhstan. To make it appear more credible, he contacted Daniil Bednov, an acquaintance at the Russian outlet Ukraina.ru, and asked him to alter an American visa in Photoshop so that it appeared to have been issued to “Amir Osipov” for 2004-2005.

The interview was recorded and published. On Oct. 13, Dougan reported back to his FSB contact Vladislav Yevsyukov: “Great news! The Tim Walz interview, where Demid said he was a foreign exchange student, was picked up by major channels late last night and has now gotten more than a million views with thousands of retweets, reposts and comments! This may be the coup de grâce claim that kills the Harris campaign. Now everyone is talking about it.”

But how did a former police officer become a “journalist” in the first place? In 1996, Dougan joined the Marine Corps, operating the Dragon anti-tank guided missile system. His duties also included demolitions, where he learned to use different types of explosives and specialized techniques for destroying bridges and buildings. However, he did not complete his four-year enlistment, later claiming on a police job application that he had left because of a broken leg. However, Yvonne Reid-Carlock, then a Marine Corps spokesperson, told The Washington Post that Dougan’s service apparently did not meet his commanders’ expectations, leading him to leave before his contract ended.

From 2003 to 2009, Dougan worked first as a patrol officer and then as a sheriff’s deputy in Palm Beach County, Florida, which at the time was the wealthiest county in the state. Donald Trump’s Mar-a-Lago estate is located there (Dougan and his sister visited it in 2011), as was Jeffrey Epstein’s mansion. In 2009, Dougan abruptly moved north — from Florida to Maine, where he joined the police department in Windham. He lasted less than a year but still managed to rack up seven harassment complaints from colleagues.

After returning to Florida, Dougan ran into further trouble when a court ordered him to pay $275,000 to former police officer Howard Howell. In June 2006, a Palm Beach resident had complained that a neighbor was playing loud music on his property after 11 p.m. One of the guests at the party — a child’s birthday celebration, was fellow sheriff’s deputy Howard Howell. Dougan was a member of one of the two police units that responded, and he began aggressively confronting the property owner as well as Howell. “You need to turn that fucking music off now,” he shouted at Howell. When Howell tried to explain that there was no reason for such conduct, telling Dougan that he was also a police officer, Dougan grabbed pepper spray and discharged the entire canister into Howell’s face before turning and walking away. Dougan later argued in court that he believed Howell had reached for a weapon (although Dougan acknowledged he had not actually seen Howell do so).

During the trial, it was noted that all the partygoers, including Officer Howell, were Black. Ten years later, after arriving in Russia, Dougan would tell stories about police colleagues who mistreated Black residents in Palm Beach County, saying that this had inspired him to become a fighter against injustice. In his book, however, Dougan emphasized that he was “a man of modest stature, standing at five foot seven”, while Howell “was a hulking figure of over six feet and 240 pounds.”Dougan added that: “This horrifying incident was far from the typical noise complaint we were initially called for, painting a stark image of the level of dysfunction that had seeped into the Sheriff's Office.”

At the same time, he was facing the threat of another lawsuit — this one seeking $75,000 — from a former colleague in Maine who accused him of harassment. In his book, Dougan writes that the actions of Windham’s police chief cost him his house, though he does not explain in detail how he lost it.

Those problems clearly angered Dougan, and he launched a website attacking his former colleague in Windham, posting her photograph with the caption “liar,” as well as another website publishing hostile material about Palm Beach County Sheriff Ric Bradshaw and his deputy. Around the same time, he launched PBSOTalk.com, a forum where “individuals could leave anonymous tips on law enforcement corruption and misconduct in Florida.”

Dougan first traveled to Russia in February 2013, supposedly to see a woman he had met on Facebook. “She was no classic beauty, but she had an incisive intellect that sparked my intrigue - the quintessential embodiment of a woman, in my opinion. She enticed me with tales of Moscow's vibrancy and the potential for new business opportunities,” he wrote in his book.

Strangely enough, one of the first business meetings attended by the former police officer, who spoke no Russian, was with Pavel “Pal Palych” Borodin, who had served as the Kremlin’s “property manager” under Boris Yeltsin, a role that saw him give a job to none other than Vladimir Putin after the former KGB colonel's old boss, St. Petersburg mayor Anatoly Sobchak, lost his bid for re-election in 1996. In the early 2010s, when Dougan arrived in the Russian capital, Borodin was working as the chair of the ethics committee of the Russian Football Union, later becoming chairman of the board of the Eurasian Economic Space Entrepreneurs’ Union, known as the Business Union of Eurasia. His associate, lobbyist Andrei Chukhlib, was still saved in Dougan’s contacts under the name “Pavel Borodin” as late as 2024.

The American spent a month in Moscow and, after returning home, immediately applied for a three-year visa. “I found a strange affinity for this beautiful chaos. My Russian comrades attributed this connection to my supposed 'Russian soul', and I was inclined to agree. The paradox of disorder and freedom in Russia was intoxicating,” Dougan wrote (before reflecting on how the idea of freedom back home was “fraught with caveats”).

A woman named Anna Gushchina had attended Dougan’s first meeting with Borodin. It is unclear whether she was the woman who prompted his trip to Russia, but in any event, a year later the two founded LegalStork Inc. in Palm Beach. “At its core, Legalstork offered an innovative search tool to its customers free of charge, allowing process servers to find people based on a variety of criteria sourced from public records. These records were primarily harvested from the Voter Registration databases of several states,” Dougan wrote in his book.

Dougan claimed that while working on the project, he discovered a bug in voter databases that eventually allowed him to compile a list containing names, addresses, and other personal information belonging to several thousand police officers, prosecutors, judges, and FBI agents. In February, the data were published on PBSOTalk.com. Dougan says that, by then, he had already sold the site to his “Russian friends.” 

On March 13, 2016, a source used Tor to send Dougan files related to the Democratic National Committee. The two had already agreed that Dougan would launch an anonymous website to publish them. However, on March 14, FBI agents arrived to search Dougan’s home, after which the former police officer packed up a few belongings and headed for the Canadian border, ultimately flying to Moscow via Turkey. Along the way, he met the source, who gave him a flash drive containing a second copy of the files.

Portraying himself as a persecuted whistleblower, Dougan applied for asylum in Moscow. Within days, he said, he had registered DCLeaks.com — the same website that would later publish intercepted emails and documents belonging to U.S. politicians, military officials, and public figures. U.S. investigators attributed those hacks to Russian military intelligence officers from the GRU.

In the summer of 2016, links to DCLeaks.com were promoted by the Guccifer 2.0 account, which would also later be linked to the GRU. Guccifer 2.0 claimed responsibility for attacks on the Democratic Party and said he was Romanian and had no connection to Russia. However, The Insider reported in 2016 that metadata from Guccifer 2.0’s emails indicated he was using a VPN whose interface was available only in Russian. When he was asked to speak Romanian in an online chat, his responses were so awkward that native speakers said Romanian was clearly not his first language and that he was likely relying on an online translator.

In recent years, Dougan has repeatedly been asked in private conversations whether he knows who was behind Guccifer 2.0. He usually joked about the question or said he had no idea. At times, however, he hinted that he himself was Guccifer 2.0. “I’ve had many names over the years. Even BadVolf started as a Russian persona,” he wrote in a February 2025 exchange with an unfamiliar Reddit user.

The Insider’s editorial team, however, doubts that John Dougan had the technical ability either to hack the Democratic Party’s servers himself, let alone to convincingly impersonate a Russian hacker. In March 2024, after all, Dougan asked the large language model Claude what an API was (in simple terms, it is a way for one computer program to request something from another, such as a weather app asking a server for a forecast). APIs are among the most basic concepts in software development.

Meanwhile, U.S. investigators concluded that professional hackers working with Russian military intelligence carried out the 2016 breach of Democratic Party systems, while eight years later, Dougan was still asking an AI chatbot what an API was.

“My work schedule is unbearable. I’m doing the work of an entire technical team and earning less than a Yandex delivery man. I’m tired. Burned out. I don’t think I can keep this up much longer.”

On Feb. 24, 2026, Dougan and Khoroshenky were not marking the start of the fifth year of Russia’s full-scale invasion of Ukraine. Instead, Khoroshenky found himself providing emotional support to the “disinformation impresario.” He advised Dougan to write to Valery Korovin, who “will take steps to improve the conditions.” Other messages included, “John, hang in there, brother. Russia really needs you,” and “John, we won’t leave you in trouble 🤝.”

Several days later, while John Mark Dougan was in the hospital following a scheduled operation, Russia was intensifying its internet restrictions. “Whatever these stupid bastards in the Russian government are doing right now to block the internet, if they keep this up, it will shut us off completely. I’m almost ready to call citizens to action to rise up against this extreme censorship. It pisses me off so much. Over the past week, our ability to publish has dropped sharply. I’m going to start a campaign to turn the public against the Nazis running Roskomnadzor. Their policies are getting people killed,” Dougan wrote to Korovin directly from his hospital room. He had not yet heard that responsibility for tightening Russia’s internet restrictions had reportedly shifted to the FSB. Korovin advised Dougan against making such comments lest he “end up in prison — you could have done that in America.”

Meanwhile, Korovin was trying to arrange housing for his American friend, who after 10 years of moving between rented apartments was finally set to settle into a one-bedroom unit located about 2 miles from the Moscow Ring Road under a five-year rent-free lease (with an option to extend it).

Dougan never managed to earn enough to buy the house he wanted — one with a workshop and barbecue area. Instead, he planned to install servers in his new apartment, where he still spends much of his time handling basic technical tasks, including helping users set up VPN apps on their phones.

A German-language version of this article about John Dougan will soon be available on the website of CORRECTIV.