48
Organized Crime in Bulgaria: Markets and Trends
161
such sales, so the segment diminished down to several types of vehicles. As this
segment was now safer and more profitable, many car thieves turned to the
business of restoring stolen vehicles to their owners instead of direct involvement
in theft.
Structure of the Bulgarian Auto Theft Market
In an attempt to adapt to recent developments Bulgarian auto thieves managed
to organize in a way rather singular in Europe. Based on interviews with police
officers and people involved in car theft networks, the structure of the Bulgar-
ian auto theft market can be described as follows. The hierarchy-based market
from the period of racket insurance was altogether replaced by networks involv-
ing auto thieves on a par with a number of other supporting actors. Besides a
group of thieves, a network’s infrastructure is usually also available to brokers,
technical experts, lawyers, car sellers, police officers willing to leak intelligence,
etc. Networks are not fixed, but dynamically changing according to the project
underway. The activities/actors of different networks may overlap, and they fall
apart easily when they cease to be competitive. An auto thief, for instance, could
move from group to group without actually leaving the broader network.
The country is unofficially carved into regional markets around the larger cit-
ies, such as Sofia, Plovdiv, Varna and Bourgas. Each of them has several squads
working within one or more car theft networks. This regionalism raises the com-
petitiveness of local groups and networks as they know the market much better,
including the road infrastructure, the available hideouts and places to modify,
dismember and sell the stolen vehicles, to negotiate prices with possible buyers.
Finally, they are familiar with local enforcement and judiciary officials. Thus, an
auto theft group based in Pazardzhik will not risk stealing a car in Sofia as they
don’t know the city well and the getaway roads are few. Close familiarity with
the place is indispensable in the capital city as well, which is also divided into
smaller areas where particular car theft gangs act. In middle-sized towns, how-
ever, it is also important to operate outside the town, to avoid being caught by
the police. Thus, thieves from Varna would extend their ventures to nearby Shu-
men or Dobrich, or even to the remoter Pleven. The groups also need to be part
of networks with countrywide coverage to increase their effectiveness, assisting
and rivaling each other at the same time. Such networking makes it possible to
return a car to its owner from Pazardzhik even when it was stolen in Bourgas,
as regional networks are also linked to each other.
257
When juxtaposing regional markets, Sofia stands out among all other regions as
it is accountable for more than half of all auto thefts in Bulgaria. To compen-
sate for size and profits, most regions have to rely on networks among the
other larger cities. South and North Bulgaria, for instance, have thriving auto
theft markets, as their main cities are well interlinked (Pazardzhik–Plovdiv–Stara
Zagora and Varna–Shumen–Dobrich, respectively), whereas in regions with less
important towns and poorer roads car theft has weakened since the late 1990s
(e.g. Rousse, Vidin, Montana, Kardzhali, Smolyan, etc). The second largest car
theft market gravitates around the Plovdiv–Bourgas axis with the Trakia highway
257 Interview with respondent D.
57
162
The Vehicle Theft Market
(and the byroads near the stretches that are still under construction) as its back-
bone. Thieves from Pazardzhik, Assenovgrad, Haskovo, Stara Zagora, Sliven and
Yambol are drawn around Plovdiv, but Haskovo, Yambol and Sliven also belong
to the network centered round Bourgas, which also attracts smaller towns along
the Balkan mountain range traditionally strong in car theft. Varna is the pivot of
a less important regional network including the towns of Dobrich, Shumen and
Pleven. In addition to the described factors, since 2001 Bulgarians have emigrated
to Western Europe in large proportions, and the two larger networks’ markets
have declined considerably.
Participants in car theft networks grouped around their roles at the different stag-
es of the theft. The main role at the first stage is that of car watchers–residents
of various towns around the country whose task is to spot and pass information
about suitable targets. They have to note details, such as the car’s color, make,
year of manufacture, presence of an alarm system and the driving and parking
routines of the owner. It is also imperative to learn whether the car may be
exchanged for ransom–if it lacks coverage or if the victim can be persuaded to
pay ransom. When a target is decided upon, they follow the vehicle’s course and
keep continually in touch with the action team preparing to steal the car. Car
watchers are paid only after the operation is completed. Sometimes they perform
extra services, such as securing a garage and bribing police officers to stay away.
As a rule, they are hired by theft groups that do not operate locally.
Security guards, commonly called cover-ups, provide another important link in
the car theft chain. If the car theft team is small, this role may be performed
by a members of another thieving group or a different group altogether. Often,
it is a local police vehicle patrol that provides security while the car theft is be-
ing committed in their area. They sometimes also act as car watchers for the
thieves,
258
but their main function is to cover the theft, especially in the case of
well protected cars.
The main part is played by the thieves (called bowler hats in the vernacular
of the area around Sofia). According to police officials around 200–300 profes-
sional car thieves have operated in Bulgaria in the period 2003–2006.
259
They
act in small groups (50–60 in total) and constitute the action core of the net-
works described above. They call themselves brigades, a label inherited from
brigades, a label inherited from
brigades
the grupirovki era. A brigade can comprise 3 to 6–7 men, but the small-sized
grupirovki era. A brigade can comprise 3 to 6–7 men, but the small-sized
grupirovki
ones are predominant.
Roughly, the groups are either closed–unwilling to admit new members as they
have stuck together for years, or open
260
–one or two established auto thieves
drawing less experienced men, sometimes from other cities, to complete a partic-
ular mission. After 2001 car theft groups became increasingly mobile. They often
migrate to Europe, and sometimes to the US and Canada, especially the most
258 The police are supposed and believed to guarantee the public’s security, but paradoxically
enough they are sometimes involved in car theft using their mobility and knowledge of the local
area to help thieves.
259 Interview with respondents А and B.
260 Interview with respondent А.
48
Organized Crime in Bulgaria: Markets and Trends
163
experienced one, half of whom are reportedly abroad. Some of them migrate
both ways several times a year.
261
The class of vehicles targeted and the techniques and equipment used in theft
also serve to differentiate between the groups. There are elite auto theft teams
specializing in luxury car thefts, such as Mercedes, BMW and Audi, whereas the
bulk of other gangs steal common makes such as Volkswagen, Opel and Renault
that do not require special technical skills to steal and are easy to sell afterwards.
Some groups specialize in vans, lorries, trailer trucks or Soviet made cars. The
methods of the different types groups vary from rough to refined. The forceful
methods involve busting a vehicle open with a metal bar, slim jim and the like,
and if the alarm goes off the thieves either cut the cables or crash the device
with a hammer. Electric shock batons are also used to disable the security system
through a brief high voltage shock and break into the car. When the light emitting
diode on the dashboard is targeted with the baton, most vehicle security electron-
ics used in Bulgaria would crash under the electric shock, the alarm would die
and the car could be started.
Methods of medium complexity. Apart from the rougher approaches, medium
class cars are stolen through alarm code breaking. To make them cheaper, most
cars commonly used in Bulgaria are equipped with similar hard code security
systems which are easy to break and deactivate the alarm.
Methods of high complexity. What is common between the teams that use more
advanced theft methods is that they plan their moves meticulously. It involves a
long investigatory period in which either car watchers, or thieves from the team
provoke minor incidents to be able to define the type of security system, which
they would later decode, and finally, disable the alarm. The next step is to un-
block the engine and ignite the car in the regular way–a task that requires high
skills and expensive devices (worth about several thousand euro) possessed by
only a few auto thieves in Bulgaria, who usually target high-class cars. There is
also an external condition that has to be secured–the car must be accessible for
a sufficiently long stretch of time–usually by police officers covering and barring
access to the larger area where the car is parked.
Superior cars are supplied with convoluted defenses, specially protected alarm
systems, immobilizers with several paths to block ignition, GPS and other elec-
tronic security devices. Nevertheless, in the last couple of years the thieves that
focus on first-rate vehicles are easily overcoming even such strong security without
applying any exceptional technical competences. Sometimes, complex technologi-
cal solutions are used, but their main principle is that of economy–instead of
straining to beak trillion-combination codes, they will produce false keys, over-
run GPS signals or break into the car, drive off and rip the GPS system out.
GPS devices are often found hanging from roadside trees or stuck to bypassed
vehicles. When the vehicle has very advanced blocking systems, the theft teams
are compelled to employ costly unblocking devices in order to remove the full
electronic system. For that purpose they follow the latest developments in vehicle
261 Unfortunately, there is no information available about the reasons behind the repetitive migra-
tions of renowned auto thieves.
51
164
The Vehicle Theft Market
security and spend sizeable amounts for tools to break them. In several cases the
police has caught whole minivans full of mechanical instruments and electronic
devices, but it is more common for car thieves to carry all of their arsenal in a
briefcase, usually containing a laptop with code-breaking and engine unlocking
software, GPS blocking devices, immobilizers, factory made deterrents and wiring
defenses.
A car theft group will usually divide in two and the first two thieves will drive
off in the open car and disable the GPS,
262
while a third member in a differ-
ent vehicle stands close by to watch for police or possible witnesses from the
neighborhood and follow the stolen car for protection. Sometimes there is also
a second escorting car, especially when the stolen one is costly. The first one
drives in front to signal if any risks arise, while the second could be a powerful
jeep with a sizeable bumper that follows behind and is ready push in case the
engine, wheels or the electronic controls stalled. This method is quite simple,
as the car could be pushed for miles on end; it is also better suited when the
stolen car has to be left behind during the flight than if the car is tugged by a
preceding vehicle.
Theft of keys is another modus operandi of car thieves, especially when they
would like to deal in the easiest way with the immobilizers of newer cars. The
method involves the theft of the car keys alongside the devices necessary to turn
off the alarm and immobilizer and saves any other efforts or expenses associated
with breaking car security.
A third method is car jacking through a variety of approaches. One of them,
known as the Spanish method, was in popular use in 2004–2005. It involves tying
a tin can to the targeted car that would make noise when the car is in motion and
compel the driver to stop and check the problem, and at this precise moment the
car is hijacked. Thieves would also cause intentional light road accidents or block
the car’s parking place to coax the driver out of the car. On some occasions, the
thieves may go from theft from robbery or use violence against the car owner.
The thieves’ next task is to drive the car to a hiding place. In cities the size
of Sofia or Varna it is considered that the vehicle is relatively safe if taken 2–3
kilometers away from where it was stolen.
263
The vehicle would be stowed in
paid car parks or narrow downtown alleys with another member of the ring
staying in a car nearby to guard it. With expensive cars the usual step is to hire
a garage by using false ID cards or by paying someone to hire it. The highest
class vehicles are supplied with several hideouts and often moved from one to
the next. The car may be left in one place until sold, moved to be taken apart
for components or trafficked out of the country. If it must be moved to a safer
place, the gang faces several risks. The car is already reported missing and the
police stop most cars matching its profile. The transfer must be done as quickly
as possible, although the driver must take care not to attract attention with reck-
less moves or speeding.
262 GPS tracking can be diverted for only a short period of time.
263 ”I don’t steal cars, I just love driving. What I do is drive the cars from one estate to another”,
says the legendary auto thief Uncle Tsuk.
51
Organized Crime in Bulgaria: Markets and Trends
165
Both former and active auto thieves claim that it is essential to keep a cool head
in sticky situations or road incidents. Special value is attached to the ability to
trick the police in a car chase. With the exception of several shootouts in such
chases in the 1990s, the police have not used firearms against fleeing car thieves.
They prefer ”not to risk the lives of officers, once the guy is in the car and off”,
and as the thieves know the limits the police set, they do not consider a chase
excessively risky.
At the same time, auto theft circles have built a myth around car chases. All kinds
of chasing stories circulate among them. Stories are told of repeat escapes in a
single night, speeding through narrow alleyways and into the opposite lane; of a
gang running for a week and leaving several cars behind until they break away
in a ”super car”. Auto thieves are prone to following movie stereotypes just as
many local mafia leaders would emulate mobsters from famous films. Emulation
is not limited to reckless driving in car chases, but to the way they organize a
theft. Most auto thieves believe a car is more valuable than anything they might
have in life–more than one’s wife, family or friends. Thieves claim that they are
in a way addicted and cannot resist cars of outstanding quality. Many of them
have become well-to-do men and have withdrawn from the stealing business, but
are often drawn back if an exceptional target appears.
The auto market prospers when there are enough craftsmen–technicians to tam-
per with the stolen car’s identity as well as people to forge its documents. The
simplest modifications, such as the change of license plates or painting the ve-
hicle a different color is performed by common mechanics in the garages where
the car is usually hidden at the start.
The most sought after mechanics are called chisel men–they hew out new license
plate numbers to replace the original ones. Some of them may specialize in Soviet-
era and old cars, while others may be skilled to falsify the identification numbers
of cars with dozens of security codes placed by manufacturer or insurer (various
numbers on the frame, engine, gear box, immobilizer, etc.). In the first case the
cars are modified in small repair shops, as the more cars they handle, the greater
their profit.
264
The engines and controls of the most expensive and modern cars,
though, are equipped with advanced technological defenses which could only be
handled by very skilled men in possession of enough hi-tech devices. They must
restyle the stolen vehicle so as to make it fully unrecognizable. The best qualified
chisel men take great pains to protect themselves from prosecution. There is hardly
any case when the police have caught one of those craftsmen in the middle of a
car disguising effort. As a rule, they work in other people’s repair shops and even if
a stolen car was found there by the police while the master mechanic was present,
there wouldn’t be direct evidence pointing to him as the perpetrator. After 2001,
many of the best qualified among those mechanics emigrated to Western Europe.
The skilled mechanics go to the car, not the other way round, they change auto
repair shops and never get caught (in contrast to auto thieves). Another group of
car mechanics deals specifically with dismantling cars for components and with
reassembling such stolen car parts into new cars.
264 There are mechanics whose work is anecdotally efficient. A man dubbed the Togliatti, who
worked in the mid-1990s and specialized in the Soviet make Zhiguli, could reportedly refashion
10 to 15 cars in a single night.
24
166
The Vehicle Theft Market
The other craft associated with stolen cars is changing its identity on paper. As
documents vary in the degree they are protected, an inept forgery could fail the
car theft chain. Counterfeits should be both technically well elaborated, but also
well researched, as all the right kind of documents must be supplied. Sometimes
the genuine papers of a crashed car are taken or the documents are stolen from
a car somewhere in Europe, so that later in Bulgaria or a country other than the
one where the vehicle was stolen, they could forge another car’s identifications
signs to match the papers.
As at some point the auto theft market had shifted to theft-for-ransom, another
group, the so called retrievers became an important link between the thieves
and the victim. The reliance on small-world
265
model of connections is probably
the peculiarity that distinguished all branches of organized criminality in Bulgaria
from their counterparts in other countries. Auto-theft action groups would easily
get back to almost any of their victims through the network of retrievers. This pat-
tern was probably successful due to the fact that the number of people servicing
the chain–thieves, retrievers, mechanics, police officers, car importers, sellers at
car dealerships and other insiders–was no greater than the population of a large
village (2,000–3,000 people).
265 First described in: Milgram, S. The Small World Problem, Psychology Today, No. 2, 1967, pp. 60-67.
Figure 20. Auto theft networks
48
Organized Crime in Bulgaria: Markets and Trends
167
After the theft is accomplished the perpetrators call one of the three or four well-
known retrievers–they are the people at the hub of most networks of thieves
and intermediaries. There are a few other less famous brokers/coordinators, but
the core of the networking system comprises several well-known names. The ones
that have risen to prominence in the last four or five years on the Sofia market
are Mitko the Turk, Zagorski and Omaiski. These men are impossible to pros-
ecute, as they act mostly as telephone exchanges, and neither money, nor cars
can be found on them. Their main strength is the trust they managed to build
as retrievers in the mid-1990s when theft-for-ransom became frequent practice.
The victims could rely on the retriever’s good name that they were going to have
their car restored. Any failure to do so detracted from the retriever’s authority.
Another trick for keeping a retriever’s reputation intact in case of failure was to
keep their involvement in the theft-for-ransom chain anonymous.
266
Towards the late 1990s the car theft market was almost never violent. As theft-for-
ransom came to the fore, those that would use violence were marginalized. The
market regulated itself and any network member from the thieves to those with
supporting roles would drop out if they failed to fulfill their part of the task.
Retrieval networks provide the link between the victim’s social circle of friends
and relatives and the actors on the auto theft market. Interviews with individuals
experienced in ransom taking confirm that it is usual practice to contact a person
close to the victim, very often someone whose own car has also been stolen
once or more. Thus, trust is again involved, as the victim could only give a large
amount of money to someone close whom they trust unconditionally. This person
must know someone from the auto theft networks–a mechanic, police officer
or local crime leader–to contact, so that he can access the retrievers. After the
ransom is received and the car is restored to its owner, he/she may be paid a
small sum by the thieves for providing the link.
In contrast to the 1990s when the thieves would reach the victim and state the
required ransom directly, the process now involves a number of intermediaries
and the victim is expected to be actively seeking contact with them. The victim
has to approach the retriever and negotiate with him the ransom terms. In case
they do not agree on a price, several options remain. If the car is expensive
and transfer risks are low, it may be trafficked out of Bulgaria. Alternatively, it
may be dismembered and sold for parts. Finally, the car could be put on fire
in a way of demonstrating power. In fact, a victim resisting pressures for ransom
could become the target of a long list of retributions. Reportedly, some people
refusing to pay ransom would have their next newly acquired car(s) damaged as
a punishment for their refusal to pay ransom. In addition, cheaper cars, especially
if the police engage in a chase and the thieves decide it is not worth the risk,
could be abandoned in a remote street and left there for months before the
police find it.
When ransom negotiations are brought to an end, the money is to be delivered
to the thieves, which usually involves several other links to make tracking the
ransom harder. This modus operandi was adopted after auto theft units were set
266 Interview with Х, a prominent retriever.
54
168
The Vehicle Theft Market
up within the police, which became increasingly effective in ransom catching.
Thieves switched to using three to four ransom carriers, which made it easier
to cover their tracks. The persons who take the money from the car owners are
put at greatest risk, but when caught they usually stick to the explanation that
they were simply doing a personal favor to the victim. It is not impossible to
detect where the ransom goes after being taken from the victim, but only up to
the second person involved. Often, he or the third person in the chain goes to
a designated office and exchanges the money into foreign currency, which is a
good track covering strategy, even if someone in the chain cooperated with the
police and used marked banknotes.
267
For these reason, it is extremely difficult to detect and present evidence in theft-
for-ransom cases. Intermediaries and thieves use coded language in their phone
calls which, even when recorded by the police, will not hold in court, as car
related vocabulary is carefully avoided. If the chosen target was a yellow Volk-
swagen Passat located anywhere in the country (as opposed to the capital city)
or abroad, they would talk about yellowish rustic-style pâté, or if they mentioned
that blue Olympics were needed, they would actually be referring to a blue Audi
being in demand.
A long chain of intermediaries, however, lowers the profit from a car theft.
If ransom intermediaries get 100–200 levs and the main link receives a percent-
age of the profit, the thieves themselves could be left with quite a small sum.
Data from the 2004 and 2005 National Crime Surveys in Bulgaria and interviews
with police officers and car thieves revealed that ransoms amounted to only one
third of the car’s price. With the average price of a stolen car about 6,100–6,200
levs,
268
those that risked the actual performance of the theft may end up with a
mere 1,000 levs if they can get a ransom for it. In 2005–2006, however, a new
trend was observed–as the number of stolen and retrieved cars dropped, the
average ransom increased, thus demonstrating the auto theft market’s adaptability
to new conditions.
There are two other key actors on the auto theft scene–the mule and the or-
ganizer. The mule can be tasked with transferring cars from abroad–Spain, Italy,
the Czech Republic, Hungary, but also with many other different tasks, such as
carrying the ransom money to the thieves. The organizer is usually the man who
orders a particular car or sort of cars to be sought. Often such people manage
the whole chain–the car-watching (in Spain or elsewhere), the mechanics, the
mules based in Central Europe, the Bulgarian car dealerships, and the traffic of-
ficials to issue its new legal documents. Interviews confirmed that organizers are
at the top of the pyramid, despite the crucial role of retrievers. They are equally
well protected, but in addition they have a much greater say in guiding the
course of the operation.
Another figure invariably present close by the criminal world in Bulgaria is the mob
or ”black” lawyer
” lawyer
”
. No actor in the auto theft business (from car thieves to car deal-
ers) would fail to budget for such a lawyer, as they could defend them or minimize
267 Intermediaries have been caught equipped with ultraviolet lamps ready to check for marked
notes.
268 Crime Trends in Bulgaria 2000 – 2005, Center for the Study of Democracy, Sofia, 2006.
68
Organized Crime in Bulgaria: Markets and Trends
169
damages whenever anything goes wrong or a theft is effectively detected and
prosecuted. There are mob lawyers specializing in auto theft, ransom and coun-
terfeiting who would see a client through from police inquiry to second-instance
court (for more on mob, or black lawyers, see Chapter I).
Mob lawyers, however, are a ready target for both the police, who are dissatis-
fied that the lawyers use illegal methods to make null police evidence at court,
and the auto theft players (thieves, mechanics, retrievers, etc), who are sometimes
sentenced despite the fat amounts they pay the lawyers.
The car theft market structure cannot be fully comprehended without analyzing
the role of car insurance companies. Interviewees have pointed out that cur-
rently three insurance firms are involved in violence and ransom seeking through
car theft. Referred to as ”the mobsters floor” by regular insurance employees,
the violence using groups are not on the insurance firms’ payroll. Often, they are
former police officers or professional athletes hired under temporary contracts or
registered as sole trader companies and subcontracted for services by the main
firm. Insurance statistics shows that the three such companies hold over 50% of
motor insurance in the country. However, other insurance companies also sign
contracts with these satellite violence-using groups. It must be noted, though,
that violent methods could be successfully applied elsewhere, but in the capital
city Sofia.
A look at the relation of auto theft networks to other organized criminal submar-
kets will also help clarify the picture. Notably, stolen cars have been used in all
Figure 21. The theft-for-ransom process
�������������
�������������
�������������
����������������
����������������
���������
���������
�
�
�
�
�
�
������
�������
��������������
�
���������������
�
����������������
������������������������
������������������������
����
��������������
����������������
����
���
������������
������������������
������������������
���������
����������
���������
����������
������
������������������
�������������������
�������������������
��������������
���������
���������
��������
������
38
170
The Vehicle Theft Market
major mafia contract killings in the last fifteen years. The fact that the murdered
mob lords were involved in the drug market, contraband, VAT frauds, prostitution
rings and so on, indicates that the auto theft market is related and supportive to
most other branches of syndicate crime. With a few exceptions, though, in the
last six–seven years auto theft itself has not been associated with violence.
The only auto theft leaders killed in that period were Dragomir ”Drashko” Iliev,
in August 2006 and Nikolai ”Kolyata” Petrov, in December 2003. Some analysts
claim that car theft networks are highly influential because of their indispensable
role in strategic criminal world killings that they do not need to resort to violence
in their own primary activities.
Market Dynamics and Recent Car Theft Methods
The auto-theft market’s geography has changed due to the described multi-par-
ticipant model of intermediation during stolen car retrieval, as well as strong
pressure from law enforcement and the insurance companies. There are few safe
places left on the map for auto thieves–mainly the capital and the small satellite
towns around it. Police records reveal that despite the falling trend, car theft
in Sofia is growing relative to the total number of thefts in Bulgaria, reaching a
share of 55% in 2006.
There are several factors behind this pattern:
• Apart from Sofia, most towns are too small-sized to allow the formation of
large networks protected by anonymity. In the last four years the average
Bulgarian towns with 30,000 to 100,000 inhabitants have had no more than
two or three active car theft groups, which has made the tracking of any
stolen car deal rather easy.
• Provincial courts are prone to issuing harsher sentences for car theft of-
fenses, particularly when the local police and local branches of insurance
companies put pressure on them. This is done even with weaker evidence
than any court in Sofia would normally accept.
• The violence used by the three aforementioned insurance companies. In-
terviewed local car thieves from Varna suggested that two locals dealing in
car theft have been killed.
• Since 2001 many car thieves have fled the Bulgarian countryside in search
of larger Western European markets, particularly to Spain and Italy.
Increased emigration and the imprisonment of major local car thieves were fol-
lowed by a significant drop of 30% to 50% of auto thefts, which is visible in
most towns/districts.
Documents you may be interested
Documents you may be interested
