Bivol and another independent Bulgarian online media, E-vestnik, (E-newspaper) gave for technical expertise the photos of Bulgarian Prime Minister Boyko Borisov, showing him sleeping in his bedroom with a handgun on his nightstand and photos of the same bedroom showing the nightstand drawer filled with wads of EUR 500 banknotes and gold bars.

The photos, sent to several Bulgarian media, escalated the feud between Borisov and Bulgarian President Rumen Radev, after Borisov accused Radev of having spied on him with a drone, something the President firmly denied.

Borisov labeled the photos a “kompromat” and said they were doctored and were disseminated to prevent him from completing several major infrastructure projects and other achievements.

The technical expertise checked a total of nine different photos, five of which were sent to E-vestnik’s e-mail and four of which were sent to Bivol. There are other photos sent to other media but they were not analyzed for lack of access to the original files.

Who sent the photos and when?

The photos have been sent by various senders through the guerillamail anonymous mail server. This site generates one-time addresses for each message sent. User ldq05x+7i9k23ln9dhdg@guerrillamail.com wrote to E-vestnik at 10:20 am Bulgarian time and to Bivol ldq21z+1f4k2yjw5rp9o@guerrillamail.com at 10:34 am Bulgarian time.

Was there any doctoring?

There are no photomontages or distortions with Photoshop, contrary to theories promoted by politicians and analysts loyal to Borisov and by his supporters on social networks.

Of the nine photos, three are completely “virgin”, have not been at all manipulated with Photoshop and the time and the dates when they were taken have not been changed in the metadata (metadata is a set of data that gives information about other data and is a descriptive text integrated in the code of the photo, containing the time of taking the picture, the speed, the type of camera and smartphone, etc. – editor’s note). There are changes in the metadata in the other six photos, likely to mislead recipients about the time they have been taken. Nevertheless, the expertise established the actual date and time of filming. They are found in the field indicated by the hexadecimal code 0x0132 (DateTime or Modify Date). The specification of this field can be seen here.

This data apparently escaped the person who had tweaked the dates and fields 0x9003 Date/Time Original (see here) and 0x9004 Create Date (see here).

The photos were checked with a program that registers the use of the software. The photo with the sleeping Borisov contains evidence of some slight use of Adobe Photoshop. The others do not.

The verification was not limited to the technical expertise of metadata. The photos were examined in detail with magnifications of up to 1,600% to search for image interference or suspicious alterations. The details of each photo were enlarged to establish specifics about the objects and what they have to do with the setting and the occupant of the bedroom.

The technical expertise used Noise Analysis, Error Level Analysis, Luminance Gradient, Clone Detection and Level Sweep, which do not mean much to the general public but allow experts to perform in-debt analysis and confirm the results. And they show no traces of doctoring and photomontage. The archive with all analyzed photos in the form in which they were received can be downloaded here.

As mentioned above, traces of Photoshop are found only in the photo that shows the sleeping Borisov. There is a proportional reduction of the image size in pixels by approximately 50% compared to the original iPhone 6S (with which the photo was taken). There is no cropping of parts of the frame but a slight adjustment of brightness and contrast is possible. This is the exact same photo, which Borisov officially recognized as authentic.

The Prime Minister also promoted the theory that rather than photomontage, the photos were arranged by someone placing bundles of cash and gold bars in the drawer of the nightstand and photographing them.

All photos are 3264×2448 pixels in size, the original size for the iPhone 6, except for the one with the sleeping Borisov, taken with the iPhone 6S and reduced by 50% to a size of 1536×2048.

Information about the photos and their dates:

August 2017 – one photo

Photo with filename Bace_nanka.jpeg. This is the photo with the sleeping Borisov. It was taken on Sunday, August 13, 2017, at 5:15 pm. The metadata has been changed so that the visible date is August 4, 2021, likely to hide the exact day and time of the photo.
The photo shows a bedroom with the sleeping Borisov, a nightstand, a bottle of water and a bottle of expensive whiskey in a bag (the brand is recognizable in the other photos) on the floor in front of the nightstand. There is an older model mobile phone on the nightstand, headphones, a handgun (the brand is recognizable in the other photos), and two tubes of ointment. The carpet is light in color. Bivol and E-vestnik decided to not publish this photo over the invasion of privacy but it can be seen on many sites in Bulgaria and abroad.

September 2017 – two photos

Photo with filename IMG_4444.jpeg. The photo was taken on Monday, September 25, 2017, at 3:18 p.m. and 11 p.m. The file name has been changed from the original iPhone but the date and time have not been adjusted in the metadata. It shows the same nightstand with an open drawer with wads of EUR 500 banknotes inside. Judging by their thickness there are 100 banknotes in each wad. From what is visible, the number of wads can be estimated at least 20, i.e. about EUR 1 million.

The photo is similar to the one with the file name IMG_5555.jpeg, which was taken on December 12, 2017 (see below). But there are differences in the drawer, which can be seen in the closer up photo from the same date and time.

(If we accept the arrangement theory, we can assume that the invisible part of these bundles of cash might be paper cut to the size of the banknotes. Nonetheless, some of the photos show the sides of the bundles with the characteristic coloring of EUR 500 banknotes, which suggests that they are either genuine or high-quality counterfeits – editor’s note).

On the floor, there is a power strip and a bag with expensive whiskey, which can be recognized better than in the other photos as Chivas Regal Royal Salute 21 YO (21-year-old). The carpet is light, the sheets are different than those in the other photos.

The top bundle on the left is held with a red rubber band. The banknotes on the right are not held together with a rubber band, as in a later photo. The top banknote has a folded corner in a different way than in the next photo of a drawer filled with bundles of cash, taken in December.

Therefore, the banknotes on the right seem to be operational cash.

Photo with filename IMG_7777.jpeg. The photo was taken on September 25, 2017, Monday, at 3:18 pm, nine seconds after the previous photo.

The person who had taken it had been obviously in a hurry as the iPhone autofocus had not responded properly and the photo is out of focus. The file name has been changed from the original. In the metadata, the date has been altered to July 22, 2024. Although the photo is out of focus, stacks of EUR 500 banknotes can be seen clearly enough in the open drawer, according to their thickness of 100 banknotes each. From what is visible the number of wads can be estimated at least 20, i.e. about EUR 1 million.

December 2017 – one photo

Photo with filename IMG_5555.jpeg. The photo was taken on December 12, 2017, Friday, at 2:19 p.m. The date and time have not been changed. The file name has been probably changed from the original.

The photo is similar to the one with the file name IMG_7777.jpeg, which had been taken three months earlier, on September 25, 2017. The difference is the differently folded banknote corner and a missing red rubber band. The number of banknotes can be still estimated as 100 per bundle and the amount in the visible part of the drawer – as EUR 800,000. The top left bundle is held with a thin yellow rubber band.

On the top of the nightstand, there is a Glock 17C handgun, which is better recognized than in the other photos. This is Borisov’s preferred gun that he carries everywhere, according to his own admissions. Next to the gun, there are three tubes of ointments for allergies, insect bites, burns, joint and muscle pain and fungus, two of which are half empty. The carpet is light in color; the sheets are different from those in other photos. One the floor, there is a bottle of water, a power strip and one can see the cap of a bottle of expensive whiskey, which can be recognized in other photos as a 21-year-aged Chivas Regal.

January 2019 – four photos

Photo with filename IMG_1111.jpeg. The photo was taken on January 4, 2019, Friday, at 4:24 p.m. The metadata has been changed to show a date of April 7, 2021, in order to conceal the exact day and time.

The photo shows a more general plan of the room – the bed, the nightstand, a wardrobe, an electric heater, central heating with a wooden grate, on which there is an icon and candles. The carpet is darker in color than in the previous photos from a year earlier. All of these are important details as they can be seen in earlier media reports from Borisov’s home.

Borisov posed in this same interior for an interview with Love magazine in 2012, which also featured photos. The carpet was then a lighter color, as in the photos from 2017, and the walls were painted with a cream color. The photo session also showed a guitar and dumbbells. In the photo from 2019, the carpet is already dark and the walls are pale purple. A bottle of water and the same bottle of Chivas Regal Royal Salute 21 YO whiskey, as the one in the 2017 photos, are seen on the floor, in front of the nightstand.

Photo with filename IMG_0000.jpeg. It was made 18 seconds after the previous one, at 4:24 p.m. The metadata has been changed and shows a date of November 26, 2021, the file name has also been changed from the original from the iPhone.

The drawer of the nightstand is open and the content is photographed from close-up. It shows two bundles of EUR 500, held with a yellow and brown rubber band. There are gold bars above them, two of which are recognized as the Belgian Umicore brand 250. This bar has the inscription FEINGOLD 999.9. Below the inscription, there is a serial number similar to a banknote one but it is not fully readable.

The edge of another larger gold object or a non-standard gold bar is also visible. There is also something wrapped in a white sheet of paper and there is a black plastic bag. The serial number on the EUR 500 banknote is clearly visible and is a real one, according to a serial number algorithm check. The letter X at the beginning indicates that the banknote has been printed in Germany.

Photo with filename IMG_7890.jpeg. Made 12 seconds after the previous one at 4:25 p.m. Here, too, the metadata has been tweaked to show a date of March 9, 2014.

It shows the whole nightstand with the open drawer and part of the bed. On the nightstand, there is the handgun, tubes of ointments, two remote controls, one for a Samsung TV set.

Photo with filename IMG_2345.jpeg. It was made at 4:25 p.m., on the same date, January 4, 2019, Friday. Nothing is touched in the photo and the original date and time are preserved.

It is identical to the photo IMG_0000.jpeg and shows the inside of the drawer but from a slightly higher angle. The edge of a gold bar or object that is visible in the previous photo is not visible here. There is a white box with a red edge at the very bottom of the drawer and a black-foil packet with illegible inscriptions on the right, under the white envelope.

February 2019 – one photo

Photo with filename IMG_3456.jpeg. The original date is February 6, 2019, Wednesday, the time – 12:11 p.m. The metadata was edited to look like it was made several years earlier, on May 3, 2013.

The bed is made and the sheets are different. The gun is in the same place, the tubes of ointment are different. There is again a bottle of water and a bottle of Chivas Regal 21 YO on the floor.

From everything analyzed so far, the following conclusions about the content of the photos can be made:

They are not doctored and had been taken in the Prime Minister’s bedroom. It is possible that they had been arranged, as Borisov, himself, suggested. Nevertheless, this is quite a complicated explanation as it means that someone had brought to the Prime Minister’s bedroom in a guarded State residence wads of cash in the amount of about EUR 1 million, gold bars and possibly a handgun, if Borisov had taken his own with him as he does not part with it, according to his own claims. This must have happened not once but on three occasions in 2017 and 2019 and must have gone through the security guards.

Such an arrangement can only be made with the participation of the officers from the national security service, all of whom are people personally chosen by Borisov.

The other possible explanation is that Borisov has been indeed piling up wads of cash and gold bars and they have been photographed by the guards or by a trusted individual, whom he has allowed into his bedroom even when sleeping. This may be a woman he has been in a relationship with for a long time. Or a “young boy”, according to Borisov’s own attempt at a joke while dismissing the photos as a “kompromat”.

Atanas Tchobanov of Bivol, Ivan Bakalov of E-vestnik

***

If you find this article useful, support our work with a small donation.

Pay a Bivol Tax!

We will highly appreciate if you decide to support us with monthly donations keeping the option Monthly

This post is also available in: Bulgarian