FBI & NCIS ARREST Navy Insider — Cold Case Cracked After 5,126 Days Using Iran Sanctions Data

6:14 a.m., February 19th, 2026, Chesapeake, Virginia. Four NCIS agents moved along the dock toward slip seven, weapons holstered, pace controlled. A man in a gray jacket was crouching over a diesel fuel line, his back to the water. He heard the footsteps, stood up, turned around. He did not run.

 The damage assessments filed with the Office of the Director of National Intelligence put the figure at hundreds of millions in compromised naval operations. A single LLC registered in Delaware had received, over the course of years, documented wire transfers totaling $214,000 from a handler who no longer existed. The file had been culled for 5,126 days.

 What brought agents to that dock in February 2026 was not new evidence from inside the United States. It was a ledger entry inside a compliance audit conducted by a shipping firm in Dubai, triggered by US Treasury sanctions enforcement tied to the Strait of Hormuz blockade. A single reference to a Delaware LLC that someone, somewhere, should have buried decades ago. They didn’t.

 And because of that, a 61-year-old marina manager named Raymond Kovacs was standing at the end of slip seven, hands slowly rising, while agents approached from three sides. The case had a name, Operation Ledgerfall. It had a file number. It had a case agent who had retired. It had a prosecutor who had moved to private practice.

 And it had a suspect who had spent 17 years believing he had gotten away with it. He was wrong. Raymond Kovacs had spent 22 years as a civilian logistics specialist at Naval Station Norfolk. His official title was Supply Chain Coordination Analyst, GS-9. His actual function was to manage port call scheduling, coordinate shipment manifests for inbound and outbound naval supply rotations, and maintain classified access to vessel movement calendars for the Second Fleet’s operational corridor along the Atlantic seaboard.

He was not a spy by training. He was not recruited by a foreign intelligence service in the traditional sense. What happened to Raymond Kovac began the way most human intelligence failures begin, with money and with a contact who knew exactly what questions to ask. In October 2008, Kovac attended a maritime logistics conference in Baltimore.

 The event drew several hundred attendees from port authority agencies, private shipping contractors, and defense logistics firms. On the second evening, at a dinner function at the Marriott Inner Harbor, he was introduced to a man named Anders Lindqvist, Swedish national, fluent English, impeccably dressed. Lindqvist presented himself as a senior procurement consultant for a Hamburg-based maritime advisory firm called Nordvex Consulting Group.

 The conversation was relaxed, professional. Lindqvist asked about port call scheduling efficiency, about the friction between navy supply chains and civilian contractors, about documentation formats. The kinds of questions a logistics consultant asks. Nothing classified. Nothing alarming. They exchanged cards.

 Six weeks later, Lindqvist contacted Kovac by email. He had a client, he said, a European maritime insurance group that needed general background data on operational patterns at major East Coast naval installations. “Nothing sensitive,” he emphasized. “Publicly available information formatted by someone who actually understood how the system worked.

” He offered $3,000 for an initial consultation. Kovac said yes. The first transfer arrived in January 2009. $3,000 wired to a Delaware LLC called Blue Pine Marine Advisors. The LLC was registered in the name of Kovac’s wife, using her maiden name. Kovac had set it up 6 months earlier, at Lindqvist’s suggestion, to keep things professional.

Blue Pine had a legitimate-looking website, a generic service description, and a business account at a regional bank in Virginia. For the first year, the relationship looked, on paper, exactly like what Lindquist had described, a consulting arrangement, general background information, logistics analysis. Kovacs provided formatted summaries of port scheduling patterns, nothing he classified as sensitive, nothing he believed crossed a line.

 He told himself he was providing context, not intelligence. He was wrong about that, too. What Kovacs did not know in 2009, and would not learn for 17 years, was that Anders Lindquist was not a Swedish maritime consultant. His real name was not Lindquist. His firm, Nordvex Consulting Group, had no Hamburg office. The company was a shell, maintained through a network of European holding structures, ultimately controlled by an Iranian intelligence apparatus operating under the Ministry of Intelligence’s commercial cover division. The operation

targeting Kovacs was one of at least seven concurrent human intelligence collection programs aimed at U.S. naval logistics infrastructure along the Atlantic corridor. By the end of 2009, the transfers had increased in frequency, still small, never more than $3,000 per transaction. But the nature of the information Kovacs was providing had shifted.

 Lindquist’s requests had become more specific, vessel movement windows, port call date ranges for specific ship classes, manifest rotation schedules that tied to fleet exercise calendars. Kovacs had rationalized each step, nothing classified on its face, all derivable from sources a sophisticated outsider might correlate. The problem was that Lindquist was not correlating, he was collecting.

 By early 2011, the total transferred to Blue Pine Marine Advisors exceeded $47,000. The FBI’s counterintelligence division had not yet identified Kovacs, but a different thread had snagged. A financial crimes analyst at the Treasury Department’s Financial Crimes Enforcement Network, reviewing wire transfer patterns flagged by a bank compliance report, noticed a cluster of small recurring international transfers into a Delaware LLC with no apparent client base, no public revenue, and an owner whose federal employment record

showed active security clearance. The analyst filed a referral to the FBI’s counterintelligence division at the Washington field office. The referral sat in a queue for 11 weeks. When it was finally assigned, a case agent at WFO opened a preliminary inquiry designated CI 114493. I spent time going through the case documentation that later became public through court filings, and one detail kept coming up in every section.

 The case was never as far along as the investigators believed at the time. By April 2011, CI 114493 had grown into a full counterintelligence investigation. The case agent, a 12-year FBI veteran named Special Agent Daniel Marsh, had identified the Delaware LLC, traced the wire transfers to their originating accounts in the Netherlands, and confirmed Kovac’s access level at Naval Station Norfolk.

NCIS had been brought in as a joint partner. A surveillance had been established. What the investigators did not have was Lindquist. The Hamburg address for Nordvex Consulting Group was a mail forwarding service. The German company registry showed a registration dating to 2006 with two nominee directors and a registered agent in Liechtenstein.

Every layer led to another layer. Marsh’s team identified four separate banking jurisdictions used in the transfer chain. They issued requests through the Mutual Legal Assistance Treaty process to the Netherlands, Germany, and Switzerland. The responses were partial. The financial chain went dark at a holding company in Cyprus.

And then, in January 2012, Lindquist disappeared. Not dramatically. Not with obvious signs. He simply stopped responding to Kovac. The email address stopped accepting messages. The phone number was disconnected. The final wire transfer to Blue Pine had arrived in November 2011. After that, nothing. Without the handler, the evidentiary picture collapsed.

 The wire transfers to Blue Pine totaled $214,000 over 3 years. But without Lindquist, without direct evidence that the payments were compensation for classified information rather than legitimate consulting fees, the case could not meet prosecution standards. A federal grand jury would hear that a Navy logistics employee had received consulting payments from a European company.

 Without the handler to testify or be charged, without a clear link between the specific information Kovacs had provided and specific Iranian operational benefit, the U.S. Attorney’s Office declined to indict. Special Agent Marsh drafted a case closure memorandum on March 14th, 2012. CI 114493 was marked inactive. The file went cold. Kovacs continued working at Naval Station Norfolk for another 4 years.

 He retired in 2016 with full benefits, a certificate of service, a handshake. He bought a small property near the Chesapeake waterfront and eventually took a job managing a marina. He coached a youth sailing group on weekends. He never used the Blue Pine account again. For 14 years, nothing connected him to anything.

 Here is what this case tells us about the counterintelligence system as it existed in the early 2010s. The architecture was built to catch the handler, not the asset. When the handler vanishes, the case collapses. The financial forensics existed. The access records existed. The transfer documentation existed. But the legal framework for prosecuting human source recruitment required establishing the full chain of culpable actors.

Lindquist’s disappearance was not an accident. It was the designed exit. The Strait of Hormuz blockade changed the mathematics. In November 2025, following escalating U.S. Treasury enforcement actions related to Iranian sanctions violations tied to Hormuz transit disruptions, a multinational compliance review process was activated across financial institutions and logistics firms operating in in Gulf region.

 One of the entities flagged for enhanced due diligence was a Dubai-registered shipping services company called Murrell Transit Solutions. Murrell had been operating since 2014. It processed freight documentation for cargo movements through regional ports. In late November 2025, a compliance audit team working under Treasury’s Office of Foreign Assets Control subpoena authority, reviewed Murrell’s internal ledgers covering the period from 2011 through 2014.

 On page 312 of a digitized internal ledger, an auditor found a line entry referencing a payment of $4,200 processed in October 2011. The payee reference field contained a code: BPMVA7741. The auditor flagged it as unusual. BPMVA7741 did not correspond to any known Murrell client. The format suggested an external reference code, not an internal one.

 A FinCEN analyst in Washington received the flagged entry as part of a larger data package in December 2025. Working through a legacy database cross-reference protocol, the analyst searched BPMVA7741 against archived financial compliance records. The search returned a hit from 2011. Blue Pine Marine Advisers, Delaware.

Account number ending in 7,741. The analyst generated an alert. The alert went to the FBI’s Counterintelligence Division. A supervisor pulled CI114493 from the inactive archive. Special Agent Marsh had retired in 2019. The case was reassigned to Special Agent Elena Farriss at the Washington Field Office.

 Farriss read the entire file in 2 days. What she found was an investigation that had been correctly assembled and correctly closed under the evidentiary standards of 2012. The problem was not that the original investigators had failed. The problem was that the exit Lindquist had used to collapse the case had left a paper trail inside a company that had been acquired, audited, and partially documented by a Dubai firm operating under a different set of compliance obligations 13 years later.

The question was not whether a crime had been committed. The documentary evidence in the original file was clear on that point. The question was whether Lindquist could be found. Farris requested a facial recognition cross-reference through the State Department’s consular database. The search parameters were narrow.

 European male, approximate age range 60 to 70, with documented business travel to the United States between 2008 and 2012. Flagged for any connection to shipping, logistics, or maritime consulting. 1,400 potential matches were returned. Farris’s team, working with a financial intelligence analyst and a technical specialist from the counterintelligence section, began narrowing the list.

They were looking for a Swedish connection specifically, based on a detail in the original file. Kovacs had told investigators in 2011 that Lindquist had mentioned Malmö twice in passing, referencing it as a city where he spent time. The search cross-referenced Swedish residency data accessible through EU passport application records submitted to US consulates after 2020.

 In January 2026, a match was returned. A Swedish national named Erik Strömberg had applied for an EU passport renewal at the Swedish consulate in Berlin in September 2024. The application photograph matched the facial composite built from Kovacs’s original 2011 description at a confidence level of 87.3%. Strömberg’s Swedish identity documentation showed a registration date of 2013.

 Before 2013, the identity trail went cold. Farris flagged the match to the legal attaché office in Stockholm. A coordinated outreach to Swedish Security Service, known as Säpo, was initiated under the existing bilateral law enforcement framework. Säpo confirmed Erik Strömberg was resident in Malmö. He operated a small import consulting firm.

He had no criminal record under the Strömberg identity. Think about what Farris is looking at in that moment. A 17-year-old case. A suspect in Virginia who has been living quietly for over a decade. A handler in Sweden operating under a manufactured identity. And a single ledger entry from a Dubai compliance audit as the thread tying it all together.

 The prosecution depends on connecting Lindquist to Stromberg, Stromberg to the Iranian intelligence operation, and both to the specific payments made to Kovacs. That is not a simple chain. The obstacle facing the prosecution team in January 2026 was substantial. Swedish extradition law required either a formal extradition request through diplomatic channels, which could take 18 to 36 months, or a negotiated arrangement under which Swedish authorities would arrest and hold Stromberg pending judicial review.

Either path required sufficient documented evidence to satisfy a Swedish court. Faris’s team worked with the Department of Justice’s Office of International Affairs for 6 weeks. They assembled a prosecution memorandum running 340 pages. The financial chain from the FinCEN records, the original FBI surveillance documentation from 2011, the facial recognition analysis, and three additional data points that had not existed in 2012.

 Cell tower records from a European carrier showing Stromberg’s phone in a Frankfurt transit corridor in 2013, consistent with a documented business trip Lindquist had described to Kovacs. A partial fingerprint match from a document recovered in a 2018 Swedish Customs investigation, previously unconnected, and a single email address recovered from Mirai Transit Solutions archived correspondence, showing a contact address that had also appeared in the original 2011 Nordvex communication chain. CPO reviewed the package in late

January 2026. They issued an internal arrest authorization on February 6th. The operational question was timing. If Stromberg was detained in Sweden before Kovacs was arrested in Virginia, there was a risk that any contact between the two, unlikely, but not impossible after 17 years, could result in flight.

 If Kovacs was arrested first and Stromberg learned of it through any channel, the Swedish operation became a pursuit rather than a detention. The decision was made to execute simultaneously. February 19th, 2026, 6:14 a.m. Eastern Standard Time, 12:14 p.m. Central European Time. In Chesapeake, Virginia, four NCIS agents moved along the dock toward Raymond Kovacs at Slip 7.

 In Malmö, Sweden, three Säpo officers were already inside the lobby of a commercial building at Södra Förstadsgatan 44, taking the elevator to the fourth floor. Kovacs was arrested without incident. He asked if he could call his wife. He was told he could make a call after processing. In Malmö, Erik Stromberg was seated at a desk when Säpo entered his office.

 He looked at the officers. He looked at the photograph they placed in front of him, a copy of the Nordvex business card recovered from Kovacs’s 2011 interview. He said nothing. He was detained pending a judicial review for extradition. There is a line in the charging document filed in the Eastern Virginia that reads almost like something written to be read decades later rather than prosecuted today. Count one, paragraph seven.

The defendant, while employed as a civilian logistics specialist with access to classified vessel movement and port scheduling data, knowingly and willfully communicated such information to a foreign agent acting on behalf of the Islamic Republic of Iran across a period commencing in or about January 2009 and continuing through November 2011. 17 years, one sentence.

What do you think? Did the system fail by closing the file in 2012? Or was that the only rational decision given what was known at the time? There is a real argument on both sides. Drop your take in the comments. Kovacs was charged with one count of conspiracy to communicate national defense information to a foreign government and one count of unlawful retention of national defense information.

The charges carried a maximum combined sentence of 25 years. His attorney entered an initial not guilty plea at the arraignment on February 23rd, 2026. The indictment unsealed in connection with the arrest described the operational damage in measured language, the kind federal court documents use when classified details cannot be fully disclosed publicly.

 The defendant’s disclosures were materially useful to a foreign intelligence service and contributed to operational planning adverse to U.S. naval interests in the Atlantic theater. That was as specific as the public record got. The classified annex, filed under seal, was described in a separate court order as extensive.

 The strangest part of this case is not the 17-year gap. It is the mechanism of discovery. The Strait of Hormuz blockade happened for reasons entirely unconnected to Raymond Kovac. The Treasury enforcement action that followed was directed at Gulf region sanctions violations. The Dubai compliance order of Miral Transit Solutions was a routine consequence of enhanced due diligence requirements.

 At every step, the people who found the thread were not looking for it. The FinCEN analyst who flagged BPM VA 7741 did not know what it was. The auditor in Dubai who noted the ledger entry had no idea what CI 114493 was. The ledger had been sitting inside Miral’s records for 14 years, unread. One entry. $4,200, October 2011.

 That is what broke a 17-year cold case. Here is the take that will probably generate some disagreement. The prosecution of Raymond Kovac, while legally correct, is a failure of the counterintelligence system as much as a success. The original case was closed in 2012, not because investigators were wrong, but because the legal architecture at the time gave the handler an effective escape route.

 Lin Kois was never charged because he was never caught. Kovac was never prosecuted because the case could not proceed without the handler. That gap between documented wrongdoing and prosecutable wrongdoing, was not an accident. It was engineered. The Iranian intelligence operation that ran Lindquist understood exactly where that gap was.

 And they built the exit through it. The case is now being referenced in internal discussions at both the FBI counterintelligence division and the Senate Select Committee on Intelligence as a data point supporting reforms to the evidentiary standards for prosecuting human source recruitment. The specific proposal under discussion would allow prosecution of an asset based on documented financial transfers and access records without requiring the handler to be charged simultaneously.

Legal scholars are divided on the constitutional implications. The FBI’s position, as expressed through unnamed officials in reporting by national security correspondents in March 2026, is that the current standard creates a structural vulnerability that adversarial services have learned to exploit.

 CI 114493 is exhibit one in that argument. By March 2026, Eric Stromberg was still in Swedish custody. The extradition request was moving through the Swedish courts. Legal analysts familiar with bilateral extradition timelines estimated the process would take between 12 and 24 months. Stromberg’s Swedish defense attorneys had filed an initial challenge to the extradition on the grounds that the Swedish identity and the alleged prior identity had not been conclusively linked under Swedish evidentiary standards. The facial recognition match

and the fingerprint partial were being contested. There was a real possibility that Stromberg would not be extradited. A real possibility that the man who ran the operation against Kovacs would remain in Sweden in a legal holding pattern for years. That was still unresolved as of the time this record was compiled.

 Will Stromberg actually face trial in a U.S. courtroom? Comment why yes or no. There is a genuine case on both sides and the answer may arrive before the year is out. Kovacs’s pre-trial proceedings continued through the spring of 2026. In May, his defense team filed a motion to suppress the FinCEN financial records on the grounds that the Dubai compliance audit had been conducted under foreign legal authority, not subject to U.S.

 Fourth Amendment constraints, and that the chain of evidentiary transmission from the Dubai audit to FinCEN to the FBI had not been accompanied by sufficient documentation of the legal authorization at each step. The motion was argued before a federal judge in the Eastern District on June 11th, 2026.

 The ruling had not yet been issued by the time this record was compiled. There was one additional element the public record noted without elaboration. In the financial documentation produced during the prosecution preparation phase, investigators identified a second Blue Pine wire transfer recipient that did not appear in the original 2011 file.

 A separate account, also in Delaware, registered in 2010 under a name that did not match Kovacs’s wife or any known associate. The account had received four transfers between 2010 and 2011, totaling $31,000. The account had since been closed. The registered owner’s identity could not be confirmed through available records.

 Who opened that account has not been established. Whether there was a second source inside the Naval Logistics Network at Norfolk, or whether the account represented a different layer of the Iranian operation’s financial structure, was still under investigation as of the date of this record. The file on that question is not cold. It is open.

 Raymond Kovacs stood at the end of a dock in Chesapeake on a February morning and did not run. He had had 17 years. He had had time to prepare for this possibility if he had believed it was still a possibility. Maybe he had stopped believing. Maybe the silence after 2012 had been convincing enough. Maybe a man who had spent 14 years managing a marina and coaching youth sailing simply stops carrying the weight of what he did in 2009.

Or maybe he knew, when he heard the footsteps, exactly what they meant. 5,126 days. That is the number that will appear in every filing, every press release, every retrospective analysis of this case. The number of days between the closure of CI114493 on March 14th, 2012, and the arrest at Slip 7 on February 19th, 2026.

The file was closed. The warrant, as it turned out, was only waiting for a ledger entry in a Dubai shipping firm’s compliance database to give it somewhere to go. The intelligence passed. The damage assessed. The handler, for now, still beyond reach. If you want to follow how the Stromberg extradition proceeds, and whether the second account ever gets traced, subscribe now so the follow-up lands when it’s ready.

 The network that ran Raymond Kovac’s may be dismantled. The architecture that allowed it to operate for 3 years and then disappear for 17 is still very much in place.