Montenegrin crime boss Alan Kožar had taken great pains to stay alive, as a war with a rival clan left a trail of blood across Europe. But in the end, a simple sunburn helped get him killed.
Kožar was hiding out on the Greek island of Corfu in the summer of 2020, using an encrypted text messaging app to keep in touch with his crew.
“I slept badly — I got sunburned yesterday and kept waking up," Kožar wrote.
"Brother, they say yogurt is good,” one of his associates replied. “So cover yourself in it, if it doesn’t bother you.”
“I have yogurt, I’ll spread it on myself now,” Kožar answered.
But Kožar had been betrayed. Right after suggesting the home remedy for a sunburn, the man he was messaging used another phone to take a photo of the exchange and send it to Kožar’s arch-enemies.
The 43-year-old Montenegrin was being hunted by killers from a rival clan, the Kavač. Another boss from his own group, the Škaljari, had just been murdered. As one of the Škaljari’s top leaders, Kožar knew he could be next. So he never revealed his location, even when communicating with a fellow clan member he thought he could trust.
Now, the messages he sent to his associate not only helped to confirm the Kavač clan’s suspicions that Kožar was most likely in Greece, but also revealed one of his weaknesses: He liked to come out of hiding to sun himself on the beach.
Kožar’s complaints about a sunburn allowed Kavač operatives to track him over the next few weeks, using open source investigative techniques (also known as OSINT) more often employed by journalists and police, including poring over satellite images, apartment listing sites, and tourist photographs.
This story of that hunt, recently told by OCCRP’s Serbian member center, KRIK, is based on a secret police report that analyzed thousands of chat messages exchanged by Kožar’s enemies.
Almost exactly a month after his sunburn, Kožar and an associate were gunned down in a hail of bullets in front of their Corfu villa. The killers had found their way right to his doorstep.
Bad Blood
The ambitious OSINT murder operation, costing at least 1.4 million euros and involving nearly a dozen people on the ground, was a turning point in the years-long battle between the Škaljari and Kavač clans.
Both groups hail from Kotor, a town on Montenegro’s picturesque Adriatic coast. In fact, they were once part of a single gang that smuggled South American drugs into Europe. But the group split in 2014, sparking a rift that has pulled in other Serbian and Montenegrin criminal organizations and led to more than 70 murders.
OCCRP
The location of the villages of Škaljari and Kavač villages in Kotor, where the eponymous criminal clans hail from.
Some insight into this secret world of violence has been made possible in recent years thanks to evidence obtained from Sky ECC, the encrypted messaging app favored by members on both sides.
The app was cracked by European investigators, leading to a series of raids on organized criminal groups in Belgium, France, and the Netherlands in early 2021. The EU’s police agency, Europol, also forwarded the newly obtained evidence to the Balkan countries, leading to dozens of arrests. Evidence obtained from Sky ECC has been used in criminal cases against members of both the Škaljari and Kavač clans.
But as Kožar basked in the Corfu sun in 2020, that was all in the future.
He was an influential man, highly respected among his colleagues, with a reputation for effective mentorship of younger gang members. He had amassed a long rap sheet over the years, including several juvenile convictions and, more recently, a prison sentence of nearly seven years for planting explosives at a construction site to intimidate its owner.
Now he was on the run from the law again — this time for planning the murder of an elderly Montenegrin mobster — but the real danger was from the rival Kavač clan.
Although his enemies didn’t know his exact whereabouts, Kožar’s reliance on Sky ECC proved a crucial vulnerability. Thanks to a Kavač member with an official license to distribute the secret communications system, the clan could see in which country a certain number was active. Kožar’s phone, they saw, was in Greece.
Of course, it was always possible that he had given it to someone else. How could they track him down?
‘For Honor and Justice’
A key step was gaining the cooperation of one of Kožar’s trusted associates: a man named Ratko Živković, nicknamed “Zemo.” According to the police report obtained by KRIK, Zemo stood to earn 100,000 euros in exchange for helping track down his unsuspecting boss.
The message he forwarded about the sunburn was an early confirmation that Kožar was indeed in Greece. But the Mediterranean country has many beaches, and Kožar’s enemies needed more information.
To coordinate their hunt, they created their own chat groups on Sky ECC — one called “For honor and justice” and the other called “Action” — where they exchanged over 12,000 messages between June and December 2020. Among other topics, they discussed how to get more photos from Kožar.
A group member in touch with the intermediary, Zemo, asked for advice: “It would be good to find some topic so I can write to him constantly,” he wrote.
“Send a picture of a weapon if it’s expensive,” came a suggestion. “A stolen car that’s being offered, a motorcycle … These are topics that interest him.”
“You have to hunt him with a picture from the gym,” another person advised.
The next important clue came when Zemo forwarded a photo Kožar had taken at a beachside restaurant.
Judging from the shape of a small islet that appeared in the background, two members of the group identified the location by searching the internet for photos showing similar views.
The restaurant was in Perama, a village on Corfu’s eastern shore.
“He’s on fucking Corfu,” one of the group members wrote. “Nik and I found the fucking bar at the same time.”
Another person noted that Kožar had chosen a good location to hide.
"It’s the best hiding place, it’s warm, and with a lot of trees. I was there only once, [came] from Montenegro on a yacht."
They immediately conveyed their findings to several gang members who were already in Greece.
“We need boats, a ship,” replied a member of the scouting team. “We’ll finish everything now, since we know where it is. Now we’ll examine all of Corfu on Google.”
Apostolis Giontzis/Alamy Stock Photo and Police report
When they located the beachside restaurant Kožar had visited, his enemies circulated photos showing the same seaside view, including a distinctive islet.
Fortunately for them, Zemo kept delivering. Next came a photo of a motorcycle Kožar had rented; tracking down the name of the rental agency helped narrow down where on the island he might be staying.
Then they got the big prize: A photo of the swimming pool at Kožar’s villa.
Searching through real estate rental sites, his enemies looked for Greek villas with pools and found what they thought might be the same one.
"Compare it with his photo, it’s just that this [photo] is from an old ad,” one wrote. “You see a tree and a slide … Right next to the deck chair, just like in his photo."
To be completely sure, they compared Kožar’s photo with satellite images of the villa on Google Maps.
“Well done, bro,” wrote one member. “That’s it, awesome. You made me so happy … Remember when we wrote that that fool would relax after a few months?”
Police report
The gang found these photos of a Corfu villa online. Certain features, such as the swimming pool, helped them identify it as the place Kožar was hiding.
‘Everyone Is Wearing Masks’
The next step was to plan and carry out the murder.
“Will we be able to find engineers to carry out all the work?” one member asked in apparent code, noting that measures taken to fight the COVID-19 pandemic could work in their favor: “It’s good that everyone is wearing masks now.”
But the pandemic did pose challenges. Travel restriction and quarantine requirements made it difficult to quickly cross international borders, leading the group to discuss how to get the hit squad into Greece illegally.
“A Macedonian from [the city of] Gevgelia takes 1,500 euros [per person], hands [the person] over to a Greek, and drives them to Thessaloniki," one member wrote.
In another last-minute hiccup, a member of the scouting team backed out of any participation in the actual killing, because he had entered Greece on his real passport and was afraid of being identified by authorities. This led one of his colleagues to withdraw as well, requiring the organizers to send two replacements.
By July 20, the hitmen had joined scouts already on Corfu, having hired the Macedonian smuggler to help them move illegally through North Macedonia, then cross the Greek border on motorbike.
Over the next three days, they staked out Kožar’s villa, taking photos of him and an associate walking, sitting, and talking in the yard. The scouts had already rented the quad bikes they would use for their escape.
Information obtained by reporters about the murder reveals no inside details about the group’s final days of planning. But that initial clue about Kožar’s penchant for spending time in the sun may have proved helpful: On July 23, he and his associate were gunned down in front of their villa just as they were returning from the beach.
The killers fled by quad bike to a boat waiting to take them back to the mainland. From the seaside village of Syvota they made their way to Thessaloniki, staying in a rented AirBnB apartment, before crossing the border to North Macedonia and eventually back to Serbia.
Although the police report detailed the planning for the murder, even naming the participants, no arrests have yet been made in any country.
This story was adapted for OCCRP by Ilya Lozovsky and Bojana Jovanović.