Germany’s largest cybercrime court started this week amid much media fanfare at a district court in the city of Trier. The courtroom was crowded. The defendants and their lawyers wore masks and were separated by plastic screens.
On the first day it took the judge two hours to read out the charges. In the second case, three of the eight defendants were given the opportunity to tell their life stories.
Eight people – four Dutch, three German and one Bulgarian – worked in a “cyberbunker” data center in a former military bunker in the pretty village of Traben-Trarbach.
They are now accused of aiding and abetting criminals in an estimated 249,000 illegal online transactions involving drugs, contract murder, money laundering and millions of euros of child abuse imagery.
Johan X., the suspect culprit has become the focus of the German media – which may not identify the accused until proven guilty.
In September 2019, a major police operation that has been carried out for half a decade to raid the bunkers and close it. A key member of the group was arrested.
The alleged culprit for the operation, Johan X., 60 years old from Holland, remained silent and was silent during the first days of the investigation, listening to the testimony of the first three defendants.
Dutchman Michiel R. who works as a “manager” in the bunker summarizes his work history in a boxy shape and gives a tearful picture of his close relationship with his mother. Jaqueline B., a German who acts as a “bookkeeper” for the operation, talks about her childhood in Cameroon growing up as the daughter of a poor farmer. A 21-year-old German IT expert who spent a year working in technical support described his solitary life and history of depression.
The location of the bunker was chosen in the Cold War because it is west of the Rhine, an important natural border in Germany
There is a lot of focus in the international media on the bunkers the group uses for its operations.
Massive constructions were built during the Cold War to house the NATO command center. It sits on a hill overlooking a small town of 6,000 people, mostly known for its Riesling vineyards.
“We’re tourist-oriented here; it’s really beautiful,” explains Patrice-Christian-Roger Langer, mayor of Traben-Trarbach. He knew the bunker well because he worked there as a computer programmer in the 1980s and 1990s.
“It’s like a giant root system,” he explained. “Only one floor above ground and four underground. The only way to distinguish each floor is through color coding on the walls. Visitors will often come and have no idea whether they are at ground level or tens of meters underground.”
After the end of the Cold War, the bunker gradually fell out of use and the German government finally sold it to Johan X. in 2013. Langer said the city council had no say in the sale, and there was a lot of speculation about Johan X. and his plans for the bunker.
The Mosel Valley is a popular place for tourists
Gossip and rumors
“So I called him and asked if I could come visit,” said Langer. “He said I could come any time, I just needed to give a little notice because of the guard dog. And he was really very open – I visited twice and could look behind every door I wanted. Not much seems to have changed since I worked there. “
Johan X. promised that his new IT hub would offer at least 80 jobs to the local community, which Langer said was badly needed. He also promised to set up an IT training center. But he remains unclear about the true nature of the operation.
Neither of his promises materialized, and rumors continued to spread among the townspeople – that X. was producing drugs or buying and selling weapons in the bunkers.
Then, in September 2019, Langer attended a meeting in a neighboring town and received a WhatsApp notification: police vans and helicopters were in the bunker. He ran back to Traben-Trarbach to find the bunker had been raided.
Only then did Langer and the rest of the town hear about what might have happened and the dark web empire allegedly run by X.
Read more: Darknet, internet shady
The bunker was the site of a major police operation in September 2019
The ‘creepy’ dark web
Johan X. * and the other defendants were charged with running a “bulletproof hosting” service for websites, where they offered clients the opportunity to carry out covert online operations.
“There is no consistent meaning for the dark web,” explains Professor Steven Murdoch, a security engineering expert at University College London. “It’s used most often as a reference to creepy stuff on the Internet – because it sounds a little creepy. And flak hosting is completely unrelated to the dark web, but it might involve the same people at times.”
Johan X. strictly offered “bulletproof hosting” to Cyberbunker customers from the start, allowing clients to access the darknet, where some of the internet’s most sinister operations take place. He originally advertised that Cyberbunker would host the website with anything but “child pornography and anything related to terrorism”.
“Bulletproof hosting is for services that are normal internet services but are illegal or prohibited,” Professor Murdoch explains. “But it’s important to remember that most bad things on the internet happen on the normal internet.” He cited one study by the British Internet Watch Foundation on child abuse images and found that less than 1% of the images were accessed via the so-called onion service, which assists anonymous users.
While some servers are virtual, hundreds of others are physically stored in bunkers
Investigators are still examining the content of the hundreds of physical and virtual servers housed by the bunkers and say they have not found any content unrelated to illegal activity. But Murdoch says it’s inconceivable that a host service provider might not know about the nature of their customers’ online activity – especially if they consciously turn a blind eye.
“The principle that organizations are not responsible for their customers is a good principle, and it is widely applied,” Murdoch said. “Once you become a large organization, there will be bad people using your services. So the question is – what proportion of your customers are bad people?”
Proportion is an important part because a major internet hosting service like Amazon can facilitate millions of cases of illegal online activity. But considering their gigantic size, this is only a fraction of their service, Murdoch pointed out.
The eight defendants and 250,000 crimes – evidence summarized in a pile of files
Making new breakthroughs
Defense lawyers this week argued that the groups surrounding Johan X. were not aware of what content and transactions were being carried out on the website hosted by the bunker servers.
With the trial running for more than a year, the public prosecutor said the trial would cover “a new legal foundation.”
Although the prosecutor was able to prove that Johan X. and his team were aware of the activity, the key question of the trial was whether the internet service provider had the right to act on this knowledge.
Germany is a country where data privacy is highly protected: electronic payment methods are still uncommon in most countries partly due to concerns about data mining. Mayor Langer was among those who saw the case as an opportunity to re-examine some of these regulations.
“I work with children, and my internet search history and personal background have to be checked by the police every year,” he said. “But can this man run an operation that facilitates the sale of child abuse images and he can claim a lack of knowledge due to data security? Something has to change.”
The trial will run as early as December 2021 as prosecutors will go through thousands of charges against the defendants. The evidence shows that the guilty verdict is far from certain. But Professor Murdoch said law enforcement often hides important evidence in cases like these.
“We may never know exactly what happened [in the bunker],” he says.
Mayor Langer was eagerly awaiting a decision: “This is truly history in the making.”
* Editor’s note: DW follows the German press code, which emphasizes the importance of protecting the privacy of suspected criminals or victims and urges us not to disclose full names in such cases.