Skip to main content
Topic: CyberBunker: Process kick-off in Trier: Unprecedented giant process (Read 666 times) previous topic - next topic

CyberBunker: Process kick-off in Trier: Unprecedented giant process

At the Bulletproof Hoster on the Moselle, the C&C servers of the Mirai botnet were hosted among other things.

Today, Monday, the trial against the wire-pullers of the Darknet data center Cyberbunker was opened at the 1st Great Youth Chamber of the Regional Court of Trier. Four Dutchmen, three Germans and one Bulgarian are accused of having helped to make possible almost 250,000 criminal acts as operators of this so-called bulletproof host. The trial is the first of its kind in German criminal history in which the operators of a hosting service are also prosecuted for the crimes of their customers.

The public prosecutor's office accuses the defendants of forming a criminal organization that existed solely for the purpose of profiting from the crimes of other criminals. The accused are thus theoretically threatened with a maximum sentence of 15 years in prison, two of whom were full or partial adolescents at the time of the crimes and can therefore expect a milder sentence.

Mammoth trial on the Moselle

The mammoth trial on the Moselle is scheduled to last until the end of 2021, with two days of negotiations per week. An enormous amount of time, judging by the sheer number of crimes to be investigated, but it could well be exhausted. The public prosecutor's office accuses the accused of a total of seven criminal offences. On the one hand, they would have hosted the four underground marketplaces Cannabis Road, Wall Street Market, Fraudsters and Flugsvamp 2.0. In addition, according to the public prosecutor's office, they operated three trading centers for experimental synthetic drugs from China. They are also accused of having hosted a link list of over 6,500 websites in the Tor network, through which drugs, counterfeit money, murder orders, weapons and child pornography were traded.

A wealth of data for the investigators

With the exception of one defendant, who was still considered a juvenile offender at the time of the arrest warrant, all suspected offenders have been in pre-trial detention for almost a year without interruption. As the presiding judge stressed at the beginning of the proceedings, the court is aware of the unusual nature of this situation. The length of the proceedings also reflected the sheer amount of material that needed to be examined. In an interview with heise online, the investigating senior public prosecutor Jörg Angerer from the Landeszentralstelle Cybercrime (Central Office for Cybercrime) of the Koblenz Public Prosecutor General's Office said that he was still busy evaluating the material in the case. The amount of material seized - a total of almost 2 petabytes of data - is unprecedented. Another reason why the proceedings had been so extensive in preparation was that thousands of crimes had to be investigated.

Finally, in order to prove that the defendants were guilty of forming a criminal organisation in the seven criminal offences, it was also necessary to prove the offences committed by the sellers of illegal goods to which they had aided and abetted, Angerer explained. The reading of the indictment alone, with dozens of such cases, took over an hour.

The crimes committed by the customers of the cyberbunker were mainly violations of the Narcotics Law and the New Psychoactive Substances Law, i.e. trafficking in illegal medicines or drugs. The Swedish police estimate that the marketplace Flugsvamp 2.0 alone has now accounted for more than 90 per cent of the Swedish drug trade.

Organised like a traditional hoster

The prosecution is confident that it can prove to the defendants that they knew exactly what was being traded on the websites they were hosting on their servers in the former German Armed Forces bunker on the Moselle. This can be seen from the internal e-mail system, which was secured together with the customers' websites on the servers in the cyberbunker. The defendants' activities were allegedly organised in a strictly hierarchical manner, very similar to a normal company.

One of the defendants had therefore bought the former Bundeswehr bunker through a foundation which he had set up in the Netherlands and, with the help of three other defendants, had it converted into a computer centre and operated it for almost 450 000 euros. A fourth defendant had acted as manager, operated the cyber bunker and distributed the tasks within the gang. The other defendants, including a German classified as a juvenile delinquent, had lived on the bunker premises and had looked after servers and customers as admins.

Trial could drag on

The investigating authorities had long observed the activities of the cyber-bunker operators and apparently also monitored their customers in order to intercept and seize drugs and forged documents sent as evidence. They smuggled a cyberman into the data centre in the bunker, who worked as a gardener and unskilled labourer on the bunker premises. In this way, the investigators were finally able to enter the bunker in a large-scale raid when the defendants were eating in a restaurant in Traben-Trarbach.

To open the proceedings, the presiding judge pleaded with the defendants to confess. A useful confession could possibly reduce the sentence if a verdict was reached. A confession would be particularly useful if it would reduce the length of the trial and the effort involved as well as the court costs. At present, there are no signs that any of the eight defendants will confess.

source (in German):