Cyberbunker: Almost six years in prison for operators of darknet data centers

Enlarge image

NATO bunker on the Moselle: This is where the darknet data center was located

Photo: PRESS OFFICE LANDESKRIMINALAMT RHEINLAND-PALATINATE / HANDOUT / EPA-EFE / REX

In the proceedings surrounding the so-called cyberbunker, seven men and one woman were sentenced to prison terms by the Trier district court on Monday. The Trier district court saw it as proven that they had operated a computing and data center for criminal customers in a former NATO bunker under the name Cyberbunker. All eight defendants were guilty of the formation and membership of a criminal organization, said the presiding judge Günther Koehler on Monday.

In their data center in Traben-Trarbach, Rhineland-Palatinate, the accused are said to have given criminal customers digital protection against state access in exchange for money. These customers are said to have belonged to large darknet marketplaces such as "Wall Street Market" or "Fraudsters" until the shutdown. Last year, SPIEGEL reconstructed the comprehensive history of the cyberbunker in a cover story.

The Dutch main defendant, Herman X., was sentenced to five years and nine months in prison.

Another six defendants received terms of between two years and four months and four years and three months in prison.

The Trier judges sentenced the eighth accused to one year imprisonment, which was suspended.

The court acquitted all defendants of the allegation of aiding and abetting the approximately 250,000 crimes that are said to have run through the hosted pages.

Herman X. is considered to be the head of the group.

The public prosecutor's office in Koblenz had demanded seven and a half years imprisonment for him last week.

His defense pleaded for acquittal.

"We had a clear conscience ... and we all believed we were acting legally and correctly," wrote X. from pre-trial detention in Trier before the trial began.

SPIEGEL and NDR had sent him a catalog of 65 questions in prison for joint research.

Most of the questions he answered willingly.

The first instance judgment of the Trier regional court is not yet final.

It was initially unclear whether the defense lawyers wanted to appeal.

Enlarge image

Chief Public Prosecutor Jörg Angerer (right) before the verdict is announced

Photo: Harald Tittel / dpa

The investigations were carried out by the State Central Cybercrime Office at the Koblenz Public Prosecutor's Office.

Attorney General Jörg Angerer's pleading stated that the defendants had told their customers that they hosted everything except child abuse material and terrorism.

"I am convinced that it is a criminal offense to operate such an infrastructure with sight, like the heads behind the cyberbunker," Angerer told SPIEGEL before the trial began.

Tapped conversations and messages that the cyberbunker operators received were intended to show that the operators knew that they were making their servers available to criminals.

"Instead of doing something, the operators of illegal sites were even warned," says Angerer.

For the investigators, it was a superlative process in several respects: Before the trial began in October, the chief public prosecutor spoke of 249,000 crimes, 650 officers involved in a special mission, 403 confiscated servers and two million gigabytes of confiscated data.

The access was preceded by five and a half years of investigative work.

For the state central office for cybercrime in Rhineland-Palatinate, it was the largest procedure to date.

Further darknet sites in sight

The cyberbunker called itself a »Bulletproof Hoster«.

Such services operate servers and ensure customers extensive anonymity and protection.

They play an important role in criminal business on the Darknet, but are usually a closed world for law enforcement agencies.

The entire investigation had therefore been followed with tension.

Senior Public Prosecutor Angerer was able to announce before the end of the trial that there have been 227 follow-up proceedings against customers of the cyberbunker so far.

Many of them were discontinued due to a lack of investigative approaches to identify customers.

In a major follow-up proceeding, however, the Koblenz Public Prosecutor's Office succeeded in digging up "DarkMarket", one of the world's largest darknet black markets at the time.

The success against the cyberbunker was an important blow against the Darknet for investigators and also marked the beginning of one of the most extensive cybercrime proceedings in Germany to date.

Nevertheless, the criminals are likely to have switched to other providers long ago, Angerer is also certain: "It's like with a Hydra: You cut off one head and the next grows back," Angerer told SPIEGEL in October 2020.

A new law passed after the end of the cyber bunker could make the work of investigators in Germany easier in the future.

With paragraph 127, a new offense was created in the penal code under the name "criminal liability for operating criminal trading platforms on the Internet".

Accordingly, it is a criminal offense to "operate a trading platform on the Internet, the purpose of which is aimed at enabling or promoting the commission of illegal acts".

You can read more about the background to the new law here.

No privilege for the hoster

From a legal point of view, the question of whether the defendants had to accept responsibility for what their customers did with the rented servers was interesting for the trial.

Basically in Germany, a web hoster is not responsible for the content on its servers.

You can imagine such a hoster to be like a landlord with a comprehensive caretaker service.

Before the start of the trial, Herman X. indicated that the defendants probably wanted to invoke this privilege: "They have to compare our servers with bank lockers," he wrote from prison.

“No bank employee checks what's in the lockers.

He can't even do it without the customer's key. "

The Trier district court apparently saw it differently in the case of the cyberbunker.

hpp / dpa / afp