Shortly after Pavel Durov, the founding father of Telegram, was arrested by the police in France final summer season and charged with failing to forestall illicit exercise on the app, a French regulation professor specializing in cybersecurity bought on-line messages from a person named Isaac Steidl.
“I want to discuss with you,” mentioned an e-mail signed by Mr. Steidl, who launched himself because the founding father of the web chat website Coco. “My case is similar to Telegram’s, and so are the fees.”
Michel Séjean, the professor, who shared copies of the messages with The New York Occasions, mentioned he didn’t know Mr. Steidl, had no real interest in serving to him, and by no means responded. He was, nonetheless, acquainted with Coco — an internet site the place nameless customers may chat with out leaving information of the dialog.
French regulation enforcement had tied the location to hundreds of prison instances, together with the current trial of Dominique Pelicot and 50 different males, most of whom had been convicted of raping Mr. Pelicot’s now ex-wife whereas she was closely sedated, and who testified that that they had first met him on the chat website.
The French authorities had already closed the web site in June, and the messages to Mr. Séjean urged that Mr. Steidl was involved that they’d goal him subsequent.
Final week, they did.
Like Mr. Durov earlier than him, Mr. Steidl was positioned beneath investigation on a raft of prison expenses by authorities primarily utilizing a 2023 regulation that has made France a testing floor for an aggressive new strategy to carry the heads of on-line platforms personally liable.
The new regulation permits the authorities to prosecute individuals who run the platforms and knowingly allow unlawful content material, items or providers to be exchanged whereas additionally requiring customers to stay nameless or whereas failing to maintain sure person knowledge.
Whereas some specialists warn that the brand new regulation stays comparatively untested in courts, it has given the French authorities a seemingly highly effective new device.
“The noose is tightening across the directors of such a platform,” mentioned Nathalie Bucquet, a lawyer for the French chapter of Innocence in Hazard, a toddler safety group that had known as for Coco to be shut down.
Mr. Steidl, 44, didn’t reply to requests for an interview. However within the years previous his indictment, he took steps that made it tougher for French regulation enforcement to achieve him. He dropped his French citizenship, registered his web site overseas and moved to Bulgaria.
Final week, he was ordered to pay 100,000 euros ($102,000) in bail and was barred from leaving France, with the duty to often test in at a neighborhood police station.
Julien Zanatta, his lawyer, mentioned that Mr. Steidl willingly traveled to France to cooperate when the authorities summoned him. Mr. Steidl would “reveal his innocence” and was “horrified” by stories of crimes tied to his platform, his lawyer mentioned.
“He was upset to seek out out what had been carried out by individuals who had misused his website,” Mr. Zanatta mentioned.
Coco was first registered in 2005 with a plain dwelling web page and a cutesy Nineteen Nineties aesthetic, with a cracked-open coconut. It marketed itself as a “good” chatting discussion board that didn’t require customers to create an account — they may entry it by offering solely a gender, age, postal code and pseudonym.
Customers may chat instantly or be part of boards, and the location made cash by charging a small month-to-month payment for entry to extra options. Within the three months earlier than it was shut down, the location’s month-to-month site visitors reached greater than 500,000 customers, in response to SimilarWeb estimates.
Crucially, information of the nameless conversations weren’t saved.
Over time, the authorities repeatedly tied the location to prison exercise, and advocacy teams combating baby abuse and homophobia had turn into more and more vocal in demanding that the authorities shut it.
Mark Pohlmann, the president of a nonprofit in opposition to cyberviolence in France — who was interviewed by the police as a part of the investigation into Coco — mentioned that when conducting analysis concerning the chat website by posing as a feminine person, dozens of male customers contacted him inside seconds of logging on, typically by making sexual feedback or asking for specific pictures.
The French police and prosecutors say that from 2021 to 2024, the platform was implicated in over 23,000 instances that concerned 480 alleged victims, together with allegations of sexual abuse of kids, pimping, prostitution, rape, drug trafficking, scams and homicides.
On the Pelicot trial, Mr. Pelicot mentioned that he had met the opposite males on the web site, in a personal chat room known as “With out her data.” Many of the defendants denied ever seeing that exact chat room however acknowledged that that they had met Mr. Pelicot on the location earlier than transferring to different platforms.
A number of defendants on the trial mentioned they got here to the web site in the hunt for paid intercourse, or to purchase and promote medication. Christian Lescole, an expert fireman and longtime person of the web site, informed the courtroom that it began as an area to debate hobbies like chess or music.
“However because the years glided by, all of the predators and scammers began coming to Coco,” mentioned Mr. Lescole, who was convicted of aggravated rape of Ms. Pelicot.
Whilst the web site’s notoriety grew, its founder remained within the shadows.
Mr. Steidl appeared to reside off the web however has a really low profile on-line. His Fb web page is empty. His LinkedIn web page is bare-bones. How carefully Mr. Steidl managed the web site on a day-to-day foundation is unclear. Two individuals recognized as moderators of the location had been arrested in July, however authorities didn’t element their precise function.
Born within the Vaucluse and raised within the Var, each areas of southeastern France, Mr. Steidl graduated from a pc science program at an engineering college in Toulon in 2003, the college’s head of communications mentioned.
Mr. Steidl owned the coco.fr area identify via an organization known as Zenco that was registered in Toulon in 2011. In 2022, in the course of the investigation that preceded the Pelicot trial, the investigating decide’s workplace contacted Zenco to request knowledge related to the case. However it by no means obtained a solution, in response to an outline of the case by the decide.
Quickly after, Ms. Steidl started pulling his firm, his web site, and himself, out of France.
By October 2022, coco.fr was redirecting site visitors to coco.gg, in response to web archives on the French Nationwide Library, indicating that it had been registered in Guernsey, an island within the English Channel.
Then, in 2023, Zenco was shut down, in response to public enterprise information. That very same yr, in April, Mr. Steidl renounced his French citizenship, authorities information present. His lawyer says he’s an Italian citizen.
And in some unspecified time in the future, he moved to Bulgaria, the place an organization known as Vinci LTD was related to the location in March 2024, in response to info collected by Domaintools. Vinci is owned and managed by Mr. Steidl, in response to Bulgarian firm registration information.
However in June, after an 18-month investigation spanning throughout Europe, French authorities shut the location down. Two of the location’s servers had been seized in Germany, financial institution accounts had been frozen in a number of European international locations, and police seized 5 million euros. French regulation enforcement officers questioned Mr. Steidl in Bulgaria, though he was not charged on the time.
Mr. Séjean, the professional who was contacted by Mr. Steidl, mentioned that France’s 2023 regulation — and the creation in 2019 of a specialised nationwide cybercrimes unit — had allowed French prosecutors to take a much less piecemeal strategy of their focusing on of on-line platforms suspected of permitting illicit exercise to flourish.
“Earlier than 2023, you couldn’t get at it in a single fell swoop, it was damaged down case by case,” mentioned Mr. Séjean, who teaches on the Université Sorbonne Paris Nord.
Ms. Bucquet, the lawyer, mentioned the brand new regulation “vastly facilitates” police work as a result of “the mere data of the illicit nature of the content material justifies prison legal responsibility on the a part of the administrator.”
However some critics mentioned making use of the brand new offense to Mr. Steidl’s web site could possibly be overreaching, and that whereas the regulation has allowed prosecutors to swiftly convey expenses, future convictions are unsure.
Alexandre Archambault, a lawyer with experience in digital and cybersecurity instances, famous that the primary conviction utilizing the brand new regulation, in November, was in opposition to the creator and the administrator of a Telegram group that shared baby intercourse abuse materials — not Telegram itself or its executives.
“Does this intensive interpretation of the offense conform to European regulation?” Mr. Archambault mentioned. “I doubt it.”
Mr. Steidl’s lawyer mentioned that his shopper was being unfairly singled out.
“There are often websites which might be diverted from their function to commit offenses, and the individuals answerable for these websites are by no means prosecuted for complicity,” he mentioned.
Beneath French and European guidelines, platforms that host content material on-line can’t be held responsible for what customers publish, and they aren’t beneath any obligation to preemptively monitor for any unlawful content material.
However additionally they must have procedures permitting individuals to flag such content material for removing and to make sure some stage of cooperation with authorities — which was not the case for Coco, in response to French prosecutors, who mentioned it confirmed “a infamous lack of moderation.”
For now, although, some advocacy teams say that closing the web site was inadequate.
“The day they shut Coco down, I despatched the police an e-mail with a listing of over 100 comparable web sites,” mentioned Mr. Pohlmann, the nonprofit president. “It’s like saying that closing a drug dealing spot in Marseille solves the issue of drug trafficking in France.”
“Coco is the tree hiding the forest,” he mentioned.
Liz Alderman contributed reporting from Paris, and Michael H. Keller and Jennifer Valentino-DeVries from New York.
