The trial of two young French people aged 25 prosecuted for extortion, computer hacking and money laundering in the crypto-porn scam case, opened Monday before the 13th criminal chamber of Paris, has just ended this Wednesday, September 27. The prosecution requested sentences of 4 and 3 and a half years’ imprisonment against Augustin I. and Jordan R., with a probationary suspension of three years.
The two defendants were on trial for extortion involving pornography and piracy. During the first half of 2019, millions of Internet users received these malicious messages threatening to disclose to third parties alleged recordings of consultations of pornographic sites, unless a ransom was delivered, averaging around of 500 euros.
So many spam messages sent via Varenyky – a reference to a type of traditional Ukrainian ravioli -, a homemade malware which had enabled the creation of a network of infected machines. “Augustin I. is the creator of the virus, so he is the initiator of this,” points out prosecutor Audrey Gerbaud to justify his heavier requisitions. But the two accused, who have since fallen out, nevertheless have shared responsibilities, continues the prosecutor. With “certain organization”, they managed the botnet together, launched the malicious campaigns and laundered the sums collected.
“They didn’t invent sextortion”
“No one claims that they invented sextortion, specifies the magistrate. But it is they who generalized this modus operandi in France.” The duo would thus have aroused vocations with their juicy campaign. At the end of the trial, their benefits still remain uncertain. The two defendants admitted to the magistrates financial gains of around 150,000 euros. During the investigation, it was more like “hundreds of thousands of euros”. The investigators finally estimated the total financial volume having circulated on the wallets linked to crypto-porn at 1.3 million euros, a loot obviously involving other computer hackers.
Before the judges, Dominique, one of the victims, remembered receiving the crypto-porn message. “When I received this email, I was extremely shocked,” says this sixty-year-old who immediately filed an angry complaint. I was told that I had particular tastes in pornography, that my computer had been taken over remotely and that I would be seen doing things. I especially feared a montage: the message said that if I did not pay within 48 hours, photos would be sent to my contacts.”
Identification of victims
These massive campaigns have, notes the prosecutor, complicated the identification of the targeted Internet users. “One of the difficulties of the judicial investigation is the volume of victims” of this malware designed to “affect as many people as possible”, she judges. Thus, if new complaints were recorded after the opening of the investigation, the prosecution struggled to establish links between the different emails and the defendants. In the end, the 21,609 reports received by the Ministry of the Interior made it possible to register 1,300 complaints, which resulted in 149 civil party filings at the hearing.
But because of a notice to victims sent too broadly before the trial, several people showed up in court only to be turned away, the fault of emails received outside the period of the facts withheld. This perimeter, from January to June 2019, was deemed “hazardous” by civil parties. Victims who received threatening messages in English finally felt that they should also be passed on to the defendants. “They are both bilingual, several versions of these emails existed, notably in Japanese”, while the operating methods were the same, summarizes Camille Tardé, the lawyer of an Internet user.
Blackmail rather than extortion
If for the civil parties the scope of prevention is too restrictive, for the defense it is too vague. The defendants’ lawyers therefore requested release due to inaccuracies regarding the identity of the victims in the prosecution. “If you do not know to which victims the facts must be attributed, you will be hard-pressed to condemn them,” summarizes Me Jean-Laurent Panier, Augustin I.’s lawyer. “The file is pschitt, the work of “investigation has not been done sufficiently”, assures his colleague Guillaume Halbique for Jordan R.
The two lawyers then disputed the extortion accusations. For them, the malicious messages were more like blackmail, an offense punished less severely. The prosecution saw in the long letters sent to the victims “a moral constraint characteristic of extortion”. The emails played on stereotypes linked to hackers, necessarily capable of taking total control over any machine. “But how can we imagine that there is an irresistible force, the definition of coercion in the penal code, if 95% of the victims have not paid?”, asks Guillaume Halbique. The judgment was reserved until November 2.