Within the National Directorate of Customs Intelligence and Investigations (DNRED), Cyberdouane tracks down criminal groups mainly on the Internet. Its director (whose anonymity we have respected for security reasons) explains to Le Monde how he and his team pursue an organized crime with increasingly sophisticated activities: trafficking in narcotics, tobacco, shisha tobacco, counterfeiting but also arms trafficking.
What are the means of action of Cybercustoms?
Our prerogatives, subject to the customs code, are gaining momentum. With an authorization from the prosecution, our agents can carry out a “coup d’achat”, allowing us to pass themselves off as customers, and thus buy weapons, but also narcotics or counterfeit articles such as tobacco. This allows us to trace back to the source of traffic: sellers and marketplaces. Since 2016, we have been able to carry out surveys under pseudonyms, allowing us to collect information on the sales channels of prohibited products, and to get closer to the real identity of the sellers.
First, detect Internet fraud, then detect profiles. We particularly target those that we believe are the most important, who post ads on a regular basis. Then our job is to break the anonymity on the internet, to break the immunity. Let those who think they are untouchable understand that this is not the case. Sometimes it’s very easy, when they give their mobile number – for example, for people reselling counterfeit perfumes made in China. These people can earn up to 50,000 euros a year this way: it is very real traffic, but not necessarily the most dangerous public. On the other hand, when it comes to more organized networks, they know that it is illegal and protect themselves more, even for the trafficking of tobacco and shisha tobacco, which is very important at the moment.
The use of VPNs [virtual private networks], the dark Net, prepaid telephones, but also false identity documents… The law is evolving more slowly than the Internet, and this is a major issue. For example, with regard to the seizure of cryptocurrencies. The law needs to continue to evolve so that we can create what are called “honeypots”, allowing people to pose as sellers. This solution exists in the United States and has very good results. We in France are not yet inciting.
The problem also comes from the GDPR [General Data Protection Regulation], which prohibits storing data. And the differences between States make international investigations more complex. Admittedly, the States usually agree on cases of pedophilia and terrorism, but there is a problem of standardization of the law on other topics, such as the sale of tobacco online, legal in Belgium but not in France.
The profiles are very varied. In narcotics, there are drug addicts, who resell to buy them back; those who want to make ends meet; and then organized groups. During the “customs detentions” (the arrests carried out with the customs surveillance services), one sometimes finds just a few kilos, but there can be many more, sold on a regular basis in the previous months. They are good traders, they have accounts everywhere to attract their customers.
In a very recent case, 400 kilos of shisha tobacco had been sold on social networks, in particular on Facebook and Snapchat. We have also dismantled structures, of four or five people, with vehicles equipped with caches for narcotics. A case judged a few months ago associated two heads of networks with two “logisticians” responsible for packaging and posting several dozen shipments a day. Their turnover, in cryptocurrencies, amounted to 750,000 euros in ten months. Similarly, some networks are “two-headed”, selling both on the Internet and on the street.
Finally, the biggest sellers are mainly based abroad, in particular in the Netherlands, an area of synthetic drug production. There, some sellers do not sell below ten kilos per shipment.
The feeling of impunity changed with the dismantling of the “Silk Road” network, in the United States, in 2013. Then, we dismantled the first network in France, the “Black Hand” forum, in 2018. But going back to the source of a network is particularly difficult, and it can take several years. We are here to find errors. But the higher the range, the more the networks are cautious and structured.
Also, our exchanges with the platforms are minimal: it is very complex to gather information about real identities. For example, in a recent file, everything was fake: fake papers, a “nurse” room rented under a fake name, fake payslips, and even a fake phone number, corresponding to two people from western Paris , over the age of 75, who unknowingly paid for traffickers’ subscription after their bank details were hacked.
Since 2017, we no longer only target sellers, but rather platforms. Our goal is to break the working tool of the traffickers. The question is what is illegal in their activities. For example, collecting a commission on fraud – article 399 of the customs code. Yes, the Dark Net is resilient, but, at least for a while, we put a stop to their activities and we also recover data. So it’s not necessarily the files with “Madame Michu” selling some jewelry, but the more complex files, with regular sales.
Time is progressing, and people are more and more fed up with the Internet. For the new generations, the Internet is normal, it is everyday life. Even cryptocurrencies are less and less an insider affair and a good way to bypass international controls. Naturally, therefore, we see an increase in online traffic. Look also at the metaverse, where there are already advertisements, but also cases of sexual harassment… [The metaverse is defined as a 3D model of the Internet, a place parallel to the physical world where it is possible to interact with d other people through avatars.] But what is the right on the metaverse? How can I investigate it? It’s the connection to “real life” that interests me.
Yes, the panel is very wide, and will continue to expand over time. For example, the youngest trafficker ever arrested was just 16 years old. In some cases, moreover, online scams go further. Recently, we spotted a narcotics seller, credited with good reviews by buyers, who sent fruits and vegetables instead of drugs, before disappearing from the marketplace with his loot… Regarding arms sales, in networks French-speaking, they are quite rare: it attracts the police too much… This does not prevent some from getting into this type of business: in 2021, we arrested a seller of blank weapons modified to make them lethal . A very well-integrated man, who sold narcotics and weapons at night, from his home.
Their training is very varied, and, in my opinion, this diversity contributes to the strength of the team, which is rather young. It’s not just geeks – although it does take a few, very technically savvy ones. Some have gone to customs school, others have acquired computer skills in the field… Dismantling a platform can take more than a year of investigations, for two agents.
In general, the French-speaking Dark Net has been weakened, but it still exists. Also, a lot of rigs live a few months and die. Other sellers are migrating to international platforms. But in recent months, it is mainly towards social networks and messaging that drug trafficking has concentrated. More popular, they provide both protection facilities and bring in large numbers of customers, similar to a simple street deal. Moreover, selling on social networks also allows the hand-delivery of the goods.
What products are alerting you, especially to health risks?
We are very vigilant about fentanyl and other opioids. Products that are often very dangerous, especially because they can be “badly cut”. But, fortunately, this market, very important in the United States, is not very developed in France. With regard to narcotics, we observe an increase in the concentration rate of the products, some being cut with fentanyloids to have more effects. Finally, we notice sales of products and drugs diverted from their use, such as Valium, or e-liquids to vape containing THC [the main active molecule of cannabis].
What is your opinion about anonymity on the Internet?
Anonymity is reinforced, but it plays into the hands of criminals. One of the main future challenges in terms of cyber concerns the retention of data. For example, groups claiming to be “libertarian”, wanting to promote anonymity, will protect the worst in human beings – terrorists, pedophiles, traffickers…
