Coordinated raids of Zwiebelfreunde at various locations in GermanyMi 04 Juli 2018 by moritz, juris, qbi
Update July 10th: Last week Monday, prosecution stated that they will keep our things for further analysis, even after explicitly confirming to journalists that they are aware that our only connection to Riseup is the collection of donations. This includes items belonging to our partners, and other third parties like companies we work for. That same Monday, after the AfD party convening, our lawyers filed for immediate sealing and suspension of analysis until a court decision. Everything else is pending on that, and for now it looks like there are no further legal steps we can take (yet). The two of us who have not been interviewed yet (because they were not present during the raids) have been asked to give further testimony, which they will do during this week, together with our lawyers. This is not over.
On June 20th, police raided five locations across Germany, nicely coordinated at 6:00 in the morning: The private homes of all three board members, Jens, Juris and Moritz, our registered headquarters in Dresden (a lawyer’s office), and the home of a previous board member.
Please check the bottom of this page for links to various press reports about these raids detailing what happened. We will update that section regularly.
The brief summary is that a German left-wing blog “Krawalltouristen” (ruckus tourists) called for protest actions around the right-wing AfD party convening in Augsburg, Germany. Law enforcement argues that this includes calls for violence.
The German police were interested in finding the authors of said blog, and deemed it appropriate to not ask for information or go after the email provider the blog happened to be using, riseup.net, but after the German entity Zwiebelfreunde.
Zwiebelfreunde has a partnership with Riseup Labs, a US non-profit, and manages donations via European wire transfers for the Riseup collective. We spend the money in collaboration with the collective on software development, travel reimbursements, and for Riseup’s Tor infrastructure.
We will update this post as the story evolves. For more details, please see publications by other media.
What data is affected, and how?
First of all, here’s a list of things we have strong reason to believe are not affected, and can still be considered safe:
- any Torservers related infrastructure: Tor relays, mail servers, web servers
- any of Riseup’s infrastructure (because we have nothing to do with that)
- cryptoparty.in or other cryptoparty related infrastructure
- PGP keys, SSH keys, OTR keys etc
They seized most of our electronical storage equipment (disks, laptops, PCs, GnuPG Smartcards/Yubikeys), but it is safe to assume that they will not be able to break the encryption (or the smartcards). They also took our mobile phones, but even if they were to break into them, no login data or anything else affecting our infrastructure or communications is stored on those phones.
We nevertheless revoked our shared contact PGP key, and will replace more and more keys and passphrases over time. Our new key is 0x74A312092938F2F0, signed by our previous key.
So, what is affected?
Apart from encrypted media, they had the legal right to seize documents related to our Riseup bank account starting from January 2018. They also went and got those from our bank, the GLS Gemeinschaftsbank. However, we have to keep records and receipts of all expenditures for tax reasons. These documents were “safely” kept in a secure fire-proof safe.
Despite our protests, they additionally seized all printed documents relating to our own and partner projects since the inception of the association in 2011.
This includes highly sensitive personal data of donors, identities of activists that received reimbursements or payments, and a list of our members.
If you have ever donated to Torservers, or Tails or Riseup via a European bank transaction, your data is very likely now in the hands of the German police. (IBAN account number, name of account holder, amount and date)
We did everything in our power to avoid a data breach like this, and are now doing everything we can to fight it:
Our lawyers kindly asked for our equipment back. Most of the equipment does not belong to Zwiebelfreunde, and some of it is not even ours. They refused. We are now going to court over this.
The warrant lists specific items. This was not respected.
We argue that even the original warrants and seizures were clear overreach, and that this was used as an excuse to get access to member data and donor data. We have nothing to do with Riseup’s infrastructure. During the raids, the police forces clearly gave the impression that they knew we had nothing to do with either Riseup or the “ruckus tourist” blog. None of us had even heard of that blog before!
We are grateful for the quick and unbureaucratic financial support by Renewable Freedom Foundation, the logistical support of the Chaos Computer Club, and all the kind offers of help by various communities. Thank you!
If you’re not afraid to donate to accounts that are probably being monitored, you can still do so, at https://www.torservers.net/donate.html.
- 4.7.2018 ZDnet: German police raid homes of Tor-linked group’s board members
- 4.7.2018 Riseup: Bavarian raids
- 4.7.2018 CCC: Police searches homes of „Zwiebelfreunde“ board members as well as „OpenLab“ in Augsburg
- 4.7.2018 BleepingComputer: German Police Accused of Carrying Out Some Pretty Stupid Raids
- 5.7.2018 Tails: Police raid at Zwiebelfreunde: Donor data compromised
- 5.7.2018 Naked Security : Tor-linked nonprofit raided by police
- 5.7.2018 All3DP: German Police Raid Augsburg Fablab, Confiscate 3D Printed “Atom Bomb”
- 4.7.2018 security.nl: Inval Duitse politie bij privacystichting raakt TorServers en Tails
- 4.7.2018 tweakers.net: CCC uit kritiek op optreden Duitse politie bij doorzoeking leden Tor-vereniging - IT Pro - Nieuws
- 5.7.2018 Le Monde: En Allemagne, série de perquisitions chez des défenseurs des libertés numériques
- 5.7.2018 La police allemande aurait abusé de son pouvoir lors de descentes contre les associations Zwiebefreunde et CCC
- 4.7.2018 Ação policial coordenada contra a associação Zwiebelfreunde em várias localizações na Alemanha
- 6.7.2018 La Marea: La policía alemana requisa datos sensibles de activistas del anonimato electrónico
- 7.7.2018 El Diario: La Policía alemana incauta datos de miles de activistas y mecenas europeos de la privacidad digital
- 8.7.2018 Συντονισμένες έφοδοι της αστυνομίας στο μη κερδοσκοπικό οργανισμό Zwiebelfreunde σε διάφορες περιοχές της Γερμανίας
- 4.7.2018 Spiegel Online: Hausdurchsuchungen bei Netzaktivisten: Chaos Computer Club kritisiert Polizeivorgehen
- 4.7.2018 Augsburger Allgemeine: Als der Staatsschutz ins Augsburger “Open Lab” kam
- 4.7.2018 CCC: Hausdurchsuchungen bei Vereinsvorständen der „Zwiebelfreunde“ und im „OpenLab“ Augsburg
- 4.7.2018 Netzpolitik.org: „Zwiebelfreunde“-Durchsuchungen: Wenn Zeugen wie Straftäter behandelt werden
- 4.7.2018 heise: Massive CCC-Kritik an Polizei: Hausdurchsuchung bei Datenschutz-Aktivisten
- 4.7.2018 Golem: Zwiebelfreunde: Polizei durchsucht Räume von Tor-Aktivisten
- 4.7.2018 Fefe’s Blog: “ein vorsätzlicher Terroranschlag der deutschen Behörden gegen unbeteiligte Zivilisten”
- 4.7.2018 Thüringer Allgemeine: Polizeirazzia bei einem Jenaer „Zwiebelfreund“
- 4.7.2018 Sueddeutsche: Hausdurchsuchungen bei Netzaktivisten- Service-News
- 4.7.2018 12:06 Hitradio RTL Sachsen: Generalstaatsanwaltschaft München durchsucht Räume von Zwiebelfreunden Dresden
- 4.7.2018 12:40 finanzen.ch: Zwiebelfreunde: Polizei durchsucht Räume von Tor-Aktivisten
- 4.7.2018 13:57 der Standard: Chaos Computer Club übt scharfe Kritik an Hausdurchsuchungen bei Netzaktivisten
- 4.7.2018 15:20 Die Welt: Hausdurchsuchungen bei Netzaktivisten
- 4.7.2018 15:28 T-Online Digital: Netzaktivisten äußern Kritik an Polizei-Aktion
- 4.7.2018 BR Schwaben: Wegen Spendenaufrufs: Vor AfD-Parteitag: Augsburger Computer –Tüftler in Polizeigewahrsam
- 4.7.2018 16:46 Hannoversche Allgemeine: Zwiebelfreunde: Hausdurchsuchungen bei Netzaktivisten
- 4.7.2018 17:03 Münchner Merkur: Nach Aufruf zur Gewalt bei AfD-Parteitag: Hausdurchsuchung bei Netzaktivisten
- 4.7.2018 Piratenpartei Bayern: Schwere Grundrechtseingriffe bei Zeugen durch Polizei und Staatsanwaltschaft sind nicht hinnehmbar
- 4.7.2018 Die Linke: König-Preuss kritisiert Razzien bei „Zwiebelfreunden“. Fraktion im Thüringer Landtag
- 5.7.2018 10:19 Augsburger Allgemeine: Kommentar Jan Kandzora: Staatsschutz durchsucht Augsburger “Open Lab”: Eine fragwürdige Aktion. “Das OpenLab sollte prüfen lassen, ob die Durchsuchung rechtmäßig war”
- 5.7.2018 11:12 VICE Motherboard: Polizisten gehen rabiat gegen Tor-Aktivisten vor, als sie chemische Formeln in seinem Büro entdecken
- 5.7.2018 Anke Domscheit-Berg: Schutz der Privatsphäre ist ein Grundrecht und kein Verbrechen
- 5.7.2018 Reporter ohne Grenzen: Solidarität mit Netzaktivisten der Zwiebelfreunde
- 5.7.2018 17:12 Thüringen24: Gefahr für AfD durch Fuck-Bomb? Razzia auch in Thüringen
- 5.7.2018 taz: Kommentar Razzien bei Netzaktivisten: Gezielte Einschüchterung
- 5.7.2018 netzpolitik.org: Reporter ohne Grenzen solidarisiert sich mit Zwiebelfreunden
- 12.7.2018 Piratenpartei Deutschland: Justizministerkonferenz soll Hausdurchsuchungen bei Netzaktivisten beraten
- 13.7.2018 VICE Motherboard: Polizei zwingt Netzaktivisten zur Öffnung ihres Safes und gelangt an geheime Spenderliste
- 18.7.2018 Durchsuchungen vor AfD-Parteitag: Computerclub in der Bredouille
- 4.7.2018 17:44 Radio Z: Bundesweite Hausdurchsuchungen wegen E-Mail-Adresse
- 5.7.2018 12:25 Radio Dreyeckland/Chaosradio Freiburg: Beschlagnahme bei Riseup, Tor und Tails Support Netzwerk und CCC nahen Openlab in Augsburg
- 6.7.2018 Logbuch Netzpolitik LNP260: Eine Hausdurchsuchung kommt selten allein
- 14.7.2018 c-radar Juli 2018: savetheinternet.info; Hausdurchsuchung bei Zwiebelfreunde, Polizeibesuch beim CTDO
Tor exit node operator arrested in Russia - a solidarity Tor Relay Challenge launched
Run a Tor relay or exit node in solidarity with Dmitry Bogatov!
On April 12, Russia celebrated Yuriy Gagarin’s first flight in space. In the meanwhile, a young Russian scientist, mathematician and FOSS activist Dmitry Bogatov spends the Space Day in detention center. His involvement in decentralized web projects …read more
Three servers offline, likely seized
Last Thursday we noticed that three servers went down. Those servers were used to run Tor exit nodes, 10 in total. We tried to get in contact with our providers which weren’t able to tell us anything and also could not reboot the servers nor give us access to …read more
Reporters Without Borders and Torservers.net, partners against online surveillance and censorship
Reporters Without Borders and Torservers.net have joined forces to create and maintain 250 additional relays for the Tor network.
“In doing this, our two organizations are thumbing our noses at the entire world’s censors,” said Grégoire Pouget, the head of the …read more
Torcollect - A tool to collect statistics from servers that run Tor bridges
For the last half year i’ve been developing a tool that collects metrics from bridge servers. The specified application had to extract and collect the data from each single server that is registered in the system and generate static HTML reports from the received data.
Torcollect is written in …read more
Tor Relay Operator Meetup at 30C3
Torservers.net invites Tor exit relay operators and organizations to a meetup at this year’s Chaos Communication Congress 30c3 in Hamburg. If possible, for example if you’re a member of one of the ‘Torservers partner organizations’, please prepare some slides on your activities and let us know about …read more
Upgrading RAM due to large amount of user connections
Preparation for reimbursement: partner mailinglists
In preparation of Torservers.net reimbursing exit and bridge operators, we have set up two new mailing lists. Entities that receive reimbursement are called “Torservers partners” and listed at https://www.torservers.net/partners.html (if they want to be listed)
If you want to become a partner, we have …read more
Support for Relay Operators
I just noticed that I never announced that we offer support for relay operators at support [at] torservers [dot] net. You can encrypt your mails using PGP — https://www.torservers.net/torservers_pub.asc fingerprint B099 CF5D 5B97 DC65 2406 B458 C8F4 2EB2 E033 4E90
Currently, four founding members of Torservers …read more
On the way to more diversity
I have started to make changes to the Torservers.net website to reflect that we have grown from “professional Tor Exit hosting” to a state where growth of a single organization is not useful any more. We have refrained from ramping up more exit capacity for quite some time because …read more
Torservers receives 12000€ grant from Wau Holland Foundation
Sorry to spam you with just the press release, but all this took quite some time to get ready in time for March 12, Reporters without Borders “World Day Against Cyber Censorship”, and I need to catch a little sleep now.
In short: We received a grant of 12,000 …read more
New Exit at Voxility/Limehost in Romania
I’ve just installed a new Tor exit at Voxility in Romania. We have hosted there before through a German reseller (T-N Media), but the peering should have improved massively since, and by dealing with the NOC directly, we got proper RIPE reassignment and their “go” for Tor.
Let’s …read more
Progress Update - Happy New Torservers Year 2012
It’s still early enough to say Happy New Year and welcome another year worth fighting for net freedom…
Anyway, it’s been quite some time since I last sent an update to this list. I really recommend everyone to follow our twitter account @torservers or use the RSS feed …read more
Paypal and bank account changed; please update if you still use old one
We have a new bank account. Do not use my personal bank account any longer as this makes accounting more complicated.
If you do wire transfers, this is our bank info:
Account holder: Zwiebelfreunde e.V. Name of bank: GLS Gemeinschaftsbank eG IBAN: DE09430609671126825600 BIC: GENODEM1GLS (Kontonummer 1126825600, BLZ 43060967 …read more
Torservers.net Meetups in Dresden (3.9. and 15.10.)
The non-profit association behind torservers.net invites everyone, especially its current members, to two meetings. The first meeting will be held on the evening of Saturday, 3.9., in my kitchen. The second meeting will be on the evening of Saturday, 15.10., most likely also in my …read more
Torservers Progress Report
Zwiebelfreunde e.V. has finally received the necessary paperwork from the tax authorities and can now open a bank account etc. Juris is preparing a membership application form, so you should soon all be able to join. We’re still working on The Infrastructure (TM) to replace the …read more
New ~616 Mbit/s Exits at NForce NL
I am very exited to announce the new exits hosted at NForce Entertainment in the Netherlands . We have proper WHOIS reassignment and their full support, so I am experimenting with an exit policy that allows all ports to exit to hopefully attract more traffic.
NForce has decided to support …read more
New 200TB exit node hosted with Axigy (USA): manning and saeeed
I am excited to announce that I have found an ISP who showed interest and understanding in what we are doing. http://www.webhostingtalk.com/showthread.php?t=1035976
—— snip —— Great, I like what you’re doing to help those countries with respective governments. In response to Abuse, we are …read more
Torservers Progress Report February/March
Torservers.net receives $10,000 grant from Access Now
Dresden, March 8th 2011
Onions Against Dictators - Torservers.net supports democracy movements by providing uncensorable gateway to free Internet; receives $10,000 grant from Access Now
Uncensored access to the Internet can overthrow dictators and aid the creation of free societies. This has been shown by recent events in North …read more
Progress report Feb 1-5
Anyone interested in doing an English workshop on Internet censorship/online activism with me on ENA? http://www.ena2011.eu/
Feb 1st: - Flatters for torservers passed 1000! https://flattr.com/thing/5649/ - Flattr Revenue January: €128,57
Feb 2nd: - We have our own ARIN WHOIS entries now for zeller and …read more
New Tor relays online - zeller and raskin (thanks Mike from DefaultRoute!)
zeller.torservers.net and raskin.torservers.net just went live. These two relays are donations by the founder of defaultroute.net, Mike Sawicki, currently set at 20 Mbps each. He will SWIP the IP range, after that we will gradually open the exit policy.
Thank you Mike Sawicki - http://hax …read more
- www.codero.com donated a 100mbps Tor exit! The IP range should be SWIPed and RDNS set properly soon. We’re still testing the setup, so for now we’re only allowing port 443 to exit. http://torstatus.all.de/router_detail.php?FP=C67622A01D8D3B742A14506CD446342993C20FE3
It is named “wau”, after Wau …read more
Merry Christmas / Traffic Stats December 2010 / 27c3
It’s been very quiet on this list for a while now, and the website doesn’t show much progress either, so let me give you a “behind the scenes”.
- Abuse After convincing Softlayer to add a comment to our WHOIS range and limiting the ports, all complaints were directed …
All four nodes on top of all.de torstatus :-)
Datacenter stats: http://www.torservers.net/status/100624-sl.png
Tell your friends ;)
Haven’t heard back from neither BayTSP about my DMCA status, nor from Softlayer/100TB about SWIP. The 100TB admin told me he emailed their network engineers to check whether it is possible - although they told me about …read more
Another day, another dollar
We have a new server in Australia!
I’ve been contacted by networkpresence.com.au, a nice ISP in Australia. They have donated a small server for running another Tor exit node with 1MB/s of traffic.
First nodes are online :-)
Thanks to YOU, the first nodes are online! As I’m still testing (never had the goal of pumping 39MB/s before), the configuration is provisional and I don’t want to announce them widely yet, but of course you should know about the progress.
anonymizer2.torservers.net (no web …read more
You can now Flattr torservers.net
Update: 32MB/s, new Torstatus screenshot
Tor Exit Node Sponsorship - looking for partners
At the moment, 25% of all traffic exits through Blutmagie (thanks Olaf!). I guess we all agree that this situation is far from optimal.
Judging from the number of requests in the last months where people were looking for friendly ISPs, help with setting up, running and managing Tor nodes …read more