Flight of the Predator: Jet linked to Israeli spyware tycoon delivers surveillance tech from the EU to notorious Sudanese militia

AOJ71H 18 May 2022 10:26 Khartoum DOF/220518 C750 -LCLK -HSSK

On a dusty May morning in Khartoum an executive jet taxied to a halt under the blistering sun. Two jeeps with tinted windows stood ready to meet it from one of the most notorious and feared militias in the world, the Rapid Support Forces. The sleek white Cessna flew in from Cyprus and remained on the ground in Sudan’s capital for just 45 minutes, long enough to draw a disturbing line of connection between the ferocious contest for power in Sudan and a spyware scandal roiling Greece.

Details of the Cessna’s arrival, its passengers and cargo were meant to remain secret — logged in an inaccessible location, foregoing the usual procedures. The secrecy was a testament to the power of Mohamed Hamdan Dagalo, known as Hemedti, Sudan’s richest man and the owner of a private army that is the heir to the murderous legacy of the Janjaweed, infamous for their crimes against humanity in Sudan’s troubled Western region, Darfur.

According to three independent sources, the cargo was high-end surveillance technology, made in the European Union, with the potential to tip the balance of power in Sudan thanks to its capacity to turn smartphones into audio-visual informants on their owners. When news of its arrival reached Hemedti’s rivals the equipment was seen as so dangerous that an RSF commander speaking on condition of anonymity said it was smuggled out of Khartoum to the militia’s stronghold in Darfur to prevent its seizure by the army.

Sudan, Africa’s largest country prior to civil war and partition, is in fragile transition from decades of military dictatorship under Omar al-Bashir — now in prison awaiting possible extradition to the International Criminal Court. Waves of popular protests in Khartoum in 2019 resulted in a civilian council that shares power uneasily with the military. On paper, Hemedti is second in command to Abdel Fattah al-Burhan, commander in chief of Sudan’s Armed Forces. In reality, the militia leader vies for outright control of the country. He commands Sudan’s gold industry, his soldiers fight for a price in foreign conflicts and he has forged links to Russia’s mercenary Wagner Group. Hemedti also met with Israeli intelligence twice since June 2021, with a private jet used by Mossad tracked to Khartoum. In the last year alone, RSF fighters have been implicated in enforced disappearances of protestors in Khartoum and indiscriminate shooting of civilians, including children, in Darfur.

The Khartoum flight opened a rare window on a secretive and lucrative business, linking the blood-soaked Sudanese militia to a cabal of powerbrokers in Greece, a corporate network spanning Cyprus, the British Virgin Islands and Ireland, and above all to a crisis spreading across the EU — the widespread availability of sophisticated software that can track and hack mobile phones worldwide, threatening democratic institutions and human rights defenders.

Lighthouse Reports and its partners Haaretz in Israel and Greece’s Inside Story have been investigating the activities of Intellexa, a spyware firm whose activities spread from Europe across much of the global south.  Months of digging into company records and interviews with confidential sources in multiple countries uncovered a network of companies connected to Tal Dilian, a former Israeli intelligence operative, who has bought up an array of sophisticated surveillance technology and established an EU foothold in Greece and Cyprus.

The eight-seater Cessna, which plays a significant role in Dilian’s operations, was revealed by a social media post from an Intellexa engineer – a selfie showing its subject aboard a jet with a grey leather and mahogany interior that left enough of a digital trail to isolate and identify that plane. Lighthouse Reports and partners have analysed and cross-referenced hundreds of flight records, linking the plane to key locations in Intellexa’s business, and combed dozens of passenger lists, along with corporate filings, employment records and other confidential and open source data. The findings conclusively connect the plane to Dilian, his known associates and employees in his company — including to Merom Harpaz, a central figure in his business network.

Intellexa, Tal Dilian and Merom Harpaz did not respond to requests for comment. No response was received from a Rapid Support Forces media inquiries address.

In tracing the movements of the Cessna in recent months as it criss-crossed Greece, Cyprus, Israel, the Middle East and Africa, the outlines emerge of an international scandal that destabilises the countries it lands in, all the while funnelling some of the world’s most dangerous technology into the hands of some of its most high-risk regimes.

“Equipping the RSF with sophisticated surveillance technology will not only exacerbate the brutal repression and killing of Sudan’s remarkably brave protestors and squash hopes for democracy in the region,” Anette Hoffmann, senior research fellow at the Clingendael Institute, told this investigation. “Such advanced spyware in the hands of the RSF will tilt the balance of power in favour of a ruthless former militia and Russia ally, bringing Sudan one step closer to an open confrontation with the country’s armed forces and increasing the risk of civil war.”

Publicity photo for the luxury villa complex where Tal Dilian lives in Cyprus

AOJ71H 18 May 2022 15:09 Larnaca DOF/220518 C750 -HSSK -LCLK

Returning from Khartoum that afternoon, the Cessna touched down in Larnaca, Cyprus, rolling to a halt outside the headquarters of a local aviation consultancy, Pegasus Flight Centre. Less than an hour’s drive away, in an exclusive suburb of Limassol, is a luxurious villa with an enticing kidney-shaped pool which the millionaire Israeli entrepreneur, Dilian, shares with his wife, Sara Hamou, a Polish corporate offshoring specialist.

Since leaving the Israeli army’s elite Unit 81 intelligence division, which he commanded, Dilian has specialised in surveillance tools. Basing himself in Cyprus, he first built a pioneering phone tracking firm called Circles, which he sold in 2014. He also went into business with an Israeli community leader in Cyprus, Abraham Shahak Avni, part owner of Pegasus Flight Centre.

For Avni, aviation is a fragment of a diverse portfolio. He describes himself as “a visionary entrepreneur, investor and philanthropist” whose interests span medical services, robotics, autonomous drones and intelligence products for law enforcement agencies. In partnership with Avni’s company CIS, Dilian set up a wifi interception firm called WiSpear, and kitted out a van with millions of dollars’ worth of surveillance equipment, which he began to exhibit at industry trade fairs in 2017.

Two years later, Dilian and Avni launched a more ambitious project: an “intelligence alliance” designed to “completely encompass” the needs of government agencies. The press release announced a “one-stop-shop”, a group of companies that could offer infection of devices and data extraction, wifi traffic interception, open source datamining, covert social media activities and phone geolocation, along with high powered big data analysis to make sense of it all.

In preparation for this Dilian had gone on a spending spree. He purchased Cytrox, a Hungarian and North Macedonian startup which developed phone hacking software called Predator. He brokered a marketing deal with French interception firm Nexa and invested in other companies in the area of cyber intelligence.

By uniting the capabilities of different industry niches under one roof Dilian hoped to rival the biggest players in the mercenary spyware market — in particular Israel’s NSO Group, now notorious for their Pegasus hacking software. The new alliance was to be called Intellexa.

Asked to explain the difference between NSO and Intellexa, a senior source in Israel’s offensive spyware industry said: “NSO worked in accordance with Israeli law and at times even on behalf of the state of Israel. Ethically both this firm and the Israeli policy were questionable as sales were made to oppressive regimes — but it was regulated. Intellexa on the other hand does not follow Israeli law and sells to similar but also worse clients — including those that are a risk to Israel’s own national interest. A company that does not abide by Israeli law and is not subject to any regulator is de facto a pirate organisation.”

In a sign of things to come, Intellexa’s birth into the world was accompanied by chaos. Dilian evidently intended it to be based in Cyprus, according to an undated name registration in the country’s corporate filing system. But before the paperwork was completed, the plan blew up in his face. In August 2019 he gave an on-camera interview to Forbes, in which he touted his multi-million dollar spy van, claiming it could “hack a smartphone and snoop on all the messages within” — even those protected by encrypted apps like WhatsApp and Signal. He sent a couple of colleagues off on a walk outside the van, announcing “we will trace them, we will intercept them, we will infect them.” The video, in which Harpaz can also be seen, was not well received by some factions of the Cyprus establishment who were concerned that Dilian’s operation rivalled the national intelligence agency.

Amid claims of illegal data gathering, Dilian’s employees were arrested, offices raided and equipment impounded. As warrants were issued for himself and Avni, he signalled his intention to move his base of operations elsewhere. “No company can tolerate an unstable business and legal environment, which does not provide any protection against rumours affecting corporate activities,” he said.

Faced with arrest by the Cypriot authorities, Dilian was eager for a new corporate home and he had already been putting the foundations in place since 2019 a short plane-ride away in Greece. As the police investigation into his activities in Cyprus gathered pace, Dilian had already been reorganising his business and putting Intellexa to work on behalf of his new hosts.

Photos: Reuters/Yiannis Kourtoglou, Ints Kalnins, AP/Yiannis Panagopoulos, Wikipedia, social media profiles. Art: Haaretz

AOJ71H 12 April 2022 18:41 Athens DOF/220412 C750 -LCLK -LGAV

The Cessna arrived in Athens the day after the fuse was lit on a slow-burning scandal that would come to engulf the whole of Greece’s political elite, one of its leading businessmen and a handful of other notables. The fuse was Thanasis Koukakis, a veteran business reporter described by colleagues as “dogged”, who has worked with international media including the Financial Times.

Koukakis had long suspected that his phone was tapped but discovered instead that it was also infected with Intellexa’s Predator software. Whereas spying on journalists might have provoked an outcry elsewhere in the EU, Greece is now the lowest placed European country in the rankings on media freedom published by the international watchdog Reporters Without Borders. Koukakis turned to Inside Story, a partner in this investigation, and one of the few independent investigative teams in Athens. They verified the reporter’s account, assembled the evidence and put the story out but it was largely ignored.

The Greek government denied any knowledge of Predator, blaming private actors, while its supporters in the domestic media rubbished Koukakis’ claims of a deeper scandal, saying there was no evidence of other victims. Three days after the Predator revelation a second report emerged, this time from Reporters United – another pillar of Greece’s nascent investigative scene. It published documents that showed Koukakis had been wiretapped by Greece’s intelligence agency (EYP) a year prior to his phone being infected with spyware.

The government refused to elaborate on the “national security” concerns that prompted them to intercept the calls of a respected journalist. And the EYP connection was even more troubling as the conservative government of Kyriakos Mitsotakis had changed the law within days of coming into power in 2019 to bring the intelligence agency under the direct control and oversight of the prime minister’s office — an office overseen by Mitsotakis’ own nephew, Grigoris Dimitriadis. This is the same Dimitriadis whom senior sources in Israel’s cyber industry said had previously held talks with NSO, the vendor of Pegasus.

Koukakis never believed he was alone in being targeted: “From the beginning, I considered it unlikely that such a complicated technical monitoring structure as Predator would have been set up by the Greek government to monitor only one journalist.”

The suggestion that Predator was trained on a single individual was rendered even less credible in the light of a cluster of internet domains, attributed to Intellexa’s subsidiary Cytrox, exposed by researchers from Meta and Citizen Lab, housed at the University of Toronto, Canada. This included dozens of domains mimicking Greek news sites. Lighthouse Reports used a domain intelligence database to catalogue the creation dates of the Greek lookalikes and discovered an ongoing campaign of fake news site registration, running from summer 2020.  While the domains masqueraded as legitimate news sources they were in fact malicious sites that injected malware into the devices of unsuspecting visitors. Koukakis’ phone was infected after clicking on one of these links.

Documents seen by this investigation show that many of these infected domains were registered by a developer and known associate of Tal Dilian in the Czech Republic. Meanwhile, company records show that, as he moved his office out of Cyprus, Dilian had assembled a bewildering tapestry of Intellexa-linked companies spanning multiple other countries.

Dilian created his corporate network through a number of intermediaries — principally Hamou, a former senior advisor at an offshore trust specialist, but also Felix Bitzios, a businessman whose work on bad debts at Piraeus Bank was the subject of Koukakis’ reporting in 2019. Three companies called Intellexa were registered, in Greece, Ireland and the British Virgin Islands. All three were owned by an Irish holding company, Thalestris. As Inside Story dug into company registers in Greece and Cyprus they found that Thalestris also controlled companies named Apollo, Hermes, Mistrona, Dernova, Lorenco and Feroveno — some of which were seemingly registered to a rubble-strewn vacant lot in downtown Limassol. Thalestris, in turn, was partly dependent on money from another Virgin Islands entity, Chadera Enterprises, which — behind a veil of anonymity — was ultimately controlled by Dilian and two of his associates, leaked documents reveal.

Although the Thalestris holding company kept control of most of these Greek and Cypriot subsidiaries, there were two exceptions when key associates of Dilian’s work in Greece were given a piece of the pie, corporate filings reveal. Lorenco was sold to Intellexa’s top executive in Greece, Merom Harpaz, while a 35% stake in the Greek Intellexa company went to Dilian’s fixer, Felix Bitzios, via another Cyprus-based company, Santinomo.

The baffling structure served to obfuscate the links between Dilian and Intellexa, shrouding the group’s accounts in a near-impenetrable smokescreen. But on the ground, some facts remained the same as before. Feroveno, for example, shares a telephone number with Avni’s personal assistant — who corresponded with executives of Italy’s Hacking Team about the purchase of interception software in 2013; who wrote on behalf of Dilian requesting Cypriot government assistance in closing a deal with the Netherlands in 2019; and who also acts as operations director of Pegasus Flight Centre, outside which the white Cessna parked on its return from Sudan.

Following months of meticulous paperwork, Dilian’s arrival in Greece seemed to meet with success. The company’s Greek office near the abandoned airport and former refugee camp, Hellinikon, grew rapidly, expanding to a dozen employees. It was also used as a training centre and even had an area with prayer mats for those coming from Muslim countries. Flight records show the Cessna shuttling regularly between Athens, Larnaca and potential clients in the Middle East and elsewhere.

The Clarion Congress Hotel, Prague, site of ISS World Europe

AOJ71H 15 June 2022 8:01 Prague DOF/220615 C750 -LCLK -LKPR

As the white Cessna parked up in the Czech capital it was not alone on the tarmac. Delegates at the ISS World conference, hosted in an imposing business hotel east of Prague’s historic centre, were jetting in for Europe’s premier spyware trade fair. Sometimes known as the “souk of spooks”, it is a bustling marketplace for police and intelligence agencies from around the world to purchase new tools, and for the intercept companies to demonstrate them. Attendance is strictly limited to government employees and contractors, who rub shoulders and talk shop over colourful smoothies, flutes of sparkling wine and dainty pastries.

This year’s get-together came at a time of heightened European concern about the surveillance industry. The previous summer, a media consortium had thrown a spotlight on NSO Group’s Pegasus software, showing how it had been indiscriminately used by the company’s clients to hack the phones of human rights activists, politicians and journalists. As a result, the company had been sanctioned by the US and was now — along with the industry as a whole — the target of an ongoing inquiry at the European Parliament. At the opening ceremony In Prague, however, the industry’s bête noir was warmly welcomed as “the very famous NSO Group”.

Behind closed doors, salespeople gave government delegates demos of how their products could gather WhatsApp contact data, hoover up internet browsing records and track and hack phones. There were so many interception devices at work in the space that delegates’ phones weren’t functioning properly. “I can only get 2G reception,” one of the trainers complained, referencing the downgrading of mobile signal that often accompanies attempts to grab personal data from a device. Others preferred to just leave their phones at home. Slogans around the room promised the prevention of “past and future crimes”, a safer world, and the ultimate triumph of truth and justice. Intellexa, one of the event’s sponsors, shared a thronged back room with rivals like Rayzone, Septier, Cleartrail and NSO.

A leaked business proposal — dated shortly after the Prague fair — outlined the capabilities of Dilian’s new flagship product. Predator was expanded and rebranded as the Nova Remote Intelligence and Analytics Solution. The system comprised “a fully functional standalone cyber intelligence platform with social engineering tools.” This is industry jargon for tools which fool people into clicking on malicious links, thinking they come from friends or other trusted sources. It offered “one-click infection via multiple attack vectors”, licenced for 10 targets at once, with a “magazine of 100 successful infections”. The price tag, including “remote data extraction”, project management and 12 months warranty, was $8 million.

Intellexa was clocking up air miles in the search for customers. In the months leading up to Prague, the white Cessna set off from Greece and Cyprus to visit Dubai, Abu Dhabi and Riyadh. Confidential documentation seen by Lighthouse Reports and partners shows that the company was also pushing hard for deals in Africa, and had engaged a network of known arms dealers to offer its products across the continent. As well as Sudan, the target client list included Mozambique, Angola, Kenya and Equatorial Guinea.

Inside the EU, governments are supposed to regulate any sales of surveillance technology to other countries. But authorities in Greece and Cyprus, when approached for this investigation, refused to disclose whether Intellexa or its associated companies have either applied for, or received, the requisite legal paperwork to actually carry out any non-EU sales.

The most recent set of published accounts for Thalestris, Intellexa’s Irish holding company, declared $35.6m of sales, over three quarters of which were in the Middle East. But two sources with knowledge of the company’s finances said that it had made sales of nearer $200m over the last three years.

While Intellexa’s stock was high at the industry event in Prague its activities on the ground were once again destabilising its host country. Since the revelation of the hacking of the journalist Koukakis in April, the Greek government repeatedly denied any role in or knowledge of the spyware operation. But Greece’s small independent media organisations refused to let go of the story, and its denials were looking increasingly threadbare.

RSF fighters in Darfur: Klaas Van Dijken, Lighthouse Reports

AOJ71H 4 August 2022 15:12 Tel Aviv DOF/220804 C750 -LGKR -LLBG

The arrival of the white Cessna in Tel Aviv was not unusual. Along with Athens and Larnaca, Ben Gurion airport was its most regular stopover. But what happened next was highly unusual, as the jet remained on the ground for 10 weeks. Back in Athens, what was now becoming known as “Greece’s Watergate” was reaching boiling point.

The effort to portray Koukakis as an isolated victim fell apart on July 26 when opposition leader and MEP Nikos Androulakis had his phone checked at the European Parliament as part of a security sweep. The device was found to have received the same infected message as Koukakis. Three days later Greece’s intelligence agency admitted it had also spied on Androulakis, leader of the socialist PASOK party, for a period in 2021, a repeat of the same doubling up of eavesdropping technologies that Koukakis suffered.

Meanwhile, Grigoris Dimitriadis, the prime minister’s nephew, de facto head of his office and overseer of the Greek intelligence agency, had been identified as the government’s connection to the spyware scandal in early June.

Now, as the Cessna sat on the tarmac at Ben Gurion, Reporters United produced evidence of his business links to Felix Bitzios, Dilian’s fixer and the part owner of Intellexa in Greece.

The “tall guy”, as Dimitriadis is referred to in the Greek press, resigned without giving any reason on August 5. The head of Greece’s intelligence agency, Panagiotis Kontoleon, followed suit. The government denied Dimitriadis’ exit had anything to do with Intellexa’s activities and said Kontoleon stepped down owing to failures in legal surveillance activities.

GRIGORIS DIMITRIADIS AND FELIX BITZIOS DID NOT RESPOND TO REQUESTS FOR COMMENT.

The two departures came as a jolt after a series of supine domestic investigations had skirted the core issue of who was operating the Predator hacking software in Greece. The Greek National Transparency Authority, one of three official probes, concluded that there was no contract between the state and Intellexa but did this without looking at Intellexa’s bank accounts. It delayed two months before visiting the company’s offices and failed to meet with any of its legal representatives. Similar shortcomings marked the parliamentary inquiry, led by members of the ruling party, which refused to call key witnesses, and in October cleared the prime minister of any knowledge of the spying affair.

The emerging crisis in Greece also dragged the attention of a European parliamentary committee away from the Pegasus scandal it had been set up to probe. In early September the PEGA inquiry staged a hearing in Brussels on events in Greece where Koukakis gave testimony. In early November its members spent four days in Greece and Cyprus seeking evidence on whether European laws had been broken. A senior Greek government official, who asked not to be named, summed up the contempt in which the mission was held: “We piss on PEGA,” he said.

PEGA’s rapporteur, Sophie in ‘t Veld, described the Greek government denials as “implausible” and asked why there has been no police investigation into Predator. As it stands, “it’s like catching somebody with their lips covered in chocolate and crumbs, claiming that they were never near the cookie jar”. The spyware market, she said, poses a threat to democratic institutions in Europe and around the world. “This stuff is like gangrene. It will infect one part of the body and then spread. You cannot contain it.”

With any strategy to contain the scandal now in tatters and the circumstantial evidence all-but overwhelming the Greek prime minister’s repeated denials, the corrosive effect of powerful spyware technology on even developed democracies is on full show. On November 5 the tabloid newspaper Documento published the first 35 names on what it claims is the full list of the Predator targets in Greece. Every Sunday the roll call is added to and now includes serving cabinet ministers, the inner circle of a powerful shipping and media tycoon, a popular comedian, friends of the prime minister’s wife, senior military figures and the country’s most respected newspaper editor. The list goes on.

While this new Sunday ritual is heavy on sex, lies and blackmail, it provides almost none of the evidence and sourcing that marked earlier independent reporting. So far none of those named have publicly confirmed whether they were infected.

Greece’s government has vowed to impose some form of ban on the sale of spyware but has not moved with any seriousness to close down the spyware operator on its doorstep. The white Cessna has resumed its shuttle runs with brief stops in North Africa and Switzerland. Four thousand kilometres away to the south and east in Sudan’s Jebel Marra, the mountain range that rises above Darfur, sources confirm that the surveillance system, bought from a company headquartered in the EU, is now operational.

Death Weapons: Inside a Teenage Terrorist Network

When Lukas F. walks onto the site of an abandoned army barracks in the summer of 2021 as part of his training to be a terrorist, he is 16 years old, a slender boy with dark hair.

The site is about 45 minutes from the center of Potsdam, a city just southwest of Berlin, Germany. Once it was used by the Wehrmacht, Germany’s regular armed forces during World War II; later by the Soviets. There are lakes close by, popular with swimmers.

A roar of thunder echoes across the yard, a fireball flashes. First one bomb goes off, then a second.

Lukas F. films the explosions on his mobile phone. Months before, he set up a group for young neo-Nazis from multiple countries who think they are fighting a “race war.” In their online chat, Lukas F. — a pseudonym used to protect his identity as a minor — describes these bombs as a test for the group.

Lukas F. is part of a network of young people from all over the world, teenagers who exchange far-right ideas, Nazi propaganda and videos of attacks and, in the process, egg one another on to the point where some of them come to believe they must take up arms against the liberal order.

There are dozens of groups like this, linked in an international network stretching from the west coast of the U.S. to Western Europe and the remotest corners of the Baltic states.

The groups give themselves martial names, inspired by the propaganda of the National Socialists. The most prominent among them in terms of membership calls itself the Feuerkrieg, or Fire War Division (FKD). Lukas F. from Potsdam, now 17 years old, is not just a follower: he set up his own group, closely tied into the network and called it Totenwaffen, or Death Weapons.

Reporters from Welt am Sonntag, POLITICO and Insider spent more than a year investigating the inner workings of this far-right terrorist network. Using fake identities, they gained access to about two dozen of its chat groups, spoke with insiders and secured more than 98,000 messages, including photographs and videos. In the process, they also uncovered death lists, death threats against politicians and journalists, and instructions on how to make bombs and use 3D printers to produce weapons parts.

In the course of this investigation, the editorial teams were able to identify the real names of some of the group members, including that of Lukas F., who concealed himself online behind changing pseudonyms. His case shows how teenagers as young as this can become so radicalized that they talk of committing murder. It also reveals the role played by the network in the background, and why the security services find it so difficult to break it up.

School trip to Sachsenhausen

According to sources in his circle, Lukas F. was born in Belarus. His mother is Belarusian, his father a Kazakh of German origin. The family moved to Potsdam when Lukas F. was a toddler; later, two more sons were born. Even now, Lukas F. still shares a bedroom with one of them in their parental home in an apartment block in the centre of Potsdam.

There are childhood photos of Lukas F. on the internet, uploaded by his relatives. Birthdays with plastic party beakers, a family holiday in Poland, proud grandparents. In one of these photos, Lukas F. is sitting on a military vehicle with one of his brothers and their father, and a source said that the family went to a firing range when on holiday in Belarus, with the boys being allowed to join in the shooting.

The family still has relatives in Belarus and there are indications that they have a house there, too. Lukas F. once wrote that he kept a gun there, which another person close to him said was an air rifle belonging to the family.

In Potsdam, Lukas F. attended a secondary school where, according to several of the staff, he was not known for his diligence. However, he did once volunteer as a guide for a school exhibition, they say. The exhibition was about right-wing extremism, and Lukas F.’s role was to talk visitors through a display board of far-right symbols.

Even at this early stage, according to a source, Lukas F. was often on his computer and spent a lot of time on Discord, a social platform for fans of video games. There, he and others of his ilk harassed gays and lesbians.

At the age of 15, Lukas F. went on a school trip to the Sachsenhausen concentration camp. The aim of such visits was to teach children about Nazi atrocities and the dangers of Nazi ideology. But, as his brother later tells the reporters, for Lukas F. the concentration camp visit was a turning point. When he got home, he changed the desktop image on his computer to a swastika.

Later, Lukas F. would write that he had first become aware of his “hatred” at the age of 14 or 15. “At first i doesn’t wanted [sic] it to be real that I’m a Nationalsocialist. But now I’m fighting for this.” In his chat group he describes the Holocaust as a “purge” and writes that he cannot understand how people can think it did not really happen: “It is real and it is right.”

At some point, Lukas F. creates a profile on a Russian social network. In his profile picture he is camouflaged, his face covered by a skull mask. At the top of his page he has written, “Cover the world in a bloodbath.” His parents are “friends” with him on this network, though there are no grounds to assume they share their son’s views. “Unfortunately, my father is a communist,” Lukas F. writes at one point.

The ideologue from the US

To understand what may be going on in the heads of young people like Lukas F., we need to cast our minds back a few years and to the other side of the Atlantic, to the U.S. state of Colorado, home of James Mason, now 69. Mason joined an American Nazi party when he was just 14 years old. Two years later, he was making plans to murder his headteacher, although in the end he did not carry them out. In the network of which Lukas F. is a member, Mason’s book, “Siege,” is considered a must-read. For many young far-right extremists, it is more important even than Hitler’s “Mein Kampf.”

In his book, Mason calls for liberal society to be plunged into civil war. This does not require the creation of mass organizations, he writes: It just needs individual assassins or tiny cells to carry out attacks on infrastructure, politicians or members of minorities. This will result in chaos and prepare the ground for a far-right revolution.

Mason and his ideas have gained many followers in the last few years: groups, cells and individuals, in Europe, Canada and the U.S.

Extremism researchers call this strategy “militant accelerationism.” Thomas Haldenwang, president of Germany’s Federal Office for the Protection of the Constitution, told the reporters that the Siege scene is increasingly gaining ground in Germany, too. “Young people especially, some of them still minors, are becoming followers. It is no longer unusual to find minors advocating violence or even planning acts of violence themselves.”

The list of attacks linked to this ideology is growing by the year. It includes the mass shooting at the Olympia shopping center in Munich in 2016 and the 2019 attack on a synagogue and a kebab shop in Halle. The attackers are lionized as heroes in the network chats, and their victim counts are turned into a contest, with the one who kills the most being declared the winner.

Arms factory in the bedroom

In the summer of 2020, a few months after his visit to Sachsenhausen, Lukas F. leaves the Potsdam secondary school and begins an apprenticeship. In November 2020 he sets up a chat group on the Telegram messenger service and calls it Totenwaffen. Its members include a few like-minded individuals whom he met on the Discord and Roblox gaming platforms. Lukas F. becomes the group leader – its Führer.

Between November 2020 and May 2021, nearly 100 users post messages to the Totenwaffen group. They come from many different countries, including Estonia, France and the U.S., and chat with each other in English. They have given themselves names like Maschinengewehr [Machine Gun], Kriegsmann [Man of War] and Joseph Goebbels Gaming.

On Telegram, they face no restrictions when sharing images of hacked-off heads among the group’s members.

These teenagers have moved on from video games. Toward the end of November, Lukas F. writes: “I remember when I said lets [sic] make a real terrorist group out of it” and adds that “more group members voted for the idea than against.”

That same day, a boy using the code name Edward posted a photo to the chat. It showed an MP40 submachine gun pointing toward a laminate floor. This was the standard weapon used by Hitler’s Wehrmacht.

Lukas F’s response: “Nice.”

From his digital tracks, Edward can be identified as a neo-Nazi living in Romania. At the end of 2020 he is just 13 years old. For a while he seems to be a kind of best mate to Lukas F., a younger brother in spirit. He and a user from Poland calling himself “Gas Jews,” seemingly 11 years old, were among the first to join Lukas F.’s chat group. Later, Lukas F. will describe the Totenwaffen group as a “teenager organisation,” a kind of junior unit.

Soon, new members of the group are required to take an oath, swearing that they will obey the orders of the leadership. This does not take the form of a solemn ceremony by torchlight, but is just a simple chat message, copy and paste. The new members also have to state whether or not they have read Mason’s book, “Siege.” For those who have not, the audio version is shared in the chat. It is 22 hours and 33 minutes long.

Group members praise the far-right terrorist who shot dead 51 people in two mosques in the New Zealand city of Christchurch in 2019: “Tarrant is a legend.”

They venerate Anders Breivik, the far-right terrorist who murdered 77 people in Oslo and on the holiday island of Utøya in 2011. One of them calls him a “saint.”

Two days after Edward posts his photo of the machine gun, his thoughts have turned to acquiring more weapons. He writes that he wants a 3D printer so he can print guns. Lukas F. suggests some models that would be suitable.

In a message posted in December 2020, Lukas F. makes it clear how far he himself is prepared to go: “I bet sometime I get so mad that I will place a bomb on the next location where Jewgela will do her speech.” He later clarifies that “Jewgela” refers to Angela Merkel, an anti-Semitic play on her first name.

In late February 2021, Lukas F. is making himself a uniform for a propaganda video he has been planning for months. He posts a series of photos in which he can be seen cutting a swastika from a piece of cardboard for use as a template. “Now i [sic] need to paint it,” he writes. There follows a photo of spray cans, and then one of a piece of red material with a white circle and a black swastika painted on it. That same day Lukas F. posts a photo of himself wearing the swastika as an armband in his bedroom in Potsdam.

One night in early March Lukas F. goes out spreading his propaganda in Potsdam. He puts up a poster with the words, “Rebel against the Jewish system.”

The fire warriors

To understand how this network of teenage terrorists works, we need look no further than Estonia.

In late 2018, a young boy living on the Estonian island of Saaremaa sets up a far-right group. He calls it Feuerkrieg Division and gives himself the alias “Commander.” He is just 11 years old. The group grows, with members all over the world.

These members, mostly teenagers and young men, chat about their murder fantasies, often in detail. The Feuerkrieg Division has been proven to be behind a long list of planned and attempted attacks worldwide:

U.S., 2019: Conor Climo, 23, is arrested in Las Vegas for plotting attacks on a synagogue and a gay bar. He is sentenced to two years in prison.

U.K., 2019: Police arrest Paul Dunleavy, 16, after he tries to procure a gun. He has been planning terrorist attacks. He is sentenced to five years and six months in prison.

U.S., 2019: Jarett William Smith, a soldier from Kansas, is arrested for planning an attack on a news station. He is sentenced to 30 months in prison.

Lithuania, 2019: Gediminas Berzinskas, 20, is arrested in Vilnius after trying to blow up an office building. He is sentenced to two years and four months in prison.

U.K., 2019: Luke Hunter, 21, incites terrorist attacks. He is sentenced to four years and two months in prison.

Germany, 2020: In the district of Cham, special forces arrest Fabian D, a 22-year-old electrician, at his place of work, for trying to build an assault rifle for use in an attack. He is sentenced to two years in prison.

All these young men were members of the Feuerkrieg Division, which has been classified as a serious threat by security forces worldwide. In the U.K. it was classified as a terrorist group in 2020, and other countries have followed suit. It also featured in the latest annual report of the German Federal Agency for Internal Security.

The Feuerkrieg Division is Lukas F.’s main source of inspiration. He frequently refers to it in the Totenwaffen chat group. In March 2021, for example, he writes that the group needs its own logo and that it should be based on the Feuerkrieg Division one — a skull.

An unequal battle

For the state authorities this is not a battle on equal terms. Groups disappear, only to pop up again. Group names and aliases are reused. The connections between group members are less the product of rigid organization than of shared ideology. The strength of the network lies in the fact that it is not a fixed group but simply a loose collection of individuals who can be based anywhere in the world. All they need is a computer, a mobile phone and a bedroom. And all they have in common is their ideology and their hatred: hatred of Jews, hatred of politicians, hatred of journalists.

According to the European law enforcement agency, Europol, it is this shift from a clear hierarchy to a loose collection of individuals that makes it so difficult to prosecute these groups: “In these complex situations we have to deal with individuals, since one or two individuals acting on their own initiative can pose a real threat.”

Miro Dittrich is an expert in far-right terrorism at the Center for Monitoring, Analysis and Strategy in Berlin, which systematically monitors far-right communications on Telegram. He said it took years for the authorities to start taking digital spaces seriously and that, even now, there is a lack of law enforcement. This has allowed a far-right terrorist sub-culture to develop there unhindered — a sub-culture easily accessed by minors. “Young people are starting to become radicalized much earlier,” he says. “By the age of 14 or 15 they have often already reached the end of a spiral of hatred.” The strategy of loosely connected cells and lone wolf attackers proposed by James Mason can be easily implemented by teenagers.

In democracies, there is also the issue of the age of criminal responsibility: the Estonian authorities were not able to prosecute the young “Commander” of the Feuerkrieg Division (FKD) because he was only 13. In February 2020, after police paid the boy a visit, the FKD announced its dissolution.

A year later, however, it turned up again, both in propaganda posters and flyers and on Telegram. It now had a new leader, another teenager from Estonia, still using the “Commander” alias. Everyone is replaceable.

The Iron Order

At 5:45 a.m. on May 8, 2021, Lukas F. writes in his group that he has just been out on patrol. He shares some photos of Totenwaffen propaganda posters that he has been putting up. One of them consists of a list of names: Jewish activists campaigning for transgender rights. Above it are the words, “Death to.”

He has hung one of these posters outside his old school, which he left about a year earlier. Next morning, when staff discover the poster, they report it and the police come. Now the police have a file on the Totenwaffen group, but it seems they do not know at this stage that it was Lukas F. who set it up.

Less than two weeks later, Lukas F. has a quantity of chemicals delivered to his parental home in Potsdam: a kilo of sulphur, 250 grams of magnesium powder and similar, purchased for less than €60 on Amazon. These are the chemicals that he will use to make the bombs he later tests at the abandoned army site.

A few days after Lukas F. posts the photos of his chemicals in the Totenwaffen chat, he announces a new coalition: “I’m happy to have Feuerkrieg Division on our side, Sieg Heil to our alliance!”

But there is more: the new “Commander” of the FKD is a member of the Totenwaffen group, and our investigations have revealed that he was in direct contact with Lukas F.

At the time in question, the FKD was creating a kind of terrorist umbrella organisation under the name “Iron Order.” An internal document from 2021, seen by the reporters carrying out this investigation, includes the logos of 11 groups that had signed up. They describe themselves as a “National Socialist coalition.”

One of them is Lukas F.’s Totenwaffen.

Many members of the groups in the Iron Order are active in multiple chat groups; it is a loose network and the boundaries are blurred. Lukas F., for example, also posts to the Inject Division, another member of the coalition. Inject Division was set up by a Texan who was arrested in May 2021 for planning a terror attack on a Walmart store.

Slow investigations

Later, Lukas F. starts thinking about how he, too, can acquire a firearm. An arms dealer has sent him photos of two guns and he posts them to the chat.

“First or second?” he asks.

“If you get the first one, get some spare magazines too,” writes Edward.

In the summer of 2021, Brandenburg police get a tipoff from another authority. Shortly afterward, officers search the family apartment and seize Lukas F.’s laptop and mobile phone, along with a Nazi Party flag and chemicals apparently left over from his bomb-making experiment.

The officers take Lukas F. to the police station, question him and let him go.

The seizure of his devices means that Lukas F. is no longer able to access his chat groups. Edward replaces him as head of the Totenwaffen. In the autumn of 2021 he, too, disappears — followed by the rest of the group. A rumor goes around the various far-right chat rooms that Edward’s mother has simply taken his mobile phone away.

The investigations then drag on for months. The reporters’ research shows that, at the time of writing, police have still not secured any evidence from the site where Lukas F. set off his bombs. One of the bombs shattered a concrete base into pieces that are still there. And the school to which Lukas F. returned one night was never warned of the potential danger by police, even though the far-right scene has produced several school attackers.

Last August, for example, a 15-year-old at a school in the Swedish town of Eslöv knifed a teacher in the stomach. In January this year a 16-year-old boy injured a teacher and a fellow student at a school in Kristianstad, in the south of Sweden, again with a knife. The two teenagers were in contact with each other — and documents from the Swedish investigations show that they moved in the same kind of circles as Lukas F. Both masked themselves with tube scarves on which lower jaws were printed. This mask is used by many members of the network around Lukas F. and the wider scene. It is both an identifier and a concealer of the wearer’s identity.

A response to an enquiry from a Left Party member of the Bundestag, Martina Renner, revealed that the German Federal Republic’s Joint Extremism and Terrorism Prevention Center, which includes the intelligence services and the police, discussed the Totenwaffen group four times last year and again repeatedly in 2022. The content of those discussions was strictly confidential.

The investigations carried out by the Brandenburg authorities have not as yet produced any results.

There have been arrests elsewhere, however: According to an Estonian intelligence report, two young men linked to the Feuerkrieg Division were arrested in the Baltic nation in October 2021. Information acquired by the reporters reveals that one of them is the second “Commander.” Two Americans then take the group over, and a Dutchman sets up a splinter group with the same name.

In late December 2021, when the investigations are still ongoing, Lukas F. turns up in the network chat groups again. He is trying to make contact with the Feuerkrieg Division, and wants to be admitted to an internal chat. The reporters have seen a private message he sent at that time to a trusted associate: “I had and still have big plans for Totenwaffen.”

In early 2022 Lukas F.’s mobile phone and laptop are returned to him.

The Brandenburg authorities involved in the investigation refuse to answer the reporters’ questions about all this. “The press’s right to information,” writes the local prosecutor general, “is limited by the interests of the persons in question, which take precedence and are entitled to protection.”

The interview

In March 2022 the reporters contact Lukas F. He writes that he does not want a face-to-face meeting but that the reporters can text him their questions.

So messages go back and forth, first for a whole day, then over several weeks. He writes that he cooperated with the police when they searched his home and that he “unfortunately” gave them his passwords — “because my mother was putting pressure on me.” But at least he now knows how to “hide from the government,” he writes.

He does not hide very successfully, however: In April he orders a copy of the 35,000-word manifesto of Theodore Kaczynski, the “Unabomber” who sent at least 16 parcel bombs in the U.S. between 1978 and 1995, killing three people. That same month, Lukas F. leaves a review of the manifesto online … using his full name.

The public prosecutor’s office in Brandenburg is still investigating him at this point, but does nothing. In their view, he does not pose an imminent threat.

In his texts to the reporters, Lukas F. writes: “I was prepared to do a lot.”

How much?

“No comment.”

Has he changed since then?

“No comment.”

Asked why he still posts to the old chats, he replies, “I know a few of the people, they’re very nice, I like them.” He writes that he is a “nationalist.”  He writes that he might give legal activism a try, maybe join a party. But first he’ll have to find a foothold. He writes that he has always had to sort everything out by himself: He even made his police statement without a lawyer present.

What if he is charged?

“Then I’m screwed.”

More recently, there has been some movement among international investigative authorities: Shortly before Easter 2022 a 15-year-old was arrested in Denmark, accused of being a member of the Feuerkrieg Division. Around the same time, several key players in the network disappeared and propaganda channels fell silent. Since then, there has been a little less activity in many of the chats. People in the movement assume that several of their comrades were all arrested at the same time, in the U.S., in the Netherlands.

But new groups have long since been set up.

Home visit

At the end of May this year, the reporters ring the doorbell of a flat on the eighth floor of an apartment block in the centre of Potsdam. The door is opened by Lukas F.’s parents. His mother is a petite woman who smiles a lot but says little. His father is wearing a sports brand t-shirt and does all the talking, demanding to know who these people are and why they have turned up unannounced.

The reporters tell him they know about the police search from the chats. And that they want to speak with Lukas.

“We’re already having a conversation,” said his father, “but OK” — and he disappears inside the flat. A moment later Lukas F. appears at the door. He is now 17 years old, thin, almost lanky. His eyes are cast downward, his dark hair comes down to his ears.

“Not interested,” he said, and slams the door shut. Afterwards he texts the reporters, telling them never to come back.

His parents do not say anything that day either. Later they write to refuse the reporters’ request for a meeting, though they do answer a few questions by text. In these replies, Lukas’ father said his son is a victim of puberty and of circumstances. He minimizes: “He’s never harmed anyone.” Lukas’s mother replies in Russian, saying she is shocked, horrified and does not understand how all this can be happening.

Several family members tell us there had been an argument earlier that day, and that the father had thrown away Lukas’ Nazi literature, including “Mein Kampf,” saying it was making him stupid.

In early June, the Brandenburg authorities take action. A special police unit arrests Lukas F. in his parents’ flat. He is now in prison somewhere in Märkisch-Oderland. The state security service has classified him as dangerous, someone who poses a real threat to the public. Officials are still investigating. They suspect him of having been preparing a “serious act of violence against the state”: a terrorist attack, in other words.

Shortly afterward, the reporters write to Lukas F. in prison, offering him another chance to comment. Their letter remains unanswered.

In recent months a new band of far-right teenagers has formed in Brandenburg. Their base is an abandoned house to which they have acquired access. They greet each other by forming the fingers of their right hands into an L and shouting, “Free L”: Freedom for Lukas.

This investigation is the result of a journalistic collaboration between reporters from POLITICO, Insider and Welt am Sonntag, working together as Axel Springer Investigations. The reporters used fake identities to infiltrate the network. They also spoke to insiders, scientists, terrorism experts, intelligence services, security authorities and leading figures in the network, and their families.