The Wiretap: How Law Enforcement Took Control Of The Dark Web's ‘Gmail'

Forbes

15-04-2025

The Wiretap is your weekly digest of cybersecurity, internet privacy and surveillance news. To get it in your inbox, subscribe here.
For people seeking to keep their communications away from the prying eyes of government and law enforcement, the dark web has provided a haven for years. One option was the Darknet Mail Exchange, or DNMX, which advertised itself as just like Gmail, but with one additional benefit: 'We don't care who you are and will never ask for your information or reveal your identity; this is the dark net after all.'
But in October 2023, all those promises of anonymity came undone as the Dutch police seized DNMX servers and began rummaging through users' emails. At the time, cops believed DNMX was being used for the trade of child sex abuse material, terrorist communications and narcotics trafficking. The Dutch national police declined to comment further on the seizure, other than to tell Forbes there was an investigation. 'We will do no further notices about the investigation,' said Netherlands Police spokesperson Thérèse Ariaans.
She declined to comment on whether or not the police let the service continue running to ensnare more criminals. Although the service is now down, according to the Wayback Machine, the main clearweb (i.e. non darknet) site for DNMX was still active last year. There have also been reports on social media of criminals continuing to message over the platform as recently as late summer 2024.
In recent years, investigators have run communications channels used by criminals, the most notable case being that of Anom, an encrypted app that was controlled by police. More recently, the FBI took over the online profile of a money launderer who went by the name ElonMuskWHM to track his clients, according to 404 Media.
Court documents show some darknet users had fretted that DNMX had been hit by a law enforcement raid in 2023, though no further information was forthcoming. On Reddit, an apparent note from the DNMX administrator from 2023 warned that DNMX email accounts were 'no longer in our control.'
Since the previously unreported seizure, Dutch investigators have been sharing their findings with all manner of other agencies, from Europol to American federal departments. In one case, they found a child sexual exploitation enterprise using DNMX that offered to pay people to produce illegal footage. In some cases, the DNMX user, whose illicit business was known as Newstarz, would offer to pay as much as $500,000 for a year's contract, or up to $50,000 for a series of images around a given narrative. It also offered an 'Elite Membership Level' that would provide 'sexual access to all models and families at meets,' according to court documents filed by the DOJ.
The DOJ is now prosecuting a former U.S. Marine Corps officer, Jonathan Laroche, for allegedly creating CSAM and selling it to the DNMX user behind Newsta, who remains unknown, according to a search warrant and a criminal complaint. Laroche, a former Navy detective who had been sentenced in a separate case for choking a detained sailor at Naval Base San Diego earlier this year, has not yet filed a plea for a new charge of producing CSAM. Neither his lawyer nor the DOJ had responded to requests for comment at the time of publication.
The owner of DNMX may have seen his service get taken down, but he promised in 2023 to offer a new one. 'The darknet needs a good email provider and I will bring a new one online soon,' according to the Reddit notice. It's unclear if that project ever bore fruit.
Got a tip on surveillance or cybercrime? Get me on Signal at [phone].
Chris Krebs, former CISA director. (Photo by Jim Lo Scalzo-Pool/Getty Images)
Getty Images
The White House has revoked clearance approval for Chris Krebs, former head of the Cybersecurity and Infrastructure Security Agency (CISA), and his employer SentinelOne.
Trump infamously fired Krebs in 2020 after he lost the election, blaming the ex-CISA director after the latter assessed there was no evidence of votes being compromised in any way. At the time, Trump had been on the warpath trying to undermine the election result.
The White House release doesn't mention that public fracas, but claimed Krebs was 'a significant bad-faith actor who weaponized and abused his Government authority.' Alongside claiming he was involved in hiding information on the Hunter Biden laptop saga, the Trump administration also alleged Krebs 'suppressed conservative viewpoints under the guise of combatting supposed disinformation, and recruited and coerced major social media platforms to further its partisan mission.'
Controversial forum 4Chan was inaccessible for many users on Tuesday amid claims it had been hacked and its user data released, including moderators' identities and email addresses.
Senator Ron Wyden said he will block Trump's nomination for the next CISA director, Sean Plankey, until the agency releases a report on what he alleged was a 'multi-year cover up' of security flaws at U.S. telecommunication companies, TechCrunch reports.
Chinese officials quietly acknowledged to U.S. counterparts in December that the country was behind attacks on American infrastructure, like ports, water utilities and airports, the Wall Street Journal reports. The admission came in December in a Geneva summit with the outgoing Biden administration.
Someone has blown the whistle on how DOGE is handling data at the National Labor Relations Board, the federal agency tasked with investigating complaints about unfair labor practices, NPR reports.
Silicon Valley residents may've gotten a shock over the weekend after hackers made audio-enabled traffic control buttons imitate the voices of Mark Zuckerberg and Elon Musk. According to a TechCrunch report, one Musk voice told passersby, 'I guess they say money can't buy happiness… I guess that's true. God knows I've tried. But it can buy a Cybertruck and that's pretty sick, right?'
'F—k, I'm so alone,' the Musk voice concluded.
Tailscale, which protects network traffic with a peer-to-peer mesh virtual private network, announced a $160 million Series C round, led by Accel with participation from CRV, Insight Partners, Heavybit, and Uncork Capital. Existing angel George Kurtz, CEO of cybersecurity giant Crowdstrike, put in again, alongside new investor Anthony Casalena, the CEO of Squarespace. The company, founded in 2019, claims some major AI customers, including Perplexity, Hugging Face and Groq.
A breach at the U.S. Office of the Comptroller of the Currency allowed hackers to spy on over 100 bank regulators' emails for over a year, Bloomberg reports. As a result, some banks, including JPMorgan and BNY, have paused sharing information with the agency.