Not long after, there was Pavel Durov, the founder of Telegram arrested by police in France last summer and accused of failing to prevent illicit activity on the app, a French law professor specializing in cybersecurity received online messages from a man named Isaac Steidl.
“I would like to talk to you,” said the email signed by Mr. Steidl, who introduced himself as the founder of the online chat site Coco. “My case is very similar to Telegram’s, and so are the allegations.”
Michel Séjean, a professor who shared copies of the messages with The New York Times, said he did not know Mr. Steidl, had no interest in helping him and never responded. However, he was familiar with Cocoa — a website where anonymous users can chat without leaving a record of the conversation.
French police have linked the site to thousands of criminal cases, including recent trial of Dominique Pelicot and 50 other men, most of whom were convicted of raping the ex-wife of Mr. Pelicota while she was heavily sedated, who testified that they first met him on a chat page.
The French authorities already closed the website in June, and the messages of Mr. They suggested to Séjean that Mr. Steidl worried that he would be attacked next time.
Last week they did.
Like Mr. Durov before him, Mr. Steidl was placed under investigation on the raft of criminal charges authorities are mostly using the 2023 law that made France a testing ground for an aggressive new approach to holding top positions on online platforms personally responsible.
The new law allows authorities to prosecute those who operate platforms and knowingly allow the exchange of illegal content, goods or services, while also requiring users to remain anonymously or until it stores certain user data.
While some experts warn that the new law remains relatively untested in the courts, it has given French authorities a seemingly powerful new tool.
“The noose is being tightened around the administrators of this type of platform,” said Nathalie Bucquet, a lawyer for the French branch of Innocence in Danger, a child protection organization that called for Coco’s closure.
Mr. Steidl, 44, did not respond to requests for an interview. But in the years leading up to his indictment, he took steps to make it harder for French police forces to track him down. He gave up his French citizenship, registered his website abroad and moved to Bulgaria.
Last week he was ordered to pay 100,000 euros ($102,000) bail and banned from leaving France, with an obligation to report regularly to the local police station.
Julien Zanatta, his lawyer, said Mr. Steidl had voluntarily traveled to France to cooperate when summoned by the authorities. Mr Steidl would “demonstrate his innocence” and was “appalled” by reports of crimes linked to his platform, his lawyer said.
“He was upset when he found out what the people who abused his site had done,” said Mr. Zanatta.
Coco was first registered in 2005 with a plain homepage and a cute nineties aesthetic, with a cracked coconut. It advertised itself as a “nice” chat forum that didn’t require users to create an account – they could access it by just providing their gender, age, zip code and a nickname.
Users could chat directly or join forums, and the site made money by charging a small monthly fee to access additional features. In the three months before it was shut down, the site’s monthly traffic reached more than 500,000 users, according to SimilarWeb estimates.
Crucially, no records are kept of anonymous conversations.
During the years of government multiple times tied place criminal activities and advocacy groups that fight child abuse and homophobia became increasingly vocal in demanding that the authorities shut him down.
Mark Pohlmann, president of a non-profit organization against cyberbullying in France — who was interviewed by police as part of the Coco investigation — said dozens of male users contacted him within 30 minutes while he was conducting research on the chat site posing as a female user. seconds of logging in, often making sexual comments or asking for explicit photos.
French police and prosecutors say that from 2021 to 2024, the platform was implicated in more than 23,000 cases involving 480 alleged victims, including allegations of child sexual abuse, pimping, prostitution, rape, drug trafficking, fraud and murder.
At the Pelicot trial, Mr Pelicot said he met the other men on a website, in a private chat room called “Unbeknownst to her”. Most of the defendants denied ever seeing that particular chat room, but admitted they had met Mr. Pelicot on the site before moving to other platforms.
Several of the defendants at trial said they came to the website looking for paid sex or to buy and sell drugs. Christian Lescole, a professional firefighter and long-time user of the website, told the court it started as a space to discuss hobbies such as chess or music.
“But as the years went by, all the predators and scammers started coming to Coco,” said Mr Lescole, who was convicted of aggravated rape of Ms Pelicot.
Although the website was gaining notoriety, its founder remained in the shadows.
It seemed that Mr. Steidl makes a living from the internet, but has a very low profile online. His Facebook page is empty. His LinkedIn the page is blank. It is unclear how much Mr. Steidl managed the website on a day-to-day basis. The two people identified as moderators of the site were arrested in Julybut authorities did not detail their exact role.
Born in Vaucluse and raised in the Var, both areas of southeastern France, Mr. Steidl graduated from the Toulon University of Engineering’s computer science program in 2003, the school’s communications chief said.
Mr. Steidl owned the domain name coco.fr through the company Zenco, which was registered in Toulon in 2011. In 2022, during the investigation leading up to the Pelicot trial, the investigating judge’s office contacted Zenco to request information related to the case. But he never received an answer, judging by the review of the case.
Soon after, Ms. Steidl began pulling her company, her website and herself out of France.
Until October 2022. coco.fr was redirecting traffic to coco.ggaccording to internet archives in the French National Library, which shows that it is registered in Guernsey, an island in the English Channel.
Then in 2023, Zenco closed, according to public business records. The same year, in April, Mr. Steidl renounced his French citizenship, government records show. His lawyer says he is an Italian citizen.
And at some point he moved to Bulgaria, where a company called Vinci LTD was linked to the site in March 2024, according to information collected by Domaintools. Vinci is owned and operated by Mr. Steidl, according to Records on the registration of Bulgarian companies.
But in June, after an 18-month investigation across Europe, French authorities shut down the site. Two website servers were seized in Germany, bank accounts were frozen in several European countries, and the police confiscated 5 million euros. French law enforcement officials questioned Mr. Steidl in Bulgaria, although he was not charged at the time.
Mr. Séjean, an expert whom Mr. Contacted, Steidl said the French law from 2023 — and the creation in 2019 of a specialized national cybercrime unit — allowed French prosecutors to take a less gradual approach in targeting online platforms suspected of allowing illicit activity to flourish.
“Before 2023, you couldn’t get there in one fell swoop, it was taken apart on a case-by-case basis,” said Mr. Séjean, who teaches at Université Sorbonne Paris Nord.
Ms. Bucquet, a lawyer, said the new law makes policing “greatly easier” because “only knowledge of the illicit nature of the content warrants criminal liability on the part of the administrator.”
But some critics say applying the new offense to Mr. Steidl’s website could be overreaching, and that while the law allowed prosecutors to file charges quickly, future convictions were uncertain.
Alexandre Archambault, a lawyer with experience in digital and cyber security cases, pointed out that the first conviction under the new law, in Novemberit was against the creator and administrator of a Telegram group that shared child sexual abuse material – not Telegram itself or its executives.
“Is this extensive interpretation of the crime in line with European law?” said Mr. Archambault. “I doubt it.”
Mr. Steidl’s lawyer said his client had been unfairly singled out.
“There are regularly sites that are diverted from their purpose to commit offences, and the people in charge of these sites are never prosecuted for complicity,” he said.
According to French and European rules, platforms that host online content cannot be held responsible for what users post and have no obligation to proactively monitor any illegal content.
But they must also have procedures in place to allow people to flag such content for removal and to ensure a certain level of cooperation with authorities – which was not the case with Coco, according to French prosecutors, who said it showed a “notorious lack of moderation”.
For now, however, some advocacy groups say shutting down the website hasn’t been enough.
“The day they shut down Coco, I sent the police an email with a list of over 100 similar websites,” said Mr. Pohlmann, the nonprofit’s president. “That’s like saying that closing the drug-dealing place in Marseille solves the drug-trafficking problem in France.”
“The coconut is the tree that hides the forest,” he said.
Liz Alderman contributed reporting from Paris, and Michael H. Keller and Jennifer Valentino-DeVries from New York.
