Shortly after Pavel Durov, the founder of Telegram, was arrested by police in France last summer and accused of failing to prevent illicit activity on the app, a French law professor specializing in cybersecurity received online messages from a man name Isaac Steidl.
“I would like to talk to you,” said an email signed by Mr. Steidl, who introduced himself as the founder of the online chat site Coco. “My case is very similar to Telegram’s, as are the charges.”
Michel Séjean, the professor, who shared copies of the messages with The New York Times, said he did not know Mr. Steidl, had no interest in helping him and never responded. However, he was familiar with Coco, a website where anonymous users could chat without leaving a trace of the conversation.
French law enforcement had linked the site to thousands of criminal cases, including the recent trial of Dominique Pelicot and 50 other men, most of whom were convicted of raping Mr. Pelicot’s ex-wife while she was heavily sedated , and who had testified that they had first met him on the chat site.
French authorities had already shut down the website in June and messages addressed to Mr Séjean suggested Mr Steidl was worried about being targeted later.
Last week they did.
Like Durov before him, Steidl has been investigated for a series of criminal charges by authorities, mostly using a 2023 law that has made France a testing ground for an aggressive new approach to holding online platform bosses personally accountable .
The new law allows authorities to criminally prosecute people who operate the platforms and knowingly allow the exchange of illegal content, goods or services, while requiring users to remain anonymous or without retaining some user data.
Although some experts warn that the new law remains relatively untested in the courts, it has provided French authorities with a seemingly powerful new tool.
“The noose is tightening around the administrators of these types of platforms,” said Nathalie Bucquet, a lawyer for the French section of Innocence in Danger, a child protection organization that had called for Coco to be shut down.
Mr. Steidl, 44, did not respond to requests for an interview. But in the years before his indictment, he took measures that made it more difficult for French law enforcement to reach him. He abandoned his French citizenship, registered his website abroad and moved to Bulgaria.
Last week he was ordered to pay 100,000 euros in bail and barred from leaving France, requiring him to report regularly to a local police station.
Julien Zanatta, his lawyer, said Mr. Steidl willingly went to France to cooperate when the authorities summoned him. Mr. Steidl would “prove his innocence” and was “horrified” by reports of crimes linked to his platform, his lawyer said.
“He was shocked to find out what had been done by people who had abused his site,” Zanatta said.
Coco was first registered in 2005 with a simple homepage and a cute ’90s aesthetic, featuring a cracked coconut. It advertised itself as a “nice” chat forum that didn’t require users to create an account: they could log in by providing only their gender, age, zip code and screen name.
Users could chat directly or participate in forums, and the site made money by charging a small monthly fee for access to additional features. In the three months before the shutdown, the site’s monthly traffic reached more than 500,000 users, according to SimilarWeb estimates.
Crucially, the records of the anonymous conversations were not kept.
Over the years, authorities have repeatedly linked the site to criminal activity, and advocacy groups fighting child abuse and homophobia have become increasingly vocal in calling for authorities to shut it down.
Mark Pohlmann, president of a non-profit organization against cyber violence in France, interviewed by police as part of the investigation into Coco, said that during a search on the chat site posing as a female user, dozens of male users had contacted. seconds after logging in, often making sexual comments or asking for explicit photos.
French police and prosecutors say that from 2021 to 2024 the platform was implicated in more than 23,000 cases involving 480 alleged victims, including allegations of child sexual abuse, pimping, rape, drug trafficking, scams and murders .
At the Pelicot trial, Mr Pelicot said he met the other men on the website, in a private chat room called “Without His Knowing”. Most of the defendants denied ever seeing that particular chat room, but acknowledged meeting Mr Pelicot on the site before moving on to other platforms.
Several defendants at trial said they entered the site looking for paid sex or to buy and sell drugs. Christian Lescole, a professional firefighter and long-time user of the website, told the court it started as a space to discuss hobbies such as chess or music.
“But as the years went by, all the predators and scammers started coming to Coco,” said Mr. Lescole, who was convicted of the aggravated rape of Ms. Pelicot.
Even as the website’s notoriety grew, its founder remained in the shadows.
Mr. Steidl appears to live off the internet, but he has a very low profile online. His Facebook page is empty. His LinkedIn page is bare bones. It is unclear how carefully Mr. Steidl managed the website on a day-to-day basis. Two people identified as moderators of the site were arrested in July, but authorities have not provided details on their exact roles.
Born in the Vaucluse and raised in the Var, both areas of southeastern France, Steidl graduated with a degree in computer science from Toulon’s engineering university in 2003, the school’s head of communications said.
Mr Steidl owned the domain name coco.fr through a company called Zenco registered in Toulon in 2011. In 2022, during the investigation preceding the Pelicot trial, the investigating judge’s office contacted Zenco to request data relating to the case. But he never received a response, according to an overview of the case by the judge.
Shortly thereafter, Ms. Steidl began withdrawing his company, his website and himself out of France.
In October 2022, according to the Internet archives of the French National Library, coco.fr redirected traffic to coco.gg, indicating that it was registered on Guernsey, an island in the English Channel.
Then, in 2023, Zenco closed, according to public affairs records. That same year, in April, Mr. Steidl renounced his French citizenship, government records show. His lawyer says he is an Italian citizen.
And at some point he moved to Bulgaria, where a company called Vinci LTD was associated with the site in March 2024, according to information gathered by Domaintools. Vinci is owned and operated by Mr. Steidl, according to Bulgarian company records.
But in June, after an 18-month investigation across Europe, French authorities shut down the site. Two of the site’s servers were seized in Germany, bank accounts were frozen in several European countries and police seized 5 million euros. French law enforcement questioned Mr. Steidl in Bulgaria, although he had not been charged at the time.
Séjean, the expert contacted by Steidl, said that the 2023 French law – and the creation in 2019 of a specialized national cybercrime unit – had allowed French prosecutors to take a less piecemeal approach in targeting online platforms suspected of enabling the development of illicit activities.
“Before 2023, you couldn’t solve it in one fell swoop, it was analyzed on a case-by-case basis,” said Séjean, who teaches at the Sorbonne University in Paris North.
Lawyer Bucquet stated that the new law “significantly facilitates” the work of the police because “the mere knowledge of the illicit nature of the content justifies criminal liability on the part of the administrator”.
But some critics say applying the new crime to Mr. Steidl’s website may be excessive, and that while the law has allowed prosecutors to bring charges quickly, future convictions are uncertain.
Alexandre Archambault, a lawyer experienced in cybersecurity and digital security cases, noted that the first conviction under the new law, in November, was against the creator and administrator of a Telegram group that shared child pornography — not against Telegram himself or his managers.
“Does this broad interpretation of the crime comply with European law?” Mr. Archambault said. “I doubt it.”
Mr Steidl’s lawyer said his client was unfairly targeted.
“There are regularly sites that are diverted from their purpose to commit crimes, and the people responsible for these sites are never prosecuted for complicity,” he said.
According to French and European rules, platforms that host online content cannot be held responsible for what users post and have no obligation to monitor any illegal content in advance.
But they must also have procedures in place that allow people to report such content for removal and ensure a certain level of cooperation with authorities – which was not the case with Coco, according to French prosecutors, who said this shows “a noted lack of moderation.”
For now, though, some advocacy groups say shutting down the website wasn’t enough.
“The day they shut down Coco, I sent the police an email with a list of over 100 similar websites,” said Pohlmann, the nonprofit’s president. “It’s like saying that closing down a drug deal in Marseille solves the drug trafficking problem in France.”
“The coconut is the tree that hides the forest,” he said.
Councilor Liz contributed a report from Paris, Michael H. Keller AND Jennifer Valentino-DeVries from New York.