In the process of the threatening letters from "NSU 2.0", an officer from the State Criminal Police Office, who evaluated the computers seized in the apartment of the accused Alexander M., spent hours on Tuesday explaining in detail how the author of the letter, according to the investigation, proceeded.
Accordingly, numerous digital and content traces were found on the computers, from which Internet research on the victims resulted, individual threatening letters or fragments, private data of the addressees and notes on the procedure in a kind of "diary", as the investigator put it.
Anna Sophia Lang
Editor in the Rhein-Main-Zeitung.
Follow I follow
The officials couldn't get hold of everything because some of it is encrypted and hasn't been cracked to this day.
In addition to the Tor browser, M. also used anti-forensic tools that permanently delete files.
Some files were password protected.
False personal details were used for mail accounts, and "caller ID spoofing" was also used, which shows the person called a wrong caller.
The witness explained that when a computer's memory is full, content is randomly overwritten.
That's why not everything that was there can still be found.
Still found a lot
Nevertheless, the investigators found a lot: a link to a death threat against the lawyer Seda Basay-Yildiz, which only the creator of the document receives after registering in the program used for this purpose.
The user is called "NSU 2".
The investigators also found the blocked address of the threatened lawyer.
Also, one to one, the links to newspaper articles used by the writer of the threatening letters.
In the case of cabaret artist Christian Ehring, the exact file names of the photos from Ehring's passport and identity card, which also appeared in threatening letters, emerged.
The photos come from a leak in which data from celebrities was published.
The LKA officer also reported that research on the internet matched what was later mentioned in the threats.
The user of the computer dealt with the distribution of business at courts and with the structure of the police in Berlin, Frankfurt, Wiesbaden, Würzburg and Munich.
It is assumed that he did "social engineering" and obtained information from authorities and companies by making false statements.
Not only does the literature that was secured in Alexander M.'s apartment fit in with this, books like "The Art of Deception" or "Manipulate, but right".
But also notes that appeared in the "diary", among other things: There were specific instructions such as "Don't call there as a public prosecutor" or "Call Vattenfall again for a telephone number".
The calls went not only from an alleged police officer or public prosecutor to police stations and registration offices, but also to shipping service providers or energy suppliers.
The mail-order company Otto also appears, which is how customer numbers, telephone numbers and addresses were generated, the witness said.
Using the left-wing politician Anne Helm as an example, she showed how the computer user went from Googling the first time to entering the home address in Google Maps in two days of research.
It is unclear where he got the address from.
No hits anywhere
In addition, the witness described how the investigators were looking for networks of the threatening letter writer.
Names, nicknames, telephone numbers, personal data and keywords were used to search for clues to police officers from the 1st district in Frankfurt, as well as connections to the Hamburg and Berlin police.
But there were no hits.
Not even on the "PI-News" platform, where Alexander M. was active, as well as on a chess platform with profiles, some of which were amazingly similar.
They were called "Obersimulant", "Sudel-Ede", "Elefant im Porzellanladen" and others, and some had similar profile pictures.
The investigators also found logins to these accounts on the computers evaluated.
According to the official, no connections have been found to André M., who has since been convicted and who was behind the letters from the "state prank orchestra".
The "NSU 2.0" had indeed cleverly presented a connection to the imprisoned André M. and claimed a real duty of care, but despite cooperation with the LKA Berlin "no identification relationship" could be proven.
The witness said that M. chose "the camouflage coat of the police" by suggesting that he belonged to the police - by writing about his "police colleagues" or by referring to himself as "King of the 3rd duty group in the 1st precinct".
"He has acquired a fictitious perpetrator personality." The process will continue on Thursday.Keywords: