How Police Busted Shiny Flakes, Germany's Biggest Online Drug Market

The trial of Maximilian S., the alleged operator of the online drug market Shiny Flakes, began Monday in Leipzig. While the authorities continue trying to auction off the 1,197 bitcoins seized from his 10 wallets, his lawyer, Stefan Costabel, is pouring over the many boxes of investigation files, preparing for what may be his hardest defense ever.

Maximilian is accused of dealing at least 914 kilograms of drugs worldwide over a period of 14 months. Maximilian allegedly didn't just sell basically all illegal substances (except for heroin), he also dealt in a large variety of prescription drugs. Authorities discovered these along with enormous amounts of MDMA, speed, cocaine, LSD, hash and 49,000 euros in cash, as well as digital scales and vacuum sealing machines, in his room in an apartment in Leipzig where he lived in with his mother and his stepfather. It was one of the biggest drug busts in German history.

People following the case have asked how the police were able to shut down the expansively-networked drug empire so quickly. Our research over the past months has shown that investigators didn't get onto Maximilian's trail in the way they purported to do so during a press conference they gave—basically, by using their supposed cybercrime expertise—but rather were able to find him using traditional investigative measures. Also, plain luck played a big role. We are now able to trace how the seizure was executed thanks to new information provided exclusively to Motherboard Germany.

Two mistakes sealed Maximilian's fate. One was the insufficient postage on a package that focused investigator's attention on Leipzig. The other was laziness: Maximilian kept using the same package station that was situated close to his house to send and receive drug parcels. He would take taxis to package station 145, which was under video surveillance. He always ordered these taxis using a cell phone he used exclusively for this purpose. More than a dozen cell phones and more than two dozen SIM cards were discovered in his room, demonstrating a high amount of effort put into logistics and organization, which continuously grew as the volume of his business did—allegedly hitting 4.1 million euros revenue per year as of February 2015. It's hard to imagine the amount of pressure the dealer must have been under.

Another thing that stood out to investigators was the routine nature of his deliveries. According to prosecutors, a courier from the Netherlands drove to the Gohlis district of Leipzig each Thursday to replenish Maximilian's supply of drugs—investigators knew this from watching the package station and the entrance to his house. On February 24th, the authorities allowed Maximilian to meet the courier to receive 25,000 ecstasy pills, 20 kilos of hash, 10,000 doses of LSD and 27 kilos of amphetamine without incident. After the drop, the courier took off, only to be nabbed by the police in a parking lot after turning a few corners while Maximilian was carrying the heavy boxes up to his room.

After the alleged courier, a Bulgarian called Zhivko Z., was arrested—his trial also begins in Leipzig on August 24th—an entire hour went by before a SWAT team stormed Maximilian's room. At this point the authorities had amazing luck: Prosecutors allege that Maximilian was not as protective of his data as he let on in an interview with Motherboard.

The authorities not only found a neatly laid-out list of deliveries made since December 2013, including notes made on individual orders, they also found a document listing all of the most important logins for running his platforms. It was a pretty lucky find for the authorities. Only a month prior to the seizure they had no idea who they were actually looking for, then imagine: They're standing in a 20-year-old's bedroom that's packed to the brim with drugs with a text document open on his laptop giving them access to all of his accounts.

Everything the police needed for further investigations and for effortlessly shutting down the platform was laid out for them on a silver platter, from Cloudflare access to the login details for his servers at a Dutch company. Shortly after the seizure, the Shiny Flakes website displayed a banner advertising career opportunities with the police in Saxony.

It's certain that Maximilian, should he be guilty of running Shiny Flakes, nonetheless operated with caution and sophistication for a long time and safeguarded himself in many respects. By using dozens of SIM cards and various cell phones he was able to keep certain channels of communication with suppliers separate. He also had the tools for setting up magnetic cards to send and receive goods from the package station with hacked post accounts. Maximilian was a busy young man who planned his operations meticulously and was adequately equipped for comprehensive trade in narcotics worldwide. He seems to have been especially diligent about securing the door to his room—to this day the defendant claims that his mother and stepfather knew nothing about his profitable startup because he would fortify himself in his room whenever he was conducting business.

Before he withdrew from the outside world, Maximilian pursued another career involving customer service. After completing high school in Leipzig in 2011, he began an apprenticeship in an Italian restaurant, where he's remembered for being hardworking but also stiff. After discontinuing his apprenticeship in 2013, his boss was disappointed, but what triggered the rather surprising career change remains completely unclear. What is clear is that Maximilian decided he wanted to be his own boss and declared himself to be a web designer. This was when he began the clandestine setup of distribution channels for his steadily growing drug business.

The supposed anonymity of online dealing has changed the profile of the successful dealer. They no longer necessarily have to be a violent and scary puppet master—as the example of Ross Ulbricht demonstrates—they can be a loner, new-kid-on-the-block-type, who would rather sit at home and deal online than have contact to the outside world; a person whose strengths lay in strategy, computer skills, cryptography and logistics. Maximilian did not even own a pocket knife.

Obviously secrecy is the supreme virtue when it comes to all the physical and digital traces created by online dealing. And this was Maximilian's forte. He knew that the police wouldn't be capable of reading his emails that were PGP encrypted or following his Bitcoin cash flows. He was smart enough to know how to set up his online business with the help of Tor without being discovered. His shop sites' addresses were registered in Tonga and the Cocos Islands; the servers were in the Netherlands. He operated on the darknet and clearnet, advertised what he was selling openly, and felt safe—as safe as you can feel when you're selling a huge variety of illegal substances globally. The police had nothing on him online. They had nothing on him until they were in his room, which was his warehouse and his headquarters.

What's more in question is why the police waited so long to take the apartment after arresting the courier. If Maximilian had had a question for the driver, called him, and had been unable to reach him, he could have gotten alarmed and could have started destroying evidence.

The authorities have elsewhere proved to not be all too tactically skilled in their investigation. An innocent resident of the same apartment building in Gohlis was also observed and suspected of being the operator of the Shiny Flakes drug delivery business, even though the police had succeeded in taking a picture of Maximilian at "his" package station and in following him back to his apartment building. A simple comparison with the personal information and photos of the building's residents at the Leipzig registration office could have cleared this other suspect. Instead, the Leipzig Police contacted property management and surveilled a totally innocent individual for over a week.

Whether the former drug kingpin, who has been held in a detention center for half a year now, can still be prosecuted as a minor is also up for debate. The amount of drugs allegedly found in his room is over 15,000 times more than what the law defines as "minor amounts." If he's prosecuted as an adult, he faces up to 15 years in prison.

We will continue to report on the trial as it unfolds.