On the picture Judge Theodor Meron, President of the MICT. The official opening of the new premises of the Arusha Branch of the Mechanism for International Criminal Tribunals (“MICT” or “Mechanism”) was marked by a ceremony held on Friday, 25 November 2016, in Arusha, presided over by H.E. Samia Suluhu Hassan, Vice President of the United Republic of Tanzania, who delivered the keynote speech.

The ceremony brought together over 300 attendees, including Government representatives from the United Republic of Tanzania, representatives of the international community and the United Nations, judges and staff of the MICT, and the media. The unveiling of the plaque at the new premises marked the official opening of the new home of the Mechanism in Arusha at the Lakilaki area at the outskirts of Arusha. During his remarks commencing the opening ceremony, Judge Theodor Meron, President of the MICT, acknowledged the indispensable role the Government of Tanzania played in making the new MICT premises a reality. President Meron also underscored the role of the MICT in Africa, noting that: “With the Mechanism rooted firmly here, in mandate, culture, and context, it is not too much to say that this is an African court, and that in carrying out the vital mandate that it has been given, the Mechanism will serve, first and foremost, the people of this region of the world.” Mr. Miguel de Serpa Soares, the United Nations Under-Secretary-General for Legal Affairs and United Nations Legal Counsel, delivered a message on behalf of the United Nations Secretary-General, Ban Ki-moon. In that message, the Secretary-General observed that: “The Mechanism and the inauguration of these premises reinforce our shared resolve that those whose deeds defy the conscience of humankind will not go unpunished, and that the rule of law will prevail for everyone, everywhere.” In addition, Mr. Serpa Soares gave remarks in his own capacity. H.E. Augustine P. Mahiga, the Tanzanian Minister for Foreign Affairs and East African Cooperation, delivered remarks and introduced Vice President Hassan. Mr. Serge Brammertz, Prosecutor of the MICT and the International Criminal Tribunal for the former Yugoslavia (“ICTY”), and Mr. John Hocking, Registrar of the MICT and the ICTY, also addressed those in attendance. Recalling that all victims share the same desire “to see those responsible for the crimes against them brought to justice”, Prosecutor Brammertz highlighted that “the opening of the new MICT facility here, in Arusha, the African city of justice, is an important opportunity to promote and support accountability for international crimes more broadly”. Noting that his Office is already working to support its African partners in their fight for justice, Prosecutor Brammertz suggested “this new facility can therefore be a place for education” to “teach future generations the dangers of genocide ideology” so they can “firmly reject genocide denial at all times and in all places.” The three buildings of the new premises – the courtroom, the archives and the office building – have been designed to serve the specialised functions of the Mechanism, which include the completion of remaining judicial work, archives management, witness protection, supervision of enforcement of sentences, and assistance to national jurisdictions. Addressing the audience, Registrar Hocking stated that “on our official documents I am the owner of this project. But truly, the success of this project lies in its many owners. Together we built a building. Together we built a new institution. Together we built partnerships in East Africa and beyond. Pamoja tuendelee kujenga tumaini.” The Mechanism is the first of a number of international and regional justice-related institutions that will move to the Lakilaki area.

Drug trafficking and Hawala money laundering ring dismantled by joint investigation team An organised crime group specialised in money laundering, whose members were active in France, Belgium, the Netherlands and Morocco, was dismantled last November. An investigative judge at the Court of Marseille had been investigating since 2015 into the activities of this complex structure involved in transporting the proceeds from drug trafficking, estimated that at least 300 Million EUR had already been laundered. The drugs were sold in France where the profits were collected and then transported to Belgium and the Netherlands. The criminals’ modus operandi involved the use of cash couriers traveling by car who would pick up the proceeds from drug trafficking throughout Western Europe (collection rate of over EUR 1 million per month) and transport the cash to Belgium and the Netherlands. The cash was there laundered to Morocco via the Middle East using unregulated financial channels (the Hawala system), thus leaving no tell-tale trail evidence for law enforcement investigators. Belgian authorities reported 23 transports from Belgium to the Netherlands in a two-month period alone in early 2016. Eurojust was requested to facilitate the transmission and execution of Letters of Request, and to assist a joint investigation team (JIT) between France, Belgium and the Netherlands. A coordination meeting with France, Belgium and the Netherlands was held at Eurojust in May 2016. Europol employed mobile offices to assist national authorities during the action day, which was conducted by 450 police officers. 36 arrests took place simultaneously in France, Belgium and the Netherlands. Over EUR 2 622 000 in France, EUR 2 800 000 in Belgium and EUR 85 000 in the Netherlands, in total, around 5.5 Million EUR, in cash has been seized, alongside drugs, e.g. 20 kilo cocaine in the Netherlands, a quantity of gold worth EUR 800 000, eight cars in Belgium, three semi-automatic weapons (one in France, one in Belgium, one in the Netherlands) and ammunition. In all phases of this complex investigation, information exchange among national authorities, Eurojust and Europol was essential.

The International Union of Pure and Applied Chemistry (IUPAC) and more than 40 international and national scientific chemical societies from Africa, Europe, the Middle East, and North America have condemned recently the use of toxic chemicals, especially chlorine, as weapons. “This show of support reveals that the global norm against the use of chemical weapons remains firm,” declared the Director-General of the Organisation for the Prohibition of Chemical Weapons (OPCW), Ambassador Ahmet Üzümcü.  The Chemical Weapons Convention (CWC) outlaws the use of any toxic chemical as a weapon and requires its 192 States Parties to take all necessary measures to ensure that such substances are not used for prohibited purposes. Notes of Support and Letters to the OPCW: Letter from International Union of Pure and Applied Chemistry (IUPAC) Joint Letter from the American Chemical Society and American Chemistry Council Letter from Cefic regarding the use of chlorine and other chemicals as a chemical weapon    

After more than four years of investigation, the Public Prosecutor’s Office Verden and the Lüneburg Police (Germany), in close cooperation with the United States Attorney’s Office for the Western District of Pennsylvania, the Department of Justice and the FBI, Eurojust, Europol and global partners, dismantled on December first an international criminal infrastructure platform known as ‘Avalanche’. The Avalanche network was used as a delivery platform to launch and manage mass global malware attacks and money mule recruiting campaigns. It has caused an estimated EUR 6 million in damages in concentrated cyber attacks on online banking systems in Germany alone. In addition, the monetary losses associated with malware attacks conducted over the Avalanche network are estimated to be in the hundreds of millions of Euros worldwide, although exact calculations are difficult due to the large number of malware families managed through the platform. The global effort to take down this network involved the crucial support of prosecutors and investigators from 30 countries. As a result, five individuals were arrested, 37 premises were searched, and 39 servers were seized. Victims of malware infections were identified in over 180 countries. In addition, 221 servers were put offline through abuse notifications sent to the hosting providers. The operation marks the largest-ever use of sinkholing* to combat botnet** infrastructures and is unprecedented in its scale, with over 800 000 domains seized, sinkholed or blocked. On the action day, Europol hosted a command post at its headquarters in The Hague. From there, representatives of the involved countries worked together with Europol’s European Cybercrime Centre (EC3) and Eurojust officials to ensure the success of such a large-scale operation. In addition, Europol supported the German authorities throughout the entire investigation by assisting with the identification of the suspects and the exchange of information with other law enforcement authorities. Europol’s cybercrime experts produced and delivered analytical products. Eurojust’s Seconded National Expert for Cybercrime assisted by clarifying difficult legal issues that arose during the course of the investigation. Several operational and coordination meetings were also held at both Europol and Eurojust. Sir Julian King, European Commissioner for the Security Union, said: ‘Avalanche shows that we can only be successful in combating cybercrime when we work closely together, across sectors and across borders. Cybersecurity and law enforcement authorities need to work hand in hand with the private sector to tackle continuously evolving criminal methods. The EU helps by ensuring that the right legal frameworks are in place to enable such cooperation on a daily basis.’ Ms Michèle Coninsx, President of Eurojust, said: ‘Today marks a significant moment in the fight against serious organised cybercrime, and exemplifies the practical and strategic importance of Eurojust in fostering international cooperation. Together with the German and US authorities, our EU and international partners, and with support from Eurojust and Europol’s EC3, Avalanche, one of the world’s largest and most malicious botnet infrastructures, has been decisively neutralised in one of the biggest takedowns to date.’ Mr Rob Wainwright, Europol Director, said: ‘Avalanche has been a highly significant operation involving international law enforcement, prosecutors and industry resources to tackle the global nature of cybercrime. The complex trans-national nature of cyber investigations requires international cooperation between public and private organisations at an unprecedented level to successfully impact on top-level cybercriminals. Avalanche has shown that through this cooperation we can collectively make the Internet a safer place for our businesses and citizens.’ The criminal groups have been using the Avalanche infrastructure since 2009 for conducting malware, phishing and spam activities. They sent more than 1 million e-mails with damaging attachments or links every week to unsuspecting victims. The investigations commenced in 2012 in Germany, after an encryption ransomware*** (the so-called Windows Encryption Trojan) infected a substantial number of computer systems, blocking users’ access. Millions of private and business computer systems were also infected with malware, enabling the criminals operating the network to harvest bank and e-mail passwords. With this information, the criminals were able to perform bank transfers from the victims’ accounts. The proceeds were then redirected to the criminals through a similar double fast flux**** infrastructure, which was specifically created to secure the proceeds of the criminal activity. The loss of some of the network’s components was avoided with the help of its sophisticated infrastructure, by redistributing the tasks of disrupted components to still-active computer servers. The Avalanche network was estimated to involve as many as 500,000 infected computers worldwide on a daily basis. What made the Avalanche infrastructure special was the use of the double fast flux technique. The complex setup of the Avalanche network was popular among cybercriminals because of the double fast flux technique offering enhanced resilience to takedowns and law enforcement action. Malware campaigns that were distributed through this network include around 20 different malware families, such as goznym, marcher, matsnu, urlzone, xswkit, and pandabanker. The money mule schemes operating over Avalanche involved highly organised networks of ‘mules’, who purchased goods with stolen funds, enabling cybercriminals to launder the money they acquired through the malware attacks or other illegal means. In preparation for this joint action, the German Federal Office for Information Security (BSI) and the Fraunhofer-Institut für Kommunikation, Informationsverarbeitung und Ergonomie (FKIE) analysed over 130 TB of captured data and identified the server structure of the botnet, allowing for the shutdown of thousands of servers and, effectively, the collapse of the entire criminal network. The successful takedown of this server infrastructure was supported by INTERPOL, the Shadowserver Foundation, Registrar of Last Resort, ICANN and domain registries involved in the takedown phase. INTERPOL has also facilitated the cooperation with domain registries. Several antivirus partners provided support concerning victim remediation. Computer users should note that this law enforcement action will NOT clean malware off any infected computers – it will merely deny the Avalanche users’ ability to communicate with infected victims’ computers. Avalanche victims’ computers will still be infected, but shielded from criminal control. Victims of malware operating over the Avalanche network may use the following webpages created for assistance in removing the malware: • www.bsi-fuer-buerger.de/botnetz and www.bsi-fuer-buerger.de/avalanche, in German • www.bsi-fuer-buerger.de/EN/botnetz and www.bsi-fuer-buerger.de/EN/avalanche, in English • https://us-cert.gov/avalanche • www.nationalcrimeagency.gov.uk/news/962-avalanche-takedown • www.getsafeonline.org/news/avalanche • www.actionfraud.police.uk/news-police-takedown-computer-network-used-to-infect-millions-of-devices-dec16 • www.cyberaware.gov.uk/blog The Shadowserver Foundation has supported this operation and will be making the sinkhole data available globally to responsible bodies via their free daily remediation feeds.