The Case Of The Cold War Hacker Found Dead In A German Forest

Thirty years after a young West German computer whiz working for the KGB was found dead, we return to an unsolved mystery from the final days before the Wall fell.

What happened to Karl Koch
What happened to Karl Koch
Antonia Kleikamp

BERLIN — It was a classic case of reality being stranger — and more dangerous — than fiction. In May 1989, Karl Koch, a West German hacker linked to an espionage scandal with the Russian secret services, was found dead under suspicious circumstances. The mystery surrounding his death remains, in a plot that is somewhat typical of the Cold War.

Already in 1989 did Germany's public service broadcaster ARD see the story's potential, dedicating the half-hour program Brennpunkt to it in March 1989. "Eastern spies on Western computer networks. German hackers are working for the KGB" was the title of the show.

The program aired on the same day the police carried out a nationwide operation, arresting four young men; more evidence was obtained from another 14 alleged co-conspirers. For several years, the suspects had repeatedly hacked into the protected computer networks of German and U.S. companies and authorities to steal data, which they sold to the KGB, the main secret service in the Soviet Union.

In order to establish first contact with the Soviet secret service, three young men, named Karl Koch alias "Hagbard Celine", Dirk Otto B. alias "DOB", and Peter C. alias "Pedro", drove to East Berlin in September 1986. At first, they were ignored by the Soviets, but then they found an agent who recognized the potential of such attacks. His code name was "Sergei". Over the following two years, the hackers delivered all kinds of programs and huge amounts of data to the KGB. The Soviet organization paid a total of 90,000 Deutsche Mark to the group.

I did not want to kill anyone.

Karl Koch was probably the most gifted of the small hacker group. At that time there was no public Internet and only a few computers were connected via the normal telephone network. Koch and his friends had to take telephones apart to get the necessary components. With acoustic couplers that split data packets into beeps, Karl Koch and his crew went to telephone booths and were easily able to override the low-security barriers of the network.

Around 1986, Koch appeared at the Cebit computer fair in his hometown Hannover. In front of an audience, he hacked himself with a standard home computer in a secured mainframe. Koch even had his picture taken and filmed — but only from the back.

Actually, Koch would have had every reason to protect his identity: He was not only a highly talented nerd and hacker, but also a mentally unstable drug addict convinced he was hunted by "dark forces'. Hagbard Celine, his fake name, came from the main character of the Illuminatus! science fiction trilogy written by Robert Shea and Robert Anton Wilson.

Source: Wikimedia Commons

Soon after contacting the KGB, the German hackers stumbled upon an American on their path. It was system administrator Clifford Stoll who worked at the Lawrence Berkeley Laboratory: on his employer's computer, Stoll had discovered a $0.75 accounting error. Apparently, this error came from someone that had entered the system without authorization.

After months of research, Stoll found out that the security breach originated in West Germany and set a trap for the hackers: He copied from various sources a file that at that time was considered huge. He called it "SDInet". The "Strategic Defense Initiative", known as SDI, was a program launched by then U.S. President Ronald Reagan to build a space shield against enemy nuclear missiles. It was a hot topic in the second half of the 1980s.

The German hackers came across the file and copied it. Due to its sheer size, Stoll had enough time to track down the data thieves. German authorities jumped in and apprehended Karl Koch's group. Koch then offered to be a witness. In 1990, the authorities closed the case, with the hackers found guilty of espionage. Peter C. was given two years, Dirk-Otto B. received a 14-month sentence, while another participant named Markus H. alias Urmel was given 20 months.

Was he kidnaped and then killed? If yes — by whom? By the KGB?

But what happened to Koch could never be clarified. On May 23, 1989, he was seen alive for the last time. He was 23 at the time. A week later, his charred corpse was found in a forest in Lower Saxony. Next to the body was an empty gas can.

Had Koch burned himself in an acute fit of persecutory delusion? Or was he kidnaped and then killed in that cruel way? If yes — by whom? By the KGB? Or by other hackers who wanted revenge for his betrayal? There was no evidence that allowed the authorities or the public to speculate. In the epilogue of his book on the KGB hack, Stoll wrote: "The tragic death of Karl Koch has deeply shocked me. I did not want to kill anyone."

Keep up with the world. Break out of the bubble.
Sign up to our expressly international daily newsletter!

How Thailand's Lèse-Majesté Law Is Used To Stifle All Protest

Once meant to protect the royal family, the century-old law has become a tool for the military-led government in Bangkok to stamp out all dissent. A new report outlines the abuses.

Pro-Democracy protest at The Criminal Court in Bangkok, Thailand

"We need to reform the institution of the monarchy in Thailand. It is the root of the problem." Those words, from Thai student activist Juthatip Sirikan, are a clear expression of the growing youth-led movement that is challenging the legitimacy of the government and demanding deep political changes in the Southeast Asian nation. Yet those very same words could also send Sirikan to jail.

Thailand's Criminal Code 'Lèse-Majesté' Article 112 imposes jail terms for defaming, insulting, or threatening the monarchy, with sentences of three to 15 years. This law has been present in Thai politics since 1908, though applied sparingly, only when direct verbal or written attacks against members of the royal family.

But after the May 2014 military coup d'état, Thailand experienced the first wave of lèse-majesté arrests, prosecutions, and detentions of at least 127 individuals arrested in a much wider interpretation of the law.

The recent report 'Second Wave: The Return of Lèse-Majesté in Thailand', documents how the Thai government has "used and abused Article 112 of the Criminal Code to target pro-democracy activists and protesters in relation to their online political expression and participation in peaceful pro-democracy demonstrations."

Criticism of any 'royal project'

The investigation shows 124 individuals, including at least eight minors, have been charged with lèse-majesté between November 2020 and August 2021. Nineteen of them served jail time. The new wave of charges is cited as a response to the rising pro-democracy protests across Thailand over the past year.

Juthatip Sirikan explains that the law is now being applied in such a broad way that people are not allowed to question government budgets and expenditure if they have any relationship with the royal family, which stifles criticism of the most basic government decision-making since there are an estimated 5,000 ongoing "royal" projects. "Article 112 of lèse-majesté could be the key (factor) in Thailand's political problems" the young activist argues.

In 2020 the Move Forward opposition party questioned royal spending paid by government departments, including nearly 3 billion baht (89,874,174 USD) from the Defense Ministry and Thai police for royal security, and 7 billion baht budgeted for royal development projects, as well as 38 planes and helicopters for the monarchy. Previously, on June 16, 2018, it was revealed that Thailand's Crown Property Bureau transferred its entire portfolio to the new King Maha Vajiralongkorn.

photo of graffiti of 112 crossed out on sidewalk

Protestors In Bangkok Call For Political Prisoner Release

Peerapon Boonyakiat/SOPA Images via ZUMA Wire

Freedom of speech at stake

"Article 112 shuts down all freedom of speech in this country", says Sirikan. "Even the political parties fear to touch the subject, so it blocks most things. This country cannot move anywhere if we still have this law."

The student activist herself was charged with lèse-majesté in September 2020, after simply citing a list of public documents that refer to royal family expenditure. Sirikan comes from a family that has faced the consequences of decades of political repression. Her grandfather, Tiang Sirikhan was a journalist and politician who openly protested against Thailand's involvement in World War II. He was accused of being a Communist and abducted in 1952. According to Sirikhan's family, he was killed by the state.

The new report was conducted by The International Federation for Human Rights (FIDH), Thai Lawyer for Human Rights (TLHR), and Internet Law Reform Dialogue (iLaw). It accuses Thai authorities of an increasingly broad interpretation of Article 112, to the point of "absurdity," including charges against people for criticizing the government's COVID-19 vaccine management, wearing crop tops, insulting the previous monarch, or quoting a United Nations statement about Article 112.

Activist in front of democracy monument in Thailand.

Shift to social media

While in the past the Article was only used against people who spoke about the royals, it's now being used as an alibi for more general political repression — which has also spurred more open campaigning to abolish it. Sirikan recounts recent cases of police charging people for spreading paint near the picture of the king during a protest, or even just for having a picture of the king as phone wallpaper.

The more than a century-old law is now largely playing out online, where much of today's protest takes place in Thailand. Sirikan says people are willing to go further on social media to expose information such as how the king intervenes in politics and the monarchy's accumulation of wealth, information the mainstream media rarely reports on them.

Not surprisingly, however, social media is heavily monitored and the military is involved in Intelligence operations and cyber attacks against human rights defenders and critics of any kind. In October 2020, Twitter took down 926 accounts, linked to the army and the government, which promoted themselves and attacked political opposition, and this June, Google removed two Maps with pictures, names, and addresses, of more than 400 people who were accused of insulting the Thai monarchy. "They are trying to control the internet as well," Sirikan says. "They are trying to censor every content that they find a threat".

Keep up with the world. Break out of the bubble.
Sign up to our expressly international daily newsletter!