Shortly after Pavel Durov, the founder of Telegram, was arrested by the police in France last summer and charged with failing to prevent illicit activity on the app, a French law professor specializing in cybersecurity got online messages from a man named Isaac Steidl.
“I would like to talk with you,” said an email signed by Mr. Steidl, who introduced himself as the founder of the online chat site Coco. “My case is very similar to Telegram’s, and so are the charges.”
Michel Séjean, the professor, who shared copies of the messages with The New York Times, said he didn’t know Mr. Steidl, had no interest in helping him, and never responded. He was, however, familiar with Coco — a website where anonymous users could chat without leaving records of the conversation.
French law enforcement had tied the site to thousands of criminal cases, including the recent trial of Dominique Pelicot and 50 other men, most of whom were convicted of raping Mr. Pelicot’s now ex-wife while she was heavily sedated, and who testified that they had first met him on the chat site.
The French authorities had already closed the website in June, and the messages to Mr. Séjean suggested that Mr. Steidl was concerned that they would target him next.
Last week, they did.
Like Mr. Durov before him, Mr. Steidl was placed under investigation on a raft of criminal charges by authorities mainly using a 2023 law that has made France a testing ground for an aggressive new approach to hold the heads of online platforms personally liable.
The new law allows the authorities to prosecute people who run the platforms and knowingly permit illegal content, goods or services to be exchanged while also requiring users to remain anonymous or while failing to keep certain user data.
While some experts warn that the new law remains relatively untested in courts, it has given the French authorities a seemingly powerful new tool.
“The noose is tightening around the administrators of this type of platform,” said Nathalie Bucquet, a lawyer for the French chapter of Innocence in Danger, a child protection organization that had called for Coco to be shut down.
Mr. Steidl, 44, did not respond to requests for an interview. But in the years preceding his indictment, he took steps that made it harder for French law enforcement to reach him. He dropped his French citizenship, registered his website abroad and moved to Bulgaria.
Last week, he was ordered to pay 100,000 euros ($102,000) in bail and was barred from leaving France, with the obligation to regularly check in at a local police station.
Julien Zanatta, his lawyer, said that Mr. Steidl willingly traveled to France to cooperate when the authorities summoned him. Mr. Steidl would “demonstrate his innocence” and was “horrified” by reports of crimes tied to his platform, his lawyer said.
“He was upset to find out what had been done by people who had misused his site,” Mr. Zanatta said.
Coco was first registered in 2005 with a plain home page and a cutesy 1990s aesthetic, with a cracked-open coconut. It advertised itself as a “nice” chatting forum that did not require users to create an account — they could access it by providing only a gender, age, postal code and pseudonym.
Users could chat directly or join forums, and the site made money by charging a small monthly fee for access to additional features. In the three months before it was shut down, the site’s monthly traffic reached more than 500,000 users, according to SimilarWeb estimates.
Crucially, records of the anonymous conversations were not kept.
Over the years, the authorities repeatedly tied the site to criminal activity, and advocacy groups fighting child abuse and homophobia had become increasingly vocal in demanding that the authorities close it.
Mark Pohlmann, the president of a nonprofit against cyberviolence in France — who was interviewed by the police as part of the investigation into Coco — said that when conducting research about the chat site by posing as a female user, dozens of male users contacted him within seconds of logging on, often by making sexual comments or asking for explicit photos.
The French police and prosecutors say that from 2021 to 2024, the platform was implicated in over 23,000 cases that involved 480 alleged victims, including allegations of sexual abuse of children, pimping, prostitution, rape, drug trafficking, scams and homicides.
At the Pelicot trial, Mr. Pelicot said that he had met the other men on the website, in a private chat room called “Without her knowledge.” Most of the defendants denied ever seeing that particular chat room but acknowledged that they had met Mr. Pelicot on the site before moving to other platforms.
Several defendants at the trial said they came to the website in search of paid sex, or to buy and sell drugs. Christian Lescole, a professional fireman and longtime user of the website, told the court that it started as a space to discuss hobbies like chess or music.
“But as the years went by, all the predators and scammers started coming to Coco,” said Mr. Lescole, who was convicted of aggravated rape of Ms. Pelicot.
Even as the website’s notoriety grew, its founder remained in the shadows.
Mr. Steidl seemed to live off the internet but has a very low profile online. His Facebook page is empty. His LinkedIn page is bare-bones. How closely Mr. Steidl managed the website on a day-to-day basis is unclear. Two people identified as moderators of the site were arrested in July, but authorities did not detail their exact role.
Born in the Vaucluse and raised in the Var, both areas of southeastern France, Mr. Steidl graduated from a computer science program at an engineering university in Toulon in 2003, the school’s head of communications said.
Mr. Steidl owned the coco.fr domain name through a company called Zenco that was registered in Toulon in 2011. In 2022, during the investigation that preceded the Pelicot trial, the investigating judge’s office contacted Zenco to request data connected to the case. But it never received an answer, according to an overview of the case by the judge.
Soon after, Ms. Steidl began pulling his company, his website, and himself, out of France.
By October 2022, coco.fr was redirecting traffic to coco.gg, according to internet archives at the French National Library, indicating that it had been registered in Guernsey, an island in the English Channel.
Then, in 2023, Zenco was shut down, according to public business records. That same year, in April, Mr. Steidl renounced his French citizenship, government records show. His lawyer says he is an Italian citizen.
And at some point, he moved to Bulgaria, where a company called Vinci LTD was associated with the site in March 2024, according to information collected by Domaintools. Vinci is owned and managed by Mr. Steidl, according to Bulgarian company registration records.
But in June, after an 18-month investigation spanning across Europe, French authorities shut the site down. Two of the site’s servers were seized in Germany, bank accounts were frozen in several European countries, and police seized 5 million euros. French law enforcement officials questioned Mr. Steidl in Bulgaria, although he was not charged at the time.
Mr. Séjean, the expert who was contacted by Mr. Steidl, said that France’s 2023 law — and the creation in 2019 of a specialized national cybercrimes unit — had allowed French prosecutors to take a less piecemeal approach in their targeting of online platforms suspected of allowing illicit activity to flourish.
“Before 2023, you couldn’t get at it in one fell swoop, it was broken down case by case,” said Mr. Séjean, who teaches at the Université Sorbonne Paris Nord.
Ms. Bucquet, the lawyer, said the new law “greatly facilitates” police work because “the mere knowledge of the illicit nature of the content justifies criminal liability on the part of the administrator.”
But some critics said applying the new offense to Mr. Steidl’s website could be overreaching, and that while the law has allowed prosecutors to swiftly bring charges, future convictions are uncertain.
Alexandre Archambault, a lawyer with expertise in digital and cybersecurity cases, noted that the first conviction using the new law, in November, was against the creator and the administrator of a Telegram group that shared child sex abuse material — not Telegram itself or its executives.
“Does this extensive interpretation of the offense conform to European law?” Mr. Archambault said. “I doubt it.”
Mr. Steidl’s lawyer said that his client was being unfairly singled out.
“There are regularly sites that are diverted from their purpose to commit offenses, and the people in charge of these sites are never prosecuted for complicity,” he said.
Under French and European rules, platforms that host content online cannot be held liable for what users publish, and they are not under any obligation to preemptively monitor for any illegal content.
But they also need to have procedures allowing people to flag such content for removal and to ensure some level of cooperation with authorities — which was not the case for Coco, according to French prosecutors, who said it showed “a notorious lack of moderation.”
For now, though, some advocacy groups say that closing the website was insufficient.
“The day they shut Coco down, I sent the police an email with a list of over 100 similar websites,” said Mr. Pohlmann, the nonprofit president. “It’s like saying that closing a drug dealing spot in Marseille solves the problem of drug trafficking in France.”
“Coco is the tree hiding the forest,” he said.
Liz Alderman contributed reporting from Paris, and Michael H. Keller and Jennifer Valentino-DeVries from New York.
