From Counter-Surveillance Resource Center

The following information comes from an initial quick reading of the investigation file. Therefore, it is necessarily incomplete.

First of all, how did this investigation start?

The Anti-Terrorism Sub-Directorate (SDAT) of the judicial police began an investigation on its own initiative, at the beginning of January 2022, following “confidential information collected by [the] service” (in another document, a judge speaks of “anonymous intelligence”). The police “gathered” the names of two comrades who, according to this information, were likely to be responsible for the incendiary attacks, claimed by anarchists, which had been targeting vehicles in Paris and the surrounding area for years. In the past, different local police stations and the anti-terrorism group of the DPJ 1 (a section of the Parisian Judicial Police) had already carried out investigations, notably for “criminal association”, without success.

The National Division of Research and Surveillance (DNRS, which can be understood as the “operational unit” of the SDAT) set up an operation for tailing the two comrades. They planned to follow Ivan from January 10 to February 3, 2022, and the other person from January 17 to February 3. Concretely, this part of the file includes the statements of the DNRS agents who, in the morning, placed themselves in front of the homes of the two comrades and followed them (on foot or by car) in their movements, at work, photographed them at the supermarket, etc. It should be noted that they often lost sight of their “target” when the latter was moving on foot or by bicycle.

The second comrade was quickly cleared. The DNRS agents say that they saw and photographed Ivan putting up posters in Paris and Montreuil late in the evening of January 18. On the evening of January 21, they followed him again when he went to Paris. The comrade used his bike and the cops lost sight of him almost immediately. They then deployed four “surveillance devices” (cars come to mind). Suspecting that the comrade was still headed towards Montreuil, they placed them at four transportation corridors between Paris and this suburb. One of these “devices” recorded him on the commune of Montreuil (they lost sight of him immediately afterwards). The police used this as an indication that the comrade was responsible for the arson that occurred that night of a SFR van, in Montreuil, and of an Enedis vehicle in the twelfth Parisian district.

On February 23, the SDAT contacted the Bobigny court, which officially tasked it with investigating the comrade.

The investigations

First of all, there were a whole series of “administrative” checks. For example, with the CAF (Caisse d’Allocations Familiales, part of the French social security system), the tax authorities, various administrations and police services (with the list of judicial and police priors – any offence, whether convicted or dismissed, is listed), the comrade’s bank account statements, etc. They added some vague information about his priors in Italy.

In March, the SDAT carried out a search via the National Platform for Judicial Interception and also asked for information from the telephone service provider that the comrade used. This allowed them to learn the identities of who he communicated with, the detailed bills and the geolocation of the calls. And so they obtained the list of the locations of the comrade’s phone (to see if it was in the vicinity of the fires) and the list of his contacts, over one year. They tried to establish a short biography for each contact. They read all the SMS messages that were sent and received (and found nothing interesting).

Thanks to the comrade’s phone number they can know the IMEI number of the cellphone and try to determine if other SIM cards have been used in this device.

From March 16, the SDAT set up a real-time geolocation of the “personal” phone of the comrades.

After studying the calls with his relatives, they say that they have established that the comrade also uses another phone number as a “business” line.

Also since March, a GPS beacon was installed on Ivan’s car and a hidden camera filmed the access door of his building (it was probably installed on a light pole across the street).

From the beginning of the investigation the cops assumed that Ivan is the administrator of the blog Attaque (https://attaque.noblogs.org). In March, on the orders of the prosecutor, Laure-Anne Boulanger, they take a whole series of incendiary actions that have taken place in Paris and the surrounding region in the last few years and that have been claimed by emails sent to this blog and join them to their case (that totals 59 incendiary attacks, as of June 11). The investigating judge charged him “only” for the last six fires (those that took place in 2022), for the others Ivan is accused of being an assisting witness.

At the end of March and the beginning of April, the SDAT asks the National Directorate of Penitentiary Intelligence (DNRP) to provide them with information on any correspondence that Ivan had with K. and with B., two comrades who had been imprisoned in recent years. The DNRP sent them copies of some of these exchanges, including photocopies of the covers of the books that Ivan mailed to one of them. The DNRP also informs them of the money that Ivan sent to one of these two comrades (which the SDAT also saw in his bank account). There is a strong focus on K., with a file on his tax forms, criminal record and the list of permitted visitors in the two prisons where he was locked up. This request to the DNRP was justified by the fact that many of the arson attacks in recent years, which the SDAT suspects Ivan to be responsible for, are in solidarity with these two imprisoned comrades.

In all of the investigations for arsons in Paris, the cops consult the cameras of the PVPP system (Video Protection Plan for Paris, of the police department) to look for recordings of those responsible for the fires. To our knowledge, this has been without success. Sometimes it happens live. For example, on the night of April 24, Ivan’s car was geolocated near Paris, so an agent of the SDAT looked at the PVPP cameras. She noticed a burning truck in the 12th district and asks the local police station what it is; an Enedis van.

The SDAT police officers also systematically try to make use of the private cameras located in the immediate vicinity of the attacks and ask the local residents if they have seen anything. For the fire of March 4, rue About, for example, they recovered the footage from the cameras of a small supermarket, a florist and two businesses, which film parts of the street. They say they see someone on a bicycle, whom they claim is the arsonist, but the images do not reveal anything useful to identify them or to prove that they are responsible for the incendiary action.

The police are also interested in the only cybercafé located in the area arounnd where Ivan lives and where they claim to have saw him enter when tailing him. For example, they ask the Municipal Police for the recordings of the nearest city camera for the day during which the e-mail claiming responsibility for the fire of March 5 was sent. They go so far as to place (in vain) a hidden camera to monitor access to the cybercafé, from April 8 to May 8.

The cops also followed our comrade when he did his shopping. For example, a few days after an arson, the SDAT asked the security of a supermarket near his home (where they had seen him enter the afternoon before the fire) which checkout he used, at what time and for a copy of the receipt (and they find nothing that interests them).

Arrest and raids

At the end of May, things begin to accelerate. The authorization for the searches of Ivan’s apartment and his car are signed by a judge on May 19 and 23. On the evening of June 10, the police officers of the SDAT notice (probably thanks to the GPS beacon) that the comrade is moving in the Paris region and they set up a tail (as they have already done on other occasions). They say that they followed him while he biked, until they arrive in the 17th district of Paris. The cops lost sight of him for three hours, until he returned to his car, but they were alerted that a car belonging to an embassy was set on fire in the 17th district (the fire spread to other cars parked next to it, and scorched the front of the businesses opposite). They then decided to arrest him.

A team of the DNRS, pistols in hand, blocked Ivan’s car at the exit of a highway with two vans (one in front and one behind), while he was arriving at his home. During the arrest, just after handcuffs and an opaque ski mask that prevents him from seeing were in place, plastic bags were put on his hands to “preserve the traces”. When the technician of the Judicial Identity arrived, he passed a kind of swab over him which was then analyzed to find traces of hydrocarbons (with negative results).

After the arrest, the police of the SDAT searched the car of the comrade. They put a cap, a backpack, an old lighter, a taser, a “police” armband and two window breakers in evidence collection bags. Then they went to his home.

During the search of his home, the cops seized two phones (the one they define as “personal” as well as the “professional” one). The first one is the brand Wiko and the Support Brigade in Telephones, Cyber-investigation and Criminal Analysis (BATCIAC) manages to examine its content without knowing the password, thanks to the XAMN and XRY software of the company MSAB. They went through the data and found nothing of interest to them. The SIM card was locked and they couldn’t access it. They also tried to access the data of the other cellphone, an IPhone 8 (with the UFED software of the company Cellbrite), without success.

They also seized two computers. The first one is encrypted with Bitlocker software, which prevents them from accessing it. They then tried to copy the hard disk (with Tableau T35 from IDE Forensic and Accessdata FTK_Imager from Bridge) but were unable to do so. For the time being, no information has been found about the analysis of the second computer (which is encrypted with LUKS). They examined the USB sticks and memory cards they found on site, without seeing anything of interest. They seized maps of the Paris video-surveillance network (PVPP), money, a few random books on anarchism and a set of stickers.

When the bourgeois play the snitch

Just after the arson of June 11, Manon Rouas, co-owner of an aesthetic clinic (Maison Marignan – Clinique médicale esthétique, 10 rue Villebois Mareuil, Paris XVII), alerted the cops that she can give them a hand. The clinic is in the immediate vicinity of the fire (its facade was damaged by the flames) and it is equipped with an intercom that films the sidewalk and the street 24 hours a day. On the video, which she gave them very quickly, a person is seen interacting with the embassy car shortly before it caught fire. The video was placed in the file as evidence against the comrade.

This information is not intended to frighten or encourage inaction, but on the contrary, to encourage action with as much caution as possible