Route of weapons used in Paris terror attacks leads to Slovak online gun shop

7 January 2015. Chérif Kouachi and his brother Said leave a bloodbath in the newsroom of magazine Charlie Hebdo. Two days later, Kouachi’s close contact, Amedy Coulibaly, assaults the kosher supermarket Hyper Cacher in Paris.

When Coulibaly takes the hostages, the Kouachi brothers are already entrenched in a printing house north of Paris. They make it outside, but are shot dead by police.

In Hyper Cacher, a man wants to run away - and Coulibaly shoots him in the back, then fires at a second shopper. He holds the others at gun point as hostages for more than four hours.

His two weapons are from Communist Czechoslovakia - both are the brand Ceska VZ 58, one manufactured in 1961, the other an extra short version from 1964.

These weapons are decommissioned military scrap metal, according to French investigative files. They are in bad shape - but can shoot to kill.

Both Ceska weapons have the seal of Kol Arms, a Slovakian gunsmith. One was de-activated into a blank-firing weapon in 2013 by Kol Arms, the other a year later. This weapon has the serial number 63622.

Both weapons were sold as blank-firing weapons in 2014 over the counter to anyone older then 18, before being re-activated by an underworld gunsmith.

According to a ballistics expert from the Paris police, the reactivation process with such weapons is easy, because it involves only re-engineering the barrel.

Such weapons are available online and through the post. The extra short weapon costs about 500 Euro, the longer version between 230 to 280 Euro.

More expensive are both the Tokarev pistols TT 33, which Coulibaly was also carrying. These date back to 1951 and 1952 - and were also turned into blank-firing weapons by Kol Arms in 2014, before being re-activated by a third party.

This type of Tokarev was spotted in the Marseille region in October 2012 and in Paris in July 2014. Coulibaly had four more pieces at his hideout at Gentilly.

How Coulibaly assembles this arsenal leads to a shop in Slovakia and an episode of bungling by the French police force.

The shop AFG Security is located in the Slovak town of Partizanske, two hours east of Vienna. The store is in a basement of a two-storey apartment building, next to a railway. A Der Spiegel reporter was free to browse, but the owner’s sister said the store refused to answer questions from journalists. All other requests for information were denied.

From this basement, AFG had been supplying criminals throughout Europe with blank-firing weapons. The arms ended up with gangsters in the UK, a Neo-Nazi in Germany and Islamic terrorists in France.

The weapons are sold “for fun”, argues AFG on its website, such as restaging battles from the second world war. It also states that these are: “original weapons, with insignificant changes.”

These ‘scrap’ weapons come from Slovakian state warehouses, the police and the military. Following the break-up of the Communist bloc, Slovakia started to sell thousands of weapons to companies such as Kol Arms, who turned murderous arms into toys.

When the weapons left Kol Arms, they were harmless - from a legal point of view. But for criminals, these were the new shit on the market.

14,000 such weapons were sold by AFG abroad, mostly online, according to the German federal police, who know of 33 investigations into German clients.

A simple process can convert them back into lethal arms.

French investigators believe a mid-experienced gunsmith needs only two hours to reactive such a weapon.

Protagonists linked to the conversion of over-the-counter products from AFG into deadly weapons faced conviction, before the shop was connected to a chain of sellers which led to the Paris terror attacks.

In 2014, AFG began to be of interest to authorities in Germany and the UK.

A starting point was a parcel from Germany, destined for a British gangster Alexander M., aka Smokey, a robber from London who now serves a life sentence. The parcel contained the submachine guns type VZ61, known as Skorpion. Smokey ordered the guns from prison, using his smartphone.

The authorities only had a pseudonym for the German intermediary who trafficked the weapons - the name Max Mustermann - on a dark net commercial website called Agora. Comments on the site ‘reviewing’ Mustermann read: “My first choice” and “Max is the best”.

The British and German police sent cyber-investigators to buy such weapons. The tracking numbers of emails led to the Bavarian town of Schweinfurt, and to a 20 year-old student Christoph K. In January 2015 the cops raided his campus flat and other arrests were made in Europe.

Christoph K. was re-activating weapons bought from AFG in his basement and selling them on at a profit of ten times. He received four years and three months in jail.

He was not the only dedicated customer of AFG. In the company records, obtained by German police BKA, was also 39 year-old Alexander R., who bought two Kalashnikovs and several Skorpions.

In Ferlach, called the “heart of Austria’s arms industry” he obtained raw tubes for new barrels to make the weapons active. Alexander R. was known for doing arms business in a Neo-Nazi network connected to the banned far-right Hoffmann Armed Sports Group - Wehrsportgruppe Hoffmann.

The police arrested Alexander R, and discovered his weapons arsenal. He was convicted to four years behind bars. From prison he wrote to his comrades that his goal was to destroy the German Federal Republic and to kill the informants who snitched on him.

Since his release, Alexander R. has been buying weapons from AFG. Because he thought the police would have the online shop and its transactions under surveillance, he ordered over the counter and paid in cash. He was convicted again - and failed with his request for appeal on most of the points. Dozens of sub-machine guns he purchased have not yet been found.

Once this route for guns had been established in the criminal and extreme right underworld, it saw exploitation by terrorists connected to fundamentalist Islam.

In 2014, AFG serves a man from north France over the internet - Claude Hermant - a former member of National Front with a paramilitary background. Hermant had spent time in prison in the Congo after taking part in a failed putsch.

The ex-paramilitary operated a survival-shop close to Lille. Using his company, he bought from AFG an assortment of pistols, submachine guns and Kalashnikovs VZ 58, all de-activated by Kol Arms.

After the Paris terror attacks in January 2015, police raided his workshop and found weapons, all reactivated either by drills or by replacing the barrel.

These included a 15 Ceska VZ 58, a Tokarev TT 33 and ammunition.

But police did not need to search for a second VZ 58 or a further Tokarev TT 33 that Herman had ordered from AFG.

The VZ 58 was the gun used at kosher supermarket Hyper Cacher to kill 20 year-old student Yohan Cohen. Two Tokarev pistols were also at the crime scene, and four others at Coulibaly’s hideout in Gentilly.

But Hermant had an excuse. The story he told investigators was that, since 2014, he had been buying weapons with the knowledge of the French Gendarmerie, to document an arms dealing ring.

Hermant sold arms to Samir L., an underworld figure from Roubaix, and he asked his police contacts if they would let him to sell more weapons to the dodgy figure. They agreed.

The police have acknowledged that Harmant had an official “informant” status starting from 2013. When the police officer in charge of overseeing Harmant was confronted about a failure to see where the guns were ending up, he stated: “I’m running 30 informants, it’s complicated.”

Another of Hermant’s clients was a Belgian, Patrick Halluent. He was also on the client list at AFG, where he bought the second Ceska VZ 58, which was used by the terrorist Coulibaly.

However a piece of the story is missing: how the weapons from Hermant moved from these intermediaries to Coulibaly.

On the 23 July 2015 a white Mercedes travels by ferry from the German island of Fehmarn to Lolland, Denmark. The driver is the Bosnian Sanel H. At a routine check on his vehicle at the ferryport of Rodby, investigators discover ten hand grenades and 13 weapons. His car is an arms depot.

Sanel H. takes it all on himself. He doesn’t give information, name accomplices or state what he plans to do with the weapons.

A note found on him mentions the Danish city of Aalborg, a phone number and a name – but he says he knows nothing about it. Due to further information, the Danish police question him about a former police officer from Bosnia and Sanel admits knowing him, calling the ex-cop “an honest man” who has nothing to do with arms dealings.

Three months later, at the German border with Belgium in Aachen: a police commando arrests the “honest man”. The German police received a tip from Bosnia. The car driven by the ex-cop has 25 hand grenades and four assault rifles under the brand Zastava M 70, the Serbian Kalashnikov.

The same type of Zastava M70 was used by Kouachi brothers during their attack on Charlie Hebdo in January. Another M70 was found in the Bataclan club after the massacre in November. A further three examples of the same weapon were found in a Seat Leon used as a getaway car by the attackers at the Bataclan.

All these weapons were not trafficked through the Slovak cycle described above. They were active weapons from the Balkans, where Zastava has historically produced four million M70 AKMs - a figure higher than the population of Bosnia and Herzegovina.

The M70 found at the Bataclan was shipped on 26 May 1981 to Sarajevo, for the local Yugoslavian Territorial Defence Forces, a National Guard that, after the fall of Yugoslavia, became the core of the Bosnian armed forces during the civil war in the 1990s.

The second Kalashnikov used at the Bataclan may also have come from the Balkans. This was a Chinese Norinco version of a Kalashnikov, with an unknown fabrication date. Such Chinese weapons were standard equipment for the Albanian Armed Forces. And the third Kalashnikov, made in 1985, came from Bulgaria.

The EU committee for internal security (COSI) made a note last year related to the Kalashnikov used at Charlie Hebdo, and observed that the weapon may have come from a stockpile in former East Germany.

The ballistic reports analyzed by EIC do not support this claim and investigators did not publish proof related to this observation, but this would not be surprising.

A similar former East Germany weapon showed up in Belgium a few years back, the type MPKIS, which originated from the Balkan war, according to Belgian intelligence.

The Bulgarian Kalashnikov used at the Bataclan could have come from Bulgaria directly: like in so many countries of the former Eastern Bloc, Bulgaria has huge piles of inactive firearms.

In 2008, Bulgaria announced that it had 46,000 small arms in surplus. Its strategy to dispose of the weapons is first to try to sell them - and what cannot be sold should be melted as scrap iron.

Meanwhile Romania announced it had 1.25 million in surplus, Albania 259,000, Serbia 90,000 and Bosnia and Herzegovina 53,000.

These are the weapons from state arsenals, which are poorly guarded - and risk burglary. In January 2009, 62 firearms disappeared from a Romanian military depot in Ciorogarla, just outside the capital Bucharest. Among the stolen weapons were submachine guns type AKM-47, TT type training pistols, and Carpati pistols. The investigation revealed that the theft was conducted at least two weeks before its discovery.

Several Romanian Army officers were sacked - and members of a criminal gang led by former martial arts champion Eugen Preda were arrested. The suspects were later convicted. 35 weapons - which were to be used in drug trafficking in Europe - were discovered in December 2009 and another 15 in January 2011.

But throughout the region a larger stockpile is likely to be in private hands, and hiding in basements: when Albanians toppled their government in 1997, at least 500,000 weapons were stolen during the riots and more then 1.5 billion rounds of ammunition.

Today there is a flourishing business selling and buying such weapons, even at flea markets, and they are sent to west Europe using buses and private cars with no verification on their contents. The customs officers stand no chance, while others take bribes, as a TV investigation published by Canal Plus has shown recently.

These are the methods used by the Bosnians arrested in Denmark last year. According to the German police BKA, they confiscated 264 such weapons from the Balkans during 2014.

In August 2015, three months before the attacks at the Bataclan in Paris, Reda H., an informant and accomplice of terrorist mastermind Abdelhamid Abaaoud, stated to the French intelligence DGSI: “[Abaaoud] told me to search for an easy target, like a concert (…) He doesn’t see any problem to get weapons, I only had to say what I need. I think they had access to a supplier network.”

To reduce such threats, is it enough for Europe to destroy the entire stockpile of the Balkan wars?

No, says former head of firearms department of the Belgian federal police, Pierre-Yves Fiévez: “Western Europe will soon face weapons coming from Tunisia and Egypt. We are already facing a wave of arms coming from the Ukrainian conflict.”

Slovakia is aiming to clear up its reputation as a hub for sales of deactivated arms that are converted into terrorist weaponry - but our undercover investigation reveals this is not going to plan.

In Slovakia, new legislation came into force last summer. On paper, there are no more sales of alarm weapons on the Internet - nor to private people.

On the website of online weapons store AFG, on a page detailing alarm weapons, there is a pop-up alerting visitors that “the following pages are intended only for professionals and business companies involved in production and sale of weapons and ammunition. A person following to the next pages confirms that he is a holder of arm license.”

The Ceska VZ 58 - the type used in the Hyper Cacher attack - is still available to buy for 320 Euro.

Whoever does not buy online, can still shop in the store if they are over 18, according to the website.

The sales manager states that the weapon is modified following the new legislation.

When asked about how the Slovaks will prevent alarm weapons being re-activated, Petar Lazarov, spokesperson for the Minister for Internal Affairs in Bratislava, said there are “new technical standards”.

But the new legislation has no different technical procedures on how to modify such weapons, according to Jaroslav Nad, defence expert of the Slovak Security Policy Institute.

Posing as an interested buyer, an EIC reporter obtained the status of a wholesale client using documents copied from the Internet.

This gave the EIC access to pictures showing how the VZ 58 is modified and a description of these modifications. This guise also offered us a better price – only 230 Euro without tax.

Looking at this evidence, German arms expert Lars Winkelsdorf said: “With the new changes the weapon cannot load blank bullets automatically. But it can still fire. And by easy measures you can rebuild it to a full automatically live weapon. To do this, you have to use some minor spare parts, which you can buy free on the market, and do some work with the barrel. That's five or six hours work, not more for somebody with an ordinary knowledge of metal workmanship.”

Doing business online is still possible for wholesalers and anyone, even with a tiny amount of intelligence - like a journalist - can pose as a wholesaler.

This would still make it possible for criminal networks to operate as before.

These actions are not against the EU’s fire-arms directive because, according to a European Commission spokesperson: “the present Directive doesn’t cover alarm weapons”.

There are discussions to draw up new legislation to include criteria to define alarm weapons and to prevent their re-activation.

But the EU spokesperson cannot say when this will happen.

A version of stories published by Spiegel, Mediapart and Le Soir under the umbrella of European Investigative Collaborations (EIC)

Read here how: EU’s freedom of goods policy opened door to Paris terror attacks

Initiators

Der Spiegel (Jörg Schmitt, Jürgen Dahlkampf)

Le Soir (Alain Lallemand)

Reporting

Andreas Ulrich, Wolf Wiedmann-Schmidt, Der Spiegel; Fabrice Arfi, Karl Laske, Matthieu Suc from Mediapart; John Hansen, Jakob Sheikh, Politiken; Milorad Ivanovic, Newsweek Serbia; Lukas Matzinger, Falter; Irene Velasco, El Mundo; Vlad Odobescu, The Romanian Centre for Investigative Journalism; Michael Bird, The Black Sea

Information Design

Pablo Medina, Javier J. Barriocanal and Paula Guisado, El Mundo; Donatien Huet, Mediapart; Jean-Philippe Demonty and Marc Vanderbel, Le Soir; Martin Brinker, Max Heber und Chris Kurt, DER SPIEGEL.

Coordination

Stefan Candea, RCIJ

Ján Kuciak from Slovakia has contributed to this research.