The police are at your door with a search warrant. The reason: a package from the Netherlands that was flagged by customs. Or a letter is in your postbox – a summons naming you as a suspect in a narcotics case. You know what you ordered. What you do not know is what you are now facing. Darknet cases are not a grey area of minor offences. A single drug order that crosses the threshold quantity is punishable under § 28a SMG (drug trafficking) by up to five years‘ imprisonment; where the trade is aggravated, the range climbs to ten years and beyond.

Austrian investigators are long since geared to darknet crime. Customs and the Federal Criminal Police Office (Bundeskriminalamt, BKA) run systematic checks on postal traffic; controlled deliveries, blockchain analysis and IP tracing are standard tools. In May 2025 the international darknet operation „RapTor“ led to arrests across several countries, including in Austria. If you searched „caught buying drugs on the darknet Austria“ or „customs seized my package“, you are in the situation this page is written for.

The other side of the coin: investigators make mistakes. An IP address does not prove who sat at the keyboard. The pure-substance content must be established by chemical analysis, not estimated. And where an undercover officer induced the act, the proceedings must be discontinued. On this page I explain, as a criminal defense lawyer in Vienna, when darknet conduct becomes punishable, how the police investigate, what penalties the SMG provides – and where the defense begins.

From order to charge: how a darknet case runs

Merely browsing the darknet is not punishable. Neither using the Tor browser nor visiting a darknet marketplace amounts to an offence. Criminal liability begins only when a concrete act is added – an order, a purchase, a sale, or the possession of illegal goods. From that point, a typical case runs through four phases, and each phase offers the defense a point of attack.

Is the dark web illegal in Austria?

No. Using the Tor browser, reaching the dark web and even opening a darknet marketplace are all legal in Austria. There is no offence of „being on the dark web“. The law does not punish the tool or the place – it punishes conduct. Liability attaches the moment you do something that is illegal in itself: buying, selling, importing or possessing drugs, weapons, forged payment cards or similar goods.

This distinction matters, because people often assume the anonymity software is the problem. It is not. The searches „is the dark web illegal“, „is it illegal to browse the dark web“ and „is Tor legal in Austria“ all have the same answer: the browser is lawful; the transaction may not be. So the question a court asks is never „were you on Tor?“ but „did you place this specific order, and what was in it?“ That is exactly where the evidence – and the defense – is decided.

Customs seized my package: the „love letter“

When Austrian customs (Zoll) intercepts a suspicious parcel, it informs the police or the public prosecutor’s office (Staatsanwaltschaft), and an investigation is opened. Many buyers first learn of it through a letter – the notice that a consignment addressed to them was seized. In the online scene this letter is grimly nicknamed the „love letter“. Receiving it does not mean you are convicted. It means a file has been opened, and your response now shapes everything that follows.

From here the case can move in two directions. Either the parcel is seized and you receive a summons (Ladung) as a suspect. Or investigators use a controlled delivery (kontrollierte Lieferung): the package is not stopped but forwarded, and the recipient is observed and arrested on acceptance. This second route is important for the defense, because accepting a package is not the same as having ordered it. A parcel can be sent to any address; taking delivery of it does not, by itself, prove who placed the order.

The single most important step

Whether you have a letter, a summons or a knock at the door: do not explain, do not „clear it up“, do not make a statement before your lawyer has seen the file. What you say in the first questioning can determine the entire case. Everything you volunteer about how often, how much or from whom can turn a defensible file into a confession.

Which offences are prosecuted in darknet cases?

„Darknet crime“ is not a separate offence in Austrian law. Liability follows from the ordinary statutes – the Narcotic Substances Act (Suchtmittelgesetz, SMG), the Criminal Code (Strafgesetzbuch, StGB) and the Weapons Act (Waffengesetz, WaffG). The darknet as the scene of the act does not change the penalty ranges, but it makes the investigation more complex and the accusation often heavier, because cross-border import and organised structures are added to the picture.

By far the most common accusation in darknet cases is drug trafficking. Cannabis, cocaine, MDMA, amphetamines and LSD make up most seized consignments. Behind them come money laundering linked to cryptocurrency, counterfeiting, trade in stolen card data and weapons offences.

Ordering drugs from the darknet: penalties and threshold quantities (Grenzmenge)

Whether a darknet drug order is a minor matter or a serious one turns on two things: the substance and the quantity. And the quantity that counts is not the gross weight of the package, but the pure-substance content (Reinsubstanz). This is a central line of defense, because the pure substance must be established by chemical analysis. An estimate is not enough (Austrian Supreme Court, OGH 12 Os 124/22k, 26 April 2023).

The three tiers of liability

The SMG draws a clear line between personal use, the threshold quantity and the large quantity. Each tier has a dramatic effect on the penalty:

• Below the threshold, for personal use: § 27 SMG – up to six months (para 2) or one year (para 1) or a fine. Diversion and treatment instead of punishment are possible.
• Threshold quantity exceeded: § 28a para 1 SMG – up to five years. Anyone who orders from abroad is treated as an instigator to import (Bestimmungstäter, § 12 second case StGB) – even for personal use, once the threshold is crossed.
• Large and exceptionally large quantity: 15× the threshold (große Menge) raises the range to one to ten years (§ 28a para 2 SMG); 25× the threshold (übergroße Menge) to one to fifteen years (§ 28a para 4 no 3 SMG).

Threshold quantities (Grenzmenge) under the SMG

The threshold quantities refer to the pure substance, not the gross weight. That is the decisive difference. The following table shows the most common substances and, for orientation, the 25× boundary above which the heaviest range applies:

A worked example: when does it tip over?

200 g of cannabis flower with a 15 % THC content yields 30 g of Delta-9-THC pure substance. The threshold is 20 g. The result: 1.5× the threshold – and the accusation jumps from § 27 SMG to § 28a para 1 SMG. Instead of up to one year, the exposure is suddenly up to five years.

Several orders: cumulative intent (Additionsvorsatz)

Anyone who orders repeatedly on the darknet risks having the quantities added together. In its landmark decision of an enlarged panel (OGH 12 Os 21/17f, 15 November 2017), the Supreme Court held that sub-threshold quantities can be aggregated where a cumulative intent existed from the outset – five small orders can add up to a single offence that crosses the threshold. Whether that is really so, or whether separate orders form separate acts, is a genuine question for the defense.

How Austrian police investigate the darknet

The BKA has specialised units for narcotics sent by post and over the internet, and its methods are advanced. But every method has legal limits – and those limits are where the defense works.

Postal control and controlled delivery

Together with the customs administration, the BKA runs systematic checks of postal traffic. Suspicious consignments are singled out by country of origin, sender profile and packaging features. In a controlled delivery, the parcel is not intercepted but forwarded, and the recipient is watched at the point of acceptance. For the suspect this cuts both ways: it can look damning, yet accepting a package still does not prove who placed the order.

Crypto tracing

Payments on darknet markets usually run through cryptocurrency. Blockchain-analysis tools let investigators follow Bitcoin transactions despite their pseudonymity, and seized assets are moved to official wallets. Privacy coins such as Monero make tracing harder, but not impossible. At a house search, hardware wallets, seed phrases and access data are looked for specifically.

Undercover investigation and sham purchases

Under § 131 of the Code of Criminal Procedure (Strafprozessordnung, StPO) the police may investigate undercover on the darknet, using cover identities. A sham purchase (Scheingeschäft) under § 132 StPO is subject to strict statutory conditions. The hard limit is entrapment: an undercover officer may uncover an offence, but may not provoke it. Where the state induces the act, the proceedings must be discontinued (§ 5 para 3 and § 133 para 5 StPO).

IP tracing and Operation RapTor

An IP address identifies an internet connection, not a person. Providers must, on a proper request, disclose which subscriber an IP address was assigned to at a given time; the Supreme Court has confirmed that duty (OGH 15 Os 172/10y). Tor and a VPN conceal the IP, but mistakes – a DNS leak, simultaneous clearnet use – can still expose it. How far international enforcement now reaches was shown by Operation RapTor in May 2025, a coordinated darknet crackdown that produced arrests in several countries, including Austria.

House search on darknet suspicion: your rights

A house search (Hausdurchsuchung) on darknet suspicion follows a familiar pattern. The parcel is intercepted at customs, the prosecutor orders the search, and the police look for further narcotics, packaging material, computers, phones, USB sticks, hardware wallets and cash. Every electronic device is seized and handed to IT forensics – deleted data, browser history, Tor use and crypto wallets are all examined.

How to conduct yourself

• Call a lawyer at once. You have the right to counsel. Use it.
• Stay silent. Make no statement on the substance. No „that isn’t mine“, no „it was only once“.
• Tolerate the search, but do not actively help. You are not obliged to assist the officers.
• Give up no passwords. You are not required to disclose passwords or PINs.
• Have everything recorded. Insist on a written record of the items seized.
• Reserve your objection. A search can be challenged afterwards before the court (§ 106 StPO).

Where the accusation is serious – especially a suspicion of commercial trafficking – an arrest may follow directly at the search, and with it the risk of pre-trial detention (Untersuchungshaft).

Defense strategies in darknet cases

Defense in darknet cases works on several levels. Every case is different, but the central points of attack recur, and an experienced defense lawyer tests each one systematically. The prosecutor bears the burden of proof – and in these cases that burden is often heavier than it first appears.

1. Attribution: who sat at the keyboard?

Darknet accounts run under pseudonyms, so the central question is whether an order can be tied to a specific person. Merely holding an internet connection does not prove that the account holder placed the order. Several people in a household, shared computers, open Wi-Fi – all of it weakens the link between an address and an act. Is a package addressed to you enough to convict you? On its own, no.

2. An IP address is not proof of the act

An IP address identifies a connection, not a person. With VPN servers, Tor exit nodes and NAT networks the attribution is uncertain in any event. It is for the prosecution to prove that the suspect performed the concrete act – not for the suspect to prove that they did not.

3. Quantity: pure substance, not estimate

The Supreme Court has made this unmistakable in 12 Os 124/22k: the pure substance must be exactly determined. Estimates or average values are not enough for a conviction under § 28a SMG. A hundred ecstasy tablets can fall below or above the threshold quantity depending on their purity. No chemical analysis means no conviction for exceeding the threshold.

4. Entrapment: when the officer goes too far

Undercover officers may uncover offences, but not provoke them. Entrapment (Tatprovokation) exists where a person is induced to commit an offence by measures attributable to the state, in a way that offends the guarantee of a fair trial – officers must confine themselves to an essentially passive investigation. Where that line is crossed, the proceedings against the person must be discontinued (§ 133 para 5 StPO), and the burden lies with the state, not the suspect.

5. Unlawful sham purchases

A sham purchase (Scheingeschäft, § 132 StPO) is bound by strict statutory conditions. Where the police stage one outside those limits, the resulting evidence is open to challenge. In darknet drug cases this overlaps directly with the entrapment question above.

6. Exclusion of evidence

Not every item of evidence may be used. Unlawful surveillance of messages without judicial authorisation, a house search without a proper order, or a break in the IT-forensic chain of custody – each can render the evidence obtained unusable.

Treatment instead of punishment (Therapie statt Strafe)

For darknet drug offences connected to personal use, Austrian law offers routes away from a conviction that do not exist in this form in the UK or the US. The SMG allows the sentence to be replaced by health-related measures – provided the conditions are met. This is worth understanding early, because it can change the whole objective of a defense.

• § 35 SMG – provisional withdrawal from prosecution: where there is a need for treatment, the public prosecutor can provisionally withdraw from the prosecution for a probation period of one to two years, where necessary combined with a health-related measure.
• § 37 SMG – discontinuation by the court: once the indictment has been filed, the court applies §§ 35 and 36 SMG by analogy and can discontinue the proceedings by court order under the same conditions.
• § 39 SMG – deferral of enforcement for treatment: a custodial sentence can be deferred to allow a course of therapy.
• Diversion under the StPO: for offences of minor guilt, resolving the case without a conviction is possible in principle.

Therapie statt Strafe comes into play above all where there is genuine personal consumption and dependency. It is not confined to sub-threshold cases: for a drug-dependent accused these routes can stay open even above the threshold – § 35 para 2 SMG expressly extends the withdrawal from prosecution to offences under §§ 28 and 28a SMG, and § 39 SMG allows a sentence of up to three years to be deferred for therapy, except in the aggravated cases of § 28a para 2, 4 and 5. Only large-scale or commercial trafficking of that kind falls outside – which is one more reason why the quantity question is so often the decisive battleground.

Frequently asked questions on darknet charges in Austria

Related articles