The police are at your door with a search warrant. The reason: a package from the Netherlands that was flagged by customs. Or a letter is in your postbox – a summons naming you as a suspect in a narcotics case. You know what you ordered. What you do not know is what you are now facing. Darknet cases are not a grey area of minor offences. A single drug order from abroad that crosses the threshold quantity is punishable under § 28a SMG (drug trafficking) by up to five years‘ imprisonment; where the trade is aggravated, the range climbs to ten years and beyond.

Austrian investigators are long since geared to darknet crime. Customs and the Federal Criminal Police Office (Bundeskriminalamt, BKA) run systematic checks on postal traffic; controlled deliveries, blockchain analysis and IP tracing are standard tools. In May 2025 the international darknet operation „RapTor“ led to arrests across several countries, including in Austria. If you searched „caught buying drugs on the darknet Austria“ or „customs seized my package“, you are in the situation this page is written for.

The other side of the coin: investigators make mistakes. An IP address does not prove who sat at the keyboard. Whether the threshold quantity was exceeded is something the court must specifically establish. And where an undercover officer induced the act, the proceedings must be discontinued. On this page I explain, as a criminal defense lawyer in Vienna, when darknet conduct becomes punishable, how the police investigate, what penalties the SMG provides – and where the defense begins.

From order to charge: how a darknet case runs

Merely browsing the darknet is not punishable. Neither using the Tor browser nor visiting a darknet marketplace amounts to an offence. Criminal liability begins only when a concrete act is added – an order, a purchase, a sale, or the possession of illegal goods. From that point, a typical case runs through four phases, and each phase offers the defense a point of attack.

Is the dark web illegal in Austria?

No. Using the Tor browser, reaching the dark web and even opening a darknet marketplace are all legal in Austria. There is no offence of „being on the dark web“. The law does not punish the tool or the place – it punishes conduct. Liability attaches the moment you do something that is illegal in itself: buying, selling, importing or possessing drugs, weapons, forged payment cards or similar goods.

This distinction matters, because people often assume the anonymity software is the problem. It is not. The searches „is the dark web illegal“, „is it illegal to browse the dark web“ and „is Tor legal in Austria“ all have the same answer: the browser is lawful; the transaction may not be. So the question a court asks is never „were you on Tor?“ but „did you place this specific order, and what was in it?“ That is exactly where the evidence – and the defense – is decided.

Customs seized my package: the „love letter“

When Austrian customs (Zoll) intercepts a suspicious parcel, it informs the police or the public prosecutor’s office (Staatsanwaltschaft), and an investigation is opened. In practice you will always be reported, even if the order was below the threshold quantity and meant only for yourself. If the investigation shows nothing more than that, the report is followed by a referral report (Abtretungsbericht): the criminal police notify the health authority and report to the public prosecutor (§ 13 para 2b SMG), who then provisionally withdraws from the prosecution straight away unless further clarification of the facts is considered necessary (§ 35 para 9 SMG). Otherwise the investigation continues. Many buyers first learn of it through a letter – the notice that a consignment addressed to them was seized. In the online scene this letter is grimly nicknamed the „love letter“. Receiving it does not mean you are convicted. It means a file has been opened, and your response now shapes everything that follows.

From here the case can move in two directions. Either the parcel is seized and you receive a summons (Ladung) as a suspect. Or investigators use a controlled delivery (kontrollierte Lieferung): the package is not stopped but forwarded, and the recipient is observed and arrested on acceptance. This second route is important for the defense, because accepting a package is not the same as having ordered it. A parcel can be sent to any address; taking delivery of it does not, by itself, prove who placed the order.

The single most important step

Whether you have a letter, a summons or a knock at the door: do not explain, do not „clear it up“, do not make a statement before your lawyer has seen the file. What you say in the first questioning can determine the entire case. Everything you volunteer about how often, how much or from whom can turn a defensible file into a confession.

Which offences are prosecuted in darknet cases?

„Darknet crime“ is not a separate offence in Austrian law. Liability follows from the ordinary statutes – the Narcotic Substances Act (Suchtmittelgesetz, SMG), the Criminal Code (Strafgesetzbuch, StGB) and the Weapons Act (Waffengesetz, WaffG). The darknet as the scene of the act does not change the penalty ranges, but it makes the investigation more complex and the accusation often heavier, because cross-border import and organised structures are added to the picture.

By far the most common accusation in darknet cases is drug trafficking. Cannabis, cocaine, MDMA, amphetamines and LSD make up most seized consignments. Behind them come money laundering linked to cryptocurrency, counterfeiting, trade in stolen card data and weapons offences.

Ordering drugs from the darknet: penalties and threshold quantities (Grenzmenge)

Whether a darknet drug order is a minor matter or a serious one turns on two things: the substance and the quantity. And the quantity that counts is not the gross weight of the package, but the pure-substance content (Reinsubstanz). This is a central line of defense, because the court must establish that the pure substance exceeds the threshold quantity. Where the findings leave open how much of the drug was involved, a conviction under § 28a SMG fails to that extent (Austrian Supreme Court, OGH 12 Os 124/22k, 26 April 2023).

The three tiers of liability

For an order from abroad, the SMG draws a clear line between personal use, the threshold quantity and the large quantity. Each tier has a dramatic effect on the penalty:

• Below the threshold, for personal use: § 27 para 2 SMG – up to six months or a fine. The public prosecutor must provisionally withdraw from the prosecution (§ 35 para 1 SMG).
• Threshold quantity exceeded: § 28a para 1 SMG – up to five years. Anyone who orders from abroad is treated as an instigator to import (Bestimmungstäter, § 12 second case StGB) – even for personal use, once the threshold is crossed. Even an order placed with a seller in Austria can, above the threshold, be prosecuted as instigating an import. If you are habituated to drugs, a provisional withdrawal from prosecution under § 35 para 2 SMG may come into consideration. If you also committed the offence mainly to obtain drugs, or the means to buy them, for your own use, § 28a para 3 SMG limits the penalty to up to three years. Which of these routes is taken is a matter of discretion.
• Large and exceptionally large quantity: 15× the threshold (große Menge) raises the range to one to ten years (§ 28a para 2 SMG); 25× the threshold (übergroße Menge) to one to fifteen years (§ 28a para 4 no 3 SMG).

Threshold quantities (Grenzmenge) under the SMG

The threshold quantities refer to the pure substance, not the gross weight. That is the decisive difference. The following table shows the most common substances and, for orientation, the 25× boundary above which the heaviest range applies:

A worked example: when does it tip over?

200 g of cannabis flower ordered from abroad with a Delta-9-THC content of 15 % contains 30 g of Delta-9-THC pure substance. The threshold is 20 g. The result: 1.5× the threshold – and the accusation jumps from § 27 SMG to § 28a para 1 SMG. Instead of up to six months for personal use, the exposure is suddenly up to five years.

Several orders: cumulative intent (Additionsvorsatz)

Anyone who orders repeatedly on the darknet risks having the quantities added together. Small quantities are added together where your intent was directed from the outset at committing the acts continuously and at exceeding the threshold in total (RIS-Justiz RS0124018). An enlarged panel of the Supreme Court upheld this (OGH 12 Os 21/17f, 15 November 2017) and added that successive acts of trafficking do not become several offences merely because the total covers several threshold quantities (RIS-Justiz RS0131856). Five small orders can thus add up to an offence that crosses the threshold. Whether that is really so, or whether separate orders form separate acts, is a genuine question for the defense.

How Austrian police investigate the darknet

The BKA has specialised units for narcotics sent by post and over the internet, and its methods are advanced. But every method has legal limits – and those limits are where the defense works.

Postal control and controlled delivery

Together with the customs administration, the BKA runs systematic checks of postal traffic. Suspicious consignments are singled out by country of origin, sender profile and packaging features. In a controlled delivery, the parcel is not intercepted but forwarded, and the recipient is watched at the point of acceptance. For the suspect this cuts both ways: it can look damning, yet accepting a package still does not prove who placed the order.

Crypto tracing

Payments on darknet markets usually run through cryptocurrency. Blockchain-analysis tools let investigators follow Bitcoin transactions despite their pseudonymity, and seized assets are moved to official wallets. Privacy coins such as Monero make tracing harder, but not impossible. At a house search, hardware wallets, seed phrases and access data are looked for specifically.

Undercover investigation and sham purchases

Under § 131 of the Code of Criminal Procedure (Strafprozessordnung, StPO) the police may investigate undercover on the darknet, using cover identities. A sham purchase (Scheingeschäft) under § 132 StPO is subject to strict statutory conditions. The hard limit is entrapment: an undercover officer may uncover an offence, but may not provoke it. Where the state induces the act, the proceedings must be discontinued (§ 5 para 3 and § 133 para 5 StPO).

IP tracing and Operation RapTor

An IP address identifies an internet connection, not a person. Providers must, on a proper request, disclose which subscriber an IP address was assigned to at a given time; the Supreme Court has confirmed that duty (OGH 15 Os 172/10y). Tor and a VPN conceal the IP, but mistakes – a DNS leak, simultaneous clearnet use – can still expose it. How far international enforcement now reaches was shown by Operation RapTor in May 2025, a coordinated darknet crackdown that produced arrests in several countries, including Austria.

House search on darknet suspicion: your rights

A house search (Hausdurchsuchung) on darknet suspicion follows a familiar pattern. The parcel is intercepted at customs, the prosecutor orders the search on the basis of a court authorisation (§ 120 para 1 StPO), and the police look for further narcotics, packaging material, computers, phones, USB sticks, hardware wallets and cash. Electronic devices are seized for analysis – since 1 January 2025 only on the basis of a court authorisation that sets out which categories and contents of data, from which period, are covered (§ 115f paras 2 and 3 StPO); in exigent circumstances (Gefahr im Verzug) the police may provisionally secure data carriers on their own (§ 115f para 4 StPO). Within that scope IT forensics examines the data, including deleted data, browser history, Tor use and crypto wallets.

How to conduct yourself

• Call a lawyer at once. You have the right to counsel. Use it.
• Stay silent. Make no statement on the substance. No „that isn’t mine“, no „it was only once“.
• Tolerate the search, but do not actively help. You are not obliged to assist the officers.
• Give up no passwords. You are not required to disclose passwords or PINs.
• Have everything recorded. Insist on a written record of the items seized.
• Reserve your objection. A search can be challenged afterwards: the court’s authorisation by a complaint (Beschwerde) within 14 days (§§ 87 and 88 StPO), the way the police or the public prosecutor carried it out by an objection for violation of rights (Einspruch wegen Rechtsverletzung) within six weeks (§ 106 StPO). Anyone who challenges the authorisation by a complaint must combine any objection to how the search was ordered or carried out with that complaint (§ 106 para 2 StPO).

Where the accusation is serious – especially a suspicion of commercial trafficking – an arrest may follow directly at the search, and with it the risk of pre-trial detention (Untersuchungshaft).

Defense strategies in darknet cases

Defense in darknet cases works on several levels. Every case is different, but the central points of attack recur, and an experienced defense lawyer tests each one systematically. The prosecutor bears the burden of proof – and in these cases that burden is often heavier than it first appears.

1. Attribution: who sat at the keyboard?

Darknet accounts run under pseudonyms, so the central question is whether an order can be tied to a specific person. Merely holding an internet connection does not prove that the account holder placed the order. Several people in a household, shared computers, open Wi-Fi – all of it weakens the link between an address and an act. Is a package addressed to you enough to convict you? On its own, no.

2. An IP address is not proof of the act

An IP address identifies a connection, not a person. With VPN servers, Tor exit nodes and NAT networks the attribution is uncertain in any event. It is for the prosecution to prove that the suspect performed the concrete act – not for the suspect to prove that they did not.

3. Quantity: pure substance, not gross weight

For a conviction under § 28a SMG, the court must establish that the pure substance exceeds the threshold quantity. A judgment that finds only that ‚quantities of drugs that can no longer be established‘ were passed on to others is not enough; the Supreme Court set aside such a conviction (OGH 12 Os 124/22k). A hundred ecstasy tablets can fall below or above the threshold quantity depending on their purity. How much pure substance has actually been established is therefore one of the first questions to put to the file.

4. Entrapment: when the officer goes too far

Undercover officers may uncover offences, but not provoke them. Entrapment (Tatprovokation) exists where a person is induced to commit an offence by measures attributable to the state, in a way that offends the guarantee of a fair trial – officers must confine themselves to an essentially passive investigation. Where that line is crossed, the proceedings against the person must be discontinued (§ 133 para 5 StPO), and the burden lies with the state, not the suspect.

5. Unlawful sham purchases

A sham purchase (Scheingeschäft, § 132 StPO) is bound by strict statutory conditions. Where the police stage one outside those limits, the resulting evidence is open to challenge. In darknet drug cases this overlaps directly with the entrapment question above.

6. Exclusion of evidence

Not every item of evidence may be used. Results of surveillance of messages may, on pain of nullity, only be used if it was lawfully ordered and authorised by the court (§ 137 para 1, § 140 para 1 StPO); the same applies to results from the analysis of seized data carriers (§ 115j para 1 StPO). A house search without the required court authorisation (§ 120 para 1 StPO), by contrast, does not automatically make the evidence unusable. If the search is declared unlawful on a complaint or objection, the evidence may not be used to your detriment without your consent for the decision on how the investigation ends or for arrest and pre-trial detention; a bar on presenting it at the main trial does not automatically follow (OGH 14 Os 46/09k of 21 July 2009, RIS-Justiz RS0125171). Errors in the IT-forensic chain of custody can be checked against the processing report (Aufbereitungsbericht), which must document how the data were processed (§ 115h para 1 StPO).

Treatment instead of punishment (Therapie statt Strafe)

For darknet drug offences connected to personal use, Austrian law offers routes away from a conviction that do not exist in this form in the UK or the US. The SMG allows the sentence to be replaced by health-related measures – provided the conditions are met. This is worth understanding early, because it can change the whole objective of a defense.

• § 35 SMG – provisional withdrawal from prosecution: where the drugs were solely for personal use and you gained no advantage from them, the public prosecutor must provisionally withdraw from the prosecution of an offence under § 27 para 1 or 2 SMG for a probation period of one to two years, where necessary combined with a health-related measure. For offences under §§ 28 and 28a SMG, withdrawal comes into consideration only if you are habituated to drugs, the offence does not fall within the jurisdiction of the lay-judge or jury court, your guilt would not be regarded as grave and withdrawal appears no less suitable than a conviction to keep you from such offences (§ 35 para 2 SMG). Whether the prosecutor withdraws in that case is a matter of discretion, for instance as regards the gravity of guilt.
• § 37 SMG – discontinuation by the court: once the indictment has been filed, the court applies §§ 35 and 36 SMG by analogy and must, under the conditions that apply to the prosecutor, provisionally discontinue the proceedings by court order, up to the end of the main trial.
• § 39 SMG – deferral of enforcement for treatment: a custodial sentence can be deferred to allow a course of therapy.
• Diversion under the StPO: possible where the offence carries no more than five years‘ imprisonment and your guilt would not be regarded as grave (§ 198 para 2 StPO). This also applies to §§ 28 and 28a SMG, as far as the offence carries no more than five years, and you need not be habituated to drugs. In practice, however, it is mostly refused there for reasons of general prevention.

Therapie statt Strafe comes into play above all where the drugs were for personal use. Dependency is not required for that: for withdrawal under § 35 para 1 SMG in a case under § 27 SMG, all that counts is whether the drugs were solely for personal use and you gained no advantage from them. It is not confined to sub-threshold cases: for an accused habituated to drugs these routes can stay open even above the threshold – § 35 para 2 SMG expressly extends the withdrawal from prosecution to offences under §§ 28 and 28a SMG, and § 39 SMG allows a sentence of up to three years to be deferred for therapy, except in the aggravated cases of § 28a para 2, 4 and 5. Only large-scale or commercial trafficking of that kind falls outside – which is one more reason why the quantity question is so often the decisive battleground.

Frequently asked questions on darknet charges in Austria

Related articles