The ARES Team
On 27 September 2017, the Spanish Guardia Civil launched key raids under Operation RUGER, executed in conjunction with EUROPOL and law enforcement and customs/border agencies from Cyprus, Germany, the UK, and the US. Operation RUGER was initiated in March after the detection by Spanish postal services of various parcels destined for foreign addresses which contained carefully concealed firearms and ammunition.
A 24-year-old man from Pamplona was arrested along with five of his customers, taken into custody simultaneously in various European countries. Firearms, ammunition, and components were recovered in various calibres; .25 ACP (6.35 × 16SR mm), .32 ACP (7.65 × 17 mm), .357 Magnum (9.1 × 33R mm), and 12 gauge (shotgun). The firearms the accused had allegedly been selling were converted from blank-firing and deactivated small arms, using a home workshop type setup, before being sold on the Dark Web.
During the raids on multiple locations in Spain, the following items were recovered:
- 22 x handguns (both semi-automatic models and revolvers)
- 1 x sawed-off shotgun
- 1 x concealed firearm contained in a lighter (chambered for .25 ACP)
- 15 x handgun magazines
- Multiple barrels for handguns
- Multiple spare parts for handguns
- Ammunition (.357 Magnum, .25 ACP, and 12 gauge cartridges)
- Over 500 cartridge cases (.25 ACP & .32 ACP)
- Over 500 projectiles (.25 ACP & .32 ACP)
- 1000 x primers
- 1 kg of propellant
- 1 x reloading press and dies
- Workshop equipment for repairing and fabrication of new firearms components
- 7 x steel barrel blanks
During the course of the investigation it was determined that, in 2017 alone, the arrested individual had sent more than 30 parcels to multiple customers in Europe, Latin America, and Asia. In various cases, the recipients were involved in criminal activities, including homicides. In one case, the handgun sent from Spain was immediately used by the recipient to commit suicide.
This individual was very active on the Dark Web, and a well-known seller on AlphaBay Market, a Dark Web marketplace shutdown in July of this year by US authorities. He employed multiple active measures to conceal his activity, payments, and shipments, and encrypted his communications with customers. Additionally, the accused allegedly employed a ‘safehouse’ (possibly a dead drop location) to receive blank firing and deactivated weapons.
These items were later converted and repaired in a workshop fitted with a ‘false floor’, under which he had apparently installed a clandestine workshop. In addition to workshop equipment suitable for conducting repairs (‘reactivation’) to deactivated firearms and the conversion of blank-firing weapons via operations such as removing barrel/chamber occlusions, the accused also had possession of barrel blanks and the equipment necessary to fit these to converted handguns. The operation also included removing serial numbers and other markings, and assembling ammunition for the weapons prior to their sale online. Payment was received in Bitcoin.
Blank-firing weapons, whether converted or not, have been used in crimes in Spain. On 28 September, an altercation between two people on the Madrid Metro resulted in one man drawing and discharging a blank-firing handgun. Blank-firing guns are widely available in Spain, and may be legally purchased upon presentation of government-issued identification.
Some of the models available in online web stores based in, and servicing Spain, were examined by ARES researchers. Several of these have design features which are desirable for their conversion to lethal-purpose firearms. Amongst the recovered weapons are Turkish made blank-firing handguns of makes and models often seen converted to lethal-purpose firearms. Such converted Turkish guns have been documented by ARES in numerous countries, including conflict and post-conflict zones such as the Central African Republic, Iraq, Libya, and Yemen. Interestingly, when making a ‘clean’ search in Spanish for one of these common Turkish models, the first autocomplete suggestion was “modificada” (Spanish for ‘modified’; a term used in Spanish to describe converted blank-firing guns and other modified firearms).
According to Spanish law enforcement sources, the investigation is “closely related” to the 2016 Munich attack in which an assailant opened fire outside a McDonald’s restaurant in the vicinity of the Olympia Shopping Mall, killing nine people and injuring thirty-six, before committing suicide. Investigators indicated that the firearm used was a ‘reactivated’ Glock handgun, believed to have been purchased on the Dark Web. It is not clear whether Spanish and German investigators believe the accused arrested in Pamplona to have supplied the firearm used in Munich, or whether the connection is broader, such as sharing an online sales platform.
Images from the Guardia Civil. With thanks to confidential sources.
Remember, all arms and munitions are dangerous. Treat all firearms as if they are loaded, and all munitions as if they are live, until you have personally confirmed otherwise. If you do not have specialist knowledge, never assume that arms or munitions are safe to handle until they have been inspected by a subject matter specialist. You should not approach, handle, move, operate, or modify arms and munitions unless explicitly trained to do so. If you encounter any unexploded ordnance (UXO) or explosive remnants of war (ERW), always remember the ‘ARMS’ acronym:
AVOID the area
RECORD all relevant information
MARK the area to warn others
SEEK assistance from the relevant authorities