In February 2021, Qurium, an organization that provides secure web hosting services for human rights organizations and independent news outlets, received a rambling message from someone whose email signature indicated they were in the legal department of the European Commission.
Writing in dense legalese, the representative, “Raúl Soto,” demanded that Qurium take action on articles from a Kenyan-based investigative journalism website that it hosts, The Elephant. The articles in question included an investigation into alleged corruption, but Soto’s email wasn’t about the allegations. Rather, he claimed that the piece had infringed the European Union’s General Data Protection Regulation (GDPR), which governs personal data collection and storage in Europe.
Qurium’s staff were suspicious. A brief investigation revealed that the street address in Soto’s signature was not, in fact, that of the European Commission; rather, it was a rented office space in Brussels. Using a publicly available database, they found that complaints were filed to search engines around the same time, claiming that The Elephant article was plagiarized and requesting that the piece be removed and de-indexed from searches — meaning it wouldn’t show up on the first few pages of search engine results.
[…]