On 14 January 2016, an Oslo man in his 20s clicked on a for sale ad on the darknet.
He bought a whole package of stolen identity documents there, including a copy of the passport issued to Ole Henrik Golf from southern Norway.
The Oslo man, who had been convicted of minor drug offenses and for theft of a baguette, pays in Bitcoin.
He answers VG’s phone call like this:
“I have an idea of what this is about. You are writing about the Lørenskog case, right?”
Anne-Elisabeth Hagen, the 69-year-old wife of Norwegian billionaire Tom Hagen, disappeared without a trace from her home in the Lørenskog municipality near Oslo on 31 October 2018. Since then, police have been engaged in one of the biggest investigations in Norwegian history to get to the bottom of it.
In April 2020, Tom Hagen was charged with killing his wife, even though no remains were found, and he denies any involvement in her disappearance.
Years passed, and the mystery remained unsolved. Police have concentrated resources on the so-called “crypto lead.”
In November 2021, they sought anyone who bought or sold a copy of Ole Henrik Golf’s passport.
The person or persons behind Anne-Elisabeth Hagen's disappearance used the identity of Golf, who is from the south Norway coastal town of Mandal, to open several accounts on cryptocurrency exchanges and create the e-mail address: firstname.lastname@example.org.
According to police, that must have been part of the planning of Anne-Elisabeth Hagen's disappearance. The planning had to have started at least six months before she disappeared on 31 October 2018, perhaps even earlier, based on information fragments recovered from the dark web.
Norway’s largest newspaper, VG, and the E24 business news outlet, have tried to find out who sold the copy of Golf's passport to the perpetrators in the Lørenskog case.
This seller may have unique information that could identify those people:
A new bitcoin address, perhaps an email account or an unknown alias, are examples of information that could lead police to the perpetrators.
And that’s where the name CardPass comes in.
VG's investigations suggest that a seller using this name may have sold the passport to the perpetrators in the Lørenskog case.
CardPass is also a key lead in police investigations.
The police have tried to identify whoever is hiding behind the alias so they can get in touch with them, VG has learned.
But why hasn’t CardPass contacted police after their inquiries?
There have been illegal marketplaces on the secretive darknet, also called the dark web, for at least a decade. This unregulated part of the Internet can be used to traffic drugs, identity papers and other illegal goods.
A common trait of these marketplaces is that they often disappear. And when they do, all information about illegal transactions between buyers and sellers is deleted.
While researching this article, VG gained access to information from more than 70 deleted marketplaces that operated on the dark web between 2013 and 2020.
Our investigation into CardPass' activity over time has, in part, been done with a new tool.
The Lørenskog police have not used the same tool.
VG has searched deleted material for Norwegian passports and mapped CardPass' operations over six years in seven different marketplaces, from 2015 until 2021.
The police investigation shows that those behind Anne-Elisabeth Hagen's disappearance took several planning steps in the summer of 2018.
Among other things, they created an e-mail account and opened accounts on currency exchanges.
They used a copy of Golf’s passport, which they had already bought.
During the summer of 2018, the marketplace ‘Dream’ was one of the most popular on the dark web and CardPass operated there year-round. VG's material shows that the package including Golf’s passport was advertised for sale through the summer and that CardPass made little over NOK 15,000 on the deal.
‘Dream’ was deleted from the dark web in 2019, but VG succeeded in obtaining more copies of its pages.
Was this the marketplace the perpetrators used to buy the passport?
«This is CardPass from Alphabay and Trade Route. I\'m well-known, trusted vendor with 1000+ items sold.»
This is CardPass’ introduction to potential customers on the Dream marketplace on 12 July 2017.
CardPass is described as "very professional" and one who delivers the goods - quickly.
“A very reliable seller”, writes a customer.
As usual on the dark web, CardPass communicated in English.
It never says which country the person behind the pseudonym comes from.
On 26 December 2017, some people buy the package with Golf's passport on ‘Dream’, according to the police.
This is one of the purchases that interests the Lørenskog investigators.
That Christmas, serious planning of the disappearance was looming.
Could CardPass have information about that ‘Christmas shopping’?
After trading stolen identity papers for seven years, traces of CardPass disappeared in early 2021.
Many on the dark web wonder what happened to this experienced peddler of identity documents.
'Where did he go? I saw him a week ago, but cannot find him now," someone wrote about CardPass on the dark web a year ago.
On a forum thread asking for opportunities to buy fake betting accounts, another person writes the following:
"I know there was a guy at the White House Market, named CardPass, who sold them. But he is gone now.”
In recent weeks, VG and E24 have tried to find and get in touch with CardPass through different methods and channels on the dark web. CardPass has not responded to inquiries made through various encrypted email and chat services.
In the autumn of 2021, there is a note from the Norwegian National Criminal Investigation Service (Kripos) on the doormat of the Oslo man, who bought the copy of Golf's passport on the dark web five years earlier.
– When I called them, they said it was about the Lørenskog case. I knew I had nothing to do with it, but I immediately thought it might have something to do with the passport I bought, he says.
The Oslo man bought the passport to use it for criminal gain. At this time he was addicted to drugs.
- And the addiction often leads to criminal offenses.
Police immediately told him that he was not a suspect in the case.
The police said that they found the Oslo man because he had registered a mobile phone SIM card in Ole Henrik Golf's name. He then put the SIM card registered in Golf's name in the same phone as one with a SIM card registered in his real name.
During the interrogation, the police wanted to know everything about the purchase of the passport and who sold it to him.
He doesn’t remember.
“No, unfortunately. I bought the passport with Bitcoins, and I gave the police my entire transaction history; all the information I had,” says the Oslo man.
However, the Oslo man remembers that he bought the passport copy on a marketplace called ‘Hansa’ in 2016.
VG gained access to four different copies of ‘Hansa’ but has not been able to document that CardPass was active there.
Could the Oslo man have bought the passport from someone other than CardPass?
From the Lørenskog sheriff's office, we look straight down on Langvannet lake and the house at the address Sloraveien 4, the home of Anne Elisabeth Hagen and where she was last seen almost four years ago.
Police still believe the crypto track can solve the mystery.
The prosecutor in the Lørenskog case, Gjermund Hanssen, declined to comment on investigations into CardPass or the possibilities for this alias being the one who sold the passport to the perpetrators.
But he says finding solid information on the dark web is highly demanding, especially when it comes to identifying who may have bought the passport that was used in planning Anne-Elisabeth Hagen's disappearance.
“The work is challenging, extensive and time-consuming, partly because that type of (online) interaction is often performed with high operational security, including using anonymization services, on anonymized networks, with payment often carried out with cryptocurrency,” says Hanssen.
Even though police have an overview of all buyers and sellers of the passport, their investigations suggest that it did not change hands as often as they first feared.
“It is not necessarily the number of purchases, per se, that is the most challenging, but rather clarifying who, and how many people, may have bought it, passed in on and so on and then find a link between them and the crime against Anne-Elisabeth Hagen,” says Hanssen.
The Oslo man hopes the police find out who is behind Anne-Elisabeth Hagen's disappearance. The man says he lives a better life today and that there is a lot that he would undo if he could.
“I also feel very sorry for Ole Henrik Golf. I'm sorry to have abused his identity. It is not something I stand behind today,” he says.