📊 Exhibit A: The Guccifer Template

Marcel Lehel Lazăr's story is the founding myth of Romanian cybercrime — and the lesson that shaped everything that followed:

Lazăr's method was primitive — guessing passwords and checking AOL recovery questions. His infrastructure was a consumer desktop. He was identified because he used his personal internet connection. Every detail of his arrest reads as a training manual for what not to do. The next generation of Romanian cyber operators learned every lesson.

📊 Exhibit B: Hackerville — The eBay Proving Ground

Around 2005, Râmnicu Vâlcea gained international notoriety as a center of online auction fraud. The operation was systematic:

1. Post fake eBay listings for luxury goods
2. Receive payment via Western Union wire transfers
3. Ship nothing
4. Scale through recruitment of local youth as money mules

The FBI estimated millions of dollars in losses. DIICOT (Direcția de Investigare a Infracțiunilor de Criminalitate Organizată și Terorism) conducted raids. Some operators were arrested. The town earned the nickname "Hackerville" — a misnomer, since the core activity was social engineering fraud, not hacking.

The critical lesson from Hackerville was not technical. It was organizational: the people who got arrested were the ones who touched the money. The ones who provided infrastructure — internet cafés, VPN access, laptop procurement — were never charged. The infrastructure layer was invisible to law enforcement because it wasn't committing a crime. It was providing services to people who were.

📊 Exhibit C: The Enforcement Gap — DIICOT's Mandate

Romania's cybercrime enforcement operates through a structural constraint:

DIICOT investigates hackers who commit crimes — people like Guccifer. ANCOM regulates telecom operators — licensed carriers. CERT-RO responds to incidents — attacks against Romanian targets.

None of these agencies has a clear mandate to investigate a Romanian SRL that provides hosting services used by foreign actors to scan foreign targets. NexonHost Srl (13 IPs, 100% abuse, bulletproof-flagged) is not hacking. It's hosting. Bunea TELECOM SRL had 3 ASNs blacklisted by Spamhaus — a private organization — and no Romanian agency took action. The enforcement gap is not about capacity. It's about jurisdiction over a category of activity that doesn't exist in Romanian law as criminal.

📊 Exhibit D: FlokiNET — Ideology as Business Model

FlokiNET ehf (AS200651) presents itself as a "freedom hosting" provider — infrastructure for whistleblowers, journalists, and activists. Registered in Iceland. But 7 of its 24 IPs are in Romania, and those Romanian IPs tell a different story:

RDAP contacts: abuse@flokinet.is for all IPs. Maintainers include both Icelandic (lir-is-flokinetehf-1-MNT) and Seychelles (sc-flokinet-ltd-1-mnt) registrations. A Swedish phone number (+46844683245) covers 23 of 24 IPs.

FlokiNET's ideological positioning — free speech hosting, press freedom — is genuine for its Icelandic operations. But why does a free-speech hoster need Romanian infrastructure at 2.5× the threat level of its home base? The Romanian Corridor offers two things Iceland doesn't: M247's transit network and regulatory distance from Icelandic law. Even ideological hosters route through Romania when they need infrastructure that won't be examined too closely.

📊 Exhibit E: The Talent Pipeline

Romania produces approximately 9,000 IT graduates per year from its university system. Bucharest, Cluj-Napoca, Timișoara, and Iași are significant tech hubs. Major employers include: Microsoft, Oracle, Amazon, UIPath (Romanian-founded unicorn), Bitdefender (Romanian cybersecurity company, global top 10).

The legitimate tech sector is booming. Romania is the EU's fastest-growing IT outsourcing destination. Average IT salaries are 3-4× the national average.

And yet, the infrastructure layer persists. Why?

The economic incentive structure doesn't favor crime over legitimacy in the traditional sense. Romanian developers earn well. But the infrastructure path offers something the legitimate path doesn't: income without employment, scale without hiring, and risk without criminal liability. A Spamhaus listing is not a criminal conviction. An ASN-DROP is not an arrest. The worst case for a bulletproof SRL operator is that they need to form a new SRL.

📊 Exhibit F: The ROMARG Case Study

ROMARG SRL (AS205275) represents the pure-play Gen 3 operator:

Risk score 96.0 out of 100. Both IPs at critical threat levels. The HASSH fingerprint is classified as botnet infrastructure, not scanner. ROMARG isn't scanning — it's operating command and control. And it's been doing it since 2017 without a Spamhaus listing, without a DIICOT investigation, without any visible consequence. Eight years of operation at near-maximum risk with zero enforcement action. This is not evasion. This is structural immunity.