A facility in Iceland has been identified as becoming a virtual space for disinformation and identity theft.

Specifically, a building in Reykjavik that houses a penis museum has been identified as a virtual haven for perpetrators of identity theft, ransomware, disinformation, and fraud in Iceland.

The office building near the harbour in Iceland’s capital, Reykjavik, is best known as the home of the Icelandic Phallologicam Museum, displaying 320 specimens of mammal penises. 

According to the New York Times, the museum’s street is the registered address for Withheld for Privacy, a company that is part of a booming and largely unregulated industry in Iceland, allowing people who operate online domains to shield their identities.

However, while the practice has become commonplace for website owners seeking to protect themselves from harassment or spam, it has helped others cover their tracks from prying regulators, law enforcement officials, or victims. 

Withheld for Privacy and proxy services have turned Iceland into a global hub for illicit activity far out of proportion to the country’s size, the report noted, pointing out that Iceland is an attractive place for proxy services largely because of its robust privacy laws, which officials said were intended to protect ordinary users from authoritarian governments, not to shelter fraudsters. 

“We had the aim to create what we called the Switzerland of bytes,” said Mordur Ingolfsson, a former member of Iceland’s parliament who helped enact some of the country’s first internet privacy laws. What happened instead “is abuse of the work that we did.”

Iceland’s Data Protection Authority, along with the country’s prosecutor and telecommunications ministry, has pushed for legislation that would effectively ban services like Withheld for Privacy from operating in Iceland.

Withheld for Privacy, like many of its clients, is a mysterious entity, its activity seemingly obfuscated by design. 

According to Iceland’s tax department, Withheld for Privacy is registered at Kalkofnsvegur 2, but there is no outward sign that the service occupies space in the six-story building.

The Icelandic Phallological Museum is in the basement, while an H&M clothing store occupies the first two floors. 

A sales manager at Regus, a British company that operates a shared-services office on the third floor, said Withheld for Privacy had no presence in the building.

Thordur Thordarson, the museum’s chief operating officer, expressed bewilderment at the building’s links to nefarious activity online. 

“We are a penis museum, yes,” he said during a tour of its scientific and cultural displays, “but we are a serious penis museum.”