EncroChat

EncroChat was a Europe-based communications network and service provider that offered modified smartphones allowing encrypted communication among subscribers. It was used primarily by organized crime members to plan criminal activities. Police infiltrated the network between at least March and June 2020 during a Europe-wide investigation. An unidentified source associated with EncroChat announced on the night of 12–13 June 2020 that the company would cease operations because of the police operation.

The service had around 60,000 subscribers at the time of its closure. As a result of police being able to read unencrypted EncroChat messages, at least 1,000 arrests had been made across Europe as of 22 December 2020.

Background

EncroChat handsets emerged in 2016 as a replacement for a previously disabled end-to-end encrypted service. The company had revealed on 31 December 2015 the Version 115 of EncroChat OS, which appears to be the first public release of their operating system. The earliest version of the company's website archived by the Wayback Machine dates to 23 September 2015.

According to a May 2019 report by the '' Gloucester Citizen'', EncroChat was originally developed for "celebrities who feared their phone conversations were being hacked". In the 2015 murder of English mobster Paul Massey, the killers used a similar service providing encrypted BlackBerry phones based on PGP. After the Dutch and Canadian police compromised their server in 2016, EncroChat turned into a popular alternative among criminals for its security-oriented services in 2017–2018.

The founders and owners of EncroChat are not known. According to Dutch journalist Jan Meeus, a Dutch organized crime gang was involved and financed the developers.

Through a marketing strategy of "relentless online advertising", EncroChat rapidly expanded during its four and a half years of existence, benefiting from the closure of its competitors PGP Safe and Ennetcom. The network eventually reached an estimated 60,000 total subscribers at the time of its closure in June 2020. According to the French National Gendarmerie, 90 percent of subscribers were criminals, and the British National Crime Agency (NCA) said it found no evidence of non-criminals using it.

EncroChat first came to the attention of the media when it was revealed that high-profile criminals Mark Fellows and Steven Boyle had been using the encrypted devices to communicate during the May 2018 gangland murder of John Kinsella in Rainhill. The service resurfaced in the media during the summer of 2020 after law enforcement announced that they had infiltrated the encrypted network and investigative journalist Joseph Cox, who had been reviewing EncroChat for months, published an exposé in '' Vice Motherboard''.

Functionality and services

The EncroChat service was available for handsets called "carbon units", whose GPS, camera and microphone functions were disabled by the company for privacy reasons. Devices were sold with pre-installed applications, including EncroChat, an OTR-based messaging app which routed conversations through a central server based in France, EncroTalk, a ZRTP-based voice call service, and EncroNotes, which allowed users to write encrypted private notes. They generally used modified Android devices, with some models based on the BQ Aquaris X2 phone hardware, others on Samsung devices, and sometimes on non-Android BlackBerry mobile phones. Devices with EncroChat were able to boot in two modes. When only the power button was pressed to turn the handset on, they booted into a dummy Android home screen. But when the handset was switched on by pressing the power button together with the volume button, the phone booted to a secret, encrypted partition which facilitated secret communication via EncroChat's French servers. A "panic button" feature was available, where a certain PIN inputted to the device via the unlock screen would erase all data on the phone. According to journalist Jurre van Bergen, the IP of EncroChat's server points to French web hosting company OVH. EncroChat's SIM provider was the Dutch telecommunications firm KPN.

EncroChat devices were particularly popular in Europe, although they were also sold in the Middle East and elsewhere in the world. One source told ''Vice Motherboard'' that they became the "industry standard" among criminals. They were reported in July 2020 to cost €1,000 (£900) each, then €1,500 (£1,350) for a six-month contract to use EncroChat's solution. EncroChat's website says that the firm had resellers in Amsterdam, Rotterdam, Madrid and Dubai, although Cox describes EncroChat as a "highly secretive" firm which "does not operate like a normal technology company". The phones were reportedly bought via a physical transaction which "looked like a drug deal", and at least one case involves an ex-military operative selling devices in Northern Ireland.

Infiltration

The EncroChat encrypted messaging service and the related customized phones were discovered by the French National Gendarmerie in 2017 when conducting operations against organized crime gangs. At the time of the Fellows and Boyle trial in December 2018, the NCA struggled to crack the lock screen passcode, as anything was wiped out after a set number of attempts.

The investigation accelerated in early 2019 after receiving EU funding. At the end of January 2020, a judge in Lille, France, authorized the infiltration of the EncroChat servers. Intelligence and technical collaboration between the NCA, the National Gendarmerie and Dutch police culminated in gaining access to messages after the National Gendarmerie put a "technical tool" on EncroChat's servers in France. The malware allowed them to read messages before they were sent and record lock screen passwords. Messages could be read by law enforcement beginning in April. EncroChat estimated that around 50 percent of devices in Europe were affected in June 2020.

The National Gendarmerie formed a special unit to investigate the hacked information on 15 March 2020, then signed an agreement with the Dutch Police to form a joint investigation team (JIT) on 10 April, co-operating through Eurojust with the support of Europol. The data was distributed by the JIT to other European partners, including the UK, Sweden and Norway. The NCA began to receive information about the content of messages on 1 April 2020, then started to build data analysis technology to automatically "identify and locate offenders by analysing millions of messages and hundreds of thousands of images". The chief of the Dutch National Police Force, , compared the malware to "sitting at the table where criminals were chatting among themselves". In May 2020, the wipe feature was disabled at distance by law enforcement in some units. The company initially tried to push an update in response to what was initially regarded as a bug, but the devices were struck again by malware altering lock screen passwords.

On the night of 12–13 June 2020, once EncroChat suspected the infiltration by law enforcement had occurred, users received a secret message:

A few days later, an "email address long associated with EncroChat" informed ''Vice Motherboard'' that the service was shutting down permanently "following several attacks carried out by a foreign organization that seems to originate in the UK"; Cox publicly disclosed excerpts of the email on 22 June. Europol and the National Crime Agency refused to comment at the time. The identity of the persons in charge of EncroChat has not been revealed as of 3 July 2020.

Impact

European joint investigation team

The Europol-supported JIT, code named ''Emma 95'' in France and ''26Lemont'' in the Netherlands, allowed the gathering in real time of millions of messages between suspects. Information was also shared with law enforcement in several countries that were not participating in the JIT, including the UK, Sweden and Norway.

The Dutch police arrested more than 100 suspects and seized more than 8 tonnes of cocaine, around 1.2 tonnes of crystal methamphetamine, 19 synthetic drug laboratories, dozens of guns and luxury cars, and around €20 million in cash. On 22 June 2020 in a property in Rotterdam, authorities found police uniforms, stolen vehicles, 25 firearms, and 25 kg of drugs in a different property. On 22 June 2020, the Dutch police also discovered a "torture chamber" in a warehouse near the town of about 7.15 km east of Bergen op Zoom. The facility, which was still under construction when discovered, consisted of seven cells made out of sound-proofed shipping containers; torture tools were found including a dentist's chair, hedge trimmers, scalpels and pliers. The place was nicknamed by criminals the "treatment room" or the "ebi", in reference to Extra Beveiligde Inrichting (EBI), a Dutch maximum security prison.

EncroChat probes in Ireland have left criminals scrambling for cover. €1.1 million worth of cocaine was seized in an Amsterdam flat, and €5.5 million of cannabis in a trailer in County Wexford, both belonging to Irish gangs. Prominent Irish gang boss Daniel Kinahan was reported to have fled his "safe-haven" of Dubai on 9 July 2020.

Arrests were also made in Sweden. French authorities declined to disclose information publicly about the arrests in July 2020.

United Kingdom

Operation Venetic

Operation Venetic was a British national response initiated by the National Crime Agency (NCA). In June 2020, EncroChat had 10,000 users in the UK alone. As a result of the infiltration of the network, UK police arrested 746 individuals, including major crime bosses, intercepted two tonnes of drugs (with a street value at the time in excess of £100 million), seized £54 million in cash, as well as weapons, including submachine guns, handguns, grenades, an AK-47 assault rifle, and more than 1,800 rounds of ammunition. More than 28 million tablets of the sedative Etizolam were found in a factory in Rochester, Kent. Additionally, 354 kg of cocaine were seized by the Eastern unit in Essex and East Anglia, and 233 kg by the West Midlands unit. Police Scotland seized 164 kg of cocaine, £200,000 of cannabis and £750,000 in cash in several busts. In May 2020, police found two suitcases containing £1.1 million in Sheffield.

Four people have been charged by the NCA with conspiracy to murder as of 8 July 2020. British police claim to have prevented up to 200 gangland killings, although '' Vice News'' notes that "the number of homicides linked to high level organised crime—as opposed to street gangs—in this county is relatively low". Two corrupt law enforcement officers were also arrested as a result of the operation.

On 22 December 2020, Thomas Maher was jailed for 14 years and 8 months at Liverpool Crown Court. He had pleaded guilty to four counts of conspiracy to commit a crime at an earlier hearing. He was involved in conspiracies to smuggle about £1.5 million (€1.6m) of cocaine from the Netherlands to Ireland as well as laundering about £1 million (€1.09m) in cash between Ireland and the Netherlands. He had used two EncroChat phones, which were not recovered, using the aliases "Satirical" and "Snacker".

In March 2022 the first murder plot convictions due to EncroChat were secured, against Paul Fontaine and Frankie Sinclair. By that time the NCA said that 2,631 people had been arrested in the UK as part of Operation Venetic; 1,384 had been charged, 260 convicted and over five and a half tons of class A drugs, 165 weapons and £75m in criminal cash had been seized.

Operation Eternal

Operation Eternal, the London Metropolitan Police arm of the EncroChat operation, described itself as "the most significant operation the Metropolitan Police Service has ever launched against serious and organised crime". Around 1,400 EncroChat users were based in London at the time of its closure in June 2020. The Metropolitan Police seized more than £13.4 million in cash, 16 firearms, more than 500 rounds of ammunition, 620 kg of Class A drugs, and arrested 171 people. As of 8 July 2020, 113 of them have been charged; 88 face charges of conspiracy to supply Class A drugs, and 16 have been charged with firearms offences.

In September 2020 nine people were arrested after raids in Brighton, Portslade, Kent, and London linked to Operation Eternal. Three men were arrested in Brighton and Portslade, five men and a woman in Kent and London. They were arrested for a variety of charges, including conspiracy to supply cocaine. Police seized 10 kg of Class A drugs and £60,000.

Convictions

On 21 May 2021, Carl Stewart of Gem Street, Liverpool was sentenced to 13 years and 6 months at Liverpool Crown Court after pleading guilty to attempting to smuggle cocaine, heroin, MDMA and ketamine, as well as transferring criminal property. He had used EncroChat to transfer large amounts of class A and B drugs under the alias "ToffeeForce" (a reference to Everton F.C.). He was identified from a photo he had sent via Encrochat showing his hands holding a block of Blue Stilton. Police were able to identify him via his fingerprints in the photo.

Similar cases

The Canada-based company Phantom Secure, which started as a legitimate firm selling modified mobile phones, provided "secure communications to high-level drug traffickers and other criminal organization leaders" according to a 2018 FBI takedown announcement. Its CEO, Vincent Ramos, was sentenced in 2019 to a nine-year prison sentence after telling undercover agents that he created the device to help drug traffickers. Customers included members of the Sinaloa Cartel, and the FBI reportedly asked Ramos to plant a backdoor in Phantom Secure's encrypted network, which he refused to do. After this was shut down, ANOM was launched, but in 2021 was revealed to be a sting operation run by law enforcement agencies. The secure mobile phone company MPC was revealed in 2019 to have been created by Scottish criminals James and Barrie Gillespie. Christopher Hughes, a former employee of the company, is wanted by Dutch police for the murder of criminal turned blogger Martin Kok in December 2016.

Sky Global was a Canadian service provider that offered encrypted chat services and secure phones known as Sky ECC. Dutch and Belgian police claim to have accessed and decrypted the systems traffic in early 2021, leading to numerous arrests.

References

{{Reflist

*
Cyberspace
Dark web
Defunct darknet markets
Distributed computing architecture
File sharing
Internet architecture
Internet culture
Internet terminology
Network architecture
Virtual private networks
Law enforcement operations
Android forks
Mobile Linux
Mobile operating systems
2016 software
Organized crime in Europe
2020 disestablishments