Operation Ironside

Lord777

Professional
Messages
2,581
Reputation
15
Reaction score
1,322
Points
113
For more than three years, the US FBI and the Australian Federal Police operated an encrypted messaging platform to intercept the correspondence of members of criminal groups around the world.

On Monday, June 7, as part of Operation Ironside, law enforcement officers in Australia, Europe and the United States conducted a series of searches and arrested hundreds of suspected members of various criminal organizations, ranging from Australian biker gangs to drug cartels in Asia and South America, as well as arms and human traffickers in Europe.

According to the Australian Federal Police, the operation began in 2018, when the FBI managed to block the secure chat platform Phantom Secure, which was used by criminals. Assuming that the bandits who have lost a safe means of communication will look for a replacement, law enforcement officers launched their own bait service Anøm (AN0M).

Like Phantom Secure, the solution was a smartphone configured so that only one Anøm application was running on it for sending encrypted and voice messages (it was impossible to install any other applications on the device). The app provided an opportunity for law enforcement agencies to intercept messages in which criminals often discussed drug delivery methods and planned murders.

The platform was managed by the FBI, while technical specialists from the Australian Federal Police developed a system for decrypting messages directly during their transmission.

The Anøm platform was advertised on the site anom.io as well as undercover agents posing as criminals on the black market. As a result, the number of users of the platform reached 11 thousand. Law enforcement officials called Operation Ironside one of the largest operational experiments in the history of law enforcement agencies.

The decision to stop the operation was made after the criminals began to notice that their correspondence began to leak. Arrests are currently being reported in Australia, New Zealand, Germany and Sweden.

• Video:

• Video:

----

Australia and the FBI distributed a "secure" app to criminals for several years, and then arrested 800 people.

On Habré, you should not explain that any smartphone purchased in the store is a potential "bug" that can be tapped at any time. For what purpose this is done — the second question, but now it is not so important. The topic of the article is the most interesting operation of the Australian police and FBI, related to crime, secure phones and encryption.

A few years ago, there was a company like Phantom Secure. It was engaged in distributing modified smartphones among criminal elements — most often with physically removed cameras and microphones, cut out by manufacturers ' services and limited functionality, which leaves only the ability to exchange text messages over encrypted channels. Phantom Secure was not the only such company, but it was to it that law enforcement officers had the most questions. In 2018, it was closed, the head was arrested, after which the most interesting thing began.

What kind of company is this?

It, like several others, sold phones, most often BlackBerry, which, in addition to the already named elements, removed GPS modules, browsers, instant messengers, etc.Instead, closed analogues were installed — Pretty Good Privacy (PGP) software and a client for transmitting encrypted messages. If necessary, the phone could be cleared of any data, and remotely.

The company worked for several years, after which it was still closed, having arrested the management and seized assets. After that, the management was put on trial. The case file stated that the company's products were used, for example, by representatives of the Sinaloa drug cartel, as well as by various criminal groups in South America, Asia and other regions.

At the same time, both phones and subscriptions to secure communications were not cheap at all — the latter cost "corporate" customers $2000-3000 per month.

The company was shut down after undercover employees cautiously asked representatives of the organization if they could use the devices to discuss drug delivery issues. The company responded in the affirmative and the police got down to business.

Well, what's up now?

Immediately after the closure of the specified company, and with it — the encrypted messaging services EncroChat and Sky ECC, criminal groups began to look for an alternative.

Australian police have re-introduced undercover agents. One of them, a drug dealer, began to distribute devices, modified phones with "safe" to his accomplices. The main means of communication was the AN0M (or ANOM) application, which was positioned as absolutely safe.

Wireless telegraphy worked, phones with AN0M became more and more popular. A wave of popularity overtook these devices with specialized software for them in March 2021. The police closed the Sky ECC service, which is extremely popular among criminals, in March 2021, and criminals had to find a replacement for it urgently.

The usual way to distribute "Trojan" phones would not have worked, because in order to purchase a device, the buyer must have known someone from the owners of such a device. In general, something like a mutual guarantee, which is extremely difficult to overcome. The phone allowed you to exchange messages only in the only way — in the same application. All messengers, mail, etc. were deleted.

Roundabout

It is not clear how all this was kept secret, but the phones really spread around the world. They were used by representatives of 300 criminal groups from 100 countries of the world. A total of 12,000 phones were purchased. They were given to the mafia, various drug cartels, Asian groups and even bikers.

At one point, the police decided it was time to act. Australians, the FBI and representatives of law enforcement agencies from 16 other countries of the world received the results of an analysis of the correspondence of criminals. By the way, in total, the police studied about 27 million messages. All this data has been carefully studied for a long time, and capture plans have been drawn up. Of course, the correspondence was not analyzed for two days, it took many months of painstaking work.

Over the past few days, law enforcement officers conducted about 1,000 searches, as a result of which they seized tons of drugs, thousands of weapons, dozens of modified vehicles, including luxury cars, as well as tens of millions of US dollars — both in fiat and in cryptocurrencies.

The detained criminals are already giving evidence, and law enforcement officers managed to prevent several dozen crimes that were planned for the near future.

As aptly expressed by the authorities who conducted Operation Ironside, the so-called operation, the police were all the time with the criminals, literally "in the back pockets". Naturally, with this approach to the case, law enforcement officers have so much information about crimes that they will deal with it for a long time. More arrests and seizures are likely to follow in the near future.

---

Motherboard has published parts of the code of the encrypted messaging app Anom, which was secretly operated by the FBI to monitor organized crime on a global scale. The secret service intercepted messages from thousands of encrypted phones around the world.

Last year, the FBI and its international partners announced Operation Trojan Shield, in which they secretly operated an encrypted Anom app for years to collect tens of millions of messages from users. Anom has fallen into the hands of more than 300 criminal syndicates around the world. The operation led to the arrest of more than a thousand people, including suspected major drug traffickers, as well as massive seizures of weapons, cash, drugs and cars.

The code shows that messages were secretly duplicated and sent to a "ghost" contact that was hidden from users ' contact lists.

7e6b247c6e.jpg

Bot functioning scheme in law enforcement materials

The app uses the XMPP protocol for sending instant messages with its own encryption. XMPP works in such a way that each contact uses a handle that is somewhat similar to an email address. The FBI implemented in Anom they included an XMPP account for customer support, as well as a bot. The latter was hidden from the contact lists of Anom users and worked in the background. In practice, the app scrolled through the user's contact list and filtered out the bot's account.

57b34235a4.jpg


The authorities have previously put forward the idea of using a phantom contact to penetrate encrypted messages. In an article published in November 2018 on the Lawfare website, Ian Levy and Crispin Robinson, two senior members of the British intelligence agency GCHQ, wrote that "it is relatively easy for a service provider to add a law enforcement officer to a group chat or call without being noticed."

The code also shows that in the section that handles sending messages, the app attached location information to any message that is sent to the bot.

In addition, the file AndroidManifest.xml in an app that shows what permissions it is accessing, enable the "ACCESS_FINE_LOCATION" permission. This confirms that many of the intercepted Anom messages included the exact GPS location of the device at the time of sending.

In some cases, police have reported that the Anom system failed to correctly record GPS locations, but authorities believe that the coordinates are generally reliable because they were compared with other information, such as photos.

Obviously, most of the message handling code was copied from an open source messaging app.

The code itself is messy, large chunks are commented out, and the app constantly writes debugging messages to the phone itself.

4ef403f4d5.jpg


Cooper Quintin, a senior technologist at the Electronic Frontier Foundation (EFF), an activist organization, said it was "crazy" that the FBI was using ordinary developers for its purposes. "It would be like if Raytheon hired a firework manufacturing company down the street to make rocket primers, but didn't tell them they were making rocket primers," he said. The engineer believed that the FBI was working with full-time computer engineers with security clearance.

Meanwhile, courts in Europe and Australia are considering cases against alleged criminals, where the main evidence is their reports to Anom. Defense lawyers in Australia have filed legal requests to obtain the code of the app itself, arguing that access to it is important to determine the accuracy of messages. However, the Australian Federal Police refused to disclose the code.

Lawyer Jennifer Stefanak believes that any defendant has the right to know "how the device works, how anyone was able to access these messages, and most importantly, whether the initial access and subsequent distribution of these messages to the Australian authorities was lawful." other lawyers do not consider it necessary to disclose the code.

The San Diego FBI said: "We have serious concerns that publishing the entire source code may lead to a number of situations that are not in the public interest, such as disclosing sources and methods, as well as providing a scenario for including criminal elements, duplicating the application without significant investment of time and resources."

Motherboard decided not to publish the full code of the app, as it contains identifying information about who worked on it. The publication notes that it received the code from the source that provided a copy of the Anom APK file, and intends to protect its confidentiality.

In 2021, Motherboard acquired a Google Pixel 4a smartphone on the secondary market, which the FBI used as bait when catching criminals. It contained several popular apps, but none of them worked, and when you reset the device settings and enter a different PIN code, a new screen appears with other apps — the clock, calculator, and settings. At the same time, the Anom app is hidden in the calculator.

---

Sky ECC Hack: how European law enforcement officers defeated the Balkan drug cartel

With a strong desire, you can hack even the most secure messenger.…

European police have detained three people in Belgrade who they call the "biggest" drug lords in the Balkans. This was made possible by hacking the encrypted Sky ECC messenger, which was used by criminals to hide their activities from the law.

On May 11, law enforcement agencies in Serbia and the Netherlands conducted coordinated raids on suspected cartel leaders and their drug distribution infrastructure, Europol reported. During the operation, 13 suspects were arrested in Serbia, including three ringleaders, 35 homes were searched and almost 3 million euros, 15 expensive cars, a lot of jewelry, watches and weapons were seized.

Police also arrested 10 other cartel members in Belgium, Serbia, Peru and the Netherlands, for a total of 23 people. All these detentions were carried out precisely because of the previous hacking of Sky ECC.

Sky ECC is a paid end-to-end encrypted messaging app developed by Sky Global. The same company was engaged in the manufacture and sale of Google, Apple, Nokia and BlackBerry smartphones without GPS modules, cameras and microphones. Thus, via Sky ECC and special smartphones, criminals could communicate by text with "colleagues in the shop" without fear of being tapped by the police or other third parties.

In March 2021, Sky Global ceased operations after raids in Belgium and the Netherlands on Sky ECC users and sellers. In the same month, US prosecutors charged the CEO of Sky Global with selling encrypted devices to drug traffickers in order to help them evade justice.

Shortly after these arrests, the Belgian police said that they managed to "crack" the Sky ECC encryption, which allowed them to" monitor the information flow " of about 70 thousand users of the application. All this information, concentrated in the hands of the feds, still continues to contribute to investigations, arrests and trials.

In connection with the latest arrests, the European police also recalled two other encrypted communication services — EncroChat and ANOM, which were also hacked earlier and soon closed. Like Sky ECC, these paid communication apps were popular with criminals to hide their illegal operations. Data from all three services was used by law enforcement officers as evidence for thousands of arrests.

"The recent decline in three encrypted communication tools used by criminals — EncroChat, Anom and Sky ECC — has highlighted the prevalence of Balkan criminals in the global cocaine trade and related organized criminal activities," Europol said.

Although the use of the data obtained in this way as evidence to arrest people has led to several legal actions on the part of the accused, the courts always stand on the side of the police in such situations.

---

For the head of the administrator of the service "phones for the mafia" offered five million dollars

The US State Department has offered a reward of up to five million dollars for information leading to the arrest of 40-year-old Swedish citizen Maximilian Rivkin. According to The Record, he is suspected of being the administrator of an encrypted communication service for Anom phones, known as mob phones.

The United States authorities have been searching for Rivkin since 2021, when the FBI, Europol and security forces of many countries simultaneously arrested members of organized criminal communities under surveillance using the Anom phone developed by the FBI as part of Operation Trojan Shield. American law enforcement agencies are still being criticized for having criminalized the distributors of devices that, in fact, led various states of the world to members of mafia clans.

Since 2018, more than 12,000 Anom devices have been sold to 300 criminal syndicates, including the Italian and Albanian mafia, drug syndicates in Southeast Asia, and other organized crime groups.

"Users, believing that their devices were protected from law enforcement by a shield of impenetrable encryption, openly discussed ways to conceal and transport drugs, money laundering, and in some groups — violent threats," the indictment says.

Rivkin was one of 17 foreign citizens charged by the US authorities for allegedly distributing devices created by the FBI. Messages sent by Rivkin on the platform linked him to almost all of the listed acts, as well as plots to kill or kidnap people. The State Department admits that it was not possible to determine the location of the Swedish citizen, but he is easily recognized by the scars on his left knee and fingers, as well as by the tattoo with the image of three monkeys on his right arm.

---

In the United States, they are trying to find out the name of the secret country that helped the FBI in Operation Trojan Shield.

During the Trojan Shield special operation, the US Federal Bureau of Investigation (FBI) secretly managed encrypted Anom phones. According to Motherboard, the lawyers of the criminal leaders arrested as a result of the operation demand to name the state that helped the agents intercept messages.

The lawsuit filed against the FBI was the first and largest of its kind involving the bureau's technology departments. It may call into question the achievements of investigators who have arrested more than a thousand suspected criminals, as well as seized tons of drugs and hundreds of weapons.

"The bottom line is that our government knew that the introduction and distribution of spy phones was unconstitutional. Therefore, it secretly included a European state in the number of participants in the operation, trying to circumvent the privacy laws in force in the United States. Right now, the government is refusing to name this state, " said Patrick Griffin, one of the lawyers behind the motion.

He added that American law guarantees all defendants a fair trial. In this regard, Griffin expressed confidence that the name of the country will be disclosed, which will allow the defense to better plan its tactics during court hearings.

"Without the requested information, participants in the trial cannot start an investigation into the legality of wiretapping of the accused, as well as verify the reliability and authenticity of the evidence presented, including those that form the basis of this case. In addition, the defense cannot request additional documents from a country unknown to them, seek testimony from individual foreign players, or hire foreign investigators, " the statement said, which also mentions that the government refused to provide the requested information out of court.

From 2018 to 2021, the FBI secretly operated Anom's network of encrypted phones. Over time, they became an integral part of the criminal world and were distributed even by people who did not know that the bureau was behind their development. The legend about the alleged end-to-end encryption allowed investigators to monitor the correspondence of key figures of the leaders of world crime in real time.

---

Turkish police conducted a large-scale raid in several cities of the country, as a result of which drug lord Hakan Ayik, who is hiding from Australian justice, was arrested. The 404 Media portal clarifies that 36 other members of organized criminal groups were detained along with him.

Hakan Ayik is best known for controlling a significant part of the supply of drugs to Australia as part of a large cartel. It was in this country that he was born, raised and lived before the official charges were brought against him. The cartel's net annual profit, according to various estimates, ranged from 0.5 to 1.5 billion dollars. The reason for the case against him in Australia was a shipment of heroin worth $ 50 million, which Ayik tried to deliver to the continent. After that, Australia stripped the drug lord of his citizenship, and he was forced to move to Turkey.

Curiously, Ayik is to some extent responsible for his own withdrawal from the drug business. From 2019 to 2021, he, being considered a fan of encryption methods, took an active part in promoting Anom smartphones in the criminal world, which were actually developed in the FBI laboratories and allowed the security forces to obtain a huge amount of data about criminal communities around the world. As a result of a special operation conducted in 2021, more than 800 people representing the world's largest criminal clans were arrested in 16 countries.

In Turkey, Ayik owned a white business and practically did not violate local laws, with the exception of laundering money earned in the drug business. The list of specific charges is not yet clear, and it is also unclear whether Turkey will agree to extradite its citizen to Australia.

9653a4c903.png
 
Top