Operation Ironside

Lord777

Professional
Messages
2,579
Reaction score
1,491
Points
113
For more than three years, the US FBI and the Australian Federal Police operated an encrypted messaging platform to intercept the correspondence of members of criminal groups around the world.

On Monday, June 7, as part of Operation Ironside, law enforcement officers in Australia, Europe and the United States conducted a series of searches and arrested hundreds of suspected members of various criminal organizations, ranging from Australian biker gangs to drug cartels in Asia and South America, as well as arms and human traffickers in Europe.

According to the Australian Federal Police, the operation began in 2018, when the FBI managed to block the secure chat platform Phantom Secure, which was used by criminals. Assuming that the bandits who have lost a safe means of communication will look for a replacement, law enforcement officers launched their own bait service Anøm (AN0M).

Like Phantom Secure, the solution was a smartphone configured so that only one Anøm application was running on it for sending encrypted and voice messages (it was impossible to install any other applications on the device). The app provided an opportunity for law enforcement agencies to intercept messages in which criminals often discussed drug delivery methods and planned murders.

The platform was managed by the FBI, while technical specialists from the Australian Federal Police developed a system for decrypting messages directly during their transmission.

The Anøm platform was advertised on the site anom.io as well as undercover agents posing as criminals on the black market. As a result, the number of users of the platform reached 11 thousand. Law enforcement officials called Operation Ironside one of the largest operational experiments in the history of law enforcement agencies.

The decision to stop the operation was made after the criminals began to notice that their correspondence began to leak. Arrests are currently being reported in Australia, New Zealand, Germany and Sweden.

• Video:

• Video:

----

Australia and the FBI distributed a "secure" app to criminals for several years, and then arrested 800 people.

On Habré, you should not explain that any smartphone purchased in the store is a potential "bug" that can be tapped at any time. For what purpose this is done — the second question, but now it is not so important. The topic of the article is the most interesting operation of the Australian police and FBI, related to crime, secure phones and encryption.

A few years ago, there was a company like Phantom Secure. It was engaged in distributing modified smartphones among criminal elements — most often with physically removed cameras and microphones, cut out by manufacturers ' services and limited functionality, which leaves only the ability to exchange text messages over encrypted channels. Phantom Secure was not the only such company, but it was to it that law enforcement officers had the most questions. In 2018, it was closed, the head was arrested, after which the most interesting thing began.

What kind of company is this?

It, like several others, sold phones, most often BlackBerry, which, in addition to the already named elements, removed GPS modules, browsers, instant messengers, etc.Instead, closed analogues were installed — Pretty Good Privacy (PGP) software and a client for transmitting encrypted messages. If necessary, the phone could be cleared of any data, and remotely.

The company worked for several years, after which it was still closed, having arrested the management and seized assets. After that, the management was put on trial. The case file stated that the company's products were used, for example, by representatives of the Sinaloa drug cartel, as well as by various criminal groups in South America, Asia and other regions.

At the same time, both phones and subscriptions to secure communications were not cheap at all — the latter cost "corporate" customers $2000-3000 per month.

The company was shut down after undercover employees cautiously asked representatives of the organization if they could use the devices to discuss drug delivery issues. The company responded in the affirmative and the police got down to business.

Well, what's up now?

Immediately after the closure of the specified company, and with it — the encrypted messaging services EncroChat and Sky ECC, criminal groups began to look for an alternative.

Australian police have re-introduced undercover agents. One of them, a drug dealer, began to distribute devices, modified phones with "safe" to his accomplices. The main means of communication was the AN0M (or ANOM) application, which was positioned as absolutely safe.

Wireless telegraphy worked, phones with AN0M became more and more popular. A wave of popularity overtook these devices with specialized software for them in March 2021. The police closed the Sky ECC service, which is extremely popular among criminals, in March 2021, and criminals had to find a replacement for it urgently.

The usual way to distribute "Trojan" phones would not have worked, because in order to purchase a device, the buyer must have known someone from the owners of such a device. In general, something like a mutual guarantee, which is extremely difficult to overcome. The phone allowed you to exchange messages only in the only way — in the same application. All messengers, mail, etc. were deleted.

Roundabout

It is not clear how all this was kept secret, but the phones really spread around the world. They were used by representatives of 300 criminal groups from 100 countries of the world. A total of 12,000 phones were purchased. They were given to the mafia, various drug cartels, Asian groups and even bikers.

At one point, the police decided it was time to act. Australians, the FBI and representatives of law enforcement agencies from 16 other countries of the world received the results of an analysis of the correspondence of criminals. By the way, in total, the police studied about 27 million messages. All this data has been carefully studied for a long time, and capture plans have been drawn up. Of course, the correspondence was not analyzed for two days, it took many months of painstaking work.

Over the past few days, law enforcement officers conducted about 1,000 searches, as a result of which they seized tons of drugs, thousands of weapons, dozens of modified vehicles, including luxury cars, as well as tens of millions of US dollars — both in fiat and in cryptocurrencies.

The detained criminals are already giving evidence, and law enforcement officers managed to prevent several dozen crimes that were planned for the near future.

As aptly expressed by the authorities who conducted Operation Ironside, the so-called operation, the police were all the time with the criminals, literally "in the back pockets". Naturally, with this approach to the case, law enforcement officers have so much information about crimes that they will deal with it for a long time. More arrests and seizures are likely to follow in the near future.

---

Motherboard has published parts of the code of the encrypted messaging app Anom, which was secretly operated by the FBI to monitor organized crime on a global scale. The secret service intercepted messages from thousands of encrypted phones around the world.

Last year, the FBI and its international partners announced Operation Trojan Shield, in which they secretly operated an encrypted Anom app for years to collect tens of millions of messages from users. Anom has fallen into the hands of more than 300 criminal syndicates around the world. The operation led to the arrest of more than a thousand people, including suspected major drug traffickers, as well as massive seizures of weapons, cash, drugs and cars.

The code shows that messages were secretly duplicated and sent to a "ghost" contact that was hidden from users ' contact lists.

7e6b247c6e.jpg

Bot functioning scheme in law enforcement materials

The app uses the XMPP protocol for sending instant messages with its own encryption. XMPP works in such a way that each contact uses a handle that is somewhat similar to an email address. The FBI implemented in Anom they included an XMPP account for customer support, as well as a bot. The latter was hidden from the contact lists of Anom users and worked in the background. In practice, the app scrolled through the user's contact list and filtered out the bot's account.

57b34235a4.jpg


The authorities have previously put forward the idea of using a phantom contact to penetrate encrypted messages. In an article published in November 2018 on the Lawfare website, Ian Levy and Crispin Robinson, two senior members of the British intelligence agency GCHQ, wrote that "it is relatively easy for a service provider to add a law enforcement officer to a group chat or call without being noticed."

The code also shows that in the section that handles sending messages, the app attached location information to any message that is sent to the bot.

In addition, the file AndroidManifest.xml in an app that shows what permissions it is accessing, enable the "ACCESS_FINE_LOCATION" permission. This confirms that many of the intercepted Anom messages included the exact GPS location of the device at the time of sending.

In some cases, police have reported that the Anom system failed to correctly record GPS locations, but authorities believe that the coordinates are generally reliable because they were compared with other information, such as photos.

Obviously, most of the message handling code was copied from an open source messaging app.

The code itself is messy, large chunks are commented out, and the app constantly writes debugging messages to the phone itself.

4ef403f4d5.jpg


Cooper Quintin, a senior technologist at the Electronic Frontier Foundation (EFF), an activist organization, said it was "crazy" that the FBI was using ordinary developers for its purposes. "It would be like if Raytheon hired a firework manufacturing company down the street to make rocket primers, but didn't tell them they were making rocket primers," he said. The engineer believed that the FBI was working with full-time computer engineers with security clearance.

Meanwhile, courts in Europe and Australia are considering cases against alleged criminals, where the main evidence is their reports to Anom. Defense lawyers in Australia have filed legal requests to obtain the code of the app itself, arguing that access to it is important to determine the accuracy of messages. However, the Australian Federal Police refused to disclose the code.

Lawyer Jennifer Stefanak believes that any defendant has the right to know "how the device works, how anyone was able to access these messages, and most importantly, whether the initial access and subsequent distribution of these messages to the Australian authorities was lawful." other lawyers do not consider it necessary to disclose the code.

The San Diego FBI said: "We have serious concerns that publishing the entire source code may lead to a number of situations that are not in the public interest, such as disclosing sources and methods, as well as providing a scenario for including criminal elements, duplicating the application without significant investment of time and resources."

Motherboard decided not to publish the full code of the app, as it contains identifying information about who worked on it. The publication notes that it received the code from the source that provided a copy of the Anom APK file, and intends to protect its confidentiality.

In 2021, Motherboard acquired a Google Pixel 4a smartphone on the secondary market, which the FBI used as bait when catching criminals. It contained several popular apps, but none of them worked, and when you reset the device settings and enter a different PIN code, a new screen appears with other apps — the clock, calculator, and settings. At the same time, the Anom app is hidden in the calculator.

---

Sky ECC Hack: how European law enforcement officers defeated the Balkan drug cartel

With a strong desire, you can hack even the most secure messenger.…

European police have detained three people in Belgrade who they call the "biggest" drug lords in the Balkans. This was made possible by hacking the encrypted Sky ECC messenger, which was used by criminals to hide their activities from the law.

On May 11, law enforcement agencies in Serbia and the Netherlands conducted coordinated raids on suspected cartel leaders and their drug distribution infrastructure, Europol reported. During the operation, 13 suspects were arrested in Serbia, including three ringleaders, 35 homes were searched and almost 3 million euros, 15 expensive cars, a lot of jewelry, watches and weapons were seized.

Police also arrested 10 other cartel members in Belgium, Serbia, Peru and the Netherlands, for a total of 23 people. All these detentions were carried out precisely because of the previous hacking of Sky ECC.

Sky ECC is a paid end-to-end encrypted messaging app developed by Sky Global. The same company was engaged in the manufacture and sale of Google, Apple, Nokia and BlackBerry smartphones without GPS modules, cameras and microphones. Thus, via Sky ECC and special smartphones, criminals could communicate by text with "colleagues in the shop" without fear of being tapped by the police or other third parties.

In March 2021, Sky Global ceased operations after raids in Belgium and the Netherlands on Sky ECC users and sellers. In the same month, US prosecutors charged the CEO of Sky Global with selling encrypted devices to drug traffickers in order to help them evade justice.

Shortly after these arrests, the Belgian police said that they managed to "crack" the Sky ECC encryption, which allowed them to" monitor the information flow " of about 70 thousand users of the application. All this information, concentrated in the hands of the feds, still continues to contribute to investigations, arrests and trials.

In connection with the latest arrests, the European police also recalled two other encrypted communication services — EncroChat and ANOM, which were also hacked earlier and soon closed. Like Sky ECC, these paid communication apps were popular with criminals to hide their illegal operations. Data from all three services was used by law enforcement officers as evidence for thousands of arrests.

"The recent decline in three encrypted communication tools used by criminals — EncroChat, Anom and Sky ECC — has highlighted the prevalence of Balkan criminals in the global cocaine trade and related organized criminal activities," Europol said.

Although the use of the data obtained in this way as evidence to arrest people has led to several legal actions on the part of the accused, the courts always stand on the side of the police in such situations.

---

For the head of the administrator of the service "phones for the mafia" offered five million dollars

The US State Department has offered a reward of up to five million dollars for information leading to the arrest of 40-year-old Swedish citizen Maximilian Rivkin. According to The Record, he is suspected of being the administrator of an encrypted communication service for Anom phones, known as mob phones.

The United States authorities have been searching for Rivkin since 2021, when the FBI, Europol and security forces of many countries simultaneously arrested members of organized criminal communities under surveillance using the Anom phone developed by the FBI as part of Operation Trojan Shield. American law enforcement agencies are still being criticized for having criminalized the distributors of devices that, in fact, led various states of the world to members of mafia clans.

Since 2018, more than 12,000 Anom devices have been sold to 300 criminal syndicates, including the Italian and Albanian mafia, drug syndicates in Southeast Asia, and other organized crime groups.

"Users, believing that their devices were protected from law enforcement by a shield of impenetrable encryption, openly discussed ways to conceal and transport drugs, money laundering, and in some groups — violent threats," the indictment says.

Rivkin was one of 17 foreign citizens charged by the US authorities for allegedly distributing devices created by the FBI. Messages sent by Rivkin on the platform linked him to almost all of the listed acts, as well as plots to kill or kidnap people. The State Department admits that it was not possible to determine the location of the Swedish citizen, but he is easily recognized by the scars on his left knee and fingers, as well as by the tattoo with the image of three monkeys on his right arm.

---

In the United States, they are trying to find out the name of the secret country that helped the FBI in Operation Trojan Shield.

During the Trojan Shield special operation, the US Federal Bureau of Investigation (FBI) secretly managed encrypted Anom phones. According to Motherboard, the lawyers of the criminal leaders arrested as a result of the operation demand to name the state that helped the agents intercept messages.

The lawsuit filed against the FBI was the first and largest of its kind involving the bureau's technology departments. It may call into question the achievements of investigators who have arrested more than a thousand suspected criminals, as well as seized tons of drugs and hundreds of weapons.

"The bottom line is that our government knew that the introduction and distribution of spy phones was unconstitutional. Therefore, it secretly included a European state in the number of participants in the operation, trying to circumvent the privacy laws in force in the United States. Right now, the government is refusing to name this state, " said Patrick Griffin, one of the lawyers behind the motion.

He added that American law guarantees all defendants a fair trial. In this regard, Griffin expressed confidence that the name of the country will be disclosed, which will allow the defense to better plan its tactics during court hearings.

"Without the requested information, participants in the trial cannot start an investigation into the legality of wiretapping of the accused, as well as verify the reliability and authenticity of the evidence presented, including those that form the basis of this case. In addition, the defense cannot request additional documents from a country unknown to them, seek testimony from individual foreign players, or hire foreign investigators, " the statement said, which also mentions that the government refused to provide the requested information out of court.

From 2018 to 2021, the FBI secretly operated Anom's network of encrypted phones. Over time, they became an integral part of the criminal world and were distributed even by people who did not know that the bureau was behind their development. The legend about the alleged end-to-end encryption allowed investigators to monitor the correspondence of key figures of the leaders of world crime in real time.

---

Turkish police conducted a large-scale raid in several cities of the country, as a result of which drug lord Hakan Ayik, who is hiding from Australian justice, was arrested. The 404 Media portal clarifies that 36 other members of organized criminal groups were detained along with him.

Hakan Ayik is best known for controlling a significant part of the supply of drugs to Australia as part of a large cartel. It was in this country that he was born, raised and lived before the official charges were brought against him. The cartel's net annual profit, according to various estimates, ranged from 0.5 to 1.5 billion dollars. The reason for the case against him in Australia was a shipment of heroin worth $ 50 million, which Ayik tried to deliver to the continent. After that, Australia stripped the drug lord of his citizenship, and he was forced to move to Turkey.

Curiously, Ayik is to some extent responsible for his own withdrawal from the drug business. From 2019 to 2021, he, being considered a fan of encryption methods, took an active part in promoting Anom smartphones in the criminal world, which were actually developed in the FBI laboratories and allowed the security forces to obtain a huge amount of data about criminal communities around the world. As a result of a special operation conducted in 2021, more than 800 people representing the world's largest criminal clans were arrested in 16 countries.

In Turkey, Ayik owned a white business and practically did not violate local laws, with the exception of laundering money earned in the drug business. The list of specific charges is not yet clear, and it is also unclear whether Turkey will agree to extradite its citizen to Australia.

9653a4c903.png
 
A murder order in an encrypted chat turned into a prison for bandits

According to court documents released recently in the United States , in 2020, an Iranian drug dealer and two alleged mercenaries from Canada planned to kill two people. To coordinate their actions, the group used the encrypted Sky ECC telephone network, which was traditionally associated at that time with the activities of professional criminal groups.

After the hacking of the network by the police of Belgium and the Netherlands in 2021, most of the bandits against whom there was enough evidence were arrested, and the network itself was then liquidated and has not been available for use since.

The indictment cites reports from Sky ECC in which Iranian drug dealer Naji Sharifi Zindashti and Canadian Hells Angels motorcycle club member Damion Patrick John Ryan discussed some "work", "equipment", " tools "and ways to"make money". Ryan mentioned the difficulties of completing the task in the United States, but expressed his willingness to find a performer.

In the course of the correspondence, a reward of $ 350,000 was agreed, as well as covering the cost of the trip in the amount of $ 20,000. Soon the potential "executor" of the order was found, it turned out to be another Canadian named Adam Richard Pearson.

However, the accomplices did not succeed in carrying out their plans, as all three were arrested, and on charges of several other criminal acts. And with the disclosure of the Sky platform, accusations against would-be criminals have only been added.

The Sky ECC network differed from the usual encrypted chat platforms in that it was positioned as super-secure, and it was possible to use it only with a paid subscription, which cost users thousands of dollars. In this regard, it is especially funny that the network was able to "cover" the police: for what such money then, please find out? Although I don't think the bandits would appreciate such a joke.

In recent years, law enforcement agencies around the world have been conducting sophisticated operations against companies that provide encrypted telephone services. Along with Sky ECC, other high-profile cases of closed secure platforms were the elimination of ANOM and EncroChat instant messengers .

The disclosure of information about various crimes even years later only underlines the scale of the problem: so much evidence was found in Sky ECC that they are still being analyzed and used in indictments.

In the pursuit of profit, bandits are willing to pay a lot of money for "reliable" communication channels, but all their tricks are ultimately futile: they not only fail in their plans, but also lose their freedom.

It is hardly possible to say that there are methods of ensuring complete confidentiality of correspondence on the modern Internet at all, so it is clearly not worth discussing something dubious or illegal online.
 
Journalist Joseph Cox spoke about the FBI's largest covert operation involving the use of encrypted telephone networks to track criminal activity.

In 2018, Anom, a secure communication platform, appeared on the market, which soon became popular among criminal gangs. It was actively used by influential drug traffickers around the world, confident that their messages were protected. On the Anom platform, smuggling of prohibited substances, crimes and other illegal activities were discussed. However, Anom had a secret: the platform was under the control of the FBI.

The story was the topic of a presentation at the annual hacker conference DEF CON, where the author talked about all aspects of Anom's work. During the 40-minute lecture, a full analysis of how the platform functioned, from the operation of the phones themselves and the network, to the backdoor mechanism through which the special services gained access to correspondence, was presented. In addition, details of Anom's corporate structure and the FBI's actions aimed at developing the project were revealed.

For three years, intelligence agencies ran the company, providing secure phones to criminals around the world while monitoring their activities. This gave agents unique access to information about criminal activity, allowing them to track drug dealers, smugglers, and other criminals in real time.

Controlling Anom turned out to be not only a successful tactical move for the FBI, but also a challenge. Agents had to deal with problems typical of any tech startup, from cloud services to logistics and customer support. As a result, the operation was so successful that it had to be curtailed in 2021, as the scale of observations of criminal activity went beyond reasonable limits.

One of the most exciting episodes was when the inventory of Google Pixel smartphones used on Anom dropped dramatically. When there were not enough phones, the FBI organized a secret operation. The intelligence services delivered a batch of Android devices to Europe on a private jet, and then left them at the agreed place, from where Anom intermediaries took the phones, unaware of who was behind it.

Operation Anom was a turning point in the fight against organized crime. As a result of the information collected, it was possible to prevent many crimes, intercept large quantities of prohibited substances and destroy entire criminal networks. As a result of the special operation, more than 800 people were arrested in 16 countries, and a huge amount of drugs, weapons and large sums of money earned by criminals were seized.

Video:
 
The American DEA landed in the Netherlands to conduct a secret operation in the case of encrypted phones.

According to NRC.NL, American agents from the DEA (Drug Enforcement Administration) conducted a secret operation in Europe in the Netherlands without notifying local law enforcement officers. The operation was part of an investigation into the activities of the Canadian company Sky Global, which sold encrypted phones to criminals

. The phones included end-to-end encryption, self-destructing messages, "built-in hacking protection" including the deletion of all data after several failed password attempts, and a camera and browser to minimize the risk of hacking.

In 2019, the United States pledged not to interfere in the investigation of the Sky Global case so as not to interfere with the work of European investigative bodies. However, the case materials say the opposite: American agents nevertheless carried out the operation without any permission, despite a promise not to do so.

DEA agents contacted one of Sky's sellers in the Netherlands and offered him to exchange large sums of cash for bitcoins for the purpose of laundering. They wanted to involve the suspect in illegal activities to record illegal activities and establish closer contact with him for further investigation.

As a result of the operation, many suspects in the Netherlands were prosecuted on the basis of intercepted communications. Now local lawyers are wondering about the legality of the American operation in their country.

Justus Reisinger, a knowledgeable lawyer in the Sky Global case, argues that any actions by foreign forces in the Netherlands must be authorized by the local prosecutor's office or court. However, documents confirming such permission were not presented to lawyers during the trials against the suspects. According to him, this violates the basic principles of transparency.

In particular, it suggests two possible scenarios: either the United States acted without the permission of the Dutch authorities, which is a serious violation of the law, or the Dutch prosecutor's office knew about the operation, but hid this fact from the defense. The legality of the evidence collected during the operation may be questioned.

Source
 
Top