Australia arrests mastermind behind global crime app Ghost

The police’s latest attempt to circumvent a dark network that has long gone unnoticed.

The Australian Federal Police (AFP) have arrested and charged a 32-year-old man with creating and operating Ghost, an encrypted communications platform allegedly built to serve the criminal underworld. The takedown, dubbed Operation Kraken, marks a major victory in the fight against encrypted criminal networks, a battle that law enforcement has been waging for more than a decade.

About 700 AFP officers executed search warrants in four states and territories, marking the culmination of the operation. Raids were carried out almost simultaneously in Ireland, Italy, Sweden and Canada, signaling a coordinated effort to dismantle the network. The alleged Ghost users, nearly 50 of whom are Australian, face charges ranging from drug trafficking to violent crime.

The Fall of the Mind’s Mastermind

The suspect, arrested at his home in Narwee, is believed to have operated the Ghost platform from Australia, a first for the country. Although Ghost had been active for almost a decade, the AFP only gained the upper hand in 2022 when international partners joined forces to infiltrate the platform. The attempt resulted in police gaining access to encrypted messages, allowing them to intercept criminal activity in real time.

The global task force OTF NEXT, led by Europol, the FBI and the French Gendarmerie, brought together agencies from Canada, Sweden, Ireland and others. The AFP played a crucial role by creating a covert solution to modify Ghost’s software updates, effectively turning criminal users’ devices into evidence-gathering tools.

Breaking the myth of anonymity

For years, Ghost users believed that the platform’s encryption protected them from law enforcement. But as Deputy Commissioner McCartney put it, “the holy grail is always getting into criminal platforms,” and the AFP’s success in infiltrating Ghost proves that belief wrong. The AFP has prevented more than 50 threats to life and disrupted the flow of illegal drugs and firearms thanks to their newfound access.

Ghost is just the latest in a string of encrypted networks to be taken down by law enforcement, following EncroChat, AN0M, Sky Global, and Phantom Secure. Each takedown sends the same message to criminals: no platform is truly safe from the combined efforts of global law enforcement.

International impact

In Australia alone, Operation Kraken led to 38 arrests, the execution of 71 search warrants and the seizure of more than 200 kilograms of illegal drugs and 25 weapons. However, the scope of the operation extends far beyond Australia’s borders. 11 others were arrested in Ireland, one in Canada and one in Italy, belonging to the Italian mafia group Sacra Corona Unita, Europol said.

Europol Director Catherine De Bolle echoed this sentiment, stressing that no criminal network can escape their collective efforts. De Bolle stressed Europol’s role in turning cooperation into actionable results, stating: “No matter how hidden these networks think they are, they cannot escape the law.”

Decoding the Ghost Network

Ghost wasn’t just an app; it was a sophisticated system tailored to the needs of the underworld. Users could purchase it anonymously, and it used three encryption standards. One notable feature allowed users to send a code that would cause all messages on the target phone to self-destruct. This made it easier for criminal networks to evade detection, hamper forensic efforts, and coordinate cross-border operations.

The alleged mastermind worked with a network of resellers to distribute customized smartphones with encrypted software, each priced at about $2,350. The price tag included a six-month subscription to Ghost’s encrypted network and technical support for users — a level of service that underscores the scale of Ghost’s operations.

Thousands of people worldwide used Ghost, exchanging about a thousand messages on the platform every day.

As of September 17, there were 376 active Ghost devices in Australia alone, with most of them concentrated in New South Wales. The platform targeted a range of organized crime groups, from outlaw motorcycle gangs to international syndicates with ties to Italian and Middle Eastern organized crime. These groups used Ghost to coordinate drug trafficking, launder money and even arrange murder-for-hire.

Road to Operation Kraken

Ghost’s downfall began in 2022 when international law enforcement partners targeted the platform, prompting the AFP to launch Operation Kraken. The task force deployed a unique technical solution that gave them access to encrypted communications, a move that changed the course of the investigation.

Among the most incriminating pieces of evidence collected were messages exchanged between users. These messages offered a glimpse into the high-stakes world of organized crime, where anonymity was paramount and one misstep could have deadly consequences.

AFP Commissioner Reece Kershaw warned organised crime groups in 2021 that their days of trusting encrypted platforms were numbered. “The lives of many serious criminals were dramatically changed when they realised their phone – and those who vouched for it – had betrayed them,” he said in a statement. With the demise of Ghost, that warning has become reality for yet another criminal network.

For the AFP, the operation is not just a technical victory; it is a showcase of its world-class capabilities in digital forensics, intelligence gathering and covert operations. By infiltrating Ghost, the AFP not only stopped crimes in progress, but also sent a clear message to organised crime groups that its encrypted tools are not impenetrable.

The Future of Encrypted Platforms

The Ghost takedown raises questions about the future of encrypted communications platforms in organized crime. As law enforcement agencies continue to improve their technical capabilities, the arms race between criminal syndicates and global police is heating up.

Assistant Commissioner Tony Longhorn of the Western Australia Police noted that organised crime syndicates continue to rely on encrypted platforms to distribute drugs and weapons. “The encrypted communications landscape remains highly dynamic and segmented, presenting ongoing challenges for law enforcement,” Europol said.

However, Longhorn stressed that no platform offers true anonymity and that with every action, law enforcement gets one step closer to closing that gap.

Europol says it focuses on tackling criminal use of encrypted communications, while advocating a balanced approach that respects privacy and legal standards.

Private companies must also ensure that their platforms are not safe havens for criminals. They must provide lawful access to data under judicial supervision, in accordance with fundamental rights.

Law enforcement needs access to the communications of suspected individuals to combat serious crimes. However, this can go hand in hand with privacy protection, cybersecurity, and strong legal safeguards.

As legal proceedings against the alleged Ghost administrator continue, law enforcement agencies around the world are closely monitoring the events.

A warning for criminal networks

The successful infiltration and takedown of Ghost reflects a broader trend in law enforcement’s approach to organized crime. Criminal platforms, once thought untouchable, are falling one by one. For the criminals who relied on Ghost, the game is over. And for those still using encrypted platforms, the message is clear: no network is safe forever.

As Catherine De Bolle succinctly put it: “No matter how hidden these networks may feel, they cannot escape our collective effort.”

Related