Global police operation destroys criminal messaging app ‘Ghost’ – DW – 09-18-2024

Australian and international police said Wednesday they had infiltrated and dismantled an encrypted communications platform they said was specifically designed for criminals.

Criminal gangs around the world are using the ‘Ghost’ platform and associated encryption techniques for large-scale drug trafficking, money laundering and serious violent crimes, the European multinational police agency Europol announced in The Hague.

The operation, which included months of monitoring the supposedly private messages and intervening to prevent planned violent crimes, has so far led to 51 arrests, 38 of them in Australia. More are expected to follow, Europol said.

“Today we have made it clear that criminal networks, no matter how hidden they may feel, cannot escape our joint effort,” said Catherine De Bolle, Director of Europol. She thanked “all our global partners who played a crucial role in making this operation a success.”

Ghost’s servers were found in France and Iceland, the company’s owners were discovered in Australia, and financial sources were exposed in the US.

“We allege that hundreds of criminals, including members of Italian organised crime, members of motorcycle gangs, Middle Eastern organised crime and Korean organised crime, have used Ghost in Australia and overseas to import illegal drugs and order killings,” Australian Federal Police Deputy Commissioner Ian McCartney told reporters on Wednesday.

Main suspect in his thirties, with no criminal record

The alleged founder of the network is a 32-year-old Australian from New South Wales who still lives with his parents and has no previous convictions.

He was arrested a day earlier and is accused of “creating and operating Ghost, a specially encrypted communications platform, which (the Australian Federal Police) alleges was built solely for the criminal underworld,” according to the Australian Federal Police. The man launched the platform in 2017.

He appeared in Sydney District Court on Wednesday but did not apply for bail pending trial, meaning he will remain in custody until the case returns to court in November.

Customized smartphones sold as part of a package

Ghost users did not simply purchase or obtain software, but specially adapted hardware for use with the platform.

According to Australian police, users purchased modified smartphones for 2,350 Australian dollars (approximately 1,590 US dollars or 1,430 euros), complete with a six-month subscription to Ghost and technical support. Users were then required to sign up for an ongoing subscription.

These were sold through a global network of resellers to offer criminals special devices that were advertised as ‘unhackable’. These devices offered three separate standards of encryption and also made it possible to automatically delete all messages on a phone remotely, for example if the phone was lost or seized by the authorities.

Europol estimates that thousands of people worldwide use Ghost, with around 1,000 messages exchanged daily. In Australia alone, 376 phones were found with the software.

Law enforcement infiltrated the network in 2022, when they discovered a backdoor

Despite the perceived security of the messaging platform, police were able to hijack and monitor the encrypted messaging service shortly after the investigation began in spring 2022.

Australian Federal Police Deputy Commissioner Ian McCartney said France had given Australian police “a foot in the door” to decrypt and infiltrate Ghost’s network during one of its regular updates.

“We essentially infected the devices, which gave us access to the content on Australian devices,” McCartney said.

Deputy Commissioner Kirsty Schofield said Australian police had prevented 50 people from being killed, kidnapped or seriously injured since March by mapping threats in 125,000 messages and 120 video calls.

“Given the many months of interception of communications and the hundreds of thousands of communications channels intercepted, we have no evidence that this was used by anyone other than criminal organizations,” McCartney said.

According to Jean-Philippe Lecouffe, Deputy Executive Director of Europol, the operation “has taken out an instrument that was a lifeline for serious and organised crime.”

A drug lab was also located and dismantled in Australia, and weapons, drugs and over €1 million in cash were seized worldwide, according to Europol.

Active in 9 different countries

In addition to Europol, the operation also involved law enforcement agencies from Australia, Canada, France, Iceland, Ireland, Italy, the Netherlands, Sweden and the US.

Ghost is the latest in a series of encrypted communications platforms that have been shut down in recent years. These platforms were either specifically designed for criminals or were used by them.

In June 2020, the now-defunct Encrochat service was shut down. According to police, criminals quickly migrated to another service, Sky ECC, which was shut down in 2021 when the FBI seized the website.

Another popular service, known as ANOM, was the subject of a major undercover operation a little later in 2021. In that case, however, the program was a compromised undercover operation led by the FBI from the start, with the FBI calling the operation “Trojan Shield.”

msh/xx (AFP, AP, dpa, Reuters)