Europol and Eurojust, together with law enforcement and judicial authorities from around the world, have successfully dismantled an encrypted communication platform established to facilitate serious and organised crime perpetrated by dangerous criminal networks operating on a global scale.
The platform, known as Ghost, was used as a tool to carry out a wide range of criminal activities, including large-scale drug trafficking, money laundering, instances of extreme violence and other forms of serious and organised crime.Â
“Today we have made it clear that no matter how hidden criminal networks think they are, they can’t evade our collective effort. Law enforcement from nine countries, together with Europol, have dismantled a tool which was a lifeline for serious organised crime,” said Europol’s Executive Director Catherine De Bolle.
De Bolle added, “This operation is what Europol is all about: turning collaboration into concrete results by bringing together the right people, tools and expertise to address every aspect of this complex operation. The work carried out is part of our ongoing commitment to tackling organised crime wherever it operates. I want to extend my gratitude to all our global partners who played a vital role in making this operation a success.”
Ghost had gained traction among criminal organisations due to its advanced security features. Users could purchase the tool without declaring any personal information. The solution used three encryption standards and offered the option to send a message followed by a specific code which would result in the self-destruction of all messages on the target phone. This allowed criminal networks to communicate securely, evade detection, counter forensic measures, and coordinate their illegal operations across borders.
Worldwide, several thousand people used the tool, which has its own infrastructure and applications with a network of resellers based in several countries. On a global scale, around one thousand messages are being exchanged each day via Ghost.
As servers were found in France and Iceland, the company owners were located in Australia, and financial assets were located in the United States, a global operation against the phone service started.
The takedown involved a series of coordinated raids and technical interventions. Over the course of the investigation, 51 suspects have been arrested: 38 in Australia, 11 in Ireland, one in Canada and one in Italy belonging to the Italian Sacra Corona Unita mafia group.
Further arrests are anticipated as the investigation progresses.
In addition, a number of threats to life were prevented, and a drug lab dismantled in Australia, together with weapons, drugs and over one million euros in cash seized globally so far.
To facilitate investigations into the illegal activities facilitated by this communication platform, an Operational Taskforce (OTF) was established at Europol in March 2022 involving law enforcement authorities from Australia, Canada, France, Ireland, Italy, the Netherlands, Sweden and the United States.
This taskforce has been instrumental in mapping the global technical infrastructure, and was successful in targeting it by identifying key suppliers and users of the platform, monitoring its criminal usage, and executing the coordinated effort to shut it down, all under judicial oversight from the Joint Investigation Team (JIT) countries.
Building upon the law enforcement cooperation, a JIT was set up between the French and U.S. authorities in January 2024 with the support of Eurojust and Europol.
This complex, global operation was made possible thanks to active cooperation among the different countries involved and Europol, which have been engaged in the different components of the investigative activities, including actions against high-risk criminal organisations and High Value Targets, cyber-investigations, the analysis of cryptocurrencies transactions, frequent intelligence exchange using Europol’s secure channels and dozens of operational meetings arranged in different countries.
Over the course of the investigation, Europol deployed experts to Iceland, Ireland and Australia. Due to the complexity of this data-driven investigation, a number of teams at Europol were involved with specialised technical skills, including cyber-related.
A Joint Operational Centre was also established at Europol’s headquarters during the action days, where representatives from the OTF members and Europol’s officers provided support and facilitated the coordination of the simultaneous operational activities taking place across the globe.
The encrypted communication landscape has become increasingly fragmented as a result of recent law enforcement actions targeting platforms used by criminal networks. Following these operations, numerous once-popular encrypted services have been shut down or disrupted, leading to a splintering of the market.
Criminal actors, in response, are now turning to a variety of less-established or custom-built communication tools that offer varying degrees of security and anonymity. By doing so, they seek new technical solutions and also utilise popular communication applications to diversify their methods. This strategy helps these actors avoid exposing their entire criminal operations and networks on a single platform, thereby mitigating the risk of interception.
Consequently, the landscape of encrypted communications remains highly dynamic and segmented, posing ongoing challenges for law enforcement.
- Former Army Reservist Cody Francis Guilty of Conspiring to Steal Government Funds - September 30, 2024
- Alphonse Bazile, Rayshaud Green Jailed 180 Months for Firearms Offences - September 30, 2024
- Gretna Resident Felix Mackey Sentenced to 192 Months in Prison for Methamphetamine, Cocaine Hydrochloride, Cocaine Base Trafficking - September 30, 2024
