Australian Federal Police and FBI nab underworld figures using encrypted app

The Australian Broadcasting Corporation is covering it in more detail than the Reuters article, including some of the mechanics of how it was pulled off:<p><a href="https:&#x2F;&#x2F;www.abc.net.au&#x2F;news&#x2F;2021-06-08&#x2F;fbi-afp-underworld-crime-bust-an0m-cash-drugs-murder&#x2F;100197246" rel="nofollow">https:&#x2F;&#x2F;www.abc.net.au&#x2F;news&#x2F;2021-06-08&#x2F;fbi-afp-underworld-cr...</a><p>Apparently it revolved around duping Hakan Ayik, one of Australia&#x27;s most wanted drug dealers now operating as an international kingpin from Turkey, to trust the app and recommend it to his associates. It&#x27;s a double whammy, in that the network has been blown wide open and the AFP is now telling Ayik to hand himself in to avoid recriminations from his associates. No doubt there will be a movie about this one.

As to how the FBI got access to the messages, Vice says[1] after Vincent Ramos of Phantom Secure was arrested in 2018, a confidential human source offered Anom, which the source was developing, to the FBI (probably in exchange for immunity or a reduced sentence, in my opinion). The source then seeded Anom phones to his existing distributors as a replacement for Phantom Secure phones, and from their they made their way into criminal organisations.<p>[1] <a href="https:&#x2F;&#x2F;www.vice.com&#x2F;en&#x2F;article&#x2F;akgkwj&#x2F;operation-trojan-shield-anom-fbi-secret-phone-network" rel="nofollow">https:&#x2F;&#x2F;www.vice.com&#x2F;en&#x2F;article&#x2F;akgkwj&#x2F;operation-trojan-shie...</a>

What we&#x27;ve learned is only what was in Austrlia&#x27;s piece of the cake, given they started their day already. New Zeland had theirs already, too. I imagine thousands of arrests are still happening worldwide and several press conferences are going to be held today. Looking at the seal of the operation (<a href="https:&#x2F;&#x2F;www.anom.io&#x2F;trojan_shield_seal.jpg" rel="nofollow">https:&#x2F;&#x2F;www.anom.io&#x2F;trojan_shield_seal.jpg</a>), following countries participated in the operation: Canada, Australia, US, Sweden, The Netherlands, Lithuania, Finland, Hungary, Norway, Austria, UK, New Zeland, Estonia, Scotland, Germany, Denmark.<p>I expect this to be bigger than Panama Papers. Way bigger. I expect a few prominent politicians to be soon either arrested or &quot;convinced&quot; to step down. I expect the US to have gained a lot of intel and leverage over those from the countries who did <i>not</i> participate in this. We will absolutely <i>not</i> learn about everything they discovered. CIA will and the respective intelligence agencies will.<p>EDIT: Europol will hold their conference live on YouTube at 10 AM CST: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;janoorth&#x2F;status&#x2F;1402164252266409987" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;janoorth&#x2F;status&#x2F;1402164252266409987</a><p>EDIT 2: given how Serbia was in the top 4 of messages sent, I really hope that the info gathered will help Interpol fight child trafficking and exploitation in the EU.<p>From the VICE article (<a href="https:&#x2F;&#x2F;www.vice.com&#x2F;en&#x2F;article&#x2F;akgkwj&#x2F;operation-trojan-shield-anom-fbi-secret-phone-network" rel="nofollow">https:&#x2F;&#x2F;www.vice.com&#x2F;en&#x2F;article&#x2F;akgkwj&#x2F;operation-trojan-shie...</a>) quoted elsewhere here:<p>&quot;Additionally, the review of Anom messages has initiated numerous high-level public corruption cases in several countries. The most prominent distributors are currently being investigated by the FBI for participating in an enterprise which promotes international drug trafficking, money laundering, and <i>obstruction of justice</i>.&quot;<p>&quot;Late Monday, the FBI said that it would be holding &quot;a news conference announcing a massive worldwide takedown based on the San Diego FBI’s unprecedented investigation involving the interception of encrypted communications&quot; on Tuesday.&quot;

Does anyone find it funny that each criminal group could have been better off relying on a &quot;kid who knows computers&quot; level of expertise and bog standard devices running open source software which at least wouldn&#x27;t be trivially systematically turned against them all at once quite so easily.

This is how police should get around the problems presented with encryption. This is real policing.<p>The PR barrage and faux posturing by the FBI to weaken encryption has always seemed like just lazy policing to me.<p>If anything, the hacking attacks on industrial centers has better illustrated than anything why encryption is necessary, and this new triumph has demonstrated that police <i>can</i> continue to function, even thrive in a world that permits encryption.

The lesson here is complete trust in modern computing platforms is misplaced and impossible. Your hardware has backdoors, so does your OS, and encryption clients. In addition, popular apps, especially in the US, can always be commandeered by 3-letter agencies.<p>You&#x27;re only anonymous as long as you&#x27;re not actively targetted, despite using &quot;secure&quot; apps and stuff like Tor, which media makes it seem are unbreakable.

I&#x27;ve been reading a lot about these &quot;encrypted phones recently&quot;. What really shocks me is how in the last years police has been going after operators of such services under the premise that they would help criminals.<p>- Sky ECC (Shutdown, owner is facing criminal charges)<p>- Phantom Secure (Shutdown and owner got 9 years in prison)<p>- Encrochat (&quot;Hacked&quot; by french police)<p>So it seems like those &quot;Encrypted phones&quot; were very effective for Law Enforcement to put such an effort to go after them.<p>I think that criminal organizations will now rely on a do it yourself technique. Not buying phones online which is a very bad idea as law enforcement could just trap the phones at the postal facility, something they already do.<p>Going to an old fashion phone retailer, then removing the camera and GPS module yourself and installing some encrypted open source software.<p>Probably they are also going to fake messages. For 2 purposes:<p>- Talk about a fake huge drug deliveries or an imminent mass shooting to verify if the network has been compromised, I am pretty sure police has no choice other than to act in such a situation.<p>- This could be used as a strategy defense, if some messages turn out to be fake, then they can use plausible deniability on the others. And perhaps even claim police has faked them.

I find this a bit concerning. Catching bad guys is all well and good but I wonder whether the various governments are overreaching.<p>Selling a bugged phone to a known criminal is likely fine (cite: The Wire).<p>But is it acceptable to sell a bugged phone to unknown&#x2F;unidentified&#x2F;random people and then use the phone&#x27;s communications to determine if the owner is a crook and the owner&#x27;s identity? The sole basis of suspicions seems to be &quot;bought phone&quot;, or maybe &quot;bought phone using bitcoin&quot;, or even &quot;bought phone on TOR using bitcoin&quot;.<p>It will be interesting to see how many of these cases hold up in court.

I&#x27;m happy they are catching criminals, but now I wonder how many of my encryption and privacy software is actually an FBI front.

Text of TFA uses the term &quot;infiltrating&quot; in lieu of &quot;cracking&quot;. Not that I necessarily expect Reuters to keep their infosec terminology straight but I wonder if this was a novel hack or if was a simple matter of a judicial gag order, seizing the developer&#x27;s account and then pushing out a malicious update that enabled MITM or something.

Can&#x27;t find the article but Mexican drug cartels hired Cisco certified experts to setup their encrypted communications. Not just your average CCNA guy from test king, but industry experts working for Service Providers and Government.

Seems like duplication and infiltration is becoming a more common tactic amoung LE.<p>There&#x27;s some pretty convincing speculation Dream market was setup as a similar operation to this. [0]<p>If this proves anything it&#x27;s that the fear mongering by LE about encryption was overblown and they&#x27;re just lazy lol.<p>0: <a href="https:&#x2F;&#x2F;youtu.be&#x2F;1VZkiQUzITU" rel="nofollow">https:&#x2F;&#x2F;youtu.be&#x2F;1VZkiQUzITU</a>

So the big question is if would have been better to strike fast, silently gain more intel och strike in some kind of statistical analysis maner to not blow their cover á la Alan Turing and the enigma

I think this is very problematic.<p>Let&#x27;s say police claims you did something with only the chat log as an evidence and they run the chat software. Then they could very well have just faked it, because they have a high incentive to do so.<p>If the messages were on a third party platform you would at least have a neutral third party involved.

It seems like there is a bust of these &quot;safe&quot; devices every other month. And the groups trust them again, when will they learn, do not use a phone or computer. One of the last Italian capos would pass on messages on pieces of paper or verbally. And still got busted, but after a life time.

I wonder how much crime would be left if the drug trade were legalized

Looks like the app’s domain was also seized.<p><a href="https:&#x2F;&#x2F;www.anom.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.anom.io&#x2F;</a>

From what I understand they targeted a high ranking member of the gang and he promoted the app, which was developed by the police to others. Since a high level member endorsed it, it become widely used.

From the Vice Motherboard article: <a href="https:&#x2F;&#x2F;www.vice.com&#x2F;amp&#x2F;en&#x2F;article&#x2F;akgkwj&#x2F;operation-trojan-shield-anom-fbi-secret-phone-network" rel="nofollow">https:&#x2F;&#x2F;www.vice.com&#x2F;amp&#x2F;en&#x2F;article&#x2F;akgkwj&#x2F;operation-trojan-...</a><p>&quot;This data comprises the encrypted messages of all of the users of Anoms with a few exceptions (e.g., the messages of approximately 15 Anom users in the U.S. sent to any other Anom device are not reviewed by the FBI),&quot;<p>Any ideas as to why?

There are more details in a recently unsealed search warrant against a GMail user: <a href="https:&#x2F;&#x2F;storage.courtlistener.com&#x2F;recap&#x2F;gov.uscourts.casd.707623&#x2F;gov.uscourts.casd.707623.1.0_2.pdf" rel="nofollow">https:&#x2F;&#x2F;storage.courtlistener.com&#x2F;recap&#x2F;gov.uscourts.casd.70...</a><p>An informant (confidential human source, or &quot;CHS&quot;) helped the FBI and AFP (Australian Federal Police) develop and distribute Anom to criminal gangs (transnational criminal organizations, or &quot;TCOs&quot;):<p>&gt; The CHS offered this next generation device, named “Anom,” to the FBI to use in ongoing and new investigations. The CHS also agreed to offer to distribute Anom devices to some of the CHS’s existing network of distributors of encrypted communications devices, all of whom have direct links to TCOs.<p>Anom was specifically designed from the ground up with an encryption backdoor:<p>&gt; Before the device could be put to use, however, the FBI, AFP, and the CHS built a master key into the existing encryption system which surreptitiously attaches to each message and enables law enforcement to decrypt and store the message as it is transmitted. A user of Anom is unaware of this capability. By design, as part of the Trojan Shield investigation, for devices located outside of the United States, an encrypted “BCC” of the message is routed to an “iBot” server located outside of the United States, where it is decrypted from the CHS’s encryption code and then immediately re-encrypted with FBI encryption code. The newly encrypted message then passes to a second FBI-owned iBot server, where it is decrypted and its content available for viewing in the first instance.<p>Naturally, the FBI can&#x27;t spy on domestic communications without a warrant, so they got the AFP to do it for them:<p>&gt; FBI geo-fenced the U.S., meaning that any outgoing messages from a device with a U.S. MCC would not have any communications on the FBI iBot server. But if any devices landed in the United States, the AFP agreed to monitor these devices for any threats to life based on their normal policies and procedures.<p>Closing Sky Global and Encrochat drove criminals to Anom:<p>&gt; Since March 12, 2021, as a direct result of the Sky Global charges, there are now close to 9000 active Anom users. The criminals who use hardened encrypted devices are constantly searching for the next secure device, and the distributors of these devices have enabled criminals’ impenetrable communications on these devices for years.<p>Finally, the FBI quite directly admits their goal is to shake confidence in encrypted messaging:<p>&gt; A goal of the Trojan Shield investigation is to shake the confidence in this entire industry because the FBI is willing and able to enter this space and monitor messages.<p>There&#x27;s also a number of sample conversations in the warrant application showing criminals openly talking about moving drugs and other illegal activities with absolutely no code. Definitely worth a read.

This seems to be just a messaging app, but is there a market for more full-featured ERP, CRM and project management software for criminal enterprises?<p>I&#x27;m sure they would benefit from those just the same way legitimate enterprises do. The only difference is that they do more illegal stuff and use more violence, but the fundamental business dynamics should be the same.

ANOM seems like a shorter&#x2F;sharper law enforcement version of the CIA&#x27;s Cold War era intelligence operation when they purchased Swiss encrypted communication company Crypto AG.<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Crypto_AG" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Crypto_AG</a>

So they seized 130 million, arrested 1800 people. Assuming even wealth distribution, that is 72k Eur. The distribution is of course not even, as some of the confiscation images show cars worth way more than that, also watched and many bags filled to the brink with money. Some of the arrest images show the bedrooms and they do not look better than a prison cell. This means many of the involved do this for very bad ROI ratio, considering that most will face 20plus years sentences.

Why is the burner on high heat in like the fourth photo?

Odds that this is how the US nabbed the key to the Bitcoin from the Colonial Pipeline ransom? That’d be pretty wild, but makes sense...

People were onto Anom already figuring out it wasn&#x27;t what it pretended to be. Site got deleted shortly after the raid.<p><a href="https:&#x2F;&#x2F;webcache.googleusercontent.com&#x2F;search?q=cache%3APwQXt6Sn_YwJ%3Ahttps%3A%2F%2Fanomexposed.wordpress.com%2F+" rel="nofollow">https:&#x2F;&#x2F;webcache.googleusercontent.com&#x2F;search?q=cache%3APwQX...</a>

Further details on the background&#x2F;history of the operation here: <a href="https:&#x2F;&#x2F;www.nytimes.com&#x2F;2021&#x2F;06&#x2F;08&#x2F;world&#x2F;australia&#x2F;operation-trojan-horse-anom.html" rel="nofollow">https:&#x2F;&#x2F;www.nytimes.com&#x2F;2021&#x2F;06&#x2F;08&#x2F;world&#x2F;australia&#x2F;operation...</a>

I&#x27;m curious how this works constitutionally, in the US. Presumably the FBI did not have warrants for all the conversations they were listening in on, so it at least superficially seems like a fourth amendment violation.

Nice one, but i guess if this whole operation was still a secret, we could pull this trick over and over again? Now will be hard to disguise an app like that.<p>Probably the next season of the &quot;StartUp&quot; TV series

&gt; legal authorities prevented the app from being covertly used for a longer time frame.<p>I can see how strong was the temptation to continue and see how far it could go.

The takings are just insane. In EU they seized 8 tonnes (!) of cocaine and 22 tonnes of marijuana.

One day we will realise the war on drugs was mostly destructive to ordinary people. It&#x27;s important to realise the US has historically played a huge role in the global drug trade, and that really stopping the drug trade means going after banking executives, politicians and chemical corporations. However that is never done.

How would this be any different to creating a global back door in signal, wikr or slack?

Never never use a mobile phone if you&#x27;re a dirty criminal

They forgot to review the app&#x27;s source code.

Next: &quot;We&#x27;ve secretly been torturing people for the last three years — look at all the cases it helped us crack!”

Should&#x27;ve used signal

As is often the case with the FBI, they were apparently facilitating the crimes. It&#x27;s easy to argue that the crimes might not have taken place without the FBI&#x27;s help. Somehow this is never entrapment when the FBI is doing it.

not just Australia, it&#x27;s world wide and likely led by the FBI (but possibly data being collected outside the US to avoid the need of having actual warrants)<p>The following thread looks at some of the opened court documents today:<p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;ericgarland&#x2F;status&#x2F;1402100449013125123" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;ericgarland&#x2F;status&#x2F;1402100449013125123</a><p>(and points out that the Trump organisation might be in trouble ....)

&gt; and seized more than 3,000 kilograms of drugs and $45 million in cash and assets.<p>Excuse me, but I can&#x27;t stop laughing. Three years effort to catch a small fish and they sell it as if they got bust of the century.<p>Why don&#x27;t they investigate politicians that facilitate prohibition and enable these gangs to work in the first place?<p>Police can&#x27;t see they run fool&#x27;s errands.

Good that they arrested the culprits. But infiltrating the encrypted messaging app isn&#x27;t the best thing I guess.<p>The argument, it is used by criminals is flawed. Because everything is - water pipelines, cash, facebook, and so on.