Fake encrypted app cooked up over beers by Aussie cops and the FBI leads to global sting

A fake encrypted messaging app cooked up over beers by Australian cops and the FBI has led to 800 arrests across the world and the confiscation of £100million ($141.5million USD, $182.66million AUS) in cash, six tons of cocaine, assault rifles, luxury cars, motorcycles and watches.

A huge overnight bust in Australia saw 4,000 officers storm the underworld after gangsters were monitored for 18 months using the app called ‘AN0M,’ which has also been deployed by police in the US and Britain. 

The UK National Crime Agency said it had carried out ‘multiple operations’ as a result of the sting, codenamed Operation Trojan Shield. An NCA spokesman said they had targeted ‘drug trafficking and money laundering’ gangs, without revealing further details of Britain’s use of the AN0M tech. 

The app was secretly developed by the FBI who paid a super grass phone whizz to develop the tech for £70,000 plus expenses – and a reduced prison sentence for drugs smuggling, according to a court affidavit.

The informant was pressed into using his trusted distributors to sell the AN0M tech. With a sleek website which pretended AN0M was based in Switzerland, and charging a subscription fee, crooks were conned into thinking they were safe from the law.

But it was actually a Trojan Horse, re-routing all their secret messages to FBI special agents and the Australian Federal Police (AFP). 

The app was seeded into the underworld by police informants before it was picked up by drug kingpins who unwittingly acted like ‘influencers’ – the jewel in the crown was Australia’s most wanted man, Hakan Ayik, who became the ‘principal distributor,’ giving the app legitimacy to global crime syndicates.

There were more than 12,000 compromised AN0M phones, used by more than 300 crime gangs in over 100 countries, which blind copied – or ‘BCCed’- the police on around 27 million secret messages.

The app infiltrated the Mafia, Asian triad syndicates and biker gangs who trusted in the tech so much they wouldn’t bother with code words and sent pictures of huge consignments of drugs, including one which showed a French diplomatic pouch that was allegedly used to transport cocaine from Colombia. 

FBI chief Calvin Shivers called the results of the global cooperation ‘staggering’. ‘Over the last 18 months the FBI provided over 300 criminal organisations, in over 100 countries, with encrypted devices that allowed us to monitor their communications,’ Shivers told told reporters at Europol’s HQ in The Hague.

‘Not only have we heard about the number of arrests and the number of seizures, but over 100 threats to life that were mitigated,’ added Shivers. 

In Australia alone, more than 200 people have been charged as part of the operation, which Prime Minister Scott Morrison said had ‘struck a heavy blow against organised crime – not just in this country, but one that will echo around organised crime around the world’. 

Australian officers seized McLaren and Lamborghini sports cars, Ducati and Harley-Davidson motorcycles, Rolex watches, sniper rifles, bullet-proof vests, ammunition, wads of cash and duffel bags full of drugs, all from intelligence gleaned from the AN0M app.  

The FBI paid a super grass £70,000 and offered him a reduced prison sentence to help them build the tech. The man, named only as a ‘confidential human source,’ in a court affidavit, had already been creating a hardened encrypted phone with a bespoke app called AN0M. 

The FBI decided it could install its Trojan master key on the devices, enabling them to decrypt and store all the data that passed through them.

In 2018, Australian police investigators and analysts met with the FBI. ‘As you know, some of the best ideas come over a couple of beers,’ said Australian police chief, Reece Kershaw, on Tuesday.

Prodded by authorities, the developer-turned-informant tapped his trusted distributors, who targeted the Australian market. They settled on a soft launch in October 2018. The developer gave the distributors only 50 devices to sell. Seeing a ‘huge payday’, they agreed according to the affidavit.

As the AFP monitored the messages and photos shared on the devices, ‘100% of AN0M users in the test phase used AN0M to engage in criminal activity’, the affidavit said. Business grew organically, by word-of-mouth. Soon overseas criminals were flocking to use the AN0M phone.

Law enforcers had ‘an edge’ that they had never had before, said Kershaw. Among hundreds of arrests and tons of drugs seized, Australian authorities said they also disrupted 21 murder plots, including a mass killing, thanks to AN0M.

The FBI and other countries’ law enforcers discovered that Italian organised crime, Asian triads, biker gangs and transnational drug syndicates were all users.

The special agent’s affidavit, and the AFP’s Kershaw, said criminals used the phones openly, often not even using code words and frequently sharing photos of massive drug consignments and details of how they would be transported. 

Among the images shared in the affidavit were mounds of blocks of illicit drugs and a diplomatic pouch identified in the court document as French and allegedly used to transport cocaine from Colombia. There was also evidence of corrupt government officials and police.

Crime groups were being ‘notified of anticipated enforcement actions’, the affidavit said.

‘The review of ANOM messages has initiated numerous high-level public corruption cases in several countries.’

Raids targeting users of another encrypted phone, Sky ECC, in March saw ANOM’s popularity surge, with active users growing from 3,000 to 9,000 in months, the affidavit said.

Why did the operation stop? There is no clear rationale given about why the operation stopped now. However a mixture of suspicions, legal hurdles and strategy may have contributed. 

Law enforcement did not have real-time access to phone activity but instead, all sent messages were blind copied or ‘BCCed’ to FBI servers where they were decrypted.

One server was in a third country where the warrant was due to expire on June 7, 2021.

But even ahead of that deadline, suspicions were being raised.

In March, a tech geek named ‘canyouguess67’ blogged that AN0M was a ‘scam’ and that a device he had tested was ‘in constant contact with’ Google servers and relayed data to non-secure servers in Australia and the United States.

‘STAY AWAY FROM ANOM IF YOU VALUE YOUR PRIVACY AND SAFETY,’ the blogger wrote in an article, which has since been pulled down.

‘THEY ARE COMPROMISED, LIARS AND YOUR DATA IS RUNNING VIA USA’. The hacker added that law enforcement agencies had been tipped off. 

‘I was quite concerned to see the amount of IP addresses relating to many corporations within the 5 eyes Governments (Australia, USA, Canada, UK, NZ who share information with one another),’ the post said. 

In addition, one stated aim for ‘Operation Trojan Shield’ was to undermine trust in encrypted devices, a goal that could only be widely achieved when the operation was made public. 

The alleged offenders are linked to the Australian-based Italian mafia – known as the Ndrangheta – as well as outlaw motorcycle gangs, Asian triad syndicates and Albanian organised crime figures.

Police have charged 224 alleged offenders with 525 charges, shut down six clandestine laboratories and acted on 21 threats to kill, including saving a family of five.

Prime Minister Morrison said the AFP operation, known as Operation Ironside, had struck a ‘heavy blow’ against organised crime. 

‘The operation puts Australia at the forefront of the fight against criminals who peddle in human misery and ultimately, it will keep our communities and Australians safe,’ he said on Tuesday.

‘Illicit drug use ruins lives and fuels organised crime.’

AFP Commissioner Kershaw said federal agents had been in the ‘back pockets’ of criminals through the encryption app.

‘The FBI had the lead on this. We provided the technical capability to decrypt those messages,’ he said.  

Ninja Warrior 2017 contestant Sopiea Kong was among those arrested. The 33-year-old was charged last week following a raid at a Kangaroo Point home, where police allegedly seized 154g of meth.

Kong, who was also allegedly in possession of $2,030 cash and a revolver, was granted bail and will appear in court on June 28.

Former Bachelorette star Samuel Minkin, who appeared on Becky and Elly Miles’ season of the dating show, was charged with possessing a large commercial quantity of cannabis after police stopped a van in Byron Bay last month. 

Former Bandito biker Benjamin Joseph Thornton, 31, was arrested after police seized two mobile phones and a small quantity of cocaine. He was denied bail and will reappear in court next week. 

The bust exposed new details about how one of Australia’s most wanted fugitives gave police extensive access to the world’s criminal underworld.

Drug kingpin and Comancheros biker associate Hakan Ayik has spent the last decade on the run from Australian authorities after fleeing the country in 2010. 

Now living in Turkey, he was tricked into distributing messages to his criminal associates around the world via encrypted communications app AN0M, unaware it was being run by FBI special agents.

Three years ago, AFP identified Ayik as a key influencer to successfully distribute the encrypted AN0M devices due to his high status in the criminal underworld.

They sat back and secretly intercepted millions of messages sent as unsuspecting associates openly stated their plans including plots to kill, importing drugs and identifying those who could help them with their criminal enterprises.

Senior investigators describe Ayik as the ‘principal distributor of the AN0M handset.’ who didn’t just distribute the devices among associates but also profited from the sales.

‘It’s like having The Rock (Dwayne Johnson) sponsoring your gym. This is a high-value criminal sponsoring a criminal communications system,’ Australian Federal Police Superintendent Jared Taggart told News Corp papers. 

‘It’s just pure revenue, it’s a bit like selling Amway for him. His good name goes behind it, he gets some … fees, there’s a cut from the selling of the handsets.’ 

‘He’s (Ayik) essentially leveraged his position of trust in the underworld to push this platform and that’s what generated its success. His associates would readily take his word for it,’ an AFP investigator added.

Then known as Joseph Hakan Ayik, the Sydney bikie associate and gym junkie fled Australia in 2010 to avoid arrest over a $230 million heroin importation.

Ayik, subbed one of the world’s most prolific drug-smuggling masterminds, was later detained in Cyprus but then escaped and fled to Turkey, where he has created a new life.

He invested his proceeds of crime in hotel and resort developments while living a lavish lifestyle that extended to flashy cars and private yachts.

His Dutch wife, hair transplant business owner Fleur Messelink publicly flaunted the couple’s elaborate lifestyle on Instagram until this week.

Ayik is wanted in several countries, including Australia, where he is listed as one of NSW’s most wanted criminals.

An Interpol red notice has also been for Ayik’s arrest, who remains on the run from authorities.

AFP Commissioner Reece Kershaw said the alleged syndicate included ‘some of the most dangerous criminals to Australia’.

‘We allege they are members of outlaw motorcycle gangs, Australian Mafia, Asian crime syndicates and serious and organised crime groups,’ he told reporters on Tuesday.

‘We allege they’ve been trafficking illicit drugs into Australia at an industrial scale.

‘Sadly, criminal gangs are targeting Australia because it is one of the most profitable countries in the world to sell drugs, and for three years, this operation has been  overt.’

Mr Kershaw said detectives have arrested the alleged ‘King makers’ behind the alleged crimes, prevented mass shootings in suburbs and ‘frustrated serious and organised crime by seizing their ill-gotten wealth’.

‘And these figures are likely to increase over the coming days. Collectively, these alleged offenders are facing jail terms that could run into hundreds of years and some of the charges they are facing carry life imprisonment,’ he said.

The app AN0M was installed on mobile phones that were stripped of other capability. The mobile phones, which were bought on the black market, could not make calls or send emails.

It could only send messages to another device that had the organised crime app. Criminals needed to know a criminal to get a device.

The devices organically circulated and grew in popularity among criminals, who were confident of the legitimacy of the app because high-profile organised crime figures vouched for its integrity.

‘These criminal influencers put the AFP in the back pocket of hundreds of alleged offenders,’ Mr Kershaw said.

‘Essentially, they have handcuffed each other by endorsing and trusting AN0M and openly communicating on it – not knowing we were watching the entire time.’

Mr Kershaw said detectives witnessed associates ‘turning on each other’ and doing business behind each other’s backs.

‘There’s no doubt going to be some tension within the whole system about who owes what drug debt and so on. So that was pretty brazen to see that they were actually disloyal to their own groups,’ he said.

More arrests are expected domestically and offshore under a coordinated global response connected to Operation Ironside.

The AFP is also likely to seek extradition requests of a number of persons of interest living overseas. It comes as there have been tonnes of drugs and hundreds of arrests overseas.

‘I have a message for the criminals targeting Australia and Australia’s interests – the AFP will be relentless,’ Mr Kershaw said.

‘We will outsmart you. We will be a step ahead. Operation Ironside is just the beginning and the AFP is living up to our maximum of keeping Australians safe.’

New Zealand authorities have also arrested 35 people for alleged drug dealing and money laundering, seizing some $NZ3.7 million ($A3.4 million) in assets. 

Only five per cent of encrypted messages sent by criminals in Australia use the Anom platform – but Mr Morrison said suspects will now be living in fear ahead of further sting operations.

‘It is our intention that they are looking over their shoulder,’ he said.

‘We’re bearing down upon them. But you know, this isn’t over. This is a long way from over.’

Australia’s world-first Assistance and Access Act passed in 2018 allows intelligence agencies to require tech companies to hand over encrypted messages.

Mr Morrison said the AFP’s covert mission was ‘seeking to frustrate [the alleged criminals] in every link of the chain’.

‘And it is our intention that they are looking over their shoulder, because our law enforcement agencies and the partnerships we have around the world are bearing down upon them,’ he said.

‘That’s what we’re doing. We’re bearing down upon them. But you know, this isn’t over. This is a long way from over.’