A Europol representative has stated that the pan-European law enforcement agency has become the primary resource for international police investigations focused on the use of encrypted communication services by criminal enterprises, particularly following the dismantling of the Ghost encrypted messaging platform.
This extensive three-year international investigation into Ghost, which offered end-to-end encrypted messaging, resulted in police raids and arrests of multiple users engaged in organized crime. Arrests included 38 individuals in Australia, 11 in Ireland, one in Canada, and one in Italy. Among those taken into custody in Australia was a 32-year-old man suspected of being the platform’s administrator. He faces five charges, including supporting a criminal organization and fraud-related activities.
The Ghost takedown follows earlier successful police operations targeting encrypted messaging platforms, such as EncroChat and Sky ECC in 2020, and the FBI-led Anom operation, which was offered to criminal groups until 2021. During a press conference hosted by Europol, Eurojust, and law enforcement from nine involved countries—including France, Iceland, Italy, the Netherlands, Sweden, and the United States—investigators detailed the operation’s scope and execution.
Jean-Philippe Lecouffe, deputy executive director of operations at Europol, remarked, “This operation represents over three years of diligent work to dismantle a tool that was critical for serious and organized crime. Consider the complexities: servers hidden in France and Iceland, owners based in Australia, and financial connections leading to the United States. It was a truly global chase, and today, the chase has ended.”
He emphasized, “We are sending a clear message: regardless of how sophisticated the technology or how hidden the platform, we will shut it down. This is not our first takedown, and certainly not our last.”
Lecouffe highlighted Europol’s pivotal role in the operation, drawing on past experiences from dismantling EncroChat and Sky ECC networks to enhance their capabilities. “We’ve been down this path before. Europol has become the primary hub for international law enforcement collaboration against criminal encrypted platforms,” he stated.
The investigation benefitted from the technical expertise of multiple partners, allowing them to map out the entire global structure of the criminal network. They identified key suppliers and users, coordinating takedown actions through 40 operational meetings. Europol’s resources included experts with specialized skills stationed in Iceland, Ireland, and Australia, supported by the Internal Security Fund’s Project Overclock, funded by the European Commission and managed by the French Ministry of the Interior.
Bertrand Michel, deputy head of the French Gendarmerie’s National Cyber Unit, shared that Project Overclock’s technical resources were crucial to the investigation, particularly for “advanced decryption skills.” He noted, “Thanks to their expertise, we were able to intercept, retrieve, and ultimately share data exchanged by criminal users on the Ghost platform with our Operational Task Force partners in impacted countries.”
Marie Eve Lavallée, superintendent of the Royal Canadian Mounted Police, revealed that Canadian organized crime investigators also contributed technical skills, developing a novel approach to data acquisition from encrypted networks. “This technique allowed us to secure digital evidence vital for all members of the Operational Task Force,” she noted, reinforcing the importance of collaboration among law enforcement to innovate and enhance investigation techniques against secure communication platforms used for illicit activities.
Michel pointed out the lessons learned from the EncroChat takedown, which helped refine the technical and judicial skills necessary for managing such complex global cases. However, he acknowledged that the encrypted communications landscape has since evolved significantly. Brendan Dunford, a supervisory special agent at the FBI, stressed the global implications of these platforms in facilitating criminal activity, underscoring the need for a coordinated law enforcement response.
When asked whether non-criminals utilized the Ghost network, assistant commissioner David McLean of the Australian Federal Police asserted that “from hundreds of thousands of intercepted messages, we found no evidence of non-criminal use.” Lecouffe added that the messages of interest were undeniably exchanged among criminals, stating, “Any messages that did not involve criminal activity did not capture our attention.”
Europol further stated that it is committed to a balanced approach in combating crime on encrypted platforms, while also respecting user privacy rights. “Private companies need to ensure their services comply with the law and do not provide safe havens for criminals. They should establish mechanisms for lawful data access under judicial oversight, while protecting fundamental rights.”
“Law enforcement requires access to communications among suspects to tackle serious crimes, and this can coexist with privacy protections as long as cybersecurity and robust legal safeguards are maintained.”
