An alleged mastermind behind a secret app for criminals and violent enforcers has been charged by the AFP during a global takedown of an encrypted communications network.
AFP Operation Kraken charged a NSW man, aged 32, for creating and administering Ghost, a dedicated encrypted communication platform, which the AFP alleges was built solely for the criminal underworld.
About 700 AFP members executed search warrants and provided support during two days of action across four Australian states and territories on September 17-18.
Near-simultaneous police action is being undertaken in Ireland, Italy, Sweden and Canada.
Up to 50 alleged Australian offenders accused of using Ghost are facing serious charges, including significant prison sentences.
More Australian and international arrests are expected over the coming days.
It will be alleged the Australian offenders who used Ghost were trafficking illicit drugs, money laundering, ordering killings or threatening serious violence. In Australia, the AFP prevented about 50 threats to kill/harm.
Operation Kraken is law enforcement’s next take down of a dedicated encrypted communications platform. Law enforcement has again infiltrated a criminal platform and outsmarted organised crime. EncroChat, Sky Global, Phantom Secure, AN0M and now Ghost – all platforms used by transnational serious organised crime – have been dismantled over the past decade.
However, it is the first time an Australian-based person is accused of being an alleged mastermind and administrator of a global criminal platform, of which the AFP was able to decrypt and read messages.
The AFP charged the alleged administrator at his Narwee home yesterday (17 September).
He will appear in Downing Centre Local Court today (18 September) to face five charges:
- One count of supporting a criminal organisation contrary to section 390.4(1) of the Criminal Code 1995 (Cth), which carries a maximum penalty of three years’ imprisonment;
- One count of dealing with the suspected proceeds of an indictable offence less than $100,000 contrary to section 400.9(1) of the Criminal Code 1995 (Cth), which carries a maximum penalty of three years’ imprisonment;
- One count of dealing in identifying information and using it to commit fraud contrary to section 372.1(1) of the Criminal Code 1995 (Cth), which carries a maximum penalty of five years’ imprisonment;
- One count of obtaining identification information using a carriage service with intent contrary to section 372.1a(3) of the Criminal Code 1995 (Cth), which carries a maximum penalty of five years’ imprisonment; and
- One count of contravening a requirement in a section 3LA order contrary to section 3LA (6) of the Crimes Act 1914, which carries a maximum penalty of 10 years’ imprisonment.
The AFP-led Criminal Assets Confiscation Taskforce successfully obtained Proceeds of Crime Act 2002 (Cth) Restraining Orders over the suspected criminal assets. Property restrained includes various cryptocurrencies and bank accounts.
It will be alleged the administrator used a network of resellers to offer specialised handsets to criminals across the globe.
The handsets, which were a modified smart phone, were sold for about $2350, which included a six-month subscription to an encrypted network and tech support.
As of September 17, the AFP will allege there were 376 active handsets in Australia.
Ghost was created about nine years ago, however, the opportunity for law enforcement to target the platform arose in 2022.
In 2022, international partners started targeting Ghost and asked the AFP to join an operational taskforce.
Europol established a global taskforce code named OTF NEXT, which was led by the FBI and French Gendarmerie, and includes the AFP, Royal Canadian Mounted Police (RCMP), Swedish Police Authority, Dutch ³Ô¹ÏÍøÕ¾ Police, Irish Garda Síochána and the Italian Central Directorate for Anti-Drug Service. The Icelandic Police have also assisted the OTF.
While the AFP worked within the taskforce, it also established Operation Kraken after developing a covert solution to infiltrate Ghost.
The administrator regularly pushed out software updates, just like the ones needed for normal mobile phones.
But the AFP was able to modify those updates, which basically infected the devices, enabling the AFP to access the content on devices in Australia.
Most of the alleged offenders who used Ghost are in NSW, however Ghost users are also in Victoria, Western Australia, South Australia and the ACT. Results from Operation Kraken include:
- 38 arrests;
- 71 search warrants conducted;
- Intervening in 50 threats to life/threats to harm;
- Preventing more than 200kg of illicit drugs from harming the Australian community; and
- Seizing 25 illicit firearms/weapons.
AFP Deputy Commissioner McCartney said Operation Kraken once again showcased the skill, dedication and capability of the AFP.
“In 2021, AFP Commissioner Reece Kershaw revealed the details of Operation Ironside,” Deputy Commissioner McCartney said.
“The lives of many serious criminals dramatically changed when they realised their phone – and those who vouched for it – had betrayed them.
“The Commissioner warned organised crime that the AFP would come for them again – and at scale.
“That time is now.
“Over the past two days, about 700 AFP members have executed and assisted in search warrants across four states to arrest those who have used a dedicated encrypted communications platform named Ghost.
“We allege hundreds of criminals, including Italian Organised Crime, outlaw motorcycle gang members, Middle Eastern Organised Crime and Korean Organised Crime have used Ghost in Australia and overseas to import illicit drugs and order killings.
“I want to acknowledge all the AFP members who have been involved in this operation – from investigators, intelligence members, tech experts and all other support capabilities.
“Taking down dedicated encrypted communication devices takes significant skill.
“But the holy grail is always penetrating criminal platforms to access evidence – and this is where the AFP is world leading.
“And because we could read these messages, the AFP, with state partners, were able to prevent the death or serious injury of 50 individuals in Australia.
“As Ghost haunts criminals who used the platform, the AFP will be ever present to disrupt and target organised crime in Australia and offshore.”
Europol Executive Director Catherine De Bolle said: “Today we have made it clear that no matter how hidden criminal networks think they are, they can’t evade our collective effort”.
“Law enforcement from nine countries, together with Europol, have dismantled a tool which was a lifeline for serious organised crime,” Ms De Bolle said.
“This operation is what Europol is all about: turning collaboration into concrete results by bringing together the right people, tools and expertise to address every aspect of this complex operation. “The work carried out is part of our ongoing commitment to tackling organised crime wherever it operates. I want to extend my gratitude to all our global partners who played a vital role in making this operation a success.”
The head of the France’s ³Ô¹ÏÍøÕ¾ Affairs Ministry ³Ô¹ÏÍøÕ¾ Cyber Command Technical Department Colonel Florian Manet said the command provided technical resources to the taskforce notably in terms of encryption and decryption.
“A technical solution was implemented over several years which, at term, enabled the task force to access the communications of users on this secure platform,” Colonel Manet said.
Royal Canadian Mounted Police Superintendent Marie Eve Lavallée said the RCMP worked actively and tirelessly to curb international drug trafficking.
“By collaborating with authorities in various countries, including Australia, we are implementing robust strategies to counter the criminal networks that threaten our society,” Superintendent Lavallée said.
“The RCMP is pleased to have contributed to the disruption of several criminal operations that put communities at risk. The results announced today demonstrate the effectiveness of the collaboration between our two countries.”
Swedish Police Authority, Head of Operations ³Ô¹ÏÍøÕ¾ Operations Department, Superintendent Ted Esplund said: “The importance of international police cooperation should not be underestimated”.
“Criminal networks act globally and it is absolutely essential that law enforcement agencies act in the same way in order to be successful in the fight against organised crime,” Superintendent Esplund said.
“This operation is one of many examples of how we can join forces to have an impact on organised crime.”
New South Wales Police Force Assistant Commissioner Mick Fitzgerald said: “Large scale multi-agency operations like Operation Kraken continue to enhance the relationship and skills of both State and Federal law enforcement agencies.”
“The NSW Police Force’s State Crime Command is dedicated to working with the Australian Federal Police and Commonwealth partners to disrupt and dismantle organised crime networks operating in this country, Assistant Commissioner Fitzgerald said.
“The results of Operation Kraken today have shown just how effective that cooperation is and I’m incredibly proud of all the work and effort investigators have put into this operation.”
Victoria Police Crime Command Acting Assistant Commissioner Paul O’Halloran said: “This was a complex investigation involving significant resources from across Victoria Police’s Crime Command, led by our detectives within the Victorian Joint Organised Crime Task Force, and today’s outcome is testament to the collaboration between state and federal law enforcement.”
“These are people with significant involvement in organised crime, who embedded themselves in our community with the sole aim of committing offences that would wreak immense harm to many innocent people,” Acting Assistant Commissioner O’Halloran said.
“They are people who only care about profit and are all too willing to put the lives of others at risk to get it.
“As organised crime evolves, so does law enforcement. Victoria Police will continue to work closely with our partner agencies in order to take advantage of any opportunity to disrupt these syndicates and ensure every last offender is held to account.”
at 7pm AEST to outline the global operation to dismantle the Ghost network.
