https://www.abc.net.au/news/2021-06-08/fbi-afp-underworld-cr...

Apparently it revolved around duping Hakan Ayik, one of Australia's most wanted drug dealers now operating as an international kingpin from Turkey, to trust the app and recommend it to his associates. It's a double whammy, in that the network has been blown wide open and the AFP is now telling Ayik to hand himself in to avoid recriminations from his associates. No doubt there will be a movie about this one.

[1] https://www.vice.com/en/article/akgkwj/operation-trojan-shie...

I expect this to be bigger than Panama Papers. Way bigger. I expect a few prominent politicians to be soon either arrested or "convinced" to step down. I expect the US to have gained a lot of intel and leverage over those from the countries who did not participate in this. We will absolutely not learn about everything they discovered. CIA will and the respective intelligence agencies will.

EDIT: Europol will hold their conference live on YouTube at 10 AM CST: https://twitter.com/janoorth/status/1402164252266409987

EDIT 2: given how Serbia was in the top 4 of messages sent, I really hope that the info gathered will help Interpol fight child trafficking and exploitation in the EU.

From the VICE article (https://www.vice.com/en/article/akgkwj/operation-trojan-shie...) quoted elsewhere here:

"Additionally, the review of Anom messages has initiated numerous high-level public corruption cases in several countries. The most prominent distributors are currently being investigated by the FBI for participating in an enterprise which promotes international drug trafficking, money laundering, and obstruction of justice."

"Late Monday, the FBI said that it would be holding "a news conference announcing a massive worldwide takedown based on the San Diego FBI’s unprecedented investigation involving the interception of encrypted communications" on Tuesday."

The PR barrage and faux posturing by the FBI to weaken encryption has always seemed like just lazy policing to me.

If anything, the hacking attacks on industrial centers has better illustrated than anything why encryption is necessary, and this new triumph has demonstrated that police can continue to function, even thrive in a world that permits encryption.

You're only anonymous as long as you're not actively targetted, despite using "secure" apps and stuff like Tor, which media makes it seem are unbreakable.

- Sky ECC (Shutdown, owner is facing criminal charges)

- Phantom Secure (Shutdown and owner got 9 years in prison)

- Encrochat ("Hacked" by french police)

So it seems like those "Encrypted phones" were very effective for Law Enforcement to put such an effort to go after them.

I think that criminal organizations will now rely on a do it yourself technique. Not buying phones online which is a very bad idea as law enforcement could just trap the phones at the postal facility, something they already do.

Going to an old fashion phone retailer, then removing the camera and GPS module yourself and installing some encrypted open source software.

Probably they are also going to fake messages. For 2 purposes:

- Talk about a fake huge drug deliveries or an imminent mass shooting to verify if the network has been compromised, I am pretty sure police has no choice other than to act in such a situation.

- This could be used as a strategy defense, if some messages turn out to be fake, then they can use plausible deniability on the others. And perhaps even claim police has faked them.

Selling a bugged phone to a known criminal is likely fine (cite: The Wire).

But is it acceptable to sell a bugged phone to unknown/unidentified/random people and then use the phone's communications to determine if the owner is a crook and the owner's identity? The sole basis of suspicions seems to be "bought phone", or maybe "bought phone using bitcoin", or even "bought phone on TOR using bitcoin".

It will be interesting to see how many of these cases hold up in court.

There's some pretty convincing speculation Dream market was setup as a similar operation to this. [0]

If this proves anything it's that the fear mongering by LE about encryption was overblown and they're just lazy lol.

0: https://youtu.be/1VZkiQUzITU

Let's say police claims you did something with only the chat log as an evidence and they run the chat software. Then they could very well have just faked it, because they have a high incentive to do so.

If the messages were on a third party platform you would at least have a neutral third party involved.

https://www.anom.io/

"This data comprises the encrypted messages of all of the users of Anoms with a few exceptions (e.g., the messages of approximately 15 Anom users in the U.S. sent to any other Anom device are not reviewed by the FBI),"

Any ideas as to why?

An informant (confidential human source, or "CHS") helped the FBI and AFP (Australian Federal Police) develop and distribute Anom to criminal gangs (transnational criminal organizations, or "TCOs"):

> The CHS offered this next generation device, named “Anom,” to the FBI to use in ongoing and new investigations. The CHS also agreed to offer to distribute Anom devices to some of the CHS’s existing network of distributors of encrypted communications devices, all of whom have direct links to TCOs.

Anom was specifically designed from the ground up with an encryption backdoor:

> Before the device could be put to use, however, the FBI, AFP, and the CHS built a master key into the existing encryption system which surreptitiously attaches to each message and enables law enforcement to decrypt and store the message as it is transmitted. A user of Anom is unaware of this capability. By design, as part of the Trojan Shield investigation, for devices located outside of the United States, an encrypted “BCC” of the message is routed to an “iBot” server located outside of the United States, where it is decrypted from the CHS’s encryption code and then immediately re-encrypted with FBI encryption code. The newly encrypted message then passes to a second FBI-owned iBot server, where it is decrypted and its content available for viewing in the first instance.

Naturally, the FBI can't spy on domestic communications without a warrant, so they got the AFP to do it for them:

> FBI geo-fenced the U.S., meaning that any outgoing messages from a device with a U.S. MCC would not have any communications on the FBI iBot server. But if any devices landed in the United States, the AFP agreed to monitor these devices for any threats to life based on their normal policies and procedures.

Closing Sky Global and Encrochat drove criminals to Anom:

> Since March 12, 2021, as a direct result of the Sky Global charges, there are now close to 9000 active Anom users. The criminals who use hardened encrypted devices are constantly searching for the next secure device, and the distributors of these devices have enabled criminals’ impenetrable communications on these devices for years.

Finally, the FBI quite directly admits their goal is to shake confidence in encrypted messaging:

> A goal of the Trojan Shield investigation is to shake the confidence in this entire industry because the FBI is willing and able to enter this space and monitor messages.

There's also a number of sample conversations in the warrant application showing criminals openly talking about moving drugs and other illegal activities with absolutely no code. Definitely worth a read.

I'm sure they would benefit from those just the same way legitimate enterprises do. The only difference is that they do more illegal stuff and use more violence, but the fundamental business dynamics should be the same.

https://en.wikipedia.org/wiki/Crypto_AG

I wonder how this all ties together. As someone mentioned here, there surely be some movie about it.

"To determine if your account is associated with an ongoing investigation, please enter any device details below:"

and then it asks for your username, country and IMEI....

There is another press conference at 09:00 PDT too (FBI I believe).

Side note: Scotland is recognised separately from the UK in the list of participating countries. ;)

Won't happen because the media and FANG runs cover for politicians in the west as opposed to reporting on them.

They keep burring anything that can be slightly damaging to politicians while they dox private individuals with impunity.

I highly doubt it. The main drug operations run with state approval. If anything this was just an attempt to either clean the country from competition or just keep law enforcement busy. If you read the reports, what they have collected, this is nothing if you compare what kind of volumes are being moved every day.

For example, in the UK alone it is estimated that yearly volume of illegal cannabis sales is in the region of 6 billion of pounds and the haul of entire operation was like how much, a 100 million?

What it is going to achieve is a slight vacuum, new youth "get rich quick type" will take place and resume operations.

If this wasn't announced in the media, I doubt drug consumers would have ever noticed something happened. If someone is using illegal market, they have plenty of alternative contacts if their main dealer goes bust.

Also these things are already included in the pricing, so this will be just written off as cost of doing business.

Tradeoffs. Traditional tradecraft would inhibit such discovery methods. But it's slow and expensive. Your competitors would outmaneuver you in the short term.

To enable the "kid who knows computers," you also need to train your people in opsec and digital sanitation. That might similarly be expensive and growth inhibiting enough to invite more daring competition.

There's a reason that classified processing and data storage employs layered physical security too. There's that old saying about what happens when you give someone physical access to the machine.

These ones, who were busted, are greedy violent thugs. They do not know who to trust because they are untrustworthy.

Good riddance to bad rubbish.

Most if not all markets until now have been run by geeks with limited knowledge and skills, wading in to the criminal underworld and inevitably making rookie mistakes.

Both Ross and the guy in Bangkok had their personal emails tied to the markets. Some kids running a big market from Germany connected to the server on their mom's wifi. The list goes on.

By adding a backdoor to E2E encryption? That is pretty much what they have been asking for :)

Amazing that criminals still pick some unknown device over an existing solution with a proven track record.

This is not the first time something like this has happened:

- https://en.wikipedia.org/wiki/EncroChat

- https://en.wikipedia.org/wiki/Sky_Global

[0]https://webcache.googleusercontent.com/search?q=cache:PwQXt6...

None of these were exploited to retrieve this data, and the third party app that was installed was not intended to encrypt conversations given that it was a honeypot.

> popular apps

This was a small app unknown by anyone outside of criminal orgs. It had no "legitimate" non-criminal users.

> especially in the US

The app was deployed in Australia.

> can always be commandeered

Why distribute a random app when they could have gotten the criminals to use Signal or Telegram and bust them there?

> as long as you're not actively targeted

How long did it take to find Bin Laden?

> despite using "secure" apps

This was not a secure app and any audit would have revealed this (audits such as the ones that Signal and friends have undergone).

> and stuff like Tor,

Tor was not involved.

> media makes it seem are unbreakable.

None of the apps hyped as "unbreakable" were broken here, so...point still stands, I guess?

Honestly, if anything, the recommended approach from this incident would be to use the walled garden - an FBI-backed honeypot would have a lot harder time getting from the App/Play Store onto a user's phone if it was obviously a scam to collect user conversations, asked for a bunch of permissions, had no reviews, and no apparent update history. Who would download some random chat app that nobody uses?

For me the lesson here is the same old lesson - Your security is only as good as the humans that interact with it.

Surprised this wasn't done more. It's the classic tactic you see in the movies: give false intel to the suspected mole and see if they snitch on you.

Ya, acknowledging the role of compromised encryption feels like burning their source.

Speculation: Churchhill chose to let Coventry get bombed rather than disclose that German encryption had been cracked.

Wouldn't the long game be to allow criminals to believe their communications remain secure, for law enforcement to do parallel construction for their cases?

I can't imagine the calculus that goes into these decisions.

Whatsapp or Telegram which your grandma uses would be very low reward compared to amount of conversations to parse.

if the crying wolf method worked, terrorists would have a much easier time executing their plots.

Pulse night club comes to mind as a counterpoint. A lot of people died to keep an informant happy. I think a more cynical outlook on law enforcement is appropriate.

>Step 1: Confirm known bad guy has phone through some other means.

>Step 2: Decrypt phone messages of known bad guy. Confirm they are criminal activities.

>Step 3: Note all previously unknown phones that exchanged criminal messages with known criminal.

>Step 4: Those phones are now considered belonging to known criminals. Return to Step 2.

Now, its totally possible they were just saying “someone bought a phone through TOR, they are probably bad so we can decrypt their messages” but that doesn’t have to be true for them to have worked their way through this criminal network.

You start with the head honchos phone, someone texts him about a drug shipment, so you get a warrant to access the backdoor on that phone as well, and so on.

As long as there aren't isolated cells, you get every cell phone. Since you're relying on the head honcho to push the phones, there probably aren't isolated cells.

I'd also assume they don't just take orders from anyone, I'd imagine you'd need a referral.

> In the real world, threat models are much simpler (see Figure 1). Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them. In summary, https:// and two dollars will get you a bus ticket to nowhere.

[0] https://www.usenix.org/system/files/1401_08-12_mickens.pdf

- I don't want to have a personalized experience on the net.

- I don't want Google algorithms to hide my new bike frame invention because I also posted an opinion about bing censoring tank man, or about Google cache as commons.