800 criminals arrested in biggest ever law enforcement operation against encrypted communication

The US Federal Bureau of Investigation (FBI), the Dutch National Police (Politie), and the Swedish Police Authority (Polisen), in cooperation with the US Drug Enforcement Administration (DEA) and 16 other countries have carried out with the support of Europol one of the largest and most sophisticated law enforcement operations to date in the fight against encrypted criminal activities.  

Since 2019, the US Federal Bureau of Investigation, in close coordination with the Australian Federal Police, strategically developed and covertly operated an encrypted device company, called ANOM, which grew to service more than 12 000 encrypted devices to over 300 criminal syndicates operating in more than 100 countries, including Italian organised crime, outlaw motorcycle gangs, and international drug trafficking organisations. 

The goal of the new platform was to target global organised crime, drug trafficking, and money laundering organisations, regardless of where they operated, and offer an encrypted device with features sought by the organised crime networks, such as remote wipe and duress passwords, to persuade criminal networks to pivot to the device. 

The FBI and the 16 other countries of the international coalition, supported by Europol and in coordination with the US Drug Enforcement Administration, then exploited the intelligence from the 27 million messages obtained and reviewed them over 18 months while ANOM’s criminal users discussed their criminal activities. 

This operation, known as OTF Greenlight/Trojan Shield, is one of the largest and most sophisticated law enforcement operations to date in the fight against encrypted criminal activities.  A series of large-scale law enforcement actions were executed over the past days across 16 countries resulting in more than 700 house searches, more than 800 arrests and the seizure of over 8 tons of cocaine, 22 tons of cannabis and cannabis resin, 2 tons of synthetic drugs (amphetamine and methamphetamine), 6 tons of synthetic drugs precursors, 250 firearms, 55 luxury vehicles and over $48 million in various worldwide currencies and cryptocurrencies. Countless spin-off operations will be carried out in the weeks to come.  Operation Trojan Shield/Greenlight will enable Europol to further enhance the intelligence picture on organised crime affecting the EU due to the quality of the information gathered. This enhanced intelligence picture will support the continued effort in identifying operating high-value criminal targets on a global scale.

Criminal demand for encrypted platforms and past takedowns

Criminal networks have a huge demand for encrypted communication platforms to facilitate their criminal activities. However, the market for encrypted platforms is considered to be volatile. In July 2020, the EncroChat encrypted platform was dismantled by the Operational Taskforce EMMA (France, the Netherlands). This international operation sent shockwaves in the criminal underworld across Europe and was followed in 2021 with another takedown of a similar nature: an international group of judicial and law enforcement authorities (Belgium, France, the Netherlands) successfully blocked the further use of encrypted communications by organised crime networks via the Sky ECC communication service tool (Operational Task Force Limit). 

Both operations provided invaluable insights into an unprecedented amount of information exchanged between criminals. After the takedown of Sky ECC in March 2021, many organised crime networks sought a quick encrypted replacement for a communication platform that would allow them to evade law enforcement detection. This was a deliberate and strategic aspect of OTF Greenlight / Operation Trojan Shield resulting in the migration of some of the criminal Sky ECC customer base to the FBI-managed platform Anom. 

Europol’s Deputy Executive Director Jean-Philippe Lecouffe: “This operation is an exceptional success by the authorities in the United States, Sweden, the Netherlands, Australia, New Zealand and the other European members of the Operational Task Force. Europol coordinated the international law enforcement community, enriched the information picture and brought criminal intelligence into ongoing operations to target organised crime and drug trafficking organisations, wherever they are and however they choose to communicate. I am very satisfied to see Europol supporting this operation and strengthen law enforcement partnerships by emphasizing the multi-agency aspect of the case.”

Calvin Shivers, Assistant Director, Criminal Investigative Division, US Federal Bureau of Investigation: “Encrypted criminal communications platforms have traditionally been a tool to evade law enforcement and facilitate transnational organized crime. The FBI and our international partners continue to push the envelope and develop innovative ways to overcome these challenges and bring criminals to justice,” said the FBI’s Criminal Investigative Division Assistant Director Calvin A. Shivers. “We are grateful to Europol for their commitment to fighting transnational organized crime and their partnership with the FBI. ”

Linda H Staaf, Police Commissioner, Head of Intelligence of the Swedish Police (Polisen): “This operation, with an extensive strike yesterday, is one of the largest intelligence-led police operations against violent crime and drug networks ever in Sweden. From the Swedish police’s point of view there were no doubt to be the leading part in Europe together with the Netherlands and Europol. We highly appreciate this type of cooperation between law enforcement agencies. The criminality spreads across borders and international cooperation is crucial to fight serious crime. ”

Jannine van den Berg, Chief Constable of the Netherlands Police’s Central Unit: “Operation Trojan Shield is a fine example of innovative and daring police work that is unparalleled. Each partner provided its own unique expertise and together we delivered a fantastic international performance. Thanks to the excellent technical skills of the Dutch police, the millions of messages could be analyzed and interpreted. Just like the investigations into EncroChat and Sky, Operation Trojan Shield also shows that serious criminals wrongly believe that they can operate anonymously and out of sight of the police and that they cannot be caught. Nothing turns out to be less true. My compliments and thanks go to all participants of Operation Trojan Shield.”

Australian Federal Police Commissioner Reece Kershaw APM: “The AFP and FBI have been working together on a world-first operation to bring to justice the organised crime gangs flooding our communities with drugs, guns and violence. Europol has been a trusted and committed partner during this time. Very few matters unite law enforcement like bringing to justice those who seek to do our citizens harm. The FBI provided an encrypted communications platform while the AFP deployed the technical capability that helped unmask some of the biggest criminals in the world. The intelligence shared by Europol has helped to ensure this is one of the most significant global taskforces for law enforcement. This week the AFP will execute hundreds of warrants and is expected to arrest hundreds of offenders who were linked to the platform. This is the culmination of hard work, perseverance and an invaluable, trusted relationship with Europol. We thank Europol for their long and integral partnership with the AFP. Crime is local but when we work together our reach is global.”

Drug Enforcement Administration Deputy Chief of Operations Matthew Donahue said: “Operation Trojan Shield and Europol Operation Greenlight not only reveal how transnational criminal organizations continue to exploit encrypted communication services for their own illicit gain, but also show the commitment of the law enforcement community to develop innovative strategies to counter this activity. These operations underscore the seriousness of the international drug threat and provide a strong foundation from which future investigations can be built.  As clearly shown in this operation, transnational organized crime is a global problem that requires a global solution, strong international partnerships and timely information sharing which are critical tools in this fight.”  

Europol’s role and contribution

Europol set up an Operational Task Force (OTF) for Operation Trojan Shield / Greenlight and provided operational support for the participating countries by acting as a criminal intelligence hub, facilitating the exchange of information and coordinating with other investigations supported by Europol. Overall, 16 countries took part in this OTF and sent representatives to Europol in The Hague, the Netherlands, to coordinate their activities at the national and international levels. The large system of international liaison officers at Europol ensures that the interests of law enforcement agencies in the EU Member States and non-EU partners are represented at Europol’s headquarters. Europol supported OTF Greenlight / Operation Trojan Shield, which was led by the US FBI, Sweden, the Netherlands and Australia.

The following countries participated in the international coalition: Australia, Austria, Canada, Denmark, Estonia, Finland, Germany, Hungary, Lithuania, New Zealand, the Netherlands, Norway, Sweden, the United Kingdom incl. Scotland, and the United States.