{"id":588,"date":"2024-02-02T15:21:10","date_gmt":"2024-02-02T15:21:10","guid":{"rendered":"https:\/\/blogs.uwe.ac.uk\/policing\/?p=588"},"modified":"2024-02-02T19:22:53","modified_gmt":"2024-02-02T19:22:53","slug":"to-what-extent-are-we-winning-the-war-breaking-the-organised-crime-enigma-code","status":"publish","type":"post","link":"https:\/\/blogs.uwe.ac.uk\/policing\/to-what-extent-are-we-winning-the-war-breaking-the-organised-crime-enigma-code\/","title":{"rendered":"To what extent are we winning the war? Breaking the organised crime enigma code"},"content":{"rendered":"\n

I have been fortunate to lead some iconic investigations during my career in Policing and at the National Crime Agency (NCA) prior to joining the Policing Programme at UWE Bristol. It seems an appropriate moment to reflect on one of the most challenging yet rewarding of these with the launch of a BBC \u2018Gangster\u2019 series \u2018Catching the Kingpins<\/a>\u2019 (Azhar, 2024). This charts \u2018the biggest organised crime bust in British Policing History\u2019 (Azhar, 2024) following the UK response to the infiltration and take down of the criminally dedicated encrypted communications platform EncroChat<\/a>.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

This response came as I neared the end of my 30-year career in law enforcement, of which I enjoyed every day. I look back with pride on my role as UK Silver Commander for investigations on Operation Venetic and that of the whole team. The UK operation continues to generate high media attention having resulted in 3,100 arrests of which 1,867 have been charged and more than 1,200 people jailed (Stedman, 2023). I truly felt we were at that time \u2018winning the battle\u2019, but have we won the war on organised crime?<\/p>\n\n\n\n

Background to Encrypted Communications<\/strong><\/h2>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

Throughout history, we have seen examples of clandestine communication and efforts to crack them. As far back as 60 BC, with Julius Caesar\u2019s cipher<\/a>, to British cryptographers role in cracking the Enigma machine during World War II.<\/p>\n\n\n\n

Encryption is generally a technique that is used to conceal messages using algorithms. It helps to protect private information, sensitive data, and enhance security of communication.  Over the intervening decades, the landscape of encryption evolved dramatically. Organised criminals enthusiastically adopted Blackberry Messenger (BBM) to protect their communications from law enforcement. Numerous companies were subsequently set up and traded in encrypted devices for transnational organised crime, including Phantom Secure<\/a> and Ennetcom<\/a>.<\/p>\n\n\n\n

In 2014, FBI Director James Comey addressed the challenge of balancing privacy and security in a digital age, aptly termed ‘Going Dark.’ He emphasised that privacy is a personal right and security is a collective need, but they often conflict. As technology advances, especially with encryption, this balance is disrupted (Comey, 2014)<\/a>. While there were some investigation successes, criminals were clearly exploiting technology’s benefits to avoid detection.<\/p>\n\n\n\n

Into the darkness<\/strong><\/h2>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

Among the various competitors, EncroChat emerged as the preferred platform for Northern European Organised Crime, prompting the NCA to recognise it as a substantial threat. <\/p>\n\n\n\n

In 2019, the possession of an EncroChat device was designated as an ‘aggravating factor’ in sentencing at a murder trial where the Judge characterised it as a ‘new generation of untraceable mobile phones, empowering criminals to plan murders and drug deals without fear of their conversations ever being revealed\u2019 (Thomas and Docking, 2019)<\/a>.<\/p>\n\n\n\n

Adverts for EncroChat were not found on any conventional mobile phone websites or stores and were distributed through a clandestine network. The phones had pre-loaded apps for instant messaging, the ability to make VOIP calls and included a kill code which wiped them remotely. They cost around \u00a31,500 for a six-month contract and EncroChat became an entry requirement into the lucrative organised crime marketplace.<\/p>\n\n\n\n

By 2020, it was assessed that EncroChat had become the leading provider of encrypted communication services to serious organised crime (SOC) both in the UK and internationally, boasting approximately 60,000 users worldwide, with an estimated 10,000 in the UK (NCA, 2020).<\/p>\n\n\n\n

A \u2018Whole System\u2019 Response<\/u><\/strong><\/h2>\n\n\n\n

International collaboration was a key aspect of success. After a meeting at Europol, our French and Dutch partners reported an ability to penetrate EncroChat. This meant we had just a few weeks to become operationally ready to respond to an unprecedented opportunity to gather EncroChat messaging data and strike at the very heart of organised crime.  <\/p>\n\n\n\n

Just as we were gearing up the necessary legal authorities, collaborative partnerships and resourcing with Policing and the multitude of agencies involved in tackling organised crime throughout the UK, the world was plunged into Covid 19 lockdown. We were faced with a decision to pause or remain committed to action and press on. The unanimous decision was to \u2018go-go-go\u2019 as this was simply too good an opportunity to miss. I was then responsible for leading co-ordination of all UK agencies during the operation to maximise operational impact. Throughout this, only a small group of people knew the full details of the operation and what was to follow.<\/p>\n\n\n\n

Covert Phase and Data Exploitation<\/u><\/strong><\/h2>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

The operation eventually went live in April 2020 and we were immediately sat at the end of a data tsunami of messages and images exchanged between organised criminals. To give you a sense of scale, by the end of the operation over 18 million messages and images had been recovered (Jeeves, 2024)<\/a>. This treasure-trove reflected the high degree of confidence in the EncroChat platform. It was like being sat at the same table as these criminals when they were discussing their enterprises.<\/p>\n\n\n\n

With similarities to Enigma code breaking, during the covert phase the data could only be used as intelligence. There was, however, light at the end of the tunnel. It was agreed early on that once the operation had been made public, the data recovered could be used evidentially in suspect interviews and at court. Intelligence packages were built and disseminated to develop and launch operations. Together with a small team I then had the responsibility of pre-authorising all Executive Action (EA) involving arrests and seizures across the UK during the covert phase.<\/p>\n\n\n\n

Key to decision making on EA was the prioritisation based on threat, harm and risk and obfuscation of the EncroChat data through parallel sourcing of intelligence and building the picture to enable executive action. The criminals clearly had concerns which were reflected in their messages:<\/p>\n\n\n\n