Europol and Eurojust, together with law enforcement and judicial authorities from around the world, have successfully dismantled an encrypted communication platform that was established to facilitate serious and organised crime perpetrated by dangerous criminal networks operating on a global scale. The platform, known as Ghost, was used as a tool to carry out a wide range of criminal activities, including large-scale drug trafficking, money laundering, instances of extreme violence and other forms of serious and organised crime. 

Europol’s Executive Director Catherine De Bolle said:

Today we have made it clear that no matter how hidden criminal networks think they are, they can’t evade our collective effort. Law enforcement from 9 countries, together with Europol, have dismantled a tool which was a lifeline for serious organised crime. This operation is what Europol is all about: turning collaboration into concrete results by bringing together the right people, tools and expertise to address every aspect of this complex operation. The work carried out is part of our ongoing commitment to tackling organised crime wherever it operates. I want to extend my gratitude to all our global partners who played a vital role in making this operation a success.

Ghost had gained traction among criminal organisations due to its advanced security features. Users could purchase the tool without declaring any personal information. The solution used three encryption standards and offered the option to send a message followed by a specific code which would result in the self-destruction of all messages on the target phone. This allowed criminal networks to communicate securely, evade detection, counter forensic measures, and coordinate their illegal operations across borders.

Worldwide, several thousand people used the tool, which has its own infrastructure and applications with a network of resellers based in several countries. On a global scale, around one thousand messages are being exchanged each day via Ghost.

A multinational effort spanning 9 countries

As servers were found in France and Iceland, the company owners were located in Australia, and financial assets were located in the United States, a global operation against the phone service started.

The takedown involved a series of coordinated raids and technical interventions. Over the course of the investigation, 51 suspects have been arrested: 38 in Australia, 11 in Ireland, one in Canada and one in Italy belonging to the Italian Sacra Corona Unita mafia group.

Further arrests are anticipated as the investigation progresses.

In addition, a number of threats to life were prevented, and a drug lab dismantled in Australia, together with weapons, drugs and over EUR 1 million in cash seized globally so far.

To facilitate investigations into the illegal activities facilitated by this communication platform, an Operational Taskforce (OTF) was established at Europol in March 2022 involving law enforcement authorities from Australia, Canada, France, Ireland, Italy, the Netherlands, Sweden and the United States.

This taskforce has been instrumental in mapping the global technical infrastructure, and was successful in targeting it by identifying key suppliers and users of the platform, monitoring its criminal usage, and executing the coordinated effort to shut it down, all under judicial oversight from the Joint Investigation Team (JIT) countries.

Building upon the law enforcement cooperation, a JIT was set up between the French and U.S. authorities in January 2024 with the support of Eurojust and Europol.

This complex, global operation was made possible thanks to active cooperation among the different countries involved and Europol, which have been engaged in the different components of the investigative activities, including actions against high-risk criminal organisations and High Value Targets, cyber-investigations, the analysis of cryptocurrencies transactions, frequent intelligence exchange using Europol’s secure channels and dozens of operational meetings arranged in different countries.

Over the course of the investigation, Europol deployed experts to Iceland, Ireland and Australia. Due to the complexity of this data-driven investigation, a number of teams at Europol were involved with specialised technical skills, including cyber-related.

A Joint Operational Centre was also established at Europol’s headquarters during the action days, where representatives from the OTF members and Europol’s officers provided support and facilitated the coordination of the simultaneous operational activities taking place across the globe.

A fragmented and dynamic landscape

The encrypted communication landscape has become increasingly fragmented as a result of recent law enforcement actions targeting platforms used by criminal networks. Following these operations, numerous once-popular encrypted services have been shut down or disrupted, leading to a splintering of the market.

Criminal actors, in response, are now turning to a variety of less-established or custom-built communication tools that offer varying degrees of security and anonymity.  By doing so, they seek new technical solutions and also utilise popular communication applications to diversify their methods. This strategy helps these actors avoid exposing their entire criminal operations and networks on a single platform, thereby mitigating the risk of interception.

Consequently, the landscape of encrypted communications remains highly dynamic and segmented, posing ongoing challenges for law enforcement.

Lawful access to data

Europol and its partners continue to prioritise the fight against encrypted communication technologies used by criminals, while also advocating for a balanced approach that respects privacy rights and upholds legal standards.

Private companies that wish to ensure their services are used in compliance with the law also have an important role to play. They must ensure that their platforms are not safe havens for criminals and should provide mechanisms for lawful data access under judicial oversight and in full respect of fundamental rights.

Law enforcement needs access to communications among suspects to combat serious crimes. This can coexist with privacy protection, while cybersecurity is guaranteed and strong legal safeguards and oversight are in place.