Authorities are staying on top of the encrypted messaging services that criminals use to undertake their activities. A joint investigation team (JIT) involving French and Dutch authorities has taken down another sophisticated encrypted messaging service, MATRIX. For three months, authorities were able to monitor the messages from possible criminals, which will now be used to support other investigations. During a coordinated operation supported by Eurojust and Europol, the messaging service was taken down by Dutch and French authorities and follow-up actions were executed by their Italian, Lithuanian and Spanish counterparts.

MATRIX, a messaging service made by criminals for criminals, was first discovered by Dutch authorities on the phone of a criminal convicted for the murder of a Dutch journalist in 2021. A large-scale investigation into the messaging service was initiated. 

It was soon clear that the infrastructure of this platform was technically more complex than previous platforms such as Sky ECC and EncroChat. The founders were convinced that the service was superior and more secure than previous applications used by criminals. Users were only able to join the service if they received an invitation. The infrastructure to run MATRIX consisted of more than 40 servers in several countries with important servers found in France and Germany. 

Cooperation between the Dutch and French authorities started through a JIT set up at Eurojust. By using innovative technology, the authorities were able to intercept the messaging service and monitor the activity on the service for three months. More than 2.3 million messages in 33 languages were intercepted and deciphered during the investigation.

The messages that were intercepted are linked to serious crimes such as international drug trafficking, arms trafficking, and money laundering. 

Actions to take down the service and pursue serious criminals happened on 3 December in four countries. In France, one suspect was arrested, and his house searched. In Spain, two suspects were arrested following a European Arrest Warrant from the Netherlands and six houses were searched. Six houses were searched in Lithuania. The main servers in France and Germany were taken down. Criminals using the messaging service are alerted to the interception by the authorities through a splash page. Through legal requests, authorities will now be able to access the messages for their investigations. 

The cross-border investigation into MATRIX is a clear example of the importance of international cooperation to fight serious organised crime. By working together in a JIT, Dutch and French authorities were able to exchange information and evidence swiftly and execute joint actions. To support investigations into the illegal activities enabled by this communication platform, an Operational Task Force (OTF) was established at Europol in June 2024 between the Netherlands, France, Lithuania, Italy and Spain. This taskforce played a key role in monitoring criminal activity on the platform. Europol's OTF will also provide assistance with independent follow-up investigations stemming from intelligence gathered during the live phase of the operation. German authorities supported the operation with their technical expertise. Spanish authorities have been working with their French and Dutch counterparts since the early stages of the investigations.  

The encrypted communication landscape has become more fragmented following the takedown of several services such as Sky ECC, EncroChat, Exclu and Ghost. Criminals, in response to the disruptions of their messaging services, have been turning to a variety of less-established or custom-built communication tools that offer varying degrees of security and anonymity. While the new fragmented landscape poses challenges for law enforcement, the takedown of established communication channels, shows that authorities are on top of the latest technologies that criminals use.