Encrypted chats between members of criminal organisations

March 2021. A cross-border, coordinated police operation is carried out in Europe relating to several criminal investigations. Around 300 buildings are searched, over one hundred arrests are made and drugs money amounting to more than one million Euros is seized in Belgium, France and the Netherlands. At the same time, mobile phones and servers on which the Sky ECC messaging service is installed are seized.

Serious criminals all around the world had until that point conducted their business via Sky ECC. The service was not cheap, but in return it promised very high security based on strong encryption, anonymity and other technical specifications. Anyone who wanted to chat using Sky ECC had to purchase a smartphone specially adapted by the company. International drug dealers and mafia and cartel bosses felt so secure using Sky ECC that they organised and conducted their business in these chats – just as we might find and buy a second-hand piano on a shopping app and agree on a pick-up time.

Analysis of data

In 2021, fedpol agents travelled to Europol. For the first time, they were able to view the seized data, now deciphered. Specialists from several countries worked to triage the data, and assign them to the relevant member states.

 At the start of 2022 fedpol was given permanent access to the data with a connection to Switzerland, as it had been working with Europol and Switzerland was involved in the operational task force (OTF). fedpol’s crime analysis sorted out the data it needed. Working with the IT forensics team, it worked out variants in order to make content delivered as raw data readable and usable.

 The initial findings were sent to the Federal Criminal Police and cantonal police investigators in the first half of 2022.

OKTOPUS

 In order to be properly organised, a coordination body was set up: OKTOPUS. Its aim was to exchange technical expertise and to coordinate the analysis and investigation work. 

 Thanks to the data supplied by Europol, the criminal police units in Switzerland were able to recognise previously unknown links and identify suspects.

 The criminal police units in the cantons and the Federal Criminal Police from fedpol concluded that they did not have sufficient human resources to make full use of the findings. Resources had to be pooled and used according to priorities. The Association of Swiss Cantonal Criminal Police Chiefs therefore decided in autumn 2022 to set up an operational sub-group, known as OKTOPUS, under the lead of the Federal Criminal Police.

 It is not the first time that various cantons and fedpol have set up a joint team to conduct intercantonal investigations. OKTOPUS, however, not only assists with specific investigations, but also acts as a strategic tool for managing resources in complex police investigations against organised crime. The members of OKTOPUS discuss who is to conduct which investigations in which cantons, what resources are available there, and which cantons can provide support.

 Criminals can no longer use Sky ECC. However, Sky ECC is not by any means the only messaging service of this type. Many Sky ECC users have changed to other similar systems in the meantime. Sooner or later, international investigations will lead to another encrypted communication system being shut down. The experience gained with OKTOPUS in dealing with enormous volumes of data, in evaluating them and making them usable in ongoing investigations and criminal proceedings will also be crucial for fedpol and the cantons in the future.