WEBVTT - Joseph Cox: Dark Wire 0:00:00.360 --> 0:00:05.480 This story contains adult content and language. Listener discretion is advised. 0:00:12.960 --> 0:00:15.760 And they can see all of these messages and they 0:00:15.800 --> 0:00:20.599 realize these phones this is where the criminals have been hided. 0:00:25.800 --> 0:00:29.680 I'm Kate Winkler Dawson, a nonfiction author and journalism professor 0:00:29.720 --> 0:00:32.440 in Austin, Texas. I'm also the co host of the 0:00:32.479 --> 0:00:36.320 podcast Buried Bones on Exactly Right, and throughout my career 0:00:36.600 --> 0:00:40.360 research for my many audio and book projects has taken 0:00:40.400 --> 0:00:43.640 me around the world. On Wicked Words, I sit down 0:00:43.680 --> 0:00:48.400 with the people I've met along the way, amazing writers, journalists, filmmakers, 0:00:48.400 --> 0:00:52.840 and podcasters who have investigated and reported on notorious true 0:00:52.840 --> 0:00:56.640 crime cases. This is about the choices writers make, both 0:00:56.680 --> 0:00:59.600 good and bad, and it's a deep dive into the 0:01:00.000 --> 0:01:05.679 publish details behind their stories. In twenty eighteen, the FBI 0:01:05.840 --> 0:01:09.440 discovered that high level criminals around the world were using 0:01:09.640 --> 0:01:14.319 encrypted devices to plot intricate crimes. When a powerful, secure 0:01:14.480 --> 0:01:18.320 new app began courting these syndicates, members of the underworld 0:01:18.400 --> 0:01:21.720 flocked to it. One problem for the criminals, though the 0:01:21.760 --> 0:01:25.679 app was created by the FBI. Joseph Cox tells us 0:01:25.720 --> 0:01:31.640 the incredible story from his book Dark Wire. Why don't 0:01:31.640 --> 0:01:33.800 you give me sort of your elevator pitch of what 0:01:34.040 --> 0:01:37.319 this book is about. When you're talking to someone who says, oh, 0:01:37.319 --> 0:01:38.880 I heard you read a book. I don't know anything 0:01:38.880 --> 0:01:40.040 about it. Tell me about it. 0:01:40.360 --> 0:01:42.920 I mean to come out swinging straight away. It is 0:01:42.959 --> 0:01:47.280 about how the FBI secretly ran a tech startup for 0:01:47.360 --> 0:01:51.720 organized crime in order to wiatap the world. It's very 0:01:51.760 --> 0:01:54.040 crazy when you put it into one sentence like that, 0:01:54.360 --> 0:01:58.240 but this was the largest sing operation ever. Usually you 0:01:58.280 --> 0:02:02.840 may think about the FBI investigating one drug trafficking ring, 0:02:03.080 --> 0:02:06.360 or some money launderers, or even one murder. Here they 0:02:06.440 --> 0:02:12.320 investigated thousands, potentially over ten thousand at once. By providing 0:02:12.760 --> 0:02:17.240 the critical infrastructure that these criminals use. It's basically the 0:02:17.240 --> 0:02:21.880 biggest wire app that's ever existed. And of course tons 0:02:21.919 --> 0:02:24.520 of interesting questions come up from that. And I really 0:02:24.520 --> 0:02:29.080 think the book is about trust. These criminals trusted this 0:02:29.240 --> 0:02:31.680 phone so much that they were willing to commit crimes 0:02:31.680 --> 0:02:35.240 on it. The FBI trusted its international partners, which I'm 0:02:35.280 --> 0:02:37.880 sure we'll get into, the Germans, the Swedes, the Dutch, 0:02:38.000 --> 0:02:41.880 and hoping that this audacious operation would not leak. It 0:02:41.919 --> 0:02:44.440 was basically a miracle and then also, I think for 0:02:44.600 --> 0:02:48.880 us trusting, well, when are we really communicating in private? 0:02:49.160 --> 0:02:51.840 And how do we know when the messaging apps that 0:02:51.880 --> 0:02:54.520 we're using, or the phone line we're using or whatever 0:02:55.120 --> 0:02:58.200 is really secure? And it's almost getting harder and harder 0:02:58.400 --> 0:02:59.880 to answer that question. 0:03:00.360 --> 0:03:03.760 How did the FBI get this kind of information about 0:03:03.840 --> 0:03:07.320 organized crime before we had wire taps and apps and 0:03:07.360 --> 0:03:09.519 all of that, was that mostly informants. 0:03:09.760 --> 0:03:13.320 Yeah, you're going to have human intelligence like informants, you're 0:03:13.360 --> 0:03:16.640 going to have old fashioned police work. I mean, the 0:03:16.639 --> 0:03:20.600 wiretap now is over a century old, right, and they 0:03:20.600 --> 0:03:23.639 were very very quick to exploit that, as were other 0:03:23.720 --> 0:03:27.320 law enforcement agencies. But then there is always this cat 0:03:27.360 --> 0:03:31.360 and mouse between law enforcement and criminals, and criminals will 0:03:31.360 --> 0:03:34.600 then move to something like a pager, for example, or 0:03:34.680 --> 0:03:38.280 then maybe they start using cell phones and mobile phones 0:03:38.280 --> 0:03:40.920 and that sort of thing. And you can imagine, of course, 0:03:41.240 --> 0:03:44.000 you know, the wire or the sopranos or something like that, 0:03:44.080 --> 0:03:46.760 and those are sort of the stereotypical cases of well, 0:03:46.800 --> 0:03:50.600 this is how the FBI or other agencies investigate organized crime. 0:03:51.040 --> 0:03:54.360 But there's been a technological leap that I think people 0:03:54.800 --> 0:03:57.040 in the general public aren't really aware of, which is 0:03:57.120 --> 0:04:00.960 that criminals have started using these very sophisticated encryptive phones, 0:04:01.320 --> 0:04:06.160 and it's basically the most important technological leap that criminals 0:04:06.200 --> 0:04:09.360 have made since the invention of the cell phone in 0:04:09.400 --> 0:04:12.720 the first place. So whereas for decades upon decades, as 0:04:12.720 --> 0:04:15.920 you say, going back, all of that time is informants 0:04:15.920 --> 0:04:18.760 and the normal phone lines, we're in a different world 0:04:18.839 --> 0:04:25.400 now where many top tier criminals can basically communicate securely, 0:04:25.640 --> 0:04:27.520 and they can communicate in such a way where law 0:04:27.600 --> 0:04:30.359 enforcement probably aren't actually going to get the contents of 0:04:30.400 --> 0:04:33.960 their communications. It's an entirely different world now to even 0:04:34.480 --> 0:04:37.080 you know, the eighties or seventies, the nineties, it's just 0:04:37.120 --> 0:04:38.320 a different ecosystem now. 0:04:38.520 --> 0:04:41.000 I know this might be an odd question. I'm curious, 0:04:41.120 --> 0:04:44.239 is there a way to easily explain why the FBI 0:04:44.440 --> 0:04:46.240 at some point in history might have been able to 0:04:46.320 --> 0:04:49.839 tap landlines but then not cell phones, Because I feel 0:04:49.839 --> 0:04:52.680 like in every kind of cloak and Dagger movie, it's like, oh, no, 0:04:52.760 --> 0:04:54.320 we're safe, let's talk on a cell phone, but we 0:04:54.360 --> 0:04:57.320 can't talk on landlines. So what would be the difference. 0:04:57.320 --> 0:05:00.280 As we're moving more towards the modern part of the story. 0:05:00.360 --> 0:05:04.440 Back with original wire taps. It was literally that law 0:05:04.560 --> 0:05:07.599 enforcement would go and they would place a device or 0:05:07.600 --> 0:05:11.800 even crocodile clips or some sort of interception capability onto 0:05:11.880 --> 0:05:15.520 the literal wires which are carrying the communication. Of course, 0:05:15.560 --> 0:05:19.520 when criminals start to move towards cell phones, the infrastructure 0:05:19.560 --> 0:05:21.320 of that has changed, and then that's where you see 0:05:21.360 --> 0:05:25.479 the FBI or other agencies doing closer collaboration with AT 0:05:25.600 --> 0:05:29.520 and TV, Verizon, T Mobile, whoever. And they're always catching 0:05:29.560 --> 0:05:32.760 up to where the criminals are moving towards. And that's 0:05:32.839 --> 0:05:35.440 just a constant theme over the past one hundred years 0:05:35.440 --> 0:05:37.920 and decades. The criminals go a few little steps forward, 0:05:38.080 --> 0:05:41.440 and then the law enforcement agencies catch up, and it's 0:05:41.440 --> 0:05:45.160 gone from something that was purely physical as in touching 0:05:45.200 --> 0:05:48.480 the cable getting the communication to of course, now not 0:05:48.560 --> 0:05:51.400 just cell phones, but the Internet writ large, and there 0:05:51.400 --> 0:05:54.279 are places where you can go and intercept Internet data. 0:05:54.760 --> 0:05:57.840 Thinking about the NSA and GCHQ, where they literally tap 0:05:57.920 --> 0:06:01.360 the undersea cables that carry the world data. Of course, 0:06:01.400 --> 0:06:03.880 that's not something that law enforcement is typically going and doing. 0:06:03.920 --> 0:06:06.960 That's in the realm of intelligence agency. So there's always 0:06:07.000 --> 0:06:08.479 going to be a divide there as well. 0:06:09.000 --> 0:06:11.599 Well. Before we get into the sting operation that just 0:06:11.640 --> 0:06:16.320 seems so elaborate and overwhelming and creative. I do want 0:06:16.360 --> 0:06:19.440 to dip in a tiny bit about the encrypted apps, 0:06:19.600 --> 0:06:22.280 because you know, in the last month or two apps 0:06:22.320 --> 0:06:26.560 that are encrypted, like Signal, have popped up in hearings 0:06:26.600 --> 0:06:29.880 and house hearings through a lot of controversy. To simplify it, 0:06:29.920 --> 0:06:34.039 are there sort of three levels of secure phone lines. 0:06:34.120 --> 0:06:36.240 There's the lowest level like what I use, where anybody 0:06:36.279 --> 0:06:39.600 could probably tap into it. Then there is something like Signal, 0:06:39.760 --> 0:06:41.960 you know, an app where it says it's encrypted, but 0:06:42.040 --> 0:06:46.159 obviously it's not as secure as the third highest level, 0:06:46.160 --> 0:06:48.400 which would be whatever the government is using. I'm not 0:06:48.440 --> 0:06:51.080 even one hundred percent sure what encrypted means, so maybe 0:06:51.080 --> 0:06:52.680 give me the dummy version of all of that. 0:06:52.960 --> 0:06:55.160 I think that's a totally fair characterization, where you have 0:06:55.240 --> 0:06:59.400 those free levels of a completely ordinary phone line, which yes, 0:06:59.480 --> 0:07:01.320 it might be rypt in some ways, but it's not 0:07:01.400 --> 0:07:03.680 exactly done in a robust way, and you can have 0:07:04.040 --> 0:07:06.600 people intercepting it, or you can have wide apps as 0:07:06.640 --> 0:07:10.840 well that next level, such as the Signals or potentially 0:07:10.920 --> 0:07:13.440 the telegrams of people familiar with that app as well. 0:07:13.680 --> 0:07:16.520 What that does is that it will take the message 0:07:16.560 --> 0:07:18.800 that you've typed out on your phone, a text message 0:07:18.880 --> 0:07:21.840 or a voicemail or whatever, and it will encrypt it 0:07:22.240 --> 0:07:24.720 while it's still on the phone, so it hasn't crossed 0:07:24.760 --> 0:07:27.760 the cables yet, it hasn't entered the wider Internet yet, 0:07:27.920 --> 0:07:31.040 and it's safely packaged that up it transmits across and 0:07:31.080 --> 0:07:34.680 then hopefully only the person who's supposed to receive that 0:07:34.920 --> 0:07:37.080 is able to decrypt it. And you don't notice any 0:07:37.080 --> 0:07:39.600 of this, right You're just using signal or whatever, and 0:07:39.640 --> 0:07:44.200 it happens instantaneously, but in the background, that very robust 0:07:44.400 --> 0:07:47.800 set of security steps is happening. Now, if somebody did 0:07:47.840 --> 0:07:50.760 intercept that, it would just be absolute gibber. It should 0:07:50.800 --> 0:07:53.240 be ones and zeros or random letters, and they could 0:07:53.280 --> 0:07:55.760 intercept something, but they won't be able to read any 0:07:55.760 --> 0:07:58.360 of it. And then, as you say, the next layer 0:07:58.960 --> 0:08:03.000 is the device and the systems that hopefully members of 0:08:03.040 --> 0:08:05.480 the US governments and other governments are using, whereas it 0:08:05.480 --> 0:08:09.040 won't just be encrypted, but the phone or the device 0:08:09.080 --> 0:08:12.920 itself will be hardened as well. You know, you can 0:08:12.960 --> 0:08:15.800 have the best encryption in the world. If someone has 0:08:15.880 --> 0:08:19.240 hacked your phone, that's the place where the message is landing, well, 0:08:19.240 --> 0:08:21.280 then potentially they can read it as well. 0:08:21.400 --> 0:08:24.400 What is the danger of sending something that's very sensitive 0:08:24.440 --> 0:08:26.720 through signal if they're not going to receive any kind 0:08:26.720 --> 0:08:28.280 of a real quote unquote information. 0:08:28.760 --> 0:08:34.120 The benefit of signal is that you can send stuff 0:08:34.440 --> 0:08:37.160 and then if it's intercepted, it's not going to be 0:08:37.200 --> 0:08:40.320 readable by any authorities or any third parties they're getting it. 0:08:40.480 --> 0:08:43.200 But yes, if you hack onto the if somebody hacks 0:08:43.200 --> 0:08:44.719 the phone at the end of that, they're going to 0:08:44.720 --> 0:08:46.680 be able to read that. And that's just something which 0:08:46.720 --> 0:08:50.360 is the limit of encryption technology. Encryption can protect the 0:08:50.400 --> 0:08:52.720 contents of your messages and can protect it as it's sent. 0:08:53.320 --> 0:08:55.960 It can't protect you if a hacker is broken into 0:08:56.000 --> 0:08:59.280 your phone, or if you accidentally add a journalist to 0:08:59.320 --> 0:09:01.640 a group chat and then they are of course receiving 0:09:01.679 --> 0:09:04.400 all of that data as well. It can't protect against 0:09:04.840 --> 0:09:08.400 mistakes or to be less charitable, stupidity depending on the 0:09:08.400 --> 0:09:10.439 way that you're looking at it. You have to use 0:09:10.480 --> 0:09:13.760 the technology in the right way. And the great thing 0:09:13.760 --> 0:09:16.480 about these consumer apps like Signal or other ones like it, 0:09:16.600 --> 0:09:21.359 they try to eliminate the room for you to make mistakes. Basically, 0:09:21.640 --> 0:09:24.480 encryption has been around for decades, but I remember when 0:09:24.520 --> 0:09:26.360 I started using it round about the time of the 0:09:26.520 --> 0:09:30.400 Edward snowd Of revelations of twenty thirteen. It was so difficult. 0:09:30.480 --> 0:09:33.280 It was cumbersome. You had to use all these different 0:09:33.280 --> 0:09:36.920 tools and encrypture email in this really fancy way. Nowadays, 0:09:37.080 --> 0:09:39.040 you can just use WhatsApp, which is also end to 0:09:39.120 --> 0:09:41.120 end encrypted. You can use I Message, you can use 0:09:41.160 --> 0:09:43.000 any of these other ones and we don't even have 0:09:43.080 --> 0:09:45.560 to think about it. And that's a net positive that 0:09:45.679 --> 0:09:48.920 billions of people around the world are able to communicate 0:09:49.240 --> 0:09:52.880 more privately with confidentiality, and of course criminals can now 0:09:52.920 --> 0:09:53.520 do that as well. 0:09:56.760 --> 0:09:59.600 So was there to get to your story? Was there 0:10:00.040 --> 0:10:03.280 an incident that started all of this for the FBI? 0:10:03.480 --> 0:10:06.760 Did they start realizing that the criminal enterprises around the 0:10:06.800 --> 0:10:10.360 world were getting these encrypted phones that they could not access. 0:10:10.559 --> 0:10:14.200 Yeah, So, in around twenty fifteen twenty sixteen, the FBI 0:10:14.640 --> 0:10:18.960 is investigating this drug trafficker called Owen Hanson, and it 0:10:19.040 --> 0:10:23.120 seems he's pretty successful. They use an informant to basically 0:10:23.240 --> 0:10:27.120 bait him into doing a methmthetamine deal. They presume he's 0:10:27.160 --> 0:10:30.360 selling many more drugs. But they actually can't get a 0:10:30.360 --> 0:10:33.600 tap on his phone because he's using this very unusual 0:10:34.040 --> 0:10:36.680 BlackBerry back when those were cool and popular. 0:10:36.800 --> 0:10:37.760 I love blackberries. 0:10:38.000 --> 0:10:40.640 They had they're very cool keyboard. Drug traffickers loved those 0:10:40.679 --> 0:10:43.439 as well. But the FBI found that owen Hanson was 0:10:43.559 --> 0:10:46.400 using one of those and it could send encrypted emails. 0:10:46.679 --> 0:10:50.240 It also had the microphone removed, the camera taken out, 0:10:50.440 --> 0:10:53.800 the GPS as well. It basically wasn't a phone, it 0:10:53.840 --> 0:10:56.520 was like a computer in his pocket that could send 0:10:56.640 --> 0:11:02.120 encrypted messages. So the FBI investigate him without fully understanding 0:11:02.440 --> 0:11:05.199 all of the contours of his crimes, they still have 0:11:05.320 --> 0:11:08.120 enough to prosecute him. They get hold of this phone 0:11:08.400 --> 0:11:12.320 made by a company called Phantom Secure. Unfortunately for owen Hanson, 0:11:12.559 --> 0:11:15.559 he hadn't changed the default password, so the FBI were 0:11:15.559 --> 0:11:18.600 able to log in very very quickly, and they can 0:11:18.640 --> 0:11:21.760 see all of these messages because again now they're on 0:11:21.760 --> 0:11:24.559 the endpoint, they're on the device, and they're scrolling through 0:11:24.840 --> 0:11:29.480 and there's just thousands talking about criminal activity and they realize, oh, 0:11:29.840 --> 0:11:34.240 these phones, this is where the criminals have been hiding. 0:11:34.520 --> 0:11:36.679 They're not on the normal phone lines anymore. They're not 0:11:36.760 --> 0:11:41.200 on the cell phones. They're on these really sophisticated, customized 0:11:41.760 --> 0:11:46.880 pocket sized computers, And that basically starts the FBI's near obsession, 0:11:47.240 --> 0:11:51.080 or the San Diego fbis near obsession with looking into 0:11:51.120 --> 0:11:55.000 these companies, shutting them down, and eventually running their own 0:11:55.000 --> 0:11:55.439 as well. 0:11:55.600 --> 0:11:59.000 So the FBI's understanding in twenty fifteen or before was 0:11:59.040 --> 0:12:02.720 that these enterprises were run over at and T cell phones, 0:12:02.760 --> 0:12:04.400 normal cell phones that were encrypted. 0:12:04.760 --> 0:12:08.000 I think when they've been investigating drug trafficking rings before 0:12:08.120 --> 0:12:11.960 or other criminals, the sort of approach of these criminals 0:12:12.000 --> 0:12:16.040 has just been to sort of compartmentalize information, only tell 0:12:16.200 --> 0:12:19.160 people certain things, maybe use code words, all of the 0:12:19.280 --> 0:12:22.440 very stereotypical things you see in TV. But then when 0:12:22.480 --> 0:12:26.120 they're scrolling through these messages Owen Hanson and other people 0:12:26.200 --> 0:12:29.959 later on, they're not using code words. They're saying I'm 0:12:30.000 --> 0:12:33.280 going to send the five thousand kilos of cocaine or whatever. 0:12:33.440 --> 0:12:36.640 Because they're so confident in this encryption technology. Well, what's 0:12:36.679 --> 0:12:38.360 the point of using code words. We can just be 0:12:38.760 --> 0:12:41.360 explicit and blunt about it and say I'm sending the 0:12:41.400 --> 0:12:43.719 heroin to this place. And as they were going through 0:12:43.760 --> 0:12:47.920 the messages. There were addresses of where where these drugs 0:12:47.920 --> 0:12:49.800 were being picked up, where they were being sent to, 0:12:49.880 --> 0:12:53.480 as well the names of contacts. It was like opening 0:12:53.559 --> 0:12:57.239 up an entire new window to criminality. 0:12:57.760 --> 0:13:01.880 So in twenty twenty five terms this twenty fifteen technology, 0:13:01.920 --> 0:13:05.160 where does that fall, that encryption technology? Where does what 0:13:05.240 --> 0:13:07.520 Owen Hansen was using. Where does that fall on our 0:13:07.600 --> 0:13:10.400 three levels? Is it closer to the government level these days? 0:13:10.520 --> 0:13:12.360 Or is it more the signal level. 0:13:12.600 --> 0:13:15.160 It's kind of in between two of them, in between 0:13:15.200 --> 0:13:17.280 the signal one and the sort of the government level, 0:13:17.320 --> 0:13:20.920 because yes, it's encrypted, so if it gets intercepted, you're 0:13:20.920 --> 0:13:22.840 not going to be able to read it. But where 0:13:23.240 --> 0:13:26.400 these companies selling these phones to organize criminals, they did 0:13:26.440 --> 0:13:30.000 take that extra step of removing the camera, removing the GPS, 0:13:30.080 --> 0:13:33.040 taking out the microphone as well, and you know, it's 0:13:33.120 --> 0:13:37.160 kind of debatable how beneficial those removals are. But your 0:13:37.280 --> 0:13:41.840 traffickers love it when these companies introduce bells and whistles, 0:13:41.880 --> 0:13:44.240 new gadgets, or they take features out, when really the 0:13:44.280 --> 0:13:47.120 most important thing is that it's sending encrypted text messages, 0:13:47.200 --> 0:13:50.479 but it sits somewhere in between because they're highly customized 0:13:50.640 --> 0:13:52.880 and they're really expensive as well. To get one of 0:13:52.920 --> 0:13:55.360 these phones, it's going to cost you thousands of dollars 0:13:55.679 --> 0:13:58.440 for a six or a twelve month subscription. This isn't 0:13:58.440 --> 0:14:01.320 something you just go into the T mobile store and buy. 0:14:01.960 --> 0:14:05.440 We go to Fison and his four three iPhones or whatever. 0:14:05.720 --> 0:14:09.240 It is a completely different business model. And the drug 0:14:09.240 --> 0:14:11.719 traffickers love is expensive as well, because well, if it 0:14:11.760 --> 0:14:14.160 cost me thousands of dollars, that's got to mean it's good. 0:14:14.200 --> 0:14:16.479 And I mean that literally. I've spoken to drug traffickers 0:14:16.720 --> 0:14:18.959 and the people who sell the phones, and price is 0:14:18.960 --> 0:14:21.600 a major factor of building that trust. 0:14:22.040 --> 0:14:23.840 So do you have to if we're just let's say 0:14:23.840 --> 0:14:26.280 we're just talking about Phantom Secure number one, is this 0:14:26.360 --> 0:14:29.080 an above board company in any way or do they 0:14:29.120 --> 0:14:32.800 strictly deal with criminal Back then criminal enterprise. 0:14:32.640 --> 0:14:36.440 They started legit and then when it became clear that 0:14:36.560 --> 0:14:40.840 criminals were the primary customer base, the CEO of the company, 0:14:40.880 --> 0:14:44.080 a guy called Vincent Ramos, he leaned into that essentially 0:14:44.200 --> 0:14:47.320 is very competitive space as well, and you have to 0:14:47.360 --> 0:14:51.720 think that unlike the normal phone market, where there's potentially 0:14:52.040 --> 0:14:54.680 an unlimited number of customers for AT and T to 0:14:54.680 --> 0:14:58.600 get or whoever there's a finite number of drug traffickers 0:14:58.600 --> 0:15:00.920 in the world, probably kind of want them to come 0:15:00.960 --> 0:15:04.040 over to your company. If criminals are using your phone, 0:15:04.320 --> 0:15:06.040 you start to lean into that, and that's what many 0:15:06.040 --> 0:15:06.920 of these companies did. 0:15:07.360 --> 0:15:10.160 When Owen Hanson was using this encrypted phone, did he 0:15:10.280 --> 0:15:13.600 have to message with somebody who also had a phone 0:15:13.680 --> 0:15:16.160 from phantom secure or was it? Could it be any 0:15:16.200 --> 0:15:18.000 kind of phone. What if he's calling somebody on AT 0:15:18.080 --> 0:15:21.320 and T who's not upon the latest criminal technology. 0:15:21.640 --> 0:15:25.440 Yeah, these operate generally as closed networks. So if you're 0:15:25.440 --> 0:15:28.680 a phantom secure you can only message another phantom secure phone. 0:15:28.760 --> 0:15:31.520 If you're on another phone from a different company called Sky, 0:15:31.640 --> 0:15:34.760 for example, you can only message Sky people. And that 0:15:34.840 --> 0:15:38.600 has sort of two reasons, the first being that presumably 0:15:38.640 --> 0:15:41.920 it's more secure. You know, if only the phantom phones 0:15:41.920 --> 0:15:45.480 are talking to each other, then maybe there's less chance 0:15:45.560 --> 0:15:48.760 of law enforcement infiltrating or in informant getting in or 0:15:48.800 --> 0:15:52.320 something like that. The other one is a pure business decision. 0:15:52.560 --> 0:15:55.320 It's like, well, if I'm phantom secure, I only want 0:15:55.360 --> 0:15:56.800 my customers to be able to talk to each other, 0:15:56.840 --> 0:15:58.520 because that means other people have to come to my 0:15:58.560 --> 0:16:01.640 ecosystem as well, kind of like Apple and its app store. 0:16:01.680 --> 0:16:04.480 You know, you can't really move apps between an Android 0:16:04.520 --> 0:16:06.800 phone and an Apple phone. It's the same sort of 0:16:06.800 --> 0:16:08.640 business decision for these guys as well. 0:16:09.040 --> 0:16:11.760 When the FBI talks to Owen Hanson, I'm assuming he 0:16:11.800 --> 0:16:14.520 doesn't illuminate anything about any of this. Is he at 0:16:14.560 --> 0:16:17.240 all helpful to the FBI once he has been convicted. 0:16:17.920 --> 0:16:21.680 Not At first He's put into a room and the 0:16:21.720 --> 0:16:24.880 authorities and Australian authorities which have been tracing him as well, 0:16:25.120 --> 0:16:28.680 they start telling Hanson all about the alleged crimes that 0:16:28.800 --> 0:16:31.640 he's done, and he very quickly shuts up and says, 0:16:32.200 --> 0:16:34.120 this is the moment when I'm going to bring in 0:16:34.360 --> 0:16:38.760 my lawyer. Later on. I think he does testify against 0:16:38.800 --> 0:16:42.000 other people in his organization, But of course his arrest 0:16:42.320 --> 0:16:44.960 is absolutely not the end, not just for the FBI 0:16:45.040 --> 0:16:46.800 but for his story as well, because then they start 0:16:46.800 --> 0:16:50.360 to round up more members of his criminal enterprise, because 0:16:50.400 --> 0:16:52.400 now they're in the phone which has all of their 0:16:52.480 --> 0:16:54.080 contact information as well. 0:16:54.320 --> 0:16:56.600 Oh my gosh, I wonder what his reaction was when 0:16:56.600 --> 0:16:58.720 he found out he just had never changed that password 0:16:58.760 --> 0:17:01.760 and didn't think it was necessary. In the FBI got 0:17:01.840 --> 0:17:03.640 in within you know, thirty seconds. 0:17:03.960 --> 0:17:06.760 Yeah. I mean I've spoken to Owen Hanson a couple 0:17:06.760 --> 0:17:10.399 of times. He didn't specifically talk about the password, but 0:17:10.440 --> 0:17:14.040 he did admit that to me. And I mean, it's 0:17:14.400 --> 0:17:17.160 a sloppy mistake for a drug trafficker to make. And again, 0:17:17.200 --> 0:17:19.840 I think that just shows how much confidence these people 0:17:20.320 --> 0:17:24.040 have in the technology, and technology can only go so far. 0:17:24.320 --> 0:17:27.840 You may have the fanciest quantum encryption in the world, 0:17:28.000 --> 0:17:32.120 just tons of fancy algorithms. What it doesn't matter if 0:17:32.119 --> 0:17:35.600 you make a mistake like that, like not changing the password. 0:17:39.000 --> 0:17:41.960 So the FBI is realizing that their traditional methods of 0:17:42.040 --> 0:17:45.439 monitoring these folks aren't working. What is their next step? 0:17:45.560 --> 0:17:48.480 Is it sort of taking you know, Hanson's contacts and 0:17:48.520 --> 0:17:51.040 looking through and then are they flipping these people? How 0:17:51.040 --> 0:17:53.480 do they know how many how many criminals are going 0:17:53.480 --> 0:17:55.360 to places like sky or Phantom Secure. 0:17:55.920 --> 0:17:59.760 Yeah, so they do flip people in and around Hanson's 0:17:59.880 --> 0:18:03.560 or organization, and they investigate them with sort of traditional 0:18:03.760 --> 0:18:09.639 law enforcement tactics, but a prosecutor inside the San Diego office, 0:18:10.040 --> 0:18:12.520 they start to have this really interesting idea, which is 0:18:12.560 --> 0:18:15.600 that well, we're looking at the messages inside this one phone, 0:18:16.000 --> 0:18:20.080 but presumably many other criminals are using Phantom Secure phones 0:18:20.240 --> 0:18:22.959 as well, and they get some intelligence from other agencies, 0:18:23.400 --> 0:18:25.960 the Canadians and the Australians, and they do start to 0:18:25.960 --> 0:18:29.280 build up a picture of oh, Phantom Secure is a 0:18:29.320 --> 0:18:33.320 serious player in this space with thousands and thousands of customers. 0:18:33.640 --> 0:18:35.840 If we're looking at the messages of this one phone 0:18:36.000 --> 0:18:39.000 because we got lucky with this guy's bad password, what 0:18:39.080 --> 0:18:41.760 would it be like to look at the messages of 0:18:41.880 --> 0:18:44.280 all of these customers. And that plants the seed of 0:18:44.320 --> 0:18:48.120 an idea, which is, like, we need to infiltrate one 0:18:48.160 --> 0:18:51.280 of these companies, and specifically they focus on Phantom Secure 0:18:51.560 --> 0:18:53.280 because that's the one that's right in front of them. 0:18:53.520 --> 0:18:57.720 Eventually, their plan is to build their own telecommunications company 0:18:57.760 --> 0:19:00.000 to draw these guys in, which I just think is 0:19:00.160 --> 0:19:03.560 so brilliant and I'm sure a daunting task for them, 0:19:03.720 --> 0:19:05.960 But they start with saying, we need to figure out 0:19:06.000 --> 0:19:08.560 how this company works before we replicate our own company. 0:19:08.600 --> 0:19:09.040 Is that right? 0:19:09.280 --> 0:19:13.280 Yeah, So they focus first on Phantom Secure. They investigate 0:19:13.440 --> 0:19:18.560 the CEO I mentioned, Vincent Ramos, and they do various 0:19:19.119 --> 0:19:22.399 sort of undercover exercises. The Canadians try to buy the 0:19:22.480 --> 0:19:26.879 phones while posing as drug traffickers, and Phantom Secure is like, sure, 0:19:27.640 --> 0:19:30.640 here you go. In another case, I think the Canadians 0:19:31.000 --> 0:19:34.679 also then ask Phantom to wipe one of their phones. 0:19:34.720 --> 0:19:36.879 And that's sort of another key feature of these devices, 0:19:36.920 --> 0:19:40.239 which is that for Apple iPhones, you have iCloud. You know, 0:19:40.480 --> 0:19:42.640 your phone gets stolen or you lose it, you log 0:19:42.680 --> 0:19:45.000 into iCloud and you wipe the device so nobody gets 0:19:45.000 --> 0:19:47.639 all of your personal details or your photos or whatever. 0:19:48.160 --> 0:19:51.239 Phantom Secure in these companies have that as well. But 0:19:51.359 --> 0:19:54.520 you go to the company and you say, my phone 0:19:54.680 --> 0:19:57.680 has landed in somebody else's hands, and you can say 0:19:57.680 --> 0:20:00.680 specifically law enforcement, and there's a bunch of evidence about 0:20:00.800 --> 0:20:03.679 cocaine trafficking on my phone. Can you wipe it? And 0:20:03.720 --> 0:20:06.720 they will do that. And the allegation, which was later 0:20:06.800 --> 0:20:10.600 proved in court, is that Phantom Secure knew it was 0:20:10.640 --> 0:20:14.119 obstructing justice by wiping these phones, which is again is 0:20:14.160 --> 0:20:17.480 different to Tim Cook and Apple. You know, Tim Cook 0:20:17.560 --> 0:20:22.080 is not knowingly wiping Apple iPhones of criminal evidence, but 0:20:22.160 --> 0:20:26.800 Phantom Secure absolutely was doing that. So the FBI, the Australians, 0:20:26.880 --> 0:20:29.760 and the Canadians, they get all of these little bits 0:20:29.760 --> 0:20:34.320 and bobs about Phantom Secure until crucially they trick Vincent 0:20:34.400 --> 0:20:37.679 Ramos in a Las Vegas hotel room. They're filming it 0:20:37.760 --> 0:20:42.160 with undercover agents posing as drug traffickers, who they say 0:20:42.200 --> 0:20:45.080 they're interested in buying some Phantom Secure phones, and they 0:20:45.119 --> 0:20:47.760 make it very clear that they're drug traffickers. You know, 0:20:47.760 --> 0:20:50.760 we're trying to move cocaine from South America to Europe. 0:20:50.960 --> 0:20:53.439 We want to use these phones as part of that expansion. 0:20:53.800 --> 0:20:57.520 And they even ask Vincent Ramos, what if we wanted 0:20:57.840 --> 0:21:00.720 to kill one of our associates who maybe steals money 0:21:00.720 --> 0:21:03.399 from us or something, could we use your phones to 0:21:03.480 --> 0:21:07.200 do that? And Vincent sort of dances around it until 0:21:07.359 --> 0:21:11.080 eventually admitting, Hey, you don't know me, but we made 0:21:11.080 --> 0:21:14.520 the phones for this, meaning drug trafficking. And that's the 0:21:14.560 --> 0:21:16.840 moment where he's basically sealed his fate. Even though it 0:21:16.880 --> 0:21:19.919 was like a very passing comment, he's just basically omitted 0:21:19.960 --> 0:21:23.359 to under cover officials that Phantom Secure is made or 0:21:23.400 --> 0:21:27.199 at least used for drug trafficking. So they let Vincent 0:21:27.240 --> 0:21:29.720 go for a bit while they're still investigating. They lure 0:21:29.800 --> 0:21:33.639 him back to Vegas, and this time the FBI is 0:21:33.640 --> 0:21:36.200 not undercover. They're all waiting for him in the hotel room. 0:21:36.960 --> 0:21:40.119 He comes in and the agents tell him, look, we 0:21:40.200 --> 0:21:42.840 know what you're doing, we know all about Phantom Secure. 0:21:43.200 --> 0:21:46.000 We are prepared to arrest you on the spot right now, 0:21:46.600 --> 0:21:49.199 or you do something for us, and that's put a 0:21:49.240 --> 0:21:52.480 backdoor into Phantom Secure so we can read all of 0:21:52.520 --> 0:21:57.320 your customer's messages. Again, it would be like reading Owen 0:21:57.359 --> 0:22:01.000 Hanson's messages, but not for one phone, for seven, eight, nine, 0:22:01.160 --> 0:22:05.240 ten thousand, and that would I can't stress how incredible 0:22:05.240 --> 0:22:09.040 that would be for the FBI. Vincent doesn't put the 0:22:09.040 --> 0:22:11.239 back door in. Some people I speak to say he 0:22:11.280 --> 0:22:14.320 couldn't do it. Others say that he wouldn't do it 0:22:14.359 --> 0:22:17.320 because he doesn't want to impact the privacy of his customers. 0:22:17.800 --> 0:22:20.399 I definitely think it's the former. He wasn't really a 0:22:20.440 --> 0:22:23.440 tech guy who was a business guy. But he eventually 0:22:23.440 --> 0:22:26.840 decides to cooperate somewhat with the authorities, and they spend 0:22:27.160 --> 0:22:29.840 three or four days in there, sleeping on the floor, 0:22:30.240 --> 0:22:34.119 getting takeout food, and the FBI and other agents are 0:22:34.119 --> 0:22:38.240 grilling Ramos about the company, about the industry, until Vincent decides, 0:22:38.760 --> 0:22:42.200 for some reason he gets cold feet and he leaves 0:22:42.440 --> 0:22:45.399 the hotel suite while the agents are sleeping. He tries 0:22:45.400 --> 0:22:49.440 to escape to the Canadian border, which is incredibly embarrassing 0:22:49.840 --> 0:22:53.040 for the FBI, where you have your prime criminal suspect 0:22:53.080 --> 0:22:55.200 and he basically slips out in the middle of the night. 0:22:55.640 --> 0:22:58.359 I won't spoil everything about how he's caught, but the 0:22:58.400 --> 0:23:03.359 authorities deploy every resource at their disposal to catch this guy, 0:23:03.720 --> 0:23:09.480 and they eventually do. And Andrew Young, the main prosecutor involved, 0:23:09.760 --> 0:23:12.959 who I spoke to many many times for this book, 0:23:13.280 --> 0:23:16.280 he said it was like getting to the Super Bowl 0:23:16.680 --> 0:23:19.920 and then losing. You finally track down this guy, you 0:23:20.160 --> 0:23:22.119 might be able to get a backdoor into the network, 0:23:22.520 --> 0:23:25.320 and then he does something stupid like runs away. Now 0:23:25.320 --> 0:23:27.200 we're back to square one. Now we don't have anything. 0:23:27.200 --> 0:23:29.040 We can just arrest the guy and shut down the company, 0:23:29.080 --> 0:23:30.879 but how are we even going to get our backdoor? 0:23:31.320 --> 0:23:35.000 The theme here is dumb silly mistakes. Obviously for a moment, 0:23:35.040 --> 0:23:38.280 Hanson's you know, not changing his password to the FBI, 0:23:38.359 --> 0:23:41.280 letting this guy slip away. When the FBI comes to 0:23:41.359 --> 0:23:44.480 him initially and says, hey, we're we're drug traffickers or 0:23:44.560 --> 0:23:47.680 anybody who comes to Phantom Secure and says, I want 0:23:47.680 --> 0:23:50.560 a phone. I'm a drug trafficker. Is there no criminal 0:23:50.640 --> 0:23:53.560 background check, as in, let's find out if you're really 0:23:53.600 --> 0:23:57.080 a criminal? Can somebody vouch for you? Situation happening with 0:23:57.119 --> 0:23:59.320 this company, I mean that would to me, would say, 0:23:59.720 --> 0:24:01.440 so I need Joe Shmo can come off the street 0:24:01.480 --> 0:24:02.720 and if you've got a couple of thousand dollars, you 0:24:02.720 --> 0:24:03.800 can buy one of our phones. 0:24:04.400 --> 0:24:08.600 Yes, And typically the companies do that. They do check 0:24:08.640 --> 0:24:11.119 out who their customers or their potential customers are, to 0:24:11.320 --> 0:24:13.840 know if they're legit, at least in the criminal world. 0:24:14.160 --> 0:24:17.520 It seems that the FBI and his partners had a 0:24:17.560 --> 0:24:20.920 pretty good backstory, Like it wasn't completely out of the blue. 0:24:21.119 --> 0:24:23.840 From what I've read through court documents and speaking to 0:24:23.880 --> 0:24:28.840 people involved, it was a pretty well developed undercover identity. 0:24:29.520 --> 0:24:32.600 You know what authorities call a backstop, and it has 0:24:32.720 --> 0:24:35.320 all of this context and history where this wasn't just 0:24:35.320 --> 0:24:40.600 invented entirely out of cloth. There's enough to convince somebody that, Okay, 0:24:40.680 --> 0:24:44.240 this person's a criminal, you know, and I can trust 0:24:44.240 --> 0:24:45.719 them potentially. 0:24:45.520 --> 0:24:48.040 So they get Vincent Ramos and you said that he 0:24:48.200 --> 0:24:51.640 does cooperate sort of, is that right? What happens after that. 0:24:51.960 --> 0:24:54.200 He cooperates someone and he says he's going to go 0:24:54.280 --> 0:24:56.960 to San Diego, and then of course that goes out 0:24:57.000 --> 0:25:00.200 of the window when he tries to escape, and then 0:25:00.200 --> 0:25:04.360 eventually it's just that, well, the game is over for him, 0:25:04.640 --> 0:25:08.560 you know, he tried to run away. He's now been recaptured. 0:25:09.080 --> 0:25:13.160 He's completely blown the authorities attempts of getting a backdoor 0:25:13.400 --> 0:25:17.200 into Phantom secure out of the water. But what does 0:25:17.280 --> 0:25:22.760 happen is that as news spreads of Vincent Ramos's arrest, 0:25:22.800 --> 0:25:25.159 and I actually learned of that before the FBI announced it. 0:25:25.200 --> 0:25:27.280 I had a source come to me instead that the 0:25:27.359 --> 0:25:30.679 FBI has arrest of Ramos, and I did an article 0:25:31.200 --> 0:25:34.919 around that time as well. What becomes clear is that 0:25:35.000 --> 0:25:36.919 it freaks out all of the other people who are 0:25:36.920 --> 0:25:40.760 selling in cryptophones in this industry, so much so that 0:25:40.840 --> 0:25:44.760 one of them comes forward, seeing the writing on the 0:25:44.800 --> 0:25:48.280 wall and realizes, I need to make a decision here. 0:25:48.640 --> 0:25:52.280 I either need to stay in the cryptophone industry and 0:25:52.359 --> 0:25:55.080 maybe Laura Enforcement is going to come after me as well, 0:25:55.640 --> 0:25:58.199 or how about I flip and maybe I approached the 0:25:58.240 --> 0:26:01.439 FBI with a truly amazing off. And that's how we 0:26:01.480 --> 0:26:03.679 start to get into the FBI running its own company. 0:26:04.040 --> 0:26:06.399 Okay, so who is this? Who's this person who's flipping 0:26:06.440 --> 0:26:08.159 and coming forward? Is this a Sky person? 0:26:08.600 --> 0:26:13.920 This is somebody called afgu Afgo. I'm going to use 0:26:13.960 --> 0:26:17.119 that moniker because you know, they're very much a threat 0:26:17.280 --> 0:26:20.440 to their life for cooperating with law enforcement. But they 0:26:20.480 --> 0:26:24.840 sold phantom secure phones. They sold phones for other company Sky. 0:26:25.359 --> 0:26:29.040 What they were doing was developing their own encryptive phone 0:26:29.040 --> 0:26:32.240 company almost to compete with Ramos and the other ones. 0:26:32.320 --> 0:26:35.800 And that was going to be called a non anom. 0:26:36.400 --> 0:26:40.280 And this person thinks, well, if the FBI is investigating 0:26:40.320 --> 0:26:42.919 these companies, I need to play the ace at my sleeve. 0:26:43.359 --> 0:26:46.159 And his lawyers contact the FBI and the prosecutors and 0:26:46.960 --> 0:26:50.880 they say, my client has this encryptophone company they've just started, 0:26:51.119 --> 0:26:53.440 called a non would you like to use it in 0:26:53.480 --> 0:26:56.440 your own investigations? Of course, not for free. There will 0:26:56.480 --> 0:26:59.119 be money involved, a relatively small amount of about one 0:26:59.200 --> 0:27:04.199 hundred thousand dollars. More importantly, you will not prosecute, or 0:27:04.240 --> 0:27:06.560 you will give a lighter sentence to my client for 0:27:06.720 --> 0:27:08.800 charges they may or may not face in the future. 0:27:09.080 --> 0:27:13.080 But this is an incredible deal for the FBI. Rather 0:27:13.119 --> 0:27:17.040 than investigating a company like Phantom Secure have to deal 0:27:17.080 --> 0:27:19.439 with all of the work they're trying to get a 0:27:19.440 --> 0:27:23.800 backdoor in. This opportunity basically falls into their lap, which 0:27:23.840 --> 0:27:26.639 is like, would you like this tech startup which is 0:27:26.680 --> 0:27:29.199 probably going to be trusted by criminals because it's in 0:27:29.240 --> 0:27:31.920 that world, is in that ecosystem, and you can put 0:27:31.960 --> 0:27:35.880 a backdoor in yourself. Rather than shutting money these companies down, 0:27:36.440 --> 0:27:39.080 they would become the phone of choice for criminals. 0:27:39.400 --> 0:27:42.040 And at this point you've got people scared who are 0:27:42.080 --> 0:27:45.439 running these companies anyway, right, so maybe their competition is 0:27:45.520 --> 0:27:49.440 even lighter than before because you know people are running 0:27:49.600 --> 0:27:52.359 so anam. I know it needs to still be developed, 0:27:52.400 --> 0:27:55.120 but has word gotten out that this is being developed 0:27:55.160 --> 0:27:57.480 or you're gonna have another option. We're still working through 0:27:57.480 --> 0:27:59.520 the kinks kind of thing. So there was no even 0:27:59.560 --> 0:28:02.000 real hour advertise it needed once it was ready to 0:28:02.000 --> 0:28:02.800 go by the FBI. 0:28:03.200 --> 0:28:06.160 It was still super early days, but there was absolutely 0:28:06.680 --> 0:28:10.440 a void or a vacuum in place. Because the FBI 0:28:10.480 --> 0:28:14.400 shuts down Phantom, all of the other companies are pretty spooked. 0:28:14.480 --> 0:28:16.359 You know, they're not closing down just yet, but it's 0:28:16.400 --> 0:28:21.240 pretty scary. But there is a vacuum, especially in Australia 0:28:21.359 --> 0:28:26.159 where Phantom Secure was particularly popular, and criminals need a 0:28:26.160 --> 0:28:29.199 phone obviously, and you can imagine how annoying it is 0:28:29.240 --> 0:28:31.640 for us when what sapp goes down or a message 0:28:31.680 --> 0:28:35.800 goes down. Imagine if you are a cocaine trafficker moving 0:28:36.400 --> 0:28:40.360 multiple tons of drugs week after week, you need to 0:28:40.400 --> 0:28:42.840 be online and if you don't have an encryptive phone 0:28:42.840 --> 0:28:44.800 for a week, you are going to lose a lot 0:28:44.840 --> 0:28:48.000 of money. So there is an urgent need and demand 0:28:48.040 --> 0:28:50.880 for people to find a new provider. But it does 0:28:50.920 --> 0:28:56.760 start exceptionally small. It's basically word of mouth at first. Afku, 0:28:56.920 --> 0:28:59.200 the creator of a non even gives out some of 0:28:59.200 --> 0:29:02.480 the phones for free just to get it in front 0:29:02.520 --> 0:29:05.560 of people, like here's the new phone, I'm trying. Please 0:29:05.560 --> 0:29:08.239 give it a go. And it's very very slow at 0:29:08.240 --> 0:29:13.000 the start, but eventually major gangs in Australia star getting 0:29:13.040 --> 0:29:16.680 onto it, biker gangs, members of the Italian Mafia, those 0:29:16.720 --> 0:29:20.120 sorts of people, and it's effective. It's a cool new phone, 0:29:20.160 --> 0:29:24.640 whereas Owen Hanson's BlackBerry was. I mean, we laugh because 0:29:24.640 --> 0:29:27.240 Blackberries were cool back in the day. They're not cool 0:29:27.520 --> 0:29:31.280 in this point in the timeline in twenty eighteen, twenty nineteen. 0:29:31.400 --> 0:29:33.560 You know, we all want Android now. We want to 0:29:33.560 --> 0:29:38.240 send encrypted photos, we want to send encrypted voicemails, videos, 0:29:38.280 --> 0:29:40.080 all of that sort of thing. And a Noon was 0:29:40.120 --> 0:29:42.720 promising that it was going to be the cool new 0:29:43.280 --> 0:29:45.400 sort of player on the block when it came to 0:29:45.520 --> 0:29:47.120 giving encryption to criminals. 0:29:47.520 --> 0:29:50.240 Let me ask a question. If they're moving forward, you know, 0:29:50.280 --> 0:29:54.200 the FBI is moving forward with this plan tentatively. They 0:29:54.200 --> 0:29:57.040 have all this information from Phantom Secure that they got 0:29:57.440 --> 0:30:00.880 during this time with Vincent Romo's. Do they move on 0:30:01.000 --> 0:30:03.760 any of those people, any of these messages that they've read, 0:30:03.880 --> 0:30:06.040 or do they hold off because they don't want to spook, 0:30:06.560 --> 0:30:08.680 you know, all of the potential customers they could have 0:30:08.800 --> 0:30:10.400 later on with this new company. 0:30:10.880 --> 0:30:14.960 They and especially Australian foresties do make some arrests, particularly 0:30:15.040 --> 0:30:19.000 of people who are helping sell the Phantom Secure phones. 0:30:19.560 --> 0:30:21.640 They can't just like let that go. And they also 0:30:21.640 --> 0:30:25.520 shut down servers, They seize websites and web domains used 0:30:25.520 --> 0:30:29.760 by Phantom Secure. So it is a large scale disruption effort, 0:30:30.120 --> 0:30:34.800 but absolutely the resources move pretty quickly over making no 0:30:35.360 --> 0:30:40.040 the new sexy, interesting phone that criminals are going to 0:30:40.040 --> 0:30:41.160 want to flock to. 0:30:41.560 --> 0:30:45.160 So as Afku the face of this company, how involved 0:30:45.320 --> 0:30:48.400 is he this criminal? The FBI is now saying, we're 0:30:48.440 --> 0:30:50.120 going to work with you to make this legitimate. 0:30:50.360 --> 0:30:53.920 Yeah, so Afku definitely knows people in the criminal underworld, 0:30:53.960 --> 0:30:56.080 and that's how it gets its start. It would be very, 0:30:56.160 --> 0:31:00.440 very difficult for a norm or really any encryptophone company 0:31:00.480 --> 0:31:03.640 in the criminal space to get any sort of headway 0:31:04.080 --> 0:31:07.240 if you don't have those criminal connections. And that's another 0:31:07.680 --> 0:31:11.600 crucial thing about trust is that if you're a cocaine 0:31:11.640 --> 0:31:14.400 trafficker and you buy an a cryptophone from somebody like 0:31:14.440 --> 0:31:18.560 AFGA or anyone in that space, there's a specific person 0:31:19.160 --> 0:31:22.560 you can go and blame if something goes wrong. If 0:31:22.600 --> 0:31:25.760 a criminal I don't know gets an iPhone and installs 0:31:25.840 --> 0:31:27.920 signal of it, they're not going to go and beat 0:31:27.960 --> 0:31:29.600 up Tim Cook. I mean they might do, but that 0:31:29.640 --> 0:31:32.000 would be absolutely insane obviously. 0:31:32.200 --> 0:31:32.440 Yeah. 0:31:32.480 --> 0:31:35.640 But when they buy a phone from somebody in an 0:31:35.720 --> 0:31:38.960 alley in Amsterdam or from a safe house in South America, 0:31:39.480 --> 0:31:42.200 there's a specific person you can go blame. You can 0:31:42.240 --> 0:31:45.600 go hurt, you can torture potentially, and that comes up 0:31:45.640 --> 0:31:48.640 in the book as well. So he is the face 0:31:48.960 --> 0:31:53.000 of a nom, but he starts spreading out the phones 0:31:53.000 --> 0:31:55.479 to people who then have more criminal connections, who can 0:31:55.520 --> 0:31:59.360 then directly sell them to the actual cocaine traffickers or 0:31:59.360 --> 0:32:01.320 the hit men or anybody else who wants to use 0:32:01.360 --> 0:32:04.320 the phone. It's basically a pyramid scheme where you have 0:32:04.520 --> 0:32:07.920 Afriga at the top, you have the sellers underneath, maybe 0:32:07.960 --> 0:32:11.560 even more sellers underneath them. Then you have the end users, 0:32:11.560 --> 0:32:14.960 the hit men, the traffickers, whoever. But in that pyramid scheme, 0:32:15.200 --> 0:32:18.360 there's almost a secret top layer, which is the FBI 0:32:18.600 --> 0:32:21.520 above the entire pyramid in the clouds, which is actually 0:32:21.520 --> 0:32:22.680 dictating the entire thing. 0:32:23.120 --> 0:32:25.680 Are all of the people who work for a noom 0:32:25.840 --> 0:32:28.400 like Afgu, I mean, are they all aware of what's 0:32:28.440 --> 0:32:29.520 happening and what they're doing. 0:32:30.080 --> 0:32:32.760 Afgu is the only one who knows at least is 0:32:32.800 --> 0:32:35.880 my understanding. And I've spoken to people who coded the 0:32:35.920 --> 0:32:39.960 actual phone, they developed the actual app, and these were 0:32:40.640 --> 0:32:44.800 ordinary people based around Asia and Southeast Asia. They had 0:32:44.800 --> 0:32:49.400 no idea they were building basically an FBI surveillance apparatus, 0:32:49.440 --> 0:32:51.520 and I know that might be a a little bit 0:32:51.520 --> 0:32:54.200 hard for people to believe, like, well, surely they must 0:32:54.240 --> 0:32:56.360 have figured it out. I don't know. They were getting 0:32:56.360 --> 0:32:59.320 one thousand bucks to make a chat app and they 0:32:59.400 --> 0:33:02.800 log on. One I spoke to was working from his 0:33:02.880 --> 0:33:05.400 bed with his MacBook Pro on his chest, just kind 0:33:05.400 --> 0:33:09.280 of like anybody else working remotely anywhere else around the world. 0:33:09.480 --> 0:33:14.240 It's just a paycheck. Only years later did they realize, oh, 0:33:14.520 --> 0:33:17.160 I just helped wiite up the world. It was a 0:33:17.200 --> 0:33:21.120 complete secret to of course the cocaine traffickers who are 0:33:21.200 --> 0:33:23.280 using the phones, it has to remain a secret from them, 0:33:23.520 --> 0:33:26.200 but even people inside the company itself as well. 0:33:26.520 --> 0:33:29.520 So we know the United States is the mastermind of this. 0:33:29.680 --> 0:33:33.160 Who else is involved? It's Australia and Canada and other countries. 0:33:33.160 --> 0:33:33.920 Who else is in this? 0:33:34.360 --> 0:33:37.040 Yeah, so it definitely changes over the years. The Europeans 0:33:37.080 --> 0:33:39.800 eventually become involved, but right at the start it's the 0:33:39.800 --> 0:33:44.280 Australians and specifically the Australian Federal Police AFP. And the 0:33:44.360 --> 0:33:46.680 reason for that is not just because these phones are 0:33:46.680 --> 0:33:49.280 so popular in Australia, because you can make a lot 0:33:49.320 --> 0:33:52.360 of money if you get drugs to that island. Drugs 0:33:52.400 --> 0:33:54.840 cost a hell of a lot more money inside Australia 0:33:54.880 --> 0:33:57.240 than they do in the UK or the Netherlands or 0:33:57.280 --> 0:34:00.160 the United States or whatever. But the FBI wanted the 0:34:00.160 --> 0:34:03.320 Australians to sort of test it out first, like they 0:34:03.320 --> 0:34:05.840 don't even know if this backdoor is going to work. Essentially, 0:34:05.880 --> 0:34:09.400 this is a really crazy idea that nobody inside the 0:34:09.440 --> 0:34:12.839 FBI or really any agency apart from potentially the CIA, 0:34:12.960 --> 0:34:16.640 has ever done before. So the Australians try it out, 0:34:16.760 --> 0:34:20.720 and very quickly they do realize, Wow, we're getting really 0:34:20.719 --> 0:34:24.240 good intelligence. We're getting really good messages from these criminals, 0:34:24.280 --> 0:34:25.960 and they can literally see them flash up on their 0:34:25.960 --> 0:34:29.280 computer screens in a part of their headquarters called the Bunker, 0:34:29.680 --> 0:34:33.200 and it's kept incredibly tight lipped. You know, only a 0:34:33.239 --> 0:34:37.399 few people know about this incredibly sensitive capability. But then 0:34:37.440 --> 0:34:40.800 when it starts to grow in Australia, it quickly becomes 0:34:40.800 --> 0:34:43.480 apparent that we're going to need to rope in more 0:34:43.520 --> 0:34:47.520 agencies just because of the globalized nature of organized crime. 0:34:47.760 --> 0:34:50.720 You have these traffickers in Australia who are asking AFGU 0:34:50.719 --> 0:34:52.960 and other people, well, can you start selling phones to 0:34:53.040 --> 0:34:56.240 my contacts in Europe to my contacts in South America, 0:34:56.600 --> 0:34:59.480 because of course drugs have to move. They're a physical 0:34:59.520 --> 0:35:02.360 good and it's going to be connected to the worldwide 0:35:02.560 --> 0:35:05.319 supply chain as well. So quickly as the phones go 0:35:05.400 --> 0:35:08.319 abroad and they go into Europe and South American other locations, 0:35:08.560 --> 0:35:11.280 the FBI has to bring in other law enforcement agencies 0:35:11.320 --> 0:35:11.680 as well. 0:35:12.120 --> 0:35:14.480 At its height, Do I remember this right that you said? 0:35:14.520 --> 0:35:18.960 It was they were looking into ten thousand different criminals 0:35:19.120 --> 0:35:22.479 that have joined this their company. Is that right? Really? 0:35:22.520 --> 0:35:23.400 Over how many years? 0:35:23.680 --> 0:35:28.480 Yeah? So the top number of phones sold was twelve thousand, 0:35:28.680 --> 0:35:31.520 and then at some point they had nine thousand online, 0:35:31.600 --> 0:35:35.040 all at the same time. And this stretch from twenty 0:35:35.080 --> 0:35:40.200 eighteen up to twenty twenty one. So for years and years, 0:35:40.640 --> 0:35:44.839 the FBI was reading these communications of all of these 0:35:44.880 --> 0:35:48.000 criminals all over the world. And I think just to 0:35:48.040 --> 0:35:50.720 stress sort of the safety and the danger to afgu 0:35:51.040 --> 0:35:53.480 as you know, and as your listeners will know, if 0:35:53.520 --> 0:35:57.839 you're an informant to a single criminal gang, your life 0:35:57.920 --> 0:36:00.799 might be a risk. You know, obviously depends on the 0:36:00.840 --> 0:36:05.359 crime involved. If you are the confidential human source who 0:36:05.400 --> 0:36:09.520 provided the phone company that the FBI then used to 0:36:09.520 --> 0:36:12.560 wipe up the world, which caught something like thousands of 0:36:12.560 --> 0:36:16.279 thousands of criminals and about three hundred and fifty distinct 0:36:16.760 --> 0:36:20.360 crime syndicates. You've just annoyed three hundred and three hundred 0:36:20.360 --> 0:36:23.279 and fifty different criminal groups. Every single one of those 0:36:23.360 --> 0:36:24.759 is probably going to want to kill you. 0:36:25.120 --> 0:36:27.560 Well, now I have some technical questions because you've brought 0:36:27.560 --> 0:36:29.799 that up. What I was thinking was, how do you 0:36:30.400 --> 0:36:33.759 move in these investigations? How does the FBI figure out 0:36:34.320 --> 0:36:38.799 at what pace what order that you would move, Because 0:36:38.960 --> 0:36:41.040 don't you think at some point they would all catch 0:36:41.080 --> 0:36:43.720 on and say, wait a second, The common denominator here 0:36:43.840 --> 0:36:46.719 is not the drug traffickers in Mexico or in Canada. 0:36:47.200 --> 0:36:50.279 It's this phone company that we all happen to belong to. 0:36:51.000 --> 0:36:54.560 Yeah. That is the constant tension throughout the book and 0:36:54.640 --> 0:36:58.360 throughout the FBI's investigation, is that we're getting all of 0:36:58.360 --> 0:37:02.680 this intelligence. It's incredible, but if we move too quickly 0:37:02.920 --> 0:37:06.600 and too aggressively, it's going to become obvious. There's the phones. 0:37:07.440 --> 0:37:10.520 And then they have the tension of working with maybe 0:37:10.560 --> 0:37:13.640 the Ecuadorian authorities or people in other countries as well, 0:37:13.800 --> 0:37:15.759 and they want to seize the drugs. They don't want 0:37:15.800 --> 0:37:19.720 cocaine flowing across their borders or whatever. So agencies would 0:37:19.719 --> 0:37:25.680 take decisions to sometimes interceptor shipment, sometimes raid a drug lab, 0:37:25.840 --> 0:37:27.279 but they would try to do it in such a 0:37:27.280 --> 0:37:30.000 way that they were so spread out that it would 0:37:30.000 --> 0:37:34.839 give the impression they were not connected whatsoever. Towards the end, 0:37:35.560 --> 0:37:38.760 some people did start get suspicious when there's these thousands 0:37:38.800 --> 0:37:40.920 of users all over the world and all of this 0:37:40.960 --> 0:37:44.520 stuff is being shut down. But for years nobody had 0:37:44.880 --> 0:37:48.680 any clue, and to the point where there's one particular 0:37:48.719 --> 0:37:52.360 drug trafficker in the book called Maximilian Rifkin. He is 0:37:52.640 --> 0:37:57.600 my favorite person I've ever covered. He is absolutely insane, crazy, 0:37:57.640 --> 0:38:00.439 and I had a very good time digging in to him. 0:38:00.800 --> 0:38:04.319 But he puts so much faith into a norm that 0:38:04.400 --> 0:38:08.120 he tells all of his underlings, don't use Sky, don't 0:38:08.200 --> 0:38:11.800 use these other companies all come to a norm because 0:38:11.840 --> 0:38:14.480 not only was he using the phones to traffic drugs, 0:38:14.719 --> 0:38:17.040 he was selling the phones as well, So he had 0:38:17.080 --> 0:38:21.360 this duel motivation of protecting my drug trafficking and making 0:38:21.400 --> 0:38:24.080 a lot of money by selling the phones as well. 0:38:24.480 --> 0:38:27.080 And he puts so much blind faith into it, and 0:38:27.120 --> 0:38:31.240 blind trust into these phones that it was his ultimate downfall, 0:38:31.360 --> 0:38:33.960 not just of him but basically everybody he worked with. 0:38:34.280 --> 0:38:36.279 So is he working directly for the company or is 0:38:36.280 --> 0:38:38.560 he like a scalper basically buying a lot of phones 0:38:38.600 --> 0:38:39.680 in then reselling them. 0:38:39.920 --> 0:38:42.520 Here's why I would call a major distributor where he's 0:38:42.560 --> 0:38:45.760 going to get the phones, he's going to resell them, 0:38:45.840 --> 0:38:47.880 and he's going to take a commission or a cut 0:38:48.000 --> 0:38:49.839 or try to upsell them and that sort of thing. 0:38:50.200 --> 0:38:53.760 But often what I found through reading hundreds of thousands 0:38:53.760 --> 0:38:55.920 of a non messages later that they managed to obtain 0:38:55.960 --> 0:38:58.560 from the police and sources and courts and all of 0:38:58.560 --> 0:39:00.799 that sort of thing. He would also give out the 0:39:00.800 --> 0:39:04.080 phones for free because there was basically a turf war 0:39:04.280 --> 0:39:07.680 between his company or a non incroachat and another one 0:39:07.920 --> 0:39:10.759 Sky that we mentioned, and they're all trying to fight 0:39:11.000 --> 0:39:13.440 for the same customers to the point where there's violence 0:39:13.600 --> 0:39:16.080 as well. There isn't just violence in the drug trafficking world, 0:39:16.320 --> 0:39:20.000 there's violence in the industry of selling the phones to 0:39:20.080 --> 0:39:24.120 organize crimes as well, shooting, stabbings, bombings as well. But 0:39:24.200 --> 0:39:26.719 he stood and others stood to make a lot of 0:39:26.800 --> 0:39:30.120 money if they could provide the phones to drug traffickers. 0:39:30.640 --> 0:39:33.600 Is there any kind of an ethical concern that they 0:39:33.680 --> 0:39:36.600 cannot keep up with all of these messages. They're not 0:39:36.600 --> 0:39:40.400 making all of these arrests. They are facilitating murders probably 0:39:40.480 --> 0:39:42.880 all over the world because they simply are not going 0:39:42.960 --> 0:39:44.120 to be able to go in with a big net 0:39:44.120 --> 0:39:46.279 and sweep all these people up. Yeah, I mean, I 0:39:46.320 --> 0:39:48.920 know they would have gotten phones somewhere, but still, is 0:39:48.920 --> 0:39:51.240 there any kind of did you hear anybody say that. 0:39:51.560 --> 0:39:54.600 One of the major concerns before the FBI got the 0:39:54.640 --> 0:39:57.759 approval to go ahead was that this looks a lot 0:39:58.000 --> 0:40:01.680 like Operation Fast and Furious, which is where US authorities 0:40:02.160 --> 0:40:05.880 allowed the flow of guns into Mexico. And the idea 0:40:06.000 --> 0:40:08.480 was that, well, we can follow the guns and then 0:40:08.520 --> 0:40:11.239 we can arrest the cartel members who are using them. 0:40:11.280 --> 0:40:15.120 That sort of thing that massively backfired, and those weapons 0:40:15.120 --> 0:40:17.319 were then used in the murder of at least you know, 0:40:17.440 --> 0:40:20.360 one border patrol agent and various other crimes as well. 0:40:20.719 --> 0:40:24.279 There the US authorities are basically allowed the cartels to 0:40:24.320 --> 0:40:26.400 get these weapons that were then used for horrible crimes 0:40:26.600 --> 0:40:31.000 and people inside San Diego, inside the authorities, they made 0:40:31.000 --> 0:40:35.440 that direct comparison and the counter which I find somewhat compelling, 0:40:35.480 --> 0:40:38.479 even though I understand the concern is that, look, these 0:40:38.520 --> 0:40:42.319 criminals are going to be using an encryptophone regardless, Like 0:40:43.280 --> 0:40:46.040 these are all cocaine traffickers. They all use these phones. 0:40:46.239 --> 0:40:50.640 This is standard operating procedure for drug traffickers nowadays. Wouldn't 0:40:50.680 --> 0:40:52.920 it be better if they were using a phone that 0:40:52.960 --> 0:40:56.440 we did have visibility into? And apparently that argument was 0:40:56.440 --> 0:41:00.600 convincing enough for the FBI to get approved and for 0:41:00.640 --> 0:41:03.600 the prosecutors in San Diego to go ahead as well. 0:41:03.800 --> 0:41:06.920 That being said, just when there's that tension with well, 0:41:06.920 --> 0:41:09.400 should we raid this drug lab? Should we seize all 0:41:09.440 --> 0:41:12.719 of these narcotics, there's a lot of violence happening on 0:41:12.760 --> 0:41:17.560 an arm as well. There's threats of assassination, torture as well, 0:41:17.760 --> 0:41:20.040 and I document in the book there's one case where 0:41:20.480 --> 0:41:23.840 a young man is unfortunately murdered in Sweden due to 0:41:23.880 --> 0:41:27.440 assassins who used the FBI's own app. They sourced the gun, 0:41:27.920 --> 0:41:31.240 they followed the target, they lured him to a specific location, 0:41:31.719 --> 0:41:34.080 and then they murdered him. The FBI had all of 0:41:34.120 --> 0:41:36.440 that information, but they didn't give it to the Swedish 0:41:36.440 --> 0:41:37.760 authorities in time. 0:41:38.080 --> 0:41:41.400 So are they able to monitor all of these messages 0:41:41.440 --> 0:41:43.360 that are coming through? How is that even possible? 0:41:43.960 --> 0:41:47.680 It's really really difficult. First of all, the messages come 0:41:47.719 --> 0:41:52.240 to the FBI every three days, I think every Monday, Wednesday, Friday. 0:41:52.440 --> 0:41:54.560 And the way it was prescribed to me by the 0:41:54.560 --> 0:41:57.040 San Diego FBI was that they'd have a very long 0:41:57.080 --> 0:41:59.560 week of going through all of these messages, translating them, 0:41:59.600 --> 0:42:03.680 sometimes with automated technology or linguists as well disseminating it 0:42:03.719 --> 0:42:07.680 to international partners. The weekend happens Monday, there's another batch 0:42:07.719 --> 0:42:10.600 of messages, and now we have to go again. And 0:42:11.239 --> 0:42:16.320 it absolutely became unsustainable. Towards the end, they're gathering something 0:42:16.400 --> 0:42:19.759 like twenty twenty one million messages, to the point where 0:42:19.760 --> 0:42:23.120 they're getting a million messages a day, and then every 0:42:23.160 --> 0:42:25.799 single one of those messages has to be read, has 0:42:25.840 --> 0:42:28.240 to be digested, because you don't know if you missed 0:42:28.239 --> 0:42:31.800 this one single message, well maybe somebody's gonna get shot 0:42:32.080 --> 0:42:34.759 or kidnapped or tortured or whatever. And they couldn't keep 0:42:34.840 --> 0:42:38.000 up with it any longer. It's almost like the intelligence 0:42:38.400 --> 0:42:40.720 and the capability was too good. 0:42:41.000 --> 0:42:45.120 Essentially before this is you know, revealed and arm and 0:42:45.160 --> 0:42:47.440 the origins of it. You have these people, you know, 0:42:47.440 --> 0:42:50.480 going on trial. So let's say it's a criminal syndicate 0:42:50.520 --> 0:42:52.960 that they broke up somewhere in America. They go on trial, 0:42:53.080 --> 0:42:56.400 and these criminals do their defense attorneys know how this 0:42:56.480 --> 0:42:59.520 information came to them? Is that disclosed at all? I 0:42:59.560 --> 0:43:01.920 would think you would have to write, you have to. 0:43:01.880 --> 0:43:06.680 Eventually, but especially and especially what the Australian authorities did 0:43:06.960 --> 0:43:10.080 was that they would arrest people, they would intercept drug shipments, 0:43:10.480 --> 0:43:14.160 and then they would basically publish Another reason why. One 0:43:14.200 --> 0:43:17.880 concrete example is that some drugs were hidden inside a 0:43:17.920 --> 0:43:20.919 shipment of welding machines being sent to Australia. The cops 0:43:21.000 --> 0:43:22.480 knew where they were because they're reading all of the 0:43:22.520 --> 0:43:25.680 messages on the encrypted app when they arrest somebody, and 0:43:25.719 --> 0:43:27.720 then the issue at press release a couple days later, 0:43:28.080 --> 0:43:31.440 the Australians just say, oh, well, we did an X 0:43:31.560 --> 0:43:34.000 ray and then that's how we found the drugs, which 0:43:34.040 --> 0:43:38.360 is technically true, but before that they had this gold 0:43:38.440 --> 0:43:40.600 mine of intelligence that told them to do the X 0:43:40.719 --> 0:43:43.439 ray in the first place. Now, of course, years after 0:43:43.480 --> 0:43:45.919 the fact and many of these cases are still going 0:43:45.960 --> 0:43:51.600 through the courts, especially in Australia, where Australian authorities remain 0:43:52.280 --> 0:43:54.960 very very quiet about it because I mean they're still 0:43:55.000 --> 0:43:58.799 legal proceedings and they can't discuss it basically whatsoever. But 0:43:59.000 --> 0:44:01.319 now all of that information, all of that context has 0:44:01.320 --> 0:44:03.400 come out. But at the time it just looks like 0:44:03.440 --> 0:44:06.879 the authority's got incredibly lucky. But there's only so much 0:44:06.920 --> 0:44:08.800 of that you can do. You can't get lucky again 0:44:08.880 --> 0:44:11.720 and again and again and again before people start asking questions. 0:44:12.040 --> 0:44:15.799 And is Afgu just unshakable in this role that he's in. 0:44:16.080 --> 0:44:18.960 Does the FBI ever doubt him in any way as 0:44:19.000 --> 0:44:21.640 being someone who is legitimately working with them. 0:44:22.080 --> 0:44:25.520 I haven't seen any indication that they start to doubt 0:44:25.560 --> 0:44:28.359 this person. And I think the reason for that would 0:44:28.400 --> 0:44:31.920 be just like the back door works, you know. And 0:44:32.000 --> 0:44:36.480 of course, if AFGU or anyone else is using those devices, 0:44:36.520 --> 0:44:39.000 the FBI is going to see those messages as well. 0:44:39.160 --> 0:44:42.520 So if Afgu decided to go do something silly and 0:44:42.520 --> 0:44:45.000 start sending information to criminals, at least on a non 0:44:45.520 --> 0:44:47.319 the FBI is going to see that as well. And 0:44:47.360 --> 0:44:49.879 I mean, it would just be a very unfortunate thing 0:44:49.920 --> 0:44:53.040 to do to agree to cooperate in a sort of backstab. 0:44:53.239 --> 0:44:56.839 I saw no indication of that. If anything, I think 0:44:56.840 --> 0:45:02.719 the FBI were ecstatic with the capability that this provided. 0:45:02.840 --> 0:45:04.759 You know, I even heard that some of the geekier 0:45:05.080 --> 0:45:09.160 employees inside the FBI and the AFP, they marveled at 0:45:09.200 --> 0:45:12.480 this backdoor in this technology. And I'm sure they're thinking 0:45:12.480 --> 0:45:14.719 of other ways to use it in the future as well. 0:45:14.760 --> 0:45:17.640 Now that they've done it and they've built it, maybe 0:45:17.680 --> 0:45:20.560 there's another way to build it again, at least potentially. 0:45:20.840 --> 0:45:22.759 Well, this was so recent, So how long did this 0:45:22.840 --> 0:45:25.360 go on? It started in twenty eighteen. Tell me what 0:45:25.440 --> 0:45:28.320 the different stages were. Twenty eighteen the beginning, they're building 0:45:28.400 --> 0:45:30.799 the company, they're marketing it and all of that. 0:45:31.040 --> 0:45:34.560 Yeah, twenty eighteen, it starts very quiet in Australia, word 0:45:34.560 --> 0:45:38.040 of mouth. By twenty nineteen it's moved to Europe. They 0:45:38.040 --> 0:45:41.440 start to bring in some really big drug traffickers who 0:45:41.480 --> 0:45:44.919 sort of act as brand ambassadors for the phone. The 0:45:45.040 --> 0:45:48.160 US authorities actually call them influencers. Instead of you know, 0:45:48.800 --> 0:45:51.840 selling shampoo or whatever on Instagram, it's selling phones to 0:45:51.880 --> 0:45:55.160 the cartel and that catapults it. And then when you're 0:45:55.200 --> 0:45:59.120 at twenty twenty and twenty twenty one. It's basically one 0:45:59.160 --> 0:46:01.960 of the main players in this space, and it basically 0:46:01.960 --> 0:46:06.200 becomes the same size as Phantom Secure, if not bigger 0:46:06.320 --> 0:46:10.960 in some instances, and the FBI basically became better at 0:46:11.120 --> 0:46:14.879 running a tech startup for criminals than the criminals were 0:46:15.320 --> 0:46:19.359 doing it themselves. I mean, it becomes absolutely successful, and 0:46:20.400 --> 0:46:22.960 on one hand, it's a long time to run that 0:46:23.000 --> 0:46:26.279 company over years. On the other that's a very short 0:46:26.320 --> 0:46:29.200 amount of time for a non to become as big 0:46:29.239 --> 0:46:32.920 as it was. You know, it really ramped up exponentially, 0:46:33.160 --> 0:46:35.480 and I really try to draw this parallel between this 0:46:35.560 --> 0:46:38.480 tech startup for criminals and Silicon Valley. Not that those 0:46:38.520 --> 0:46:42.759 speaking for criminals, but you will have this phenomenon in 0:46:43.040 --> 0:46:46.840 tech and business called hockey stick growth where it starts 0:46:46.920 --> 0:46:49.319 rail ray stagnant, then all of a sudden it just 0:46:49.320 --> 0:46:52.040 shoots up. And that's basically what happened with a numb. 0:46:52.280 --> 0:46:55.799 How many people total at its height knew about this 0:46:56.120 --> 0:46:58.480 around the world. I cannot believe it didn't get out 0:46:58.920 --> 0:46:59.600 at its height. 0:47:00.200 --> 0:47:04.400 Was dozens of people knew about this at the start. 0:47:04.480 --> 0:47:07.920 It's basically the organized crime squad inside San Diego FBI, 0:47:08.120 --> 0:47:10.600 which to be clear, is a small office. I mean 0:47:10.680 --> 0:47:13.319 I've been there. I walked through the rooms where they 0:47:13.400 --> 0:47:16.719 read the a non messages. They're not the fanciest or 0:47:16.760 --> 0:47:19.920 the biggest FBI field office. You know, they're not LA, 0:47:20.360 --> 0:47:23.919 they're not DC obviously, or Southern District of New York. 0:47:23.960 --> 0:47:26.879 They're very much an underdog. And I think that mentality 0:47:27.280 --> 0:47:30.120 really permeated throughout the FBI of like, well, we're going 0:47:30.200 --> 0:47:32.719 to show them that we can actually do this. And 0:47:32.760 --> 0:47:35.720 that was you know, six seven, eight people at first, 0:47:35.760 --> 0:47:38.680 and then they're superiors. And then as it starts to 0:47:38.719 --> 0:47:42.320 spread to different agencies, the Germans, the Swedes, the Dutch 0:47:42.360 --> 0:47:45.239 as well, most of which I spoke to, it was 0:47:45.280 --> 0:47:49.439 a handful of people in each agency. And I think 0:47:49.440 --> 0:47:53.520 it's a genuine miracle that this did not leak. Sort 0:47:53.560 --> 0:47:56.400 of in parallel, as I go to go into in 0:47:56.440 --> 0:47:59.680 the book, there were these other investigations into Sky, into 0:47:59.800 --> 0:48:03.960 end Chat by the Europeans. They did leak. Criminals did 0:48:04.040 --> 0:48:06.840 learn that those companies were being investigated, and we know 0:48:06.960 --> 0:48:08.799 that because they were talking about it on a non 0:48:09.160 --> 0:48:12.080 they were saying, don't use Sky, don't use Ancho Chat, 0:48:12.120 --> 0:48:16.160 they're compromised. Whoever was saying that clearly had an insider 0:48:16.520 --> 0:48:19.600 somewhere in those agencies, but they didn't know that a 0:48:19.680 --> 0:48:23.120 non was compromised. So they were still in a trap, 0:48:23.239 --> 0:48:24.200 but they didn't realize it. 0:48:24.400 --> 0:48:26.319 So run those numbers again for me. What were the 0:48:26.400 --> 0:48:30.040 total number of convictions, investigations, all of that stuff, So 0:48:30.080 --> 0:48:33.480 we can be impressed with this, with this enterprise. 0:48:33.719 --> 0:48:39.000 Yeah, nine thousand users, more than a thousand arrests, tons 0:48:39.160 --> 0:48:42.680 of drugs, hundreds of weapons, one hundred and fifty threats 0:48:42.719 --> 0:48:45.759 to life mitigated. And now I don't know whether that 0:48:45.840 --> 0:48:48.320 necessarily means, you know, somebody would stopped being killed or 0:48:48.320 --> 0:48:53.920 anything like that, but the FBI least intervened. Cocaine, heroin, methamphetamine, 0:48:54.040 --> 0:48:58.280 and fetamine, all of these different drugs taken. But really 0:48:58.600 --> 0:49:02.960 more than that was all of the smuggling techniques which 0:49:02.960 --> 0:49:05.640 were detailed in the messages. They're now burned because now 0:49:05.640 --> 0:49:08.440 the FBI knows that, oh, they do this thing to 0:49:08.520 --> 0:49:12.080 move this drug. They somehow put it into the lever 0:49:12.200 --> 0:49:15.360 of clothes or something like that in this amazing chemical 0:49:15.400 --> 0:49:17.720 reaction to then smuggle the drugs. Well, now the cops 0:49:17.719 --> 0:49:19.239 all know about that because they've read about it in 0:49:19.280 --> 0:49:23.000 the messages. And most importantly, the overriding success of this 0:49:23.320 --> 0:49:27.080 operation was that criminals don't trust these phones anymore. And 0:49:27.120 --> 0:49:31.279 that was an explicit goal of the FBI, which is like, look, 0:49:31.320 --> 0:49:34.480 it's great to see drugs, it's great to arrest people, obviously, 0:49:34.920 --> 0:49:38.080 but the underlying goal was like they wanted to shatter 0:49:38.200 --> 0:49:42.399 trust in the encryptophone industry in the hope that these 0:49:42.440 --> 0:49:45.560 criminals were moved back to other forms of communication that 0:49:45.640 --> 0:49:48.479 we were talking about earlier, maybe an ordinary phone. Maybe 0:49:48.480 --> 0:49:50.560 they'll meet each other face to face, and the FBI 0:49:50.600 --> 0:49:53.520 can use more human intelligence there. I mean, they were 0:49:53.560 --> 0:49:56.920 absolutely successful in seeding paranoia. I know that from speaking 0:49:56.920 --> 0:49:58.920 to drug traffickers and the people who sell those phones. 0:49:59.320 --> 0:50:02.239 Did the FB do I have any surprising discoveries. I 0:50:02.280 --> 0:50:04.160 don't know what that would be, like a connection to 0:50:04.200 --> 0:50:07.080 a government official in another country with a drug trafficker 0:50:07.080 --> 0:50:09.400 that they had never known about. I was just wondering 0:50:09.400 --> 0:50:11.479 if anybody got trapped in this web that they didn't 0:50:11.520 --> 0:50:12.440 expect to be there. 0:50:13.160 --> 0:50:17.160 So they were so paranoid about leaks the FBI that 0:50:17.239 --> 0:50:22.239 they did not share this secret with all countries. The 0:50:22.280 --> 0:50:25.759 FBI were quite skittish and talking to me about this, 0:50:25.920 --> 0:50:29.799 but they implied that, you know, countries in Eastern Europe, Serbia, 0:50:30.480 --> 0:50:34.040 those sorts of places which absolutely have public corruption problems. 0:50:34.239 --> 0:50:36.799 And then we've seen that through the non data later 0:50:36.840 --> 0:50:40.399 on and other investigations, that officials in those countries do 0:50:40.520 --> 0:50:46.160 collaborate directly with criminal entities. And that was absolutely the 0:50:46.239 --> 0:50:49.720 paranoia of well, if we share this with XYZ country 0:50:49.920 --> 0:50:54.160 too early, it could completely derail the operation as well. 0:50:54.280 --> 0:50:57.120 And Andrew Young, again the main prosecutor on the case, 0:50:57.680 --> 0:51:00.120 he was shocked by the amount of public corruption and 0:51:00.160 --> 0:51:03.239 going across these platforms, and I think that's something a norm, 0:51:03.239 --> 0:51:06.640 and these other investigations showed is that law enforcement often 0:51:06.640 --> 0:51:10.000 catch drug traffickers, they often catch money launders, they never 0:51:10.040 --> 0:51:13.319 get the people in public office or the insiders. Are 0:51:13.320 --> 0:51:16.880 a law enforcement agency, they just don't see that activity. 0:51:17.200 --> 0:51:20.040 And then that's what they saw on these encryptive footes. 0:51:20.440 --> 0:51:23.440 So we're talking about this, you've named the company. Clearly 0:51:23.520 --> 0:51:25.440 it has come to an end and this program has 0:51:25.480 --> 0:51:27.799 been shut down. How does that look and when did 0:51:27.840 --> 0:51:28.400 that happen? 0:51:28.680 --> 0:51:32.200 Yes, so in early twenty twenty one, it becomes apparent 0:51:32.239 --> 0:51:34.840 that the FBI cannot do this anymore. They're getting a 0:51:34.880 --> 0:51:39.040 million messages a day. They simply cannot keep tempo with 0:51:39.120 --> 0:51:42.799 the amount of intelligence coming in. So they decide on 0:51:42.840 --> 0:51:46.359 a date in early June twenty twenty one to bring 0:51:46.360 --> 0:51:49.279 an end to the operation. The European authorities don't want this. 0:51:49.760 --> 0:51:53.319 They say, this is an incredible intelligence gold mine. Let's 0:51:53.360 --> 0:51:55.640 just keep running it and we can keep arresting people quietly. 0:51:55.719 --> 0:51:57.960 All of that sort of thing. That's just not possible. 0:51:58.120 --> 0:52:00.440 This had to end at some point, and again the 0:52:00.520 --> 0:52:03.359 FBI wanted it to end to some point because they 0:52:03.400 --> 0:52:06.880 wanted to undermine criminals trust in these encryptophone companies. And 0:52:06.920 --> 0:52:09.640 they can't do that unless they pull the rug underneath 0:52:09.640 --> 0:52:12.320 and come clean on it was us the entire time 0:52:12.520 --> 0:52:15.440 reading an arm. They have to do that very theatrical 0:52:15.760 --> 0:52:19.600 sort of reveal. So it starts with a series of 0:52:19.680 --> 0:52:23.520 raids and arrests in Australia in the early morning, and 0:52:23.520 --> 0:52:26.840 then as the sun moves they start doing arrests in Europe, 0:52:27.080 --> 0:52:30.359 and it's all very very dramatic. There's a big room 0:52:30.440 --> 0:52:34.920 inside EUROPEOL, which is the European Union's law enforcement coordination body, 0:52:35.400 --> 0:52:39.520 and you have German officers talking to Dutch officers, talking 0:52:39.520 --> 0:52:42.680 to Swedish officers, and they're all coordinating. I have a 0:52:42.719 --> 0:52:45.040 warrant for this guy. He's crossed over the border into 0:52:45.080 --> 0:52:47.480 your country. Can you pick him up? They're doing all 0:52:47.480 --> 0:52:50.360 that in real time, just like the criminals are presumably 0:52:50.400 --> 0:52:53.040 as well, and they're rounding up hundreds upon hundreds of 0:52:53.120 --> 0:52:56.200 people in this one single day. It's the single largest 0:52:56.239 --> 0:53:01.160 law enforcement action ever. Something like nine thousand police officers 0:53:01.200 --> 0:53:04.120 acted in some capacity on that day, I mean a 0:53:04.160 --> 0:53:08.759 small army essentially of officers. Until eventually the sun moves 0:53:08.800 --> 0:53:12.640 to San Diego and the DOJ holds a press conference 0:53:12.680 --> 0:53:14.880 where they come clean and they say we were running 0:53:14.880 --> 0:53:17.880 a NORM the entire time. I mean, I was blown away. 0:53:18.480 --> 0:53:20.840 I found out the same time as everybody else. I 0:53:21.040 --> 0:53:24.800 was speechless and stunned that, even after I've covered the 0:53:24.880 --> 0:53:28.440 encryptophone industry for years, nearly ten years at this point, 0:53:28.960 --> 0:53:31.040 I didn't think the FBI would go that far to 0:53:31.160 --> 0:53:33.480 run their own and crypto company. And then of course 0:53:33.520 --> 0:53:36.880 I start writing about it, and I'm pinging my sources 0:53:36.880 --> 0:53:38.840 and asking them, did you know about a NORM? And 0:53:38.880 --> 0:53:41.879 it turns out many of my sources did know because 0:53:41.920 --> 0:53:44.080 they were selling the phones for the company. They just 0:53:44.120 --> 0:53:45.920 didn't want to tell me as a journalist because they 0:53:45.920 --> 0:53:47.400 thought they had a good They thought they had a 0:53:47.440 --> 0:53:49.080 good gig going, they thought they were making a lot 0:53:49.080 --> 0:53:52.280 of money, and then they got caught in the biggest 0:53:52.840 --> 0:53:54.760 trap ever in law enforcement history. 0:53:54.960 --> 0:53:58.800 What about AFGU doesn't this just put him in mortal danger? 0:53:59.239 --> 0:54:01.439 Yeah? Absolutely, And I mean I don't know, of course, 0:54:01.560 --> 0:54:06.600 specifically where this person is, but it's something they're going 0:54:06.680 --> 0:54:08.200 to have to be very very careful for the rest 0:54:08.239 --> 0:54:11.600 of their life. There was actually some potential dangers to 0:54:11.640 --> 0:54:15.600 them recently in that, in a cruel twist, the DOJ 0:54:16.280 --> 0:54:20.440 didn't just run this company, it then criminally charged the 0:54:20.480 --> 0:54:22.960 people who sold the phones, even though they were doing 0:54:23.000 --> 0:54:25.879 the FBI's dirty work for them, because technically you're selling 0:54:25.920 --> 0:54:28.920 these to criminals, were gonna arrest you as well. Very recently, 0:54:28.960 --> 0:54:31.080 some of these people were about to go to trial 0:54:31.320 --> 0:54:33.920 in San Diego and as part of that after you 0:54:34.080 --> 0:54:36.440 was going to have to testify, they were going to 0:54:36.520 --> 0:54:38.160 have to be in court, they would have to show 0:54:38.200 --> 0:54:40.200 their face, they were going to have to talk about 0:54:40.239 --> 0:54:43.279 how they created the company. And maybe this was just 0:54:43.360 --> 0:54:47.000 my naivety more as a technology journalist than an old 0:54:47.000 --> 0:54:50.160 school crime journalist. But that was staggering to me. This 0:54:50.239 --> 0:54:52.279 person's life is going to be in serious danger and 0:54:52.280 --> 0:54:54.640 you're going to have him in court speaking. I was 0:54:54.640 --> 0:54:56.440 blown away by that. But what it turned out in 0:54:56.480 --> 0:54:58.800 the end was that all of these people took guilty please, 0:54:58.920 --> 0:55:01.560 so that hadn't happened. But there are going to be 0:55:01.600 --> 0:55:04.080 more cases coming through the courts and the coming months 0:55:04.080 --> 0:55:08.440 and even years. So it's not over for that person. 0:55:08.800 --> 0:55:11.279 It's not over for the FBI, and it's not over 0:55:11.320 --> 0:55:14.680 for the Australians or the other foreign law enforcement agencies 0:55:14.680 --> 0:55:17.880 as well. They still have investigations which they are starting 0:55:18.400 --> 0:55:19.840 or continuing with this data. 0:55:20.360 --> 0:55:24.160 So ultimately, what is the lesson learned here? I'm the 0:55:24.280 --> 0:55:26.759 FBI is on the lookout for what these guys are 0:55:26.800 --> 0:55:28.759 going to next. They're not just going to give up 0:55:28.760 --> 0:55:30.520 and they're not going to start using landlines. 0:55:31.000 --> 0:55:33.480 I think the lesson here is the FBI is willing 0:55:33.520 --> 0:55:39.719 to go to extraordinary lengths to insert itself into criminal infrastructure, 0:55:39.880 --> 0:55:43.080 and that's running a phone company for criminals. They've even 0:55:43.200 --> 0:55:46.200 launched their own cryptocurrency since and they use that to 0:55:46.719 --> 0:55:49.320 sort of arrest people who are doing pump and dump schemes. 0:55:49.520 --> 0:55:51.879 There's actually an ARSK I'm working on right now which 0:55:51.920 --> 0:55:55.280 isn't published yet, but it's about how the FBI secretly 0:55:55.360 --> 0:55:59.040 ran a money laundering ring for nearly a year to 0:55:59.160 --> 0:56:03.239 move criminals so then they could identify the criminal customers 0:56:03.320 --> 0:56:06.400 as well. I think a NOM was a warning shot 0:56:06.880 --> 0:56:09.320 not just of how resourceful the FBI is when it 0:56:09.360 --> 0:56:13.560 comes to getting those criminals, but also encryption is such 0:56:13.600 --> 0:56:17.600 an issue for police and for law enforcement agencies that 0:56:17.680 --> 0:56:20.759 they're willing to spend what I think it's tens of 0:56:20.760 --> 0:56:23.880 millions of dollars on this operation to get messages that 0:56:23.880 --> 0:56:25.799 the otherwise would not be able to do. 0:56:26.200 --> 0:56:29.000 To me, this reminds me of the police officer sitting, 0:56:29.120 --> 0:56:32.600 you know, at the keyboard pretending to be a young girl, 0:56:32.719 --> 0:56:36.560 you know, approaching men on the internet. This is saving 0:56:37.000 --> 0:56:38.960 you know, the people having to go out undercover and 0:56:39.640 --> 0:56:42.000 you know, in bed with these criminal syndicates. I mean, 0:56:42.040 --> 0:56:44.279 is that another thought here? As you really are, you're 0:56:44.400 --> 0:56:47.439 able to cover so much just from a computer, rather 0:56:47.480 --> 0:56:50.399 than putting agents lives at risks by trying to get 0:56:50.400 --> 0:56:51.920 them into all of these places. 0:56:52.239 --> 0:56:56.000 I mean it would have been completely impossible to arrest 0:56:56.040 --> 0:56:58.879 all of the people the authorities did through a norm 0:56:59.120 --> 0:57:01.680 if they were doing it, for lack of a better term, 0:57:01.880 --> 0:57:05.480 manually or using more old school techniques to get a 0:57:05.520 --> 0:57:08.799 wire tap onto three hundred, three hundred and fifty different 0:57:08.840 --> 0:57:11.480 criminal syndicates, maybe get the informant in there. Like, it's 0:57:11.480 --> 0:57:13.960 completely unfathomable. You wouldn't be able to do that. What 0:57:14.080 --> 0:57:17.960 the FBI did here, they basically did global law enforcement 0:57:18.360 --> 0:57:22.680 at scale in one operation. And again I keep HARKing 0:57:22.720 --> 0:57:24.520 back to the idea of tech companies, and that was 0:57:24.520 --> 0:57:26.160 a very fun thing for me in the book when 0:57:26.200 --> 0:57:30.440 I'm my guilty pleasure is reading about corporate fraud like 0:57:30.600 --> 0:57:33.640 Farrnhose and Facebook, and they kind of married that into here, 0:57:33.960 --> 0:57:35.960 because at the end of the day, this is like 0:57:36.000 --> 0:57:38.600 a scam tech company it just happens to be is 0:57:38.680 --> 0:57:40.880 run by the FBI, and they catching criminals. They were 0:57:40.920 --> 0:57:44.760 able to enforce the law on a scale that's never 0:57:44.760 --> 0:57:46.640 been seen before, and I don't know if you'll actually 0:57:46.960 --> 0:57:48.040 ever be seen again. 0:57:48.320 --> 0:57:51.520 Well, simply a citizen spectator of all of this and 0:57:51.560 --> 0:57:54.120 a fan of your book, I have to say it 0:57:54.160 --> 0:57:57.560 gives me more confidence in the FBI. You know, you 0:57:57.600 --> 0:58:01.440 don't know what's happening. You've no idea, we don't know 0:58:01.960 --> 0:58:05.040 anything about how much they're actually trying to protect, you know, 0:58:05.120 --> 0:58:08.720 our country. And so when I read things like this, 0:58:08.880 --> 0:58:11.560 and you know, these undercover and these investigations, and you 0:58:11.600 --> 0:58:13.480 have all of these people coming forward and talking to you, 0:58:13.920 --> 0:58:16.400 I just think, well, thank god. I know that it's 0:58:16.400 --> 0:58:19.680 not perfect, but at least we know that they really 0:58:19.720 --> 0:58:23.520 are trying to pull off these big operations to protect people. 0:58:24.000 --> 0:58:27.600 Yeah, and I think people involved are very proud of that. 0:58:27.720 --> 0:58:32.400 They're very happy with the results. They're very happy with 0:58:32.880 --> 0:58:34.959 how they went about it, I think most of all. 0:58:35.040 --> 0:58:37.439 And I've spoken to many people who were in the book, 0:58:37.480 --> 0:58:39.960 and I've spoken to them since in the months and 0:58:40.080 --> 0:58:45.360 years after. They still talk about the lasting relationships between 0:58:45.400 --> 0:58:48.840 the FBI and the foreign law enforcement agencies. And you know, 0:58:48.920 --> 0:58:52.360 a lot of international collaboration happens. I cover a lot 0:58:52.400 --> 0:58:55.960 of different investigations where that's the case. This was different. 0:58:56.160 --> 0:58:59.680 These people became friends, They end up becoming drinking buddies, 0:58:59.680 --> 0:59:03.040 going to the pub after you know, they've successfully intercepted 0:59:03.080 --> 0:59:06.200 this drug shipment or whatever, and what they heard again 0:59:06.240 --> 0:59:09.720 and again and again was that this operation may not 0:59:09.840 --> 0:59:13.640 have been successful if it wasn't for those personal relationships. 0:59:13.680 --> 0:59:15.720 And specifically there are two agents at the head of it, 0:59:16.320 --> 0:59:20.000 Nicholas Chevron and Stephanie Stevens, and they were FBI agents 0:59:20.200 --> 0:59:23.080 who basically ran a noom essentially, and they built the 0:59:23.120 --> 0:59:28.040 personal relationships with the Swedish authorities, the Dutch authorities, the Australians, 0:59:28.400 --> 0:59:32.800 And if you don't have that informal but strong bond 0:59:32.960 --> 0:59:37.560 between the agencies, it's very hard again to trust we're 0:59:37.560 --> 0:59:39.040 going to give you. We're going to tell you about 0:59:39.040 --> 0:59:42.440 this secret. Hey, we're secretly running a phone company for criminals. 0:59:42.600 --> 0:59:45.400 You don't just tell any person or any law enforcement 0:59:45.440 --> 0:59:47.360 agency that. You need to know that you can trust 0:59:47.360 --> 0:59:49.760 this person and the personal relationships. I think we're a 0:59:49.760 --> 0:59:50.480 massive part of that. 1:00:01.960 --> 1:00:04.880 If you love historical true crime stories, check out the 1:00:04.920 --> 1:00:07.800 audio versions of my books The Ghost Club, All That 1:00:07.920 --> 1:00:11.120 Is Wicked and American Sherlock and Don't Forget There are 1:00:11.240 --> 1:00:15.000 twelve seasons of my historical true crime podcast Tenfold More 1:00:15.000 --> 1:00:18.680 Wicked right here in this podcast feed, scroll back and 1:00:18.720 --> 1:00:21.480 give them a listen if you haven't already. This has 1:00:21.520 --> 1:00:26.000 been an exactly Right Production. Our senior producer is Alexis M. Morosi. 1:00:26.360 --> 1:00:30.840 Our associate producer is Christina Chamberlain. This episode was mixed 1:00:30.880 --> 1:00:34.760 by John Bradley. Curtis Heath is our composer. Artwork by 1:00:34.880 --> 1:00:39.280 Nick Toga. Executive produced by Georgia Hardstark, Karen Kilgarriff, and 1:00:39.400 --> 1:00:43.520 Danielle Kramer. Listen to Wicked Words on the iHeartRadio app, 1:00:43.680 --> 1:00:47.360 Apple Podcasts, or wherever you get your podcasts. Follow Wicked 1:00:47.400 --> 1:00:51.640 Words on Instagram at tenfold more Wicked, and on Facebook 1:00:51.680 --> 1:00:53.280 at wicked Words Pod 1:01:04.400 --> 1:01:04.600 Yeah