US claims seller of encrypted phones violated racketeering and drug laws

A US grand jury has indicted the CEO of a Canadian company that sells encrypted phones, alleging that he and an associate violated racketeering and drug laws. On Friday, the federal grand jury “returned an indictment against the Chief Executive Officer and an associate of the Canada-based firm Sky Global on charges that they knowingly and intentionally participated in a criminal enterprise that facilitated the transnational importation and distribution of narcotics through the sale and service of encrypted communications devices,” the Department of Justice said in a press release.

Sky Global CEO Jean-Francois Eap and Thomas Herdman, a former distributor of Sky Global devices, were charged with a conspiracy to violate the Racketeer Influenced and Corrupt Organizations Act (RICO), a law designed to punish organized crime. They were also charged with a conspiracy to distribute illegal drugs and aiding and abetting. The racketeering and drug counts each carry maximum penalties of life in prison, the DOJ said. The US is seeking criminal convictions and forfeiture of “at least $100,000,000” worth of assets.

The indictment is available in this Motherboard article.

“Sky Global’s devices are specifically designed to prevent law enforcement from actively monitoring the communications between members of transnational criminal organizations involved in drug trafficking and money laundering,” the DOJ said. “As part of its services, Sky Global guarantees that messages stored on its devices can and will be remotely deleted by the company if the device is seized by law enforcement or otherwise compromised.”

The company “installs sophisticated encryption software in iPhone, Google Pixel, Blackberry, and Nokia handsets,” allowing users to “communicate with each other in a closed network, and Sky Global routes these communications through encrypted servers located in Canada and France,” the DOJ said.

CEO defends fight against surveillance

Eap intends to fight the charges, he said in a statement posted on Sky Global’s website yesterday:

Sky Global’s technology… was not created to prevent the police from monitoring criminal organizations; it exists to prevent anyone from monitoring and spying on the global community. The indictment against me personally in the United States is an example of the police and the government trying to vilify anyone who takes a stance against unwarranted surveillance. It seems that it is simply not enough that you have not done anything illegal. There is no question that I have been targeted, as Sky Global has been targeted, only because we build tools to protect the fundamental right to privacy. The unfounded allegations of involvement in criminal activity by me and our company are entirely false.

That statement was available on Sky Global’s website earlier today. But the website now has a message saying, “This domain has been seized by the Federal Bureau of Investigation in accordance with a seizure warrant.”

We contacted the Electronic Frontier Foundation today about this case and about the legality of selling encrypted devices. EFF Senior Staff Attorney Andrew Crocker responded, “Providing an encrypted communications platform to the public is not and should not be illegal, regardless of whether users of the platform engage in illegal activity. In this case, the defendant is accused of knowingly aiding criminal enterprises, which is a separate matter.”

US and Canada cooperated

The indictment was made in US District Court for the Southern District of California. While Sky Global is based in Canada, the indictment said the alleged criminal activity occurred “within the Southern District of California and elsewhere.”

“The international operation to seize Sky Global’s infrastructure involved cooperation and efforts by law enforcement authorities in the United States and Canada,” the DOJ said. “In addition, on March 10, 2021, Europol announced that judicial and law enforcement authorities in Belgium, France, and the Netherlands had wiretapped Sky Global’s servers and monitored hundreds of millions of messages by Sky Global’s users. The European investigation resulted in hundreds of arrests, the seizure of thousands of kilograms of cocaine and methamphetamine, hundreds of firearms, and millions of Euros.”

Eap and Hardman are both citizens of Canada and residents of Vancouver. Warrants were issued for their arrests on Friday.

The case is similar to one involving Phantom Secure CEO Vincent Ramos. In October 2018, the DOJ announced a plea deal in which “Ramos admitted that he and his co-conspirators facilitated the distribution of cocaine, heroin, and methamphetamine to locations around the world including in the United States, Australia, Mexico, Canada, Thailand and Europe by supplying narcotics traffickers with Phantom Secure encrypted communications devices designed to thwart law enforcement.” Ramos was sentenced to nine years in prison and ordered to forfeit $80 million.

Sky Global sold 70,000 modified devices

“There are at least 70,000 Sky Global devices in use worldwide, including in the United States,” the indictment on Friday said. Having operated since 2010, Sky Global “generated hundreds of millions of dollars in profit by facilitating the criminal activity of transnational criminal organizations and protecting these organizations from law enforcement.”

Sky Global replaces key components of commercially available phones to prevent surveillance by law enforcement, the indictment said:

Whereas the standard iPhone, Google Pixel, Blackberry, or handset is sold to the public with the capability for voice communication, GPS navigation, camera, Internet access, and the Messenger services, when Sky Global receives the devices, their technical team removes the internal hardware/software responsible for the GPS, camera, Internet, and voice communications. Sky Global then installs sophisticated encryption software and routes the data through encrypted servers located in Canada and France.

Sky Global charged subscription fees of “approximately $1,200-$2,000 USD per six month period,” the indictment said. Sky Global “used digital currencies, including Bitcoin, to facilitate illegal transactions on the website, to protect the membership’s anonymity, and to facilitate the laundering of the membership’s ill-gotten gains,” the indictment also said.

After the Phantom Secure case, “Sky Global instituted an ‘ask nothing/do nothing’ approach toward its clients,” the DOJ said. “This policy allowed for Sky Global to claim plausible deniability from the activities of their clients that they knew or had reason to know participated in illegal activities, including international drug trafficking.”

https://arstechnica.com/?p=1749746