An international law enforcement task force has shut down Ghost, an encrypted communications app that was used by criminals to coordinate their activities.
Europol, which led the task force, announced the takedown today. The Australian Federal Police disclosed shortly thereafter that it had arrested the alleged developer and administrator of Ghost. Authorities have also taken dozens of other people into custody in connection with the operation.
Prosecutors charge that Ghost’s alleged administrator shipped the app with modified smartphones he sold for 2,350 Australian dollars apiece. Besides a handset, that price included a six-month subscription to Ghost and technical support. The suspect didn’t sell the smartphones directly to criminals but rather distributed them through a network of resellers.
The modified smartphones included a raft of data deletion features. One tool allowed criminals to quickly wipe evidence from a Ghost-equipped handset by entering a “duress password”. Another feature made it possible to delete the contents of a device remotely.
Ghost’s alleged administrator is believed to have developed the app around 2017. Australian authorities learned of the app’s existence not long thereafter. However, they weren’t aware that Ghost’s alleged administrator fell under their jurisdiction until 2021, when they were alerted to that fact by French authorities.
Besides Australia and France, the task force that shut down the app also included the U.S., Canada, Iceland, Ireland, Italy, the Netherlands and Sweden. The joint effort began in 2022 and involved hundreds of law enforcement officials.
With technical assistance from French authorities, the task force managed to decrypt some of the correspondence that Ghost processed. The Australian Federal Police then proceeded to breach the app and modify the updates that the administrator periodically released to Ghost installations. The modified updates allowed officials to gain access to criminals’ devices and the evidence they contained.
According to the Australian Broadcasting Corporation, the process through which police hacked the app was a “world first.”
After gaining access to Ghost, officials obtained 125,000 messages and 120 video calls made by cybercriminals since March. That evidence led to more than 50 arrests in Australia and other countries. Officials also seized weapons, drugs and illicit funds.
“More Australian and international arrests are expected over the coming days,” the Australian Federal Police said in a statement.
Ghost is the latest in a series of crime-focused encrypted communications apps to have been shut down by officials. In 2020, European police agencies gained access to a service called EncroChat and obtained more than 115 million conversations tied to criminal activities. Law enforcement officials shut down several similar apps in the subsequent years.