Dismantling encrypted criminal EncroChat communications leads to over 6 500 arrests and close to EUR 900 million seized

 The dismantling of the encrypted communications tool EncroChat, widely used by organised crime groups (OCGs), has so far led to 6 558 arrests worldwide. 197 of those arrested were High Value Targets. This result is detailed in the first review of EncroChat, which was presented today by the French and Dutch judicial and law enforcement authorities in Lille.

The successful takedown of EncroChat followed the efforts of a joint investigation team (JIT) set up  by both countries in 2020, supported by Eurojust and Europol. Since then, close to EUR 900 million in criminal funds have been seized or frozen.

The dismantling of EncroChat in 2020 sent shockwaves across OCGs in Europe and beyond. It helped to prevent violent attacks, attempted murders, corruption and large-scale drug transports, as well as obtain large-scale information on organised crime.  

OCGs worldwide illegally used the encryption tool EncroChat for criminal purposes. Since the dismantling, investigators managed to intercept, share and analyse over 115 million criminal conversations, by an estimated number of over 60 000 users. User hotspots were prevalent in source and destination countries for the trade in illicit drugs, as well in money laundering centres.

The information obtained by the French and Dutch authorities was shared with their counterparts in EU Member States and third countries, at their request. Based on accumulated figures from all authorities involved, this led to the following results, three years after the encryption was broken by law enforcement:

6 558 suspects arrested, amongst whom 197 High Value Targets  

7 134 years of imprisonment of convicted criminals up to now

EUR 739.7 million in cash seized

EUR 154.1 million frozen in assets or bank accounts

30.5 million pills of chemical drugs seized

103.5 tonnes of cocaine seized

163.4 tonnes of cannabis seized

3.3 tonnes of heroin seized

971 vehicles seized

271 estates or homes seized

923 weapons seized, as well as 21 750 rounds of ammunition and 68 explosives

83 boats and 40 planes seized

Investigations into the alleged criminal conduct of the company operating EncroChat were restarted by the French Gendarmerie Nationale in 2017, after discovering that the phones were regularly found during operations against OCGs. Subsequent investigations established that the company behind the tool was operating via servers in France. Eventually, it was possible to place a technical device to go beyond the encryption technique and obtain access to users’ correspondence.

A case was opened at Eurojust in 2019 by the French authorities. In the first instance, data was shared with the Netherlands, which led to the setting up of the JIT in April 2020. Since then, information on criminal activities was shared with national authorities within and outside the EU, at their request. In view of ongoing investigations, Eurojust and Europol cannot disclose a full list of authorities involved.

Eurojust not only helped to set up and support the JIT, but also coordinated the cooperation between all authorities involved. Hundreds of requests for mutual legal assistance to other authorities were handled via the Agency.  

Europol has been supporting the case since 2018. A large, dedicated team of experts at Europol analysed over 115 million messages and data it received from the JIT partners. Europol cross-checked and analysed the data, combining it with information available in its information systems, and provided close to 700 actionable intelligence packages to countries worldwide. 

To provide this extensive support, an Operational Taskforce, known as ‘OTF EMMA’ was set up at Europol’s headquarters. This OTF brought together investigators and experts from Europol, Member States and third countries under one roof to jointly work on the Encrochat data to investigate the world’s most dangerous criminals. Europol has since been supporting the spin-off investigations initiated across the world. 

Background on EncroChat and encrypted communications

EncroChat phones were presented as guaranteeing perfect anonymity, discretion and no traceability to users. It also had functions intended to ensure the automatic deletion of messages and a specific PIN code to delete all data on the device. This would allow users to quickly erase compromising messages, for example at the time of arrest by the police. 

In addition, the device could be erased from a distance by the reseller/helpdesk. EncroChat sold cryptotelephones for around EUR 1 000 each, on an international scale. It also offered subscriptions with worldwide coverage, at a cost of 1 500 EUR for a six-month period, with 24/7 support.

The illegal use of encrypted communications continues to receive major attention from judicial and law enforcement agencies across the EU. OCGs communicating via encryption were dealt another blow in March 2021, following the dismantling of the SkyECC tool. Both Eurojust and Europol remain at the disposal of national authorities in case further support is required regarding encrypted communications by criminals.