Decryption of messaging app provides valuable insight into criminal activities in the Western Balkans and beyond.

Encryption is now a fairly standard feature of messaging apps. Apps used daily by millions of people to chat to each other provide a degree of privacy. Some messaging apps advertise a type of end-to-end encryption that claims to be impenetrable,¹ which makes them desirable for criminals and difficult for the police to access.

Sky ECC was a secure messaging app developed by Canadian company Sky Global that advertised itself as the ‘most secure messaging platform you can buy’.² Messages were encrypted and automatically deleted after 30 seconds. If a phone was not reachable by the network, the message was kept for up to 48 hours before being deleted. If a user entered a ‘panic’ password, the device deleted its contents.³ These features proved popular with people with something to hide – such as criminals – especially after a similar network called EncroChat was taken down by police in spring 2020.⁴

After a series of raids in early 2021, Sky ECC was shut down. However, before the app was stopped, in March 2021, Belgian, Dutch and French police cracked Sky ECC’s encrypted messaging service, enabling them to intercept 80 million messages.⁵ This gave the police valuable information about the activities of criminal groups, including those in the Western Balkans. According to the Minister of Interior of Serbia, around 30% of the 70 000 phones using the Sky app were in the hands of criminals from the Balkans.⁶ It is thought that some politicians, prosecutors, judges and police officers from the region were also using the app.

By cracking the messaging service, police were able to monitor the activities of criminal groups and collect information on over a hundred planned large-scale criminal operations.⁷ As the Brussels Times reported, Belgian crime lords were using ‘the world’s most secure messaging app’ for their illicit dealings in everything from drug trafficking to torture and murder, and the port of Antwerp was their playground.⁸ Even after Sky ECC was taken down, investigators continue to trawl through the information and make arrests. In Belgium alone, as of March 2022, information extracted from the deciphered messages had provided evidence for 118 existing cases, led to the opening of 276 new investigations and the identification of 888 suspects. The investigators also seized more than 90 tonnes of drugs with a street value of €4.5 billion, as well as cash and goods worth almost €60 million.⁹

Revelations in the Western Balkans

The takedown of Sky ECC has also had repercussions in the Western Balkans. For example, in Bosnia and Herzegovina, there were reportedly over 2 500 subscribers.¹⁰ Information gained from decrypted messages is providing valuable data about criminal groups in the country, their transnational networks and, in some cases, their links to criminal justice officials.¹¹

In December 2021, 19 people were arrested in the Republic of Srpska for smuggling drugs and weapons as part of operation Storage 2, led by the State Investigation and Protection Agency and the Republic’s Ministry of Interior.¹² Intercepted messages revealed an organized criminal group suspected of having smuggled drugs and weapons from Albania and Montenegro to Bosnia and Herzegovina, and then on to EU countries such as Croatia, Slovenia, Hungary and Germany.¹³

A seizure of drugs facilitated by the decryption of Sky ECC.

Photo: Ministry of Interior Affairs Republic of Srpska

In another operation in February 2022, an adviser to the former Minister of Security of Bosnia and Herzegovina, Bojan Cvijetić, was arrested for alleged links to an organized criminal group that was trafficking cocaine from Latin America.¹⁴ This was followed by another operation in April 2022 that led to the arrest of 18 people,¹⁵ including judicial officials and members of the Zemun clan, a criminal group from Serbia.¹⁶

In July 2022, police arrested alleged members of an organized criminal group in Sarajevo and Neum, a town by the Adriatic coast.¹⁷ The Prosecution of Bosnia and Herzegovina claims that the group used the Sky app in order to illegally procure and sell cannabis, cocaine, speed and heroin in Albania, Bosnia and Herzegovina, Montenegro, Serbia, Turkey, Croatia and other EU countries.¹⁸ Similarly, information from the Sky app uncovered members of a criminal group from Bosanska Gradiška that was trafficking drugs and weapons from Albania and Montenegro to Bosnia and Herzegovina and Croatia, and onward into western Europe.¹⁹ In late July 2022, a member of Bosnia’s border police unit in Trebinje was accused of using the Sky app to help criminals smuggle drugs across the border.²⁰

The volume of Sky ECC users in Bosnia and Herzegovina suggests that more revelations are likely to come. ‘No Republic of Srpska police chief or other senior [Minister of Interior] official will be spared if it is proven that they cooperated with criminals and committed crimes through these encrypted applications’, said Dragan Lukač, Minister of Interior of the Republik of Srpska.²¹

The Sky ECC decryption had major repercussions in Montenegro. The former president of the country’s Supreme Court, Vesna Medenica, was arrested for abuse of office after transcripts were published of her son saying she would protect his illegal dealings in cocaine and contraband cigarettes, according to media reports.²² So far, more than 12 people are suspected of being part of a criminal group allegedly involved in smuggling and giving and receiving bribes.²³

In Serbia, decryption cast a new light on two of the country’s leading crime figures, Veljko Belivuk and Darko Šarić. In February 2021, gruesome photos showing body parts were widely shared on the messaging app. It is thought that they were from victims of a criminal group led by Belivuk, who is suspected of drug trafficking, murder and possession of illegal weapons.²⁴ Messages also uncovered criminals who were selling weapons to Belivuk’s group.²⁵

Interception of messages also helped police to better understand the modus operandi of criminal groups like that of Darko Šarić, who has been on trial since 2014 and was re-arrested in Belgrade in April 2022. He is among the highest-level criminals exposed by the decryption. According to the media, the Sky app was used to coordinate his group’s smuggling of cocaine from Ecuador to Europe. Messages revealed how a distributor in Latin America recorded the loading of cocaine into a container to show what the packages looked like when they were loaded, how many there were and what kind of stamp they were given. The videos were sent to the receiver in Europe as a way of providing proof of shipment and to help determine if the goods had been manipulated.²⁶

The revelations and accusations continue. Serbia was recently rocked by a new scandal when the former State Secretary of the Ministry of Interior, Dijana Hrkalović, who is on trial for influence peddling, accused Defence Minister Nebojša Stefanović of collaborating with criminals and of using the Sky app.²⁷ Stefanović denies the allegations.²⁸

Sky is the limit

Information gathered from decrypting the Sky ECC messaging service has been a treasure trove for law enforcement and more revelations are sure to come. According to Europol, unlocking the encryption of Sky ECC has provided valuable insight into criminal activities across the EU and beyond, and will assist in expanding investigations and prosecuting serious and cross-border organized crime for the coming months, possibly years.²⁹ In the Western Balkans, this could include more arrests and damning revelations about links between criminals and public officials.

The fate of Sky ECC shows the extent to which criminals have become reliant on encrypted messaging services to communicate, plan operations and evade surveillance, and the difficulties law enforcement agencies face in cracking these platforms and extracting data that could provide evidence against organized criminal groups. However, the takedown of EncroChat and Sky may have shaken the confidence of criminals and their collaborators in the secrecy of encrypted communication. It should also provide law enforcement – including in the Western Balkans – with valuable lessons on how to make effective use of technology, collect digital evidence and navigate the challenges of data protection, as well as how to work effectively with the private companies providing messaging services.

Notes