Murder by text: How police hacked an organised crime group chat

Telegraph

3 days ago

Your modern-day top-tier criminal is far from the Great Train Robber figure of yesteryear. Nowadays, they're tattoo-festooned gym bunnies with year-round tans boasting about their bodies, their wealth and nefarious deeds in their online networks, where status is everything.
But, as the four-part Channel 4 series Operation Dark Phone: Murder by Text, which began last night, reveals, for some of them, this vanity was to be their undoing.
The documentary chronicles how collaboration between international authorities, led in the UK by the National Crime Agency (NCA), cracked an encrypted criminal messaging network that brought some of Britain's most wanted to justice.
An encrypted chat network called EncroChat was where illegal business was brazenly being done. And though the NCA – which is responsible for the fight against serious and organised crime in Britain – were aware of it, it was proving impossible to infiltrate.
But in January 2020, they finally got a breakthrough. A hack had been developed in France, whereby a software update – actually spyware – would be sent to all phones on the platform giving agencies unprecedented access to organised crime gangs' secret communications. So was born Operation Venetic. But the NCA only had 15 days to prepare before the hack was initiated.
'It literally was 15 days of complete madness, and then a period of holding our breath,' says Marni Roberts, 55, who was the senior intelligence operations manager.
Logistically, it was a nightmare, recalls Roberts: 'We were liaising with Police Scotland, Northern Ireland, the MoD. We had the Prison Service, HMRC, Border Force and the Met and we were basically dealing with all of those and setting strictures that would allow us and them to use this material.
'But ultimately, we were the ones who were going to be responsible for it and effectively drive the activity. It was about understanding the process. Looking back, we do wonder how we managed it.'
They were all set to go when Covid hit, and the world went into lockdown. However, that didn't – and couldn't – apply to the NCA at this crucial juncture.
'It wasn't something that you could really do at home,' says Wayne Johns, 50, currently the head of child sexual abuse investigations for the NCA, but at the time was senior investigating officer for Operation Venetic, with whom he still works to support ongoing prosecutions. 'Across the whole of the law enforcement system, there were thousands of officers who didn't really see lockdown.'
The button was pressed, and they waited for the messages to arrive. And once they did, they were astonished by what they were seeing: Arms and drug deals, orders for extreme violence – all in abundance. In the first six weeks, they detected more than 150 threats to life; in a normal year, the NCA would uncover about 100.
Roberts said, 'We had a triaging system where we could pick out any words that we understood within law enforcement that indicated violence or threat, or firearms.
'In the first instance, I was like a child in a sweet shop. You'd start to read it and you'd be like, 'Oh my God, this is fantastic'. Then the next one would come and that would be even better and so on. It was unbelievable and overwhelming. It was hard to walk away as we didn't want to miss anything; like Fomo [fear of missing out] on steroids.'
Johns, who began his career with Nottinghamshire Police before moving on to the National Crime Squad, the forerunner of the NCA, agrees. 'We'd say, it was like walking into a dark room and turning the light on. [We were accessing] crime groups nationally and internationally, [but] we came to understand we were dealing with a mixed bag of criminals.
'Some were well-known, but had dropped off the radar. And then there was a sizeable group who had missed all the old-school ways to earn their spurs, and had just gone straight onto this technology, which had enabled them to access a much higher level of criminality.
'You could see straight away, it was really massive and we had to get it right because if we were going to prosecute these people in due course, we needed to be able to present the strongest possible case that was going to stand the scrutiny of the judicial system. So that added to the pressure.'
The next hurdle was identifying the people behind anonymous handles like Key-Hole, Ball-Sniffer and Tubbytern. However, because they were using an encrypted service, the criminals thought they were untouchable and were not shy about posting instructions for hit lists, pictures of their wares and, in some cases, images of themselves.
'They were standing there with their blocks of gear, or in front of their cars with their registration numbers on show, or physically holding their guns,' says Roberts, who started her law enforcement career in customs at Manchester Airport. 'They were taking photographs of each other. We couldn't believe how much they trusted the system.'
One, who went by the name of Long-Life was revealed – through a selfie – to be Jamie Rothwell, a career-criminal selling drugs and guns, living in Spain and orchestrating what amounted to a gang war back in the UK.
'We'd never heard of him,' says Johns. 'But quite quickly we were starting to see from the material he shared the scale and impact he was having in the North West [of England] in terms of the violence that he was directing. He was quite clearly a massive issue for the police in that area, and somebody who thought he was out of reach. It was one of the cases where you saw the absolute best of UK law enforcement working together.'
Rothwell was eventually extradited and prosecuted for gun and drugs offences – although his trial was adjourned after he was stabbed last August, while being held at Strangeways prison.
No stone was left unturned in finding out the identity and location of those planning crimes via EncroChat, with details taken from photos shared, such as cloud patterns and the orientation of the sun, to pinpoint locations. They could even zoom in on fingerprints.
Despite all this information, it wasn't always possible to stop the violence in its tracks – such as a man shot on his doorstep in Warrington in a case of mistaken identity. Because all of the messages were being intercepted by a team in France, there would be a delay while they packaged up the data according to the territory it related to. From there, it would then be received by a local team of analysts, before it was finally passed on to investigators. The whole process could take between 24 and 48 hours.
'You were always trying to play catch-up,' says Johns. 'Trying to get to that point where you could do something to intervene and regrettably, that was not always possible.' They did, however, manage to disarm a hand grenade left in a suburban front garden, also in Warrington.
As the series continues, we see police discovering what Andy Kragg, who led the investigation for the Netherlands, describes as evidence that 'criminals were building an underworld prison and an underworld torture facility', and details of a first for the NCA – information that drugs were being exported from the UK, with half a ton of ecstasy bound for Australia.
After 74 days, the hack was detected, with EncroChat administrators telling its 60,000 users to 'power off your devices and dispose of them immediately'. The chat petered out, the French took down the servers and, on June 13, 2020, EncroChat shut down.
What did the NCA take from this experience? 'In terms of leading and coordinating operations at this scale, we've learned an awful lot about what works well and what we can do better,' Johns ruminates.
'We've built some really strong relationships with [other crime agencies] off the back of this, which has continued to support us across all threats in that area. It also gave us an insight into how crime groups have evolved that helps us in how we target this type of criminality.
'The idea of that old-school hierarchy, where there's a crime boss at the top and a neat pyramid that sits beneath – I don't think we necessarily see that any more.'
And while criminals will always shape-shift and find new ways to operate, the message is: you can run, but you can't hide.
'Encryption's no barrier,' says Johns. 'You are not beyond our reach just because you're sitting on a foreign shore. You might think that you're safe … but guess what?'
Operation Dark Phone: Murder by Text continues on Channel 4 on Monday 28 July at 9pm, and is available to view on channel4.com