Police shut down a shadowy encrypted messaging app Monday that was allegedly used by organised crime figures to facilitate the transfer of drugs, illicit cash, and firearms throughout Europe. Then they nabbed the people who allegedly coded it.
Cops arrested 42 users, operators, and administrators of the Exclu encrypted messaging service after carrying out dozens of raids in Belgium, Germany, and the Netherlands. The years-long, multi-nation investigation, which began in 2020, reportedly led to the confiscation of millions of dollars worth of cocaine, cash, and weapons.
What did police find on Exclu?
Dutch police were reportedly able to break into Exclu’s system, which granted them access to five-months-worth of messages passed between users prior to the raids. The eventual raids unearthed at least two major drug labs and a cocaine processing facility. Combined, the busts uncovered several kilograms worth of drugs, an assortment of luxury goods and firearms, and $US4.3 ($6) million in cash. Police agencies from France, Italy, Sweden, and Europol all played a hand in the investigation.
Exclu, the messaging app allegedly at the root of the drug operation, markets itself as having, “the most sophisticated encryption protocols in the world.” The service, according to The Associated Press, only ever managed to attract around 3,000 users, with nearly a third of those based out of the Netherlands. Exclu sold the service as a smartphone app with a licensing cost of $US860 ($1,194) for six months. Police say the suspected drug traders used the app to exchange photos, notes, voice memos, chat conversations and videos with each other.
In addition to end-to-end encryption, the company claimed it granted customers the ability to remotely wipe devices and return them to their factory defaults. The company’s mission, according to its website, is to “encrypt everything.”
“Our mission is to advice [sic] people how to securely encrypt all traffic and secure internal files and documents against sophisticated hacking attempts,” Exclu writes.
The dramatic drug raids initially stemmed from two separate investigations into the messaging service, one conducted by Dutch police looking into the company’s owners and managers, and a separate German investigation examining the app’s users. In both cases, police suspected the Exclu managers and users were connected to organised crime.
“The Exclu service has been dismantled and the data has been obtained by applying specialist knowledge and expertise in the field of technology and cybercrime, and by using hacking capabilities,” Dutch police said according to the NL Times. “In addition, the detectives also used traditional investigative methods to successfully identify users of the app.”
Regulators renewed scrutiny of encrypted messaging
The multi-nation drug raids come amid renewed concern by encryption advocates that European regulators, often seen as champions of digital privacy, may be preparing to clamp down on certain messaging tools. Last summer, the European Commission proposed a new controversial regulation that would require messaging apps to scan its users private messages for signs of child sexual abuse material or so-called “grooming” behaviour. The regulation, if passed, would potentially apply to smaller encrypted messaging apps as well as larger, more established encrypted apps like WhatsApp and Facebook Messenger.
Critics of the regulation, like the Electronic Frontier Foundation, say it poses a direct threat to encrypted messaging because it would “require the infrastructure for detailed analysis of user messages.” The regulation focuses specifically on CSAM related content, but encryption advocates say there’s a risk it and other encryption weakening tools could be expanded to other areas of interest as well.
“Is breaking encryption the only way to tackle this problem? I can tell you, it’s not,” Proton CEO Andy Yen, whose company specialises in encrypted communications, said in a recent interview with Wired discussing the regulation. “We need to always find the right balance. And for me, mandating that we undermine or weaken or break encryption, that’s not the right balance.”