51 arrests in wide-scale operation to take down encrypted communication platform used by organised crime groups

Source: Eurojust

Investigations into the communication platform started when authorities were alerted of a new encrypted service being used in Sweden, France, Spain and the Netherlands. Due to servers being located in France, French authorities started investigations into the platform. The platform’s robust encryption made it ideal for criminal networks to use for their activities. It was mostly used for drug trafficking but also for other criminal activities, such as arms trading, homicide, robbery, kidnapping, and money laundering.

The communication platform is a fully anonymised service. Users can purchase the solution without any personal information. The platform uses three encryption standards and offers the option to send a message followed by a specific code that results in the self-destruction of all messages on the target phone. By using multiple private servers around the world, third party or government agencies have difficulty tracking the communication solution.

As servers were found in France and Iceland, the platform was administered from Australia and Canada, and financial assets were located in the United States, a global operation against the phone service started. A joint investigation team (JIT) between authorities from France and the United States was set up at Eurojust, the second-ever JIT with the United States. This allowed them to exchange information and evidence in real time. Authorities from the Netherlands, Sweden, Canada and Australia were also involved in the investigations. Through coordination among the authorities, hosted by Eurojust, a strategy to take down the encrypted phone solution was defined.

To facilitate investigations into the illegal activities using this communication platform, an Operational Taskforce (OTF) was established at Europol in March 2022 involving law enforcement authorities from Australia, Canada, France, Ireland, Italy, the Netherlands, Sweden and the United States.

A Joint Operational Centre was also established at Europol’s headquarters, where representatives from the OTF members and Europol’s officers provided support and facilitated the coordination of the simultaneous operational activities taking place around the globe.

The investigations culminated in a number of joint action days taking place across the globe against the phone service. 38 suspects were arrested in Australia, 11 in Ireland, one in Italy and one in Canada. A drug lab was dismantled in Australia and weapons, drugs and over EUR 1 million euro is cash was seized globally so far. Further actions are expected as the investigation progresses.

The following authorities were involved in the actions:

  • France: Cybercrime unit Prosecutor’s office – JUNALCO (National Jurisdiction against organised crime); Gendarmerie Nationale – C3N Cybercrime Unit
  • Netherlands: National Police
  • Sweden: Swedish Prosecution Authority; Swedish Police Authority
  • Australia: The Office of the Director of Public Prosecutions
  • Canada: Public Prosecution Service of Canada
  • Iceland: Director of Public Prosecution; National Commissioner of the Icelandic Police; Reykjavik Metropolitan Police
  • United States: Department of Justice; Federal Bureau of Investigation

Mr Erik Fågelsbo new National Member for Sweden at Eurojust

Source: Eurojust

Mr Erik Fågelsbo has been formally appointed as the new National Member for Sweden at Eurojust. He will succeed Ms Marie Lind Thomsen, with whom he has been working at the Agency as Deputy National Member since March 2020. He already served as acting National Member since July last year. Mr Fågelsbo has long-standing experience in international judicial cooperation, working as Justice and Home Affairs Counsellor at the Permanent Representation of Sweden to the European Union, among other roles.

Upon his appointment as National Member for Sweden, Mr Fågelsbo stated: ‘It is a true privilege to continue working for Eurojust in this new position, in which I will ensure Sweden’s continued support to Eurojust. I particularly look forward to the work we will do on the evaluation of the Eurojust Regulation. This will be an excellent opportunity to further fine-tune our activities and to enhance the cooperation with all our partners who are fostering judicial cooperation across the European Union and beyond’. 

The new National Member for Sweden has been appointed for a period of five years. He graduated in law at Stockholm University in 1998 and started as a public prosecutor in 2000. In 2004, Mr Fågelsbo served as legal advisor to the Swedish armed forces in Kosovo and held the rank of major. From 2005 until 2010, he again worked as a public prosecutor in the National Unit Against Corruption, also in a senior role. 

Between September 2010 and December 2011, Mr Fågelsbo worked as Seconded National Expert and assistant to the National Member for Sweden at Eurojust, before becoming a legal advisor at the Swedish Ministry for Justice. In this role, he managed the mutual evaluations on the implementation of the Eurojust legal framework by Sweden.

From February 2015 until August 2019, the new National Member worked at the Swedish Representation to the EU in Brussels, where he was involved in the Regulation on Freezing and Confiscation. In this capacity, Mr Fågelsbo was also responsible for the negotiations on the new Eurojust Regulation and the start of the European Public Prosecutor’s Office (EPPO). From September 2019 until February 2020, before rejoining Eurojust, he was a temporary judge in the Svea Court of Appeal in Stockholm.

Eurojust coordinates arrests in Swedish cannabis trafficking case

Source: Eurojust

Eurojust has supported the Swedish and Spanish authorities in the coordinated arrest of four suspects involved in the wholesale and transport of cannabis and other illicit drugs. The main suspect was allegedly organising the reception of the drugs in Sweden and their distribution in and around Stockholm. He was arrested in Spain based on a European Arrest Warrant (EAW) with a view to surrender him to Sweden.

Eurojust set up a coordination centre last week to assist the Swedish and Spanish authorities with the exchange of information and the execution of the EAW, as well as European Investigation Orders. A number of premises were also searched and various goods and telecommunications equipment seized during concerted actions in both countries.

Based on the interception and decoding by the Swedish authorities of large-scale encrypted communications, it was established that the suspects has transported, received and stored large quantities of cannabis in the second half of 2020. During this period, also a large quantity of the synthetic drug MDMA was handled. 

At the request of the Swedish authorities, Eurojust enabled contact with their counterparts in Spain, where the main suspect in this case was residing. The actions on the ground were carried out at the request of and by the following authorities:

  • Sweden: Public Prosecutor’s Office of Stockholm; Swedish Police; Nordic Police and Customs Liaison Officer, Malaga.
  • Spain: Public Prosecutor’s Office of Alicante, International Cooperation Unit; Guardia Civil; Policía Nacional.

Eurojust supports an EPPO-led operation against carousel VAT fraud for the first time

Source: Eurojust

During the searches, law enforcement seized vast quantities of smartphones, worth more than EUR 15.3 million, as well as a yacht, worth EUR 3 million, and EUR 1.2 million in cash and cryptocurrency. Several luxury cars, jewellery, luxury watches and 2.5 kg of gold were also found.

The suspects are being investigated for large-scale cross-border Missing Trader Intra-Community (MTIC) fraud involving the trade of electronic goods and protective face masks through companies based in several European countries. MTIC fraud is the theft of value-added tax (VAT) from a government by organised crime groups. The perpetrators are believed to have defrauded up to EUR 195 million through several criminal schemes. Most of the VAT damage was caused in Sweden, where the missing trader companies were based.

Eurojust supported two investigations targeting the same crimes, one led by the EPPO and a second one led by the Swedish authorities. The EPPO investigation targeted the two managers and shareholders of a German distributor company that was acting as an in/out buffer/conduit company in the fraud chain. It purchased and sold mobile phones to other companies in several countries, which were then sold to the Swedish missing trader companies. Eurojust was instrumental in identifying ongoing linked investigations in Sweden, targeting the individual behind the Swedish missing trader companies.

The case was opened at Eurojust in 2021 at the request of the German European Delegated Prosecutor. Eurojust facilitated the cooperation between the EPPO and Sweden, Denmark, Hungary and Poland – all EU Member States that do not participate in the EPPO – and the United Kingdom. Eurojust can support cross-border cooperation in EPPO cases that involve countries that do not participate in the EPPO. The Agency also facilitated cooperation between Sweden and Malta.

The Agency hosted seven coordination meetings to facilitate judicial cooperation between the EPPO and the national authorities involved in the case. Eurojust facilitated the exchange of information and the execution of several European Investigation Orders and European Arrest Warrants.

During the action day, a coordination centre was set up at the EPPO premises in Luxembourg, for the first time jointly with Eurojust. The Eurojust coordination centre focused in particular on coordinating the execution of the Swedish measures in Malta.

In the run-up to the action day, Europol provided analytical support to the partners in this investigation. Furthermore, Europol supported the action day by providing over 100 secure communication channels (VCP – Virtual Command Post), and by deploying a specialist with a mobile office to the operational command centre at EPPO’s headquarters in Luxembourg.

Eurojust and the EPPO signed a Working Arrangement in February of 2021 to facilitate cooperation between the Agency and the EPPO.

The following authorities took part in this investigation:

  • Germany: German Tax Investigation Offices in Berlin, Bielefeld, Cottbus, Münster and Nuremberg; Police Headquarters from Nordhessen and Brandenburg; State Criminal Police Offices from Brandenburg and Berlin;
  • Malta: Malta Police Force – Financial Crimes Investigation Department and International Relations Unit;
  • Poland: Circuit Prosecutor’s Office in Warszawa and Zamość; Police Headquarters in Warszawa and Zamość;
  • Sweden: Swedish Economic Crime Authority.

Eurojust supports international operation against world’s largest ransomware group

Source: Eurojust

In a coordinated action supported by Eurojust and Europol, judicial and law enforcement authorities from 10 different countries have severely disrupted LockBit, the world’s most active ransomware operation. Two members of the ransomware team have been arrested in Poland and Ukraine. In addition, law enforcement has compromised LockBit’s primary platform and other enabling infrastructure. This includes the takedown of 34 servers in the Netherlands, Germany, Finland, France, Switzerland, Australia, the United States and the United Kingdom.

LockBit first emerged at the end of 2019, initially calling itself ‘ABCD’ ransomware. Since then, it has grown rapidly and by 2022 had become the most deployed ransomware variant worldwide. LockBit attacks are believed to have affected over 2,500 victims all over the world.

The group is a ‘ransomware-as-a-service’ operation, meaning that a core team creates its malware and runs its website, while licensing out its code to affiliates who launch attacks.

The joint action enabled the various police forces to take control of much of the infrastructure that enables the LockBit ransomware to operate, including the darknet, and, in particular, the ‘wall of shame’ used to publish the data of victims who refused to pay the ransom. This action has disrupted the network’s ability to operate.

Authorities have also frozen more than 200 cryptocurrency accounts linked to the criminal organisation.

This international operation follows a complex investigation led by the UK National Crime Agency. Supported by Eurojust and Europol, law enforcement from nine other countries worked in close partnership with the National Crime Agency on this case, including authorities in France, Germany, Sweden, the Netherlands, the United States, Switzerland, Australia, Canada and Japan.

The case was opened at Eurojust in April 2022 at the request of the French authorities. Five coordination meetings were hosted by the Agency to facilitate judicial cooperation and to prepare for the joint action.

Europol’s European Cybercrime Centre (EC3) organised 27 operational meetings, and 4 technical 1-week sprints to develop the investigative leads in preparation of the final phase of the investigation. Europol also provided analytical, crypto-tracing and forensic support. In addition, three Europol experts were deployed to the command post in London during the action phase.

With Europol’s support, the Japanese Police, the National Crime Agency and the Federal Bureau of Investigation pooled their technical expertise to develop decryption tools designed to recover files encrypted by the LockBit ransomware. These solutions have been made available free of charge on the ‘No More Ransom’ portal, which is available in 37 languages. So far, more than 6 million victim across the globe have benefited from No More Ransom, which contains over 120 solutions capable of decrypting more than 150 different types of ransomware.

The following authorities took part in this investigation:

  • United Kingdom: National Crime Agency, South West Regional Organised Crime Unit
  • United States: U.S. Department of Justice, Federal Bureau of Investigation – Newark
  • France: JUNALCO (National Jurisdiction against Organised Crime) Public Prosecutor’s Office Paris Cybercrime Unit – C3N (cyber unit); Gendarmerie Nationale
  • Germany: Central Cybercrime Department North Rhine-Westphalia (CCD), State Bureau of Criminal Investigation Schleswig-Holstein (LKA Schleswig-Holstein), Federal Criminal Police Office (Bundeskriminalamt)
  • Sweden: Swedish Cybercrime Centre, Swedish Prosecution Authority
  • The Netherlands: National Police (Team Cybercrime Zeeland-West-Brabant, Team Cybercrime Oost-Brabant, Team High Tech Crime); Public Prosecutor’s Office Zeeland-West-Brabant
  • Australia: Australian Federal Police
  • Canada: Royal Canadian Mounted Police
  • Japan: National Police Agency
  • Switzerland: Zurich Cantonal Police; Public Prosecutor’s Office II of the Canton of Zurich

Crackdown on criminal network dealing with online investment fraud

Source: Eurojust

Judicial and law enforcement authorities in Germany, Cyprus, Bulgaria and Sweden have carried out a coordinated action against an organised crime group suspected of online trading fraud. The network defrauded numerous victims for several millions of euros in Germany and other European countries.

During a joint action day supported by Eurojust and Europol, four suspects were arrested and thirteen places were searched.

The suspects allegedly belong to a hierarchical criminal network with numerous members. The suspects ran several fraudulent online trading platforms from call centres and other locations in Cyprus. The perpetrators presented themselves as investment advisors and convinced victims to invest large amounts of money based on fake promises of profits.

The damage caused to German victims by the two main platforms is estimated at EUR 3.3 million and EUR 164 000, respectively. The total damage caused by the platforms is likely to be many times higher. Eurojust assisted the investigations by organising a coordination meeting and setting up a coordination centre to facilitate rapid cooperation between the judicial authorities during the joint action day. The Agency also assisted with the transmission and execution of six European Arrest Warrants and several European Investigation Orders.

Europol supported this case by hosting and financing several operational meetings as well as the action day. Furthermore, it provided analytical support and financial intelligence during the investigation. On the action day, a Europol specialist with a mobile office and a universal forensic extraction device (UFED) were deployed to Cyprus, while colleagues back in The Hague offered technical support for the virtual command post.

The following authorities took part in this investigation:

  • Germany: Public Prosecutor’s Office of Göttingen; Centre for Cybercrime, Police Göttingen
  • Bulgaria: Sofia City Public Prosecutor’s Office; General Directorate Bulgarian National Police
  • Cyprus: International Police Cooperation Sub-Directorate – Police Cooperation Bureau Cyprus Police
  • Sweden: Swedish Police Authority