Encrypted Phone Seller Facing Criminal Charges Fights Back, Says Sky Global Isn't Complicit In Customers' Illegal Acts

from the a-possible-exercise-in-futility-but-perhaps-still-a-worthwhile-one? dept

Over the past couple of years, the US government -- working with law enforcement agencies around the world -- has managed to shut down cell phone services it alleges were sold to members of large criminal associations. These prosecutions have allowed the DOJ to push the narrative that encrypted communications are something only criminals want or need.

But in multiple cases, encryption was never a problem. Investigators were able to target criminal suspects with malware, allowing access to communications and data. The FBI, along with Australian law enforcement, actually ran a compromised encrypted chat service for three years, allowing the agencies to round up a long list of suspects from all over the world.

One of those targeted by these long-running investigations was Canada-based encrypted phone provider Sky Global. The DOJ claimed the company sold phones to criminals and even secured an indictment that charged Sky CEO with assisting in the distribution of at least five kilos of cocaine (this amount triggers mandatory minimum 10-year sentences). This claim was based not on CEO Francois Eap's own actions, but the alleged actions of his customers, some of whom engaged in drug dealing.

That was added to RICO allegations Eap is facing. But, so far, the US government has made no attempt to extradite Francois Eap and put him on trial. A new report by Joseph Cox for Motherboard possibly shows why the government is hesitant to make this any more of a federal case than it already is. Sky Global is fighting back in court, submitting internal communications that show it made efforts to assist in investigations and refused to remotely wipe phones it could tie to criminal activity.

Sky has filed a motion seeking the return of seized domains [PDF]. In it, the company details how it cooperated with law enforcement and attempted to deter criminals from buying its phones. At this point, Sky Global is effectively dead, even though prosecutors have yet to secure a conviction of Eap or anyone else employed by the company. The DOJ has seized all of the company's websites, making it nearly impossible to continue to sell phones or provide services to existing customers.

The exhibits included with Sky’s filing show in new detail the effort Sky took to remove criminals from its platform.

“You may not knowingly sell or otherwise provide the Products and Services to any Customer for illicit, illegal or criminal use,” a Sky terms of use document reads.

“This ECC ID has been flagged for breaching our terms of service. It will be deactivated immediately,” one email sent by a Sky support worker to a user reads. The message from Sky points to a section of the company’s terms of use that does mention non-permitted uses such as promoting criminal activity.

Another email sent by Sky’s chief operating officer to what appears to be a Sky distributor says that one of the distributor’s agents has violated the company’s terms of service because of their willingness to sell the Sky ECC product to someone wanting to use it for illicit activity, as well as other violations.

The filing also includes emails sent to customers, letting them know Sky would not assist in remote wipes of devices seized by law enforcement. Other emails show customer service reps rejecting purchasers who made statements suggesting they were going to use the phones to engage in criminal activity.

The DOJ says this means nothing. It claims the company's statements in emails and attempts to remain unaware of customers and their intentions give it nothing more than "plausible deniability." But, of course, that's how plausible deniability works. And the government should know this better than the criminals it's going after. If deniability is plausible, it means a jury may not return a guilty verdict. And government agencies have long engaged in practices that allow them to plausibly deny they have violated rights or engaged in retaliation against whistleblowers, FOIA requesters, etc. Either seize the cake or eat it, DOJ. Don't try to do both.

There appears to be some actual deniability contained in all the plausibility.

Other documents show Sky employees declining to wipe devices when asked to do so by resellers.

“Hello. Please delete this ECC ID, the police have it,” one message sent to Sky reads. “PLEASE HELP!!! Two customers have problems with the police. Their devices were confiscated,” another adds. In both cases, Sky declined to wipe the phones, according to the emails.

But there's still a lot of grey area. Former employees said it was impossible to not know the phones were being purchased and used by criminals. But steps were still taken to prevent employees from wiping phones seized from alleged criminals and to deter third-party retailers from using language that suggested the company would be complicit in the destruction of criminal evidence.

And it went further than that. According to Sky's lawyer, the company also terminated accounts associated with criminal activity, which goes above and beyond the "plausible deniability" accusations made by the DOJ.

There's a major caveat to all of this, though.

But all of the documents which Sky provided and Motherboard reviewed which show enforcement of Sky’s policies were created in 2019 or later, after the U.S. prosecution of Phantom Secure’s Ramos.

This was probably a wise reaction. But it was a reaction, nonetheless. If the government can show the company was far more complicit in criminal activity in the past, it will still be able to prosecute. But given its lack of interest in pursuing Francois Eap's extradition from Canada, it appears the DOJ might be satisfied with prosecuting cases involving Sky phone users, rather than charges against the company itself. Unfortunately, the DOJ has the power to drag this process out forever, effectively denying Sky the opportunity to remain solvent even though its CEO (and others with indictments) are still presumably innocent. Then it just becomes a war of attrition and the DOJ has infinite time and resources.

Filed Under: aiding and abetting, crime, doj, encrypted phones, encryption, francois eap, rico
Companies: sky global

DOJ Says Encryption Is Just For Criminals As It Goes After Another Secure Phone Purveyor

from the dark-mode-engaged dept

The DOJ has indicted another company for supposedly making it easier for criminals to elude law enforcement. The true target, though, isn't the company whose principals have been indicted, but encryption itself.

A couple of years ago the DOJ decided to bring RICO charges against Phantom Secure, a cellphone provider that catered to the criminal element with "uncrackable" phones/messaging services built on existing Blackberry hardware/software.

The FBI approached Phantom Secure, asking for an encryption backdoor that would allow it to snoop on its customers. Phantom Secure declined the FBI's advances. Its phones -- originally marketed to professionals desirous of additional security -- were soon marketed to criminals, a market sector that truly valued the security options offered by Phantom.

But rejecting the FBI and selling to criminals causes problems. The DOJ went after Phantom Secure, arresting the owner and charging him with a bunch of RICO and RICO-adjacent crimes.

It is happening again. The DOJ has decided encryption is a crime when companies offering encrypted communications choose to sell to people the DOJ considers to be criminals.

Here's the DOJ's portrayal of its crime-fighting efforts -- one supported by people who rarely find a sandwich they don't think can be criminally charged.

A federal grand jury today returned an indictment against the Chief Executive Officer and an associate of the Canada-based firm Sky Global on charges that they knowingly and intentionally participated in a criminal enterprise that facilitated the transnational importation and distribution of narcotics through the sale and service of encrypted communications devices.  

Jean-Francois Eap, Sky Global’s Chief Executive Officer, and Thomas Herdman, a former high-level distributor of Sky Global devices, are charged with a conspiracy to violate the federal Racketeer Influenced and Corrupt Organizations Act (RICO). Warrants were issued for their arrests today.

But here's where it gets sketchy. The DOJ is basically trying to hold a phone provider responsible for the criminal acts of its customers. In order to do that, it needs to depict encryption as an unnecessary evil that serves mainly to allow criminals to escape justice.

According to the indictment, Sky Global’s devices are specifically designed to prevent law enforcement from actively monitoring the communications between members of transnational criminal organizations involved in drug trafficking and money laundering. As part of its services, Sky Global guarantees that messages stored on its devices can and will be remotely deleted by the company if the device is seized by law enforcement or otherwise compromised.

"Or otherwise compromised." There are plenty of non-criminal reasons to want to remotely wipe a phone that has ended up in the hands of someone other than its owner. Some of those reasons are ones even the DOJ finds legitimate, like the protection of trade secrets. But in this case, the DOJ only sees an evil that must be stopped. And the fact that Sky Global's market share is so small it amounts to a rounding error isn't stopping the DOJ from attempting to make the company pay for the sins of some of its users.

There are at least 70,000 Sky Global devices in use worldwide, including in the United States. The indictment alleges that for more than a decade, Sky Global has generated hundreds of millions of dollars in profit by facilitating the criminal activity of transnational criminal organizations and protecting these organizations from law enforcement.

Allegations are just that: allegations. Sky Global may have had some legitimate customers who felt vanilla phone offerings by Google, Apple, and a host of Android-based manufacturers weren't secure enough, but those people's concerns don't matter when criminals are also using the same phones to conduct criminal activity.

The real enemy is encryption, according to the DOJ. The DOJ says preventing law enforcement from "actively monitoring communications" is its own evil, even while multiple messaging services now offer end-to-end encryption that prevents law enforcement from listening in. This is the foot in the door. If the FBI and DOJ can make enough noise about a company that supposedly marketed its product to criminals, it can make further inroads towards demonizing encryption as a threat to the security of the nation, if not an aider and abettor of criminal activity.

This is the ongoing PR war being fought by our government against a feature that provides more security to phone users. And it's being done by an agency that has yet to be completely honest about how much of a problem encryption actually poses to criminal investigations. For that reason alone, the DOJ's accusations shouldn't be granted credence. Its efforts to undermine the safety of millions of non-criminal phone users shouldn't be ignored either, because it's clear at this point the security concerns of the American public mean nothing to it.

Filed Under: backdoors, criminal, doj, encryption, fbi, jean-francois eap, rico, secure phones, thomas herdman
Companies: sky global