Australian man charged over allegedly creating app for criminal underworld
abc.net.au
abc.net.au
* The article states the accused launched the app 9 years ago at the age of 23. The app previously had the domain ghostecc.com whose historical WHOIS records indicate creation on 2016-04-13, so the dates approximately line up.
* The accused was living with his parents in a property they seemingly purchased in 1996 (when the accused would have been 4 years old) and live in today. From business registration records associated with the property, the family appears to operate a commercial cleaning business as well as a more recently formed skip bin hire business.
The app
* ghostchat.net indicates access to the app was by invitation only (side-loaded and probably Android-only) and the article indicates there were 600+ users. The contact form on ghostchat.net to request access to the app places the USA, Canada, Croatia, Denmark, Finland, Ireland, Mexico, Netherlands, Spain, Sweden and the UK at the top of the list of countries to select in that order, then all other countries are listed alphabetically thereafter.
The technical method used by law enforcement
* "the [accused] man regularly pushing updates to devices with the encrypted app provided [the Australian Federal Police's Covert and Technical Team] with the opportunity they needed."
* "The technical solution created by the AFP used to infiltrate the app is world-first and is a process that couldn't be replicated in countries like Sweden where the app 'Ghost' is also used."
The legal method used by law enforcement
* The article hints that the powers granted in the Surveillance Legislation Amendment (Identify and Disrupt) (SLAID) Bill 2021[1] were possibly used. This legislation allows black bag operations[2] and remote exploitation against premises and computer systems related to the app, and would also critically compel anyone capable of assisting to do so in secret. The legislation also has provisions that almost certainly would be used on every occasion to ensure the methods used are not revealed in the court proceedings.[3] It's perhaps the admissibility of evidence and ability to suppress black bag operation methods that the article hints could be challenged in court for the first time. Although in this case there isn't a well resourced company defending the case and as such it's hard to see how much of a challenge would be presented. The latest government report on use of the SLAID powers[4] should be published in ~November 2024 and seemingly would include mention of the warrants issued in relation to this app. As the arrests just happened today, those results wouldn't be included in the annual report until ~November 2025.
Related discourse on encrypted chat apps
* Patrick Gray from the Risky Business podcast recently interviewed the head of ASIO, Mike Burgess, (also former head of ASD) about encrypted apps just a month ago[5], but the focus of questions was on Assistance and Access (AA) powers, not the separate SLAID powers. This interview provides the latest thinking on encrypted messaging apps in Australia and Patrick asked some pointed questions about how Australia plans to get access to apps such as Signal which are hosted offshore. Another relevant line of questioning for next time would be how SLAID and AA legislation would be of any assistance with apps such as Potato Chat or Ant Messenger which were ousted a few months ago as a preferred communication method for Chinese spies operating in Australia.[6] Patrick did raise the somewhat inevitable trajectory towards censorship and/or outlawing of apps that are out-of-reach of law enforcement, something which is currently being tested with TikTok and Section 230 in the USA.
* The Australian government just a few years ago seemingly conducted a large amount of business using apps such as Signal (preferred app of the prime minister's office)[7] and WhatsApp. Seemingly this use has or is continuing to be replaced with use of Microsoft Teams for internal communications[7], making it easier to now battle mainstream encrypted messaging apps.
References
[1] https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat...
[2] https://en.wikipedia.org/wiki/Black_bag_operation
[3] Example of a likely similar request made in the US to Apple: https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d...
[4] https://www.ag.gov.au/crime/publications/surveillance-device...
[5] https://risky.biz/mikeburgess/
[6] https://www.abc.net.au/news/2024-05-13/china-spy-secret-poli...
[7] https://www.pmc.gov.au/sites/default/files/foi-logs/foi-2023...
Also, this is Ghost Chat's website: https://www.ghostchat.net
For the app developer/administrator the charges are:[1]
* One count of supporting a criminal organisation contrary to section 390.4(1) of the Criminal Code 1995 (Cth), which carries a maximum penalty of three years’ imprisonment;
* One count of dealing with the suspected proceeds of an indictable offence less than $100,000 contrary to section 400.9(1) of the Criminal Code 1995 (Cth), which carries a maximum penalty of three years’ imprisonment;
* One count of dealing in identifying information and using it to commit fraud contrary to section 372.1(1) of the Criminal Code 1995 (Cth), which carries a maximum penalty of five years’ imprisonment;
* One count of obtaining identification information using a carriage service with intent contrary to section 372.1a(3) of the Criminal Code 1995 (Cth), which carries a maximum penalty of five years’ imprisonment; and
* One count of contravening a requirement in a section 3LA order contrary to section 3LA (6) of the Crimes Act 1914, which carries a maximum penalty of 10 years’ imprisonment.
For the primary reseller of "dedicated encrypted criminal communication devices" the charges are:[2]
* Supporting a criminal organisation, contrary to section 390.4(1) of the Criminal Code 1995 (Cth). This offence has a maximum penalty of five years’ imprisonment.
* Perverting the course of justice, contrary to section 319 of the Crimes Act 1900 (NSW). This offence has a maximum penalty of 14 years’ imprisonment.
* Conspiracy to traffic a marketable quantity of controlled drugs, namely cannabis contrary to section 302.3, by virtue of section 11.5 of the Criminal Code 1995 (Cth). This offence has a maximum penalty of 25 years’ imprisonment.
* Possession of dedicated encrypted criminal communication devices for certain purposes, contrary to section 192P of the Crimes Act 1900 (NSW). This offence has a maximum penalty of three years’ imprisonment.
* Contravene requirements in s3LA order when the warrant relates to a serious offence, contrary to section 3LA(6) of the Crimes Act 1914 (Cth). This offence has a maximum penalty of 10 years’ imprisonment.
As it's not explained in the summary above, the Commonwealth offence s3LA(6) is for failing to provide access to devices subject to a search warrant. Whilst apparently not used here, there also exists an overlapping offence s80M in NSW for failing to provide access to a "dedicated encrypted criminal communication devices".[6]
For the app developer/administrator the allegation is they received less than AUD$100,000 from the 9 years working on the app. The mobile phones were sold by a reseller for AUD$2350 which indicates a maximum sales volume of ~AUD$1.5m (600 devices assumed). Take away AUD$1800/phone costs and ~AUD$300k is left to divide between reseller, the app developer/administrator, and any other involved parties. The minimum wage in Australia is AUD$47k/yr by comparison.
B-roll footage appears to confirm the target operating system for the "Ghost" app was Android as models of phones including Galaxy Z Flip 3, Galaxy Z Flip 4, Pixel 5, Pixel 6, Galaxy S22, Galaxy S22+, Galaxy S23, Galaxy S23+ are shown in a cabinet, seemingly as a collection of test devices.[6]
[1] https://www.afp.gov.au/news-centre/media-release/afp-operati...
[2] https://www.afp.gov.au/news-centre/media-release/criminal-sy...
[3] https://legislation.nsw.gov.au/view/html/inforce/current/act...
[4] https://legislation.nsw.gov.au/view/html/inforce/current/act...
[5] https://legislation.nsw.gov.au/view/html/inforce/current/act...
[6] From timestamp ~2:05 of https://spaces.hightail.com/space/clDYrxFXgW/files/fi-d5586c...