Dozens of people have been arrested as part of an investigation into an encrypted messaging network known as “Ghost”, the first of its kind to allegedly be administered by an Australian and a platform trumpeted as “un-hackable”.
Jay Je Yoon Jung, a 32-year-old Australian national from Narwee in Sydney’s south, was arrested and charged on Tuesday for allegedly creating and running the platform.
Jung was arrested about 4am. The Australian federal police said it was important for officers to gain quick entry to the house.
“Our tactical teams were able to secure him and [some] devices in under 30 seconds,” the AFP assistant commissioner Kirsty Schofield said.
The AFP was tipped off about Ghost by international authorities in 2022 and launched Operation Kraken. Over Tuesday and Wednesday, as a result of that long-running investigation, up to 50 people were expected to be arrested in Australia, with near-simultaneous police raids in Ireland, Italy, Sweden and Canada.
As of Tuesday morning, 38 people had been arrested in Australia. Most alleged offenders were in New South Wales but the AFP said Ghost users were also in Victoria, Western Australia, South Australia and the ACT.
The AFP alleges hundreds of criminals – including motorcycle gang members and Italian, Middle Eastern and Korean organised crime members – have used Ghost in Australia and overseas to “import illicit drugs and other crimes”.
Jung did not apply for bail in court on Wednesday and will remain in custody before the case returns in November. He is facing five charges, including supporting a criminal organisation and dealing with the suspected proceeds of an indictable offence.
The AFP deputy commissioner Ian McCartney alleged the network was created “solely for the use by criminals to facilitate crime” and said Jung was “driven by profit”.
“It’s been the first time we’ve identified someone who’s [allegedly] started up in Australia and it’s the first time we’ve undertaken an arrest and a charge of an individual [in relation to this].”
Police will allege Jung created the network nine years ago when he was 23. McCartney described Jung as a “computer geek” with no criminal history and who lives with his parents.
The platform had been “a slow burn over the last couple of years” but was beginning to gain more subscribers, McCartney said. It had been marketed to users as “an un-hackable network”.
In March, the AFP engineered a “technological solution” to access the platform and de-encrypt devices – modified iPhones that were sold for $2,350 along with a six-month subscription cost.
As the alleged administrator launched software updates, the AFP was able to modify those updates and access content on devices in Australia.
“In effect we infected the devices, enabling us to access the content on Australian devices,” McCartney said.
There were 376 active devices in the country as of Tuesday, with more than 7,200 devices provisioned globally over the life of the platform. The AFP has effectively shut down the platform, which will be dismantled when investigations conclude.
The AFP said it had prevented 50 “threats to life” since it gained access in March, including everything from aggravated assault and extortion to kidnapping. Schofield said that on one occasion the AFP viewed an image on the platform of a person with a firearm to their head.
“We had an hour in which to respond to that threat and pass that information to our state and territory partners to mitigate that threat,” she said. The person was rescued.
Schofield described the platform as facilitating “the whole [gamut] of criminal activity”, with instances of domestic violence also identified.
Asked what may have occurred on the platform before the AFP gained access six months ago, McCartney said: “We don’t have knowledge of that”. He also said the AFP is aware of additional encrypted messaging platforms being used by alleged criminal networks, but could not provide details.
The AFP has previously used the encrypted app An0m to covertly run a global crime sting, which is being challenged in the courts for the legality of the interception of messages.
McCartney said Operation Kraken was different because while An0m was set up by the AFP and FBI, Ghost was already in existence, so “it was the ability for the AFP to de-encrypt those messages”.
“So similar legislation, but a different approach in how we went about it,” he said.
“Will we face challenges in court? I think we will, but I think that’s the nature of the business.”
