The ANOM sting operation was a collaboration by law enforcement agencies from several countries, running between 2018 and 2021, that intercepted millions of messages sent through the supposedly secure smartphone-based messaging app ANOM. The app was covertly distributed by the United States Federal Bureau of Investigation (FBI) and the Australian Federal Police (AFP), with law enforcement agencies in other countries joining in later. The ANOM service was widely used by criminals, but instead of providing secure communication, it was actually designed to allow law enforcement to monitor all communications.

So far I found only this source that goes a little bit into more detail about the cryptographic part.


Law enforcement did not have real-time access to phone activity but instead, all sent messages were blind copied or 'BCCed' to FBI servers where they were decrypted.

Did ANOM devices / apps use hardcoded keys to encrypt & decrypt messages?

I could also imagine a server controlled by law enforcement to act as some sort of a key-distribution center, where keys were generated and stored after distribution.

How exactly did law enforcement decrypt messages send by ANOM devices?


2 Answers 2



There was a customized encryption protocol built into an existing app popular with criminal figures, based on information given in a plea bargain with a criminal.


More background:


This company as well as an RCMP insider were involved in an earlier app. The archived page below seems to be some sort of security analysis of Anom comparing it to a competitor.


Likely there were compromised servers run by or monitored by law enforcement in different locations; exact technical details may be harder to find but the more straightforward (not necessarily only) option would be to exfiltrate messages from these compromised servers.

End edit

[..] FBI, AFP [Australian Federal Police], and the CHS built a master key into the existing encryption system which surreptitiously attaches to each message and enables law enforcement to decrypt and store the message as it is transmitted. A user of Anom is unaware of this capability. By design, as part of the Trojan Shield investigation, for devices located outside of the United States, an encrypted "BCC" of the message is routed to an "iBot" server located outside of the United States, where it is decrypted from the CHS's encryption code and then immediately re-encrypted with FBI encryption code. The newly encrypted message then passes to a second FBI-owned iBot server, where it is decrypted and its content available for viewing in the first instance.

More details:

According to this story

Anom's website currently has a message saying, "This domain has been seized" and that "[l]aw enforcement has been monitoring messages and attachments from the ANØM platform. A number of investigations have been initiated and are ongoing."

The goal of the new platform was to target global organized crime, drug trafficking, and money laundering organizations, regardless of where they operated, and offer an encrypted device with features sought by the organized crime networks, such as remote wipe and duress passwords, to persuade criminal networks to pivot to the device.

The FBI and the 16 other countries of the international coalition, supported by Europol and in coordination with the US Drug Enforcement Administration, then exploited the intelligence from the 27 million messages obtained and reviewed them over 18 months while Anom's criminal users discussed their criminal activities.

The way this came about was covered in an earlier


draws from an unsealed court document containing an FBI affidavit and application for a search warrant. The 2018 arrest of Phantom Secure CEO Vincent Ramos, who sold encrypted phones to criminals, helped lead to the FBI operation. "In the wake of that arrest, a confidential human source (CHS) who previously sold phones on behalf of Phantom and another firm called Sky Global, was developing their own encrypted communications product," Vice wrote.

  • 2
    $\begingroup$ Also, theverge.com/2021/6/8/22524307/… $\endgroup$
    – kelalaka
    Jun 9, 2021 at 19:44
  • 2
    $\begingroup$ But anything about the actual customized encryption protocol? What is a master key? Clearly that can't be used with common primitives... $\endgroup$
    – Paul Uszak
    Jun 9, 2021 at 21:10

I think they hatched the idea after taking down Phantom Secure.

It's probably not a coincidence that Operation Ironside began around the same time that Phantom Secure's operation was destroyed in 2018.

The AN0M app was a ground up effort developed by the FBI, they didn't need to break any encryption since it was their system.

  • 4
    $\begingroup$ I think the question is asking for more details on how the app pretended to provide secure communications without actually doing so. $\endgroup$
    – cjm
    Jun 10, 2021 at 14:18
  • $\begingroup$ @cjm The app used encryption so technically was secure. The pretend aspect of the operation was simply law enforcement pretending to be criminals who administered the service. $\endgroup$
    – NetServOps
    Jun 11, 2021 at 0:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.