Digital Trojan Horse: Police Use Encrypted App to Uncover 55 Criminals

South Australia Police executed a major law enforcement operation, arresting 55 individuals and seizing approximately $37.9 million (A$58 million) in cryptocurrencies tied to drug trafficking, firearms offenses, and money laundering. The operation, part of Operation Ironside, leveraged intelligence from the encrypted messaging app AN0M, which was secretly controlled by authorities to intercept criminal communications.

The third phase of the multi-year investigation, a joint effort between the Australian Federal Police (AFP) and the FBI, resulted in 800 new charges, including drug trafficking, conspiracy, and weapons offenses. Deputy Commissioner Linda Williams called the arrests "unprecedented," emphasizing that the High Court's recent validation of intercepted AN0M messages as admissible evidence paved the way for the latest round of charges.

The AN0M app, distributed via modified phones lacking cameras or browsers, was marketed to criminals as a secure communication platform. However, law enforcement embedded a backdoor system that duplicated messages before encryption, allowing real-time access to the FBI and AFP. By 2024, the AFP reported 19.3 million intercepted messages from 1,600 active AN0M devices in Australia alone, revealing extensive networks involved in illicit activities.

The app's success hinged on its design: users could only communicate with other AN0M users, and messages could self-expire. Despite its security features, the FBI retained master encryption keys, enabling authorities to monitor conversations without breaking encryption. The operation's initial phase in June 2021 led to global arrests, including 220 in Australia, and the seizure of $58 million in crypto and cash.

The use of AN0M data in court faced legal hurdles. In October 2025, the High Court rejected challenges from two defendants, affirming that intercepted messages were lawfully obtained under new legislation. The ruling resolved a key legal barrier, allowing prosecutors to use AN0M evidence in ongoing cases. Deputy Commissioner Williams noted the decision enabled "resolution" in numerous investigations, with more arrests expected as courts process the latest charges.

Cryptocurrencies remained central to the probe, with authorities tracing wallet addresses to seize assets linked to money laundering. The AFP estimates that crypto seizures from Operation Ironside now total around A$58 million, highlighting the challenges of monitoring decentralized networks for illicit activity. Europol has warned that criminal use of crypto is becoming "increasingly sophisticated," straining global law enforcement resources.

The operation underscores growing concerns about crypto's dual use in legitimate finance and criminal enterprises. While the Albanese government has advanced regulatory measures, public trust in crypto remains low, with 60% of Australians expressing distrust due to fraud and laundering risks.

With 164 arrests in South Australia to date, Operation Ironside continues to evolve. Authorities warn that criminal networks may adapt to encrypted communication tools, necessitating ongoing innovation in law enforcement strategies. The latest phase also signals a broader trend: as crypto adoption grows, so does the need for robust regulatory and technological frameworks to combat its misuse.