How Belgian police infiltrated messaging service Sky ECC in February and March, gaining access to a billion messages and facilitating arrests and drug seizures
Criminals thought encrypted Sky ECC cellphones were impregnable, but cops tapped a billion messages, yielding arrests and drug seizures Tweets: @drewharwell , @kimzetter , @marson_jr , @keegan_hamilton , and @shelbyholliday Tweets: Drew Harwell / @drewharwell : Wild story about the secret police hack of a global network for drug runners, gangsters and hitmen: “Here are pictures of the wife. You can break her legs” https://www.wsj.com/... https://twitter.com/... Kim Zetter / @kimzetter : Using supposedly impregnable encrypted phones, Serbian hit men discussed plans to kill a judge. But as they texted, their messages also flashed up on the computer screens of a secret police team in Belgium that had hacked into the messenger service they were using, Sky ECC. https://twitter.com/... James Marson / @marson_jr : “The gangsters plotting to assassinate a judge thought they were leaving nothing to chance. But cops hundreds of miles away were on to them.” My story from inside the biggest police hack of an encrypted service. https://www.wsj.com/... Keegan Hamilton / @keegan_hamilton : What the DEA and European authorities saw when they gained access to the Sky ECC encrypted phone network... https://www.wsj.com/... https://twitter.com/... Shelby Holliday / @shelbyholliday : “Users, confident in Sky's impregnability, shared pictures of corpses, severed heads and other body parts, as well as bricks of cocaine & stacks of cash. One user sent a photo to demonstrate he had carried out an order to torture a victim.” https://www.wsj.com/...
Context & Ripple Effects
The WSJ investigation closes a loop that opened with the FBI's takedown of Phantom Secure, the encrypted-phone vendor that had become Sinaloa Cartel infrastructure, and accelerated when police infiltrated EncroChat in mid-2020, reading millions of messages for months. Sky ECC was the next domino: Dutch and Belgian police announced its shutdown after infiltrating it from February, claiming 100+ arrests.
What the WSJ adds is scale and texture — about a billion messages accessed over February and March, hitmen discussing plans to kill a Serbian judge, and a pipeline that handed access onward to the DEA and other European authorities. It also foreshadows the long tail: later US court records show American agencies still mining the Sky haul years afterward.
First-order effects
- Sky ECC subscribers — drug traffickers, hitmen, and other organized-crime users who paid for 'impregnable' phones — were readable in real time, driving the arrests and drug seizures Belgian and Dutch police announced at the shutdown.
- The DEA and European authorities gained access to the same billion-message corpus, extending the operational reach of the Belgian infiltration well beyond Belgium.
Second-order effects
- Every surviving encrypted-phone vendor serving criminal markets faces a trust collapse: the EncroChat-to-Sky ECC sequence shows no provider in this niche has held up against state intrusion, pushing buyers toward whatever channel they perceive as next.
- Police agencies now have a proven playbook — infiltrate the provider, sit on the traffic, share the haul across borders — which they can aim at the successor networks criminals migrate to.
Third-order effects
- If the pattern holds, dedicated criminal-communications hardware becomes structurally unviable, collapsing that market segment and forcing law enforcement and defendants alike into unresolved legal territory over mass collection of private messages — already visible in US courts adjudicating access to the Sky data years later.
The trend: Law enforcement is shifting from one-off takedowns of encrypted phone networks to sustained, multi-agency covert access whose message troves keep producing arrests for years after the service dies.