Operation Trojan Shield

Through collaboration with other law enforcement agencies worldwide, the operation resulted in the arrest of over 800 suspects allegedly involved in criminal activity in 16 countries.

The FBI alleges that the investigation revealed that Phantom Secure sold its encrypted devices exclusively to members of transnational criminal organizations (TCO).

Around the same time, the San Diego FBI branch had been working with a person, known by the pseudonym "Afgoo",[4] who had been developing a "next-generation" encrypted device for use by criminal networks.

[10] The ANOM devices consisted of a messaging app running on Android smartphones with a custom ROM called ArcaneOS that had been specially modified to disable normal functions such as voice telephony, email, or location services, and with the addition of PIN entry screen scrambling to randomise the layout of the numbers, the deletion of all information on the phone if a specific PIN is entered, and the option for the automatic deletion of all information if unused for a specific period of time.

[13] Use of the app spread through word of mouth,[6] and was also encouraged by undercover agents;[14] drug trafficker Hakan Ayik was identified "as someone who was trusted and was going to be able to successfully distribute this platform", and without his knowledge was encouraged by undercover agents to use and sell the devices on the black market, further expanding its use.

A newer MLAT and court order from Lithuania allowed the FBI to receive ANOM user data every Monday, Wednesday and Friday until 7 June 2021.

[3] It is not entirely clear why this date was chosen, but news organisations have speculated it might be related to a warrant for server access expiring on 7 June.

Australian Prime Minister Scott Morrison said that the sting operation had "struck a heavy blow against organised crime".

[22] In 2022, Motherboard journalist Joseph Cox published documents stating that the FBI obtained message data through the cooperation of an unnamed country within the European Union.

Australian Federal Police arrested 224 suspects and seized 104 firearms and confiscated cash and possessions valued at more than 45 million AUD.

[30] In the Netherlands, 49 people were arrested by Dutch National Police while they investigated 25 drug production facilities and narcotics caches.

Linda Staaf, head of the Swedish police's intelligence activities, said that the suspects in Sweden had a higher rate of violent crime than the other countries.

Initially, no arrests were made in the United States because of 4th amendment interpretations that prevented law enforcement from collecting messages from domestic subjects.

[32] However, the United States Department of Justice indicted seventeen persons (all foreign nationals, see court dockets here) under the Racketeer Influenced and Corrupt Organizations Act for their participation in "the ANOM enterprise" which spread the devices.

[33] As of April 2023[update], multiple court cases have been brought in Australia to challenge the legitimacy of the ANOM sting operation.

ANOM app screenshot
displays FBI and AFP graphics, a "Trojan Shield" graphic and a "This domain has been seized" notice, with a form inviting visitors "To determine if your account is associated with an ongoing investigation, please enter any device details below"
ANOM website screenshot, 10 June 2021
Press conference announcing the Operation Trojan Shield arrests