Exclu

~ the obituary ~

Five hundred euros bought three months on Exclu. For the last five months of its existence the Dutch police were reading it. That is the whole grave, and everything else is detail about how a service whose only product was secrecy managed to run for years without ever finding out that it had none.

Exclu was an encrypted messaging service sold as a subscription rather than as an app you could find in a store. Licenses went for five hundred euros for three months, and either eight hundred or nine hundred for six depending on which agency's press release you read. It had somewhere around three thousand users. Nobody has ever established publicly when it started operating or who built the first version; the paper trail begins with a German investigation opened in june 2020, which is late in the story rather than early.

There is no nostalgia in this one and no distance for me to perform. I never touched it and neither did anybody I have ever met. It belongs on this list because of what it was selling, which was the same thing every legitimate secure messenger sells: end to end encryption on a locked down handset, with the promise that the math is enough. The math was never the part that failed here.

~ the case file ~

~ how it worked ~

The business model of a criminal-grade messenger is a subscription to a phone, not to software. You buy the handset with the service already on it, you pay for a fixed license period, and the appeal is precisely that the thing is not on any app store and cannot be downloaded by somebody who wandered in. That closed distribution is sold as the security feature. In practice it means the entire user base is a customer list held by one small operation, and the entire network is one set of servers rented from somebody.

This was the third of these to fall in three years. EncroChat was taken apart in june 2020 and Sky ECC in march 2021, both of them by European police who got inside the infrastructure rather than inside the ciphertext. Exclu picked up users from both collapses, which meant that by 2022 it was carrying people who had already been burned twice by exactly the failure mode that was about to happen to them a third time.

~ the raid ~

In 2019 German police raided CyberBunker, a bulletproof hosting operation running out of a former military bunker at Traben-Trarbach. That raid produced the data that let investigators decrypt Exclu traffic. Two operations ran off it: one from september 2020 aimed at the people running the service, and one from late april 2022 aimed at the people using it.

The action day was 3 february 2023, and seventy nine locations were searched across four countries at once. Reported arrest counts sit between forty two and forty eight depending on the source, and Eurojust's own figure is forty five. Investigators came out with over five million euros in cash, three hundred thousand ecstasy tablets, twenty firearms and two hundred phones, along with the drug production sites those numbers imply.

~ the funny part ~

What killed Exclu is that it was hosted somewhere it thought was untouchable. CyberBunker's entire pitch was that a decommissioned bunker in a German valley was outside the reach of anybody with a warrant, and that pitch attracted the sort of customer who most needed it to be true. When it turned out not to be true, the raid did not just take down the host. It seeded a four-year investigation into everything the host had been holding.

So the lesson is not about encryption at all. Every one of these services worked exactly as advertised at the cryptographic layer, and every one of them died at the layer underneath, where somebody has to own a server in a building in a country with police in it. Secrecy sold by subscription always has a customer database attached, and the whole thing is only ever as private as the least careful person running it.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »