Phantom Secure

» see phantomsecure.com as it lived, on the wayback machine

~ the last words ~

A restaurant in Bellingham, Washington, on 7 March 2018, is where the FBI arrested Vincent Ramos. He lived across the border in Richmond, British Columbia, and he had spent a decade running a company that took ordinary BlackBerry and Android handsets and stripped them down to a single function. Eight days later the Department of Justice unsealed an indictment against Ramos and four associates, and Phantom Secure stopped existing.

The product was a phone with its features removed. The camera and the GPS chip came out physically, along with the browser. What was left was encrypted messaging, routed through servers placed in jurisdictions with strict privacy law, and a remote kill switch that let the company wipe a handset from a distance if its owner asked, or if a handset ended up somewhere it should not be. Marketed as privacy hardware, the devices were, in the FBI's account, used almost entirely by one customer segment.

That segment was organized crime. Prosecutors said Phantom Secure had been generating about 80 million dollars a year since 2008 and had roughly 20,000 devices in circulation, and the indictment named the Sinaloa Cartel among the clients. The charge was not that Ramos had built encryption, which is legal, but that he had knowingly sold it as an evasion tool to people he understood to be traffickers. He pleaded guilty under RICO in 2019 and took nine years in US federal prison, with a separate drug conspiracy count dropped in the plea.

~ the record ~

~ the business model ~

Phantom Secure had no consumer funnel at all. There was no store page and nothing to download. You got a device because somebody who already had one vouched for you, and the subscription ran into the thousands of dollars a year. For a product this notorious, almost nobody who reads this page could have been a customer even if they had wanted to be, which is a strange kind of distance for a dead network to have.

The referral requirement was also the security model. Keeping the user base closed is what kept the network coherent, and it is what made the whole thing legible to prosecutors once they got inside. A system where every customer is vouched for by another customer is a system where the membership list is also a conspiracy chart.

~ the arrest ~

One detail from the investigation is the reason this grave is interesting rather than merely sordid. The FBI, according to reporting on the case, asked Ramos to install a backdoor into the Phantom Secure network. He declined. He then went to prison for nine years, having refused the one cooperation that might have shortened the sentence, which reads as either a principle or a calculation about what happens in that business to people who cooperate.

The case reached further than the company. In September 2019 the RCMP arrested Cameron Ortis, the Director General of its own National Intelligence Coordination Centre, on charges of leaking classified material. The indictment described special operational information passed in 2015 to an individual identified as "V.R.". Ortis was sentenced to fourteen years in early 2024. Ramos was released in November 2024 and deported to Canada.

~ the inheritance ~

When Phantom Secure went down, its users needed somewhere to go, and the market obliged. One of the services they moved to was ANOM, which was run by the FBI from the beginning. Every message on it was readable by the people the network was sold to defeat, and when the operation was finally announced in June 2021 it produced hundreds of arrests across dozens of countries. Taking out Phantom Secure created the demand that made the honeypot work. EncroChat, dismantled by French and Dutch police in 2020, filled part of the same gap and ended the same way.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »