Cryptophone supplier Sky Global takes legal action over US government website seizures
Canadian tech company Sky Global has filed a legal motion claiming that the US government unlawfully seized the company’s internet sites following police investigations into the use of its cryptophones by organised crime
Sky Global, the Canadian tech company at the centre of a multinational police investigation into organised criminal gangs that used the company’s encrypted phones for drug dealing, is seeking a court order against the US government.
The Vancouver-based company argues in legal documents that the FBI and other US enforcement agencies acted unlawfully by seizing the company’s web domains, causing irreparable damage to its business and operations.
Sky Global said it marketed its phones to legitimate business users, including members of the legal, healthcare and financial industries, and presented use cases for those industries on its websites. The firm also supplied free phones to a Canadian police force in the hope that it would lead to a contract.
Ashwin Ram, attorney for Sky Global, said the US government’s treatment of the company was troubling. “Anyone concerned about privacy should be deeply troubled by how the government almost shut down a legitimate, law-abiding company that was attempting to address critical issues around data protection and privacy,” he said.
US prosecutors indicted Sky Global’s Canadian CEO, Jean-Francois Eap, and a former phone distributor, Thomas Herdman, in March 2021, for racketeering and knowingly facilitating the import and distribution of drugs and the sale of encrypted communications devices.
Sky Global argues, however, in a “notice of motion” filed in the Southern District of California court, that supplying encrypted phones is not illegal. The company has not been charged with any corporate crime and the US has made no attempt to extradite its CEO.
“Providing encrypted messaging solutions and protecting consumers’ privacy rights is not illegal. Indeed, numerous high-profile companies, including WhatsApp, Signal and Apple, provide consumers with encrypted messaging services,” it states.
The company argues that it took steps to ensure its Sky ECC phones, which provide an encrypted messaging service, were not used for illegal purposes.
“What has happened here is the equivalent of the government seizing Apple.com because drug dealers use iPhone encryption features to communicate with each other. Such a seizure would never be allowed to happen to Apple or any other high-profile tech company,” the company states in a legal motion for the return of its property.
“What has happened here is the equivalent of the government seizing Apple.com because drug dealers use iPhone encryption features to communicate with each other. Such a seizure would never be allowed to happen to Apple or any other high-profile tech company”
Sky ECC legal complaint
Sky ECC, which operated from Canada and the US, claimed to have 120,000 users worldwide, making it one of the largest encrypted phone networks.
The company hit the headlines in March 2021 when Belgian, French and Dutch police launched raids against suspected organised crime groups and drug dealers identified through intercepted messages from the phones.
Experts from the French Gendarmerie were able to intercept and decrypt hundreds of millions of messages after gaining access to the company’s servers, which were hosted by the French cloud services provider OVH at its Roubaix datacentre. Other servers were based in Canada.
The police operation had similarities to an investigation by the Dutch and French police, with the UK’s National Crime Agency, into the EncroChat encrypted phone network, which used the same datacentre.
Return of domains
Sky Global is seeking an order to require the FBI to return 116 internet domains seized by the FBI and other US law enforcement agencies in March 2021 and US Immigration and Customs Enforcement (ICE) Homeland Security Investigations in May 2020.
The seizures “crippled” Sky Global’s business operations, making it impossible for it to email its business partners, and the company had to lay off 27 staff members and 14 contractors.
“Despite not having been charged with any crime, Sky Global’s own websites are being used by the government to broadcast to the world the false and damaging suggestion that Sky Global was involved in serious criminal conduct in the United States and Canada,” the motion states.
After the first seizure, according to a US warrant, around 6,000 Sky ECC users migrated to An0m, also known as Anom, an encrypted phone service created and run by the FBI and the Australian Federal Police to capture drug trafficking communications.
This suggests that, at most, 5% of Sky ECC’s 120,000 users were potentially involved in the criminal activity alleged to have occurred in its investigation and related prosecution, according to the legal motion.
According to a US Department of Justice press release, demand for An0m “grew exponentially” after the FBI and the San Diego US Attorney’s Office dismantled Sky Global in March 2021.
“Criminal users sought a new brand of hardened encryption device to plot their drug trafficking and money laundering transactions and to evade law enforcement,” it said.
Ashwin Ram, a partner at law firm Steptoe & Johnson in Los Angeles, acting for Sky Global, said its client had no control over its resellers and customers beyond contractual obligations prohibiting the unlawful use and marketing of its technology.
“Sky Global was essentially used as a pawn by law enforcement to support investigations against a small fraction of Sky Global’s users and its third-party sales network,” he said.
Sky sought to limit criminal use
Sky Global argues in its court filing that it took specific steps to limit the ability of Sky ECC’s customers to use encrypted phones for illicit activities.
“Sky Global was essentially used as a pawn by law enforcement to support investigations against a small fraction of Sky Global’s users and its third-party sales network”
Ashwin Ram, Steptoe & Jonhson
They included terms and conditions and a master distribution agreement that required resellers and distributors not to sell the phones to anyone for “illegal, illicit or criminal use”.
Sky Global also reviewed websites and social media to ensure that its phones were not being marketed inappropriately, including for criminal purposes.
From April 2020, Sky said it took a more active role by requiring that all Sky ECC third-party distributors obtained its approval for any new websites, advertisements or social media posts.
The company also said in its filing that it “consistently cooperated with law enforcement”. Sky ECC’s partners were required to refuse requests to remotely wipe phones know to be the subject of a legal investigation.
Sky ECC’s law enforcement guidelines, filed in the court, state that Sky cooperated with law enforcement agencies but did not have access to data about its customers.
The company said it could not provide law enforcement officers with access to text messages, photographs, phone numbers, metadata, the number of messages sent by users, their IP address and location, among other data.
According to the guidelines, Sky Global was only able to provide law enforcement with the date an account was created, and the date of last use, if provided with a customer’s account number.
The company also stated it would not respond to law enforcement service orders from countries outside Canada unless the request was made through a mutual legal assistance treaty or letters rogatory.
US refused to disclose warrants
According to the legal motion, the US government has refused to disclose copies of the seizure warrants or any information about the legal basis for the seizure and retention of Sky Global’s internet domains, “thus depriving it of any meaningful opportunity for judicial review”.
Sky Global’s CEO, Jean-François Eap, and his legal representative contacted the US government in July 2021 to discuss the charges against him and to explore the possibility of cooperating with the government in its investigation. Eap voluntarily handed over internal documents.
“The government, however, has declined to engage in substantive discussions regarding the forfeiture,” the complaint states. As a result, Sky Global “has been left with no option” but to take legal action to recover its seized property.
Sky Global has not been charged with a crime and it cannot be held criminally liable, the company claims.
But the seizure allowed the government to use Sky Global’s own websites to suggest that the company was the subject of criminal allegations in both the US and Canada, despite the fact it has never been charged.
The suggestions of criminality were ambiguous and damaging and devoid of context or detail, it claims.
The government’s seizure of Sky Global’s domains also “demonstrates a callous disregard for the company’s rights”, under the US Constitution, including its right to due process and the right to be protected from unlawful prior restraint on its free expression.
The government’s claim that it cannot provide Sky Global with copies of the warrants because they were filed under seal is a red herring, as the investigation has been publicly disclosed in court documents and no longer needs to be protected, Sky Global claims.
“Even if the warrants themselves were initially sealed, the necessity for maintaining the seal has expired,” it says.
Seizure notices posted on the company’s websites by ICE Homeland Security Investigations in May failed to “identify the court that purportedly issued the seizure warrant” and appear to erroneously identify both the seizure authority and the underlying violations committed.
Sky Global’s domain name provider, Go Daddy, wrote to Sky’s legal adviser in October 2021 declining to disclose the warrant and other documentation issued by US law enforcement to seize the company’s domains, on the grounds that the warrant was still under seal.
US indictment sought arrest of CEO and distributor
US prosecutors issued an arrest warrant in March 2021 for Jean-François Eap, the CEO of Sky Global following an international police operation to penetrate the company’s network and harvest “hundreds of millions” of messages.
A federal grand jury in the US indicted Eap for racketeering and knowingly facilitating the import and distribution of illegal drugs through the sale of encrypted communications devices.
Sky Global denies any wrongdoing and claims that the US appears to have made no attempts to extradite Eap.
The grand jury also indicted a former distributor of Sky ECC phones, Thomas Herdman.
The US arrest warrants, issued on 12 March 2021, followed a series of raids by Belgian and Dutch police on suspected drug traffickers following a joint operation with French law enforcement that harvested supposedly secure messages from the Sky ECC phone network.
Canadian entrepreneur: Jean-François Eap
Jean-François Eap, an entrepreneur with a background in computer science and the telecommunications industry, founded Sky Global in 2010.
The company launched its encrypted phone network, Sky ECC in 2013, based on BlackBerry’s unified endpoint management (UEM) services. It later made its encrypted communications service available on Android and Apple iPhones.
The company sold its phones through third-party distributors which employed their own resellers, but none of them were employed by Sky Global, according to the complaint.
Sky Global also developed Moola, a secure app that allows people to buy, store and save gift cards.
Eap also runs a number of other business ventures, including the mobile phone retail and wholesale businesses Inspire Wireless and Pepper Wireless. He is co-founder of high-end sushi restaurant Hello Nori with his partner Jennifer Zhang.
Sky ECC supplied phones that offer self-destructing messages, secure audio messages, a secure encrypted vault, and an app that can disguise itself as a calculator “in secure mode”. One of the company’s selling points was that it did not store encrypted messages on its servers.
Authorised partners offered Android, BlackBerry and iOS mobile phones for between €900 and €2,000. The phones could also be bought from Sky Global’s website.
Sky ECC distributor: Thomas Herdman
Thomas Herdman, a former distributor for Sky ECC, was responsible for the international distribution of Sky Global devices throughout the world.
Little is known about Herdman, but according to a now deleted biography, he ran a consulting company based in Japan and Vancouver.
Herdman, who is fluent in Japanese, claimed to have worked for companies including IBM Japan, Honda, Baskin-Robbins International and Daiwa Securities.
He claimed to be a specialist in capital financing, project development, acquisitions and divestitures. According to the biography, he participated in gold exploration ventures in Africa, and oil and gas projects in North America.
He offered advice on trading cryptocurrencies and consultancy on bitcoin, according to a second biography published for a speaking engagement in 2018, and was in the process of adding a crypto payment system to Sky Messaging.
