How a Canadian Company's Encrypted Phones Ended Up in the Hands of Criminals Worldwide

To buy it, you had to meet a dealer in person, and bring cash. Sometimes he’d ask to meet in a hotel lobby, sometimes a cafe. The security protocol was strict.

The dealer himself only had a small supply, carefully meted out by a superior in a larger hierarchy. And he would only deal with you once he had verified you and made sure you were not a law enforcement agent.

What was this coveted product? Not a drug, not a weapon — but privacy. These dealers were selling phones specially modified by the Canadian company Sky Global, which boasted that their unique security features made them practically uncrackable.

From the outside, the devices looked like ordinary Blackberries or iPhones. But inside, they were different: Their camera, microphone, and GPS were disabled, and the phones came pre-loaded with a special encrypted messenger app, Sky ECC, hidden under the calculator icon. Messages sent via this app were encrypted and completely secure — at least in theory.

But in February and March 2021, a joint force of European law enforcement agencies, led by Belgian, Dutch and French investigators, managed to crack Sky Global by tapping into its servers, giving them an unprecedented glimpse at what was happening on its phones. Around the same time, Sky Global’s CEO, Jean-Francois Eap, was indicted in the United States for facilitating drug trafficking. This August, after a multi-year investigation, he was also indicted in France alongside 30 others on a number of charges, including criminal association and money laundering. (A trial in the French case is expected to begin next year, while the current status of the U.S. case is unclear. Eap and other figures associated with Sky have denied wrongdoing.)

The decrypted messages have already been used as evidence in major criminal investigations across Europe, including against a “super cartel” of drug lords who Europol says controlled a third of the continent’s cocaine trade. Police have described the Sky messages as an unprecedented bonanza of intelligence into criminal groups.

“One colleague from the Netherlands said it was as if we were at a table with the criminals,” said Catherine de Bolle, a Belgian police officer who heads Europol. “And it really was.”

All the while, Sky Global’s founder and CEO, Jean-Francois Eap, has portrayed himself as a well-meaning defender of privacy who was inadvertently caught up in a maelstrom of crime. His friends told The Guardian he was a “tech startup nerd” who had never even smoked a cigarette.

Since his U.S. indictment, Eap has been on a drive to clear his name, hiring a PR firm and embarking on a media campaign to explain his point of view. He and Sky Global have insisted that its products were designed for anyone who needed privacy, from politicians to film stars, although they have conceded that in practice some of their users ended up being criminals. But this, argues Eap, is the price of providing privacy to those who need it.

“There is no question that I have been targeted [by law enforcement], as Sky ECC has been targeted, only because we build tools to protect the fundamental right to privacy,” he told Vice shortly after his indictment.

Lawyers for Sky Global have said that the company did its best to clamp down on criminal activity, but that, ultimately, Sky ECC was just a tech tool like any other. In a U.S. court filing in November 2021 to protest the seizure of its web domains, lawyers said the shutdown was “the equivalent of the government seizing Apple.com because drug dealers use iPhone encryption features.”

“It’s never possible — it doesn't matter what product we're talking about — to ensure that no one misuses a product for illicit purposes,” said Ashwin Ram, a U.S. lawyer representing Eap, in an interview. “It’s no different from a gun manufacturer … Some gun somewhere will be misused for criminal purposes.”

Now, drawing on leaked French investigative files, The Crime Messenger investigation by OCCRP and 12 international media partners has uncovered fresh evidence that Sky Global’s management was, at best, willfully blind to the fact that that a number of their users were criminals — and acted in ways that may have facilitated criminal use of the phones.

Sky Global’s distribution network was complex and opaque, with multiple layers of distributors — often based in Canada — overseeing lower-level “resellers,” who moved the product into the hands of end users. These resellers tended to be locals, often with connections to the criminal underworld of their home countries.

Digging into Sky’s distribution companies, reporters found more red flags: In one case, all the founding directors of a key distributor had criminal records. Another distributor was co-owned by a business partner of a convicted arms trafficker.

Ten resellers with ties to France were indicted by the Paris court in August, seven of whom had prior convictions for offenses including drug and weapons trafficking. OCCRP and partners in The Crime Messenger have identified at least a dozen other resellers who also had criminal records, often for serious offenses. Some of them continued to engage with organized crime groups while selling the phones.

Eap’s lawyers told reporters that Sky’s network of third-party distributors was common in the telecom industry, and that it had aimed to build “a distribution network that would honor the company’s policies and contractual obligations.”

In one decrypted Sky conversation summarized in a French police report, Jean-Francois Eap and a man known as Sky111 — a top distributor based in the Netherlands — discuss a problem with Sky111’s main Balkan reseller, Saša Vasilijević.

Vasilijević, it seems, had violated company protocols by openly referring to drugs in a group chat. Sky111 was told by Eap to “remind Sasa of the correct protocols”— and then to re-register him under a different username. The police summary identifies Vasilijević as “a reseller affiliated with the Serbian mafia.” (Vasilijević has denied any ties to criminal activity and has no criminal record.)

(Read more about Vasilijevic and other Balkan resellers for Sky.)

Sky Global’s lawyer, Ashwin Ram, said the company had no knowledge of the group chats in question. “When the company learnt that a distributor, reseller, or end user may have breached its terms of service, it took swift and affirmative remedial action,” he said. “Depending on the circumstances, such measures ranged from reprimand, re-training, to the termination of the contractual agreement. Agents who violated terms of service in a manner that resulted in termination were never re-registered. Similarly, when alerted to the Sasa allegations, Sky Global did not re-register Sasa.”

Aside from Vasilievic, reporters have identified five other Serbian and Croatian Sky dealers with ties to organized crime, or a criminal history of their own. One was Srđan Lalić, a member of the infamous Principi, which made lurid headlines in 2021 after they allegedly kidnapped and murdered men affiliated with a rival gang, and mutilated their bodies inside a “slaughterhouse” in Belgrade. The following year, Lalić cut a deal with Serbian prosecutors and agreed to testify about his criminal activities. (He did not respond to a request for comment for this story.)

Considered tech-savvy by his compatriots within the gang, Lalić had also been placed in charge of helping them improve the security of their communications — and took the opportunity to become a Sky distributor himself, which he later testified he was allowed to do with few questions asked.

In his testimony, Lalić described the Sky features that were most appealing to criminals. The most important?

“It was anonymity,” he said. “The only information users had about each other was the ID.”

As part of the French investigation into Sky, Lalić described to investigating judges how he had been inducted into the Sky system by a man he knew as “Bee,” who provided him with tech support — and advised him not to publicly mention the criminal use of Sky. (Lalic is not a suspect in the French case.)

“Sky was well aware that its system was being used by criminal organizations and [it] wanted to avoid prosecution,” he said. “With this in mind, they advised us not to leave any trace and not to say that Sky was being used for criminal purposes.”

A ‘Massive Hit’ — With Red Flags

Sky Global’s founder, Jean-Francois Eap, was born in Quebec to Cambodian parents who had sought refuge from the Khmer Rouge, an ultra-Communist regime that obsessively spied on its population to repress dissent as it starved and murdered millions.

Eap cites this background to explain his motivation for creating Sky ECC: “You know,” he told reporters from The Crime Messenger in an interview, “I carry that burden that my parents went through when… their lives were taken away from them. Their freedom, there was no freedom.” 

He said he studied computer science at Simon Fraser University in greater Vancouver, but dropped out in his third year to start a “website and hosting” company. He then started working as a customer representative for the Canadian telecom giant Rogers Communications in his early twenties. Finally, he was able to buy out the owners of the Rogers stores he was working at. “This really set me on the path of my entrepreneurial journey,” he said. (Eap continues to own 20 mobile stores in the Vancouver area through two companies, Pepper Wireless and Inspire Wireless, that are distributors for both Rogers and another major Canadian telecom company. Rogers did not respond to a request for comment.)

In 2010, he founded a company he called Secure Enterprises to offer roaming cell phone data packages. But after his phone was hacked, he said he became concerned by poor privacy protocols in the cell phone industry and partnered with a friend to create a product that would “maximize the security” of Blackberry phones. When Blackberry started struggling to compete on the smartphone market, Eap pivoted again, asking his computer scientist father to help him build “a new technology for data and security,” which he called Sky Easy. “It was a massive hit,” he said.

In 2016, the burgeoning company moved into a proper office, and within two years, the team had grown to over 70 employees. Eap said he was proud of the “vibrant” company atmosphere he had created. “We built a technology that gave back and handed back power to users,” he said.

But European police agencies say there were red flags in the operation from the start. Sky had a suspiciously narrow user base — and, French investigators noted, it seemed fine with that, spending very little on marketing. The encrypted messaging platform Telegram, which has also come under fire for offering features that enable criminal activity, has over 950 million users. In contrast, Sky had just 170,000, and Belgian police said only around 70,000 of them were active.

French police have said several times that they could not identify any users who were not criminals, although they have not provided extensive evidence for the claim. Journalists working on The Crime Messenger project also did not find many examples of people who had used the service for legitimate reasons. (Sky Global provided the names of three such users, but only one agreed to be interviewed on the record. He told journalists that he was a security contractor and personal friend of Eap’s who considered the Sky founder a “patriot” due to his advocacy for privacy rights.)

Sky was a closed network — in order to communicate with anyone using the service, you had to already know their six-digit PIN. It was also very expensive compared to other forms of encrypted communication: it cost more than 1,000 euros to buy a Sky device with a six-month subscription to the service. (By contrast, Signal, an encrypted app favored by journalists and other professionals dealing with sensitive subject matter, is free.)

In exchange for these high fees, Sky promised its users the opportunity to communicate in complete secrecy. It marketed itself as impregnable, even offering a prize of $5 million to anyone who could find a vulnerability in its encryption. A Serbian distributor said it had other features that were appealing to criminal groups — especially its “kill switch”: a Sky phone could be erased remotely if its owner were in “distress.”

“In the event of an arrest, the apparatus is “fried,” he told a local court in 2022, using a slang term his criminal group used to refer to erasing electronic devices. “That is, the agent or distributors, on a request from a close friend or colleague, triggers a remote command that destroys all content on the phone.”

This is what first caught the attention of Belgian police, who were investigating shootings and “serious violent offenses” related to cocaine trafficking through the port of Antwerp. They noticed that an unusual number of suspects suddenly seemed to be using Blackberries whose contents were mysteriously wiped after they were arrested.

“The content was deleted almost immediately and remotely by giving a "distress" password and reset to factory settings,” wrote an Antwerp judicial police officer in a 2018 report about the phones. “In other words, no content of contacts, messages or history could thus be retrieved.”

The Belgian police report noted that Sky also advertised that it did not store any messages on servers “accessible to law enforcement.” Overall, it concluded, “the services offered by Sky make police detection and prosecution by the judiciary virtually impossible.”

In a response to questions on the remote wipe feature, lawyers for Eap and his company said Sky Global “implemented a policy that prohibited the wiping of a phone that was suspected of being in police custody.” The company said that customer service and tech support for Sky phones was ultimately up to distributors and resellers, but that they were “expected, and contractually obligated, to follow company policy.”

But in at least some cases in the Crime Messenger files, it is clear they did not. French police found this message on the phone of a prolific Sky distributor: “Very important customer got arrested last night. We wiped his phone. His wife needs his Sky working again. So they are sending back his phone.”

Working With ‘The Smiling Butcher’

Although Sky Global had a website, you couldn’t actually buy its flagship product, Sky ECC, online until 2020. Instead, the company worked through a many-layered network of vendors known as “resellers,” who were managed by distribution companies with bland names like Global Wireless Solutions, Global Wireless Consulting Services, and LevUp Tech. These distributors were selected because they were “known to” Eap through his experience in the telecommunications industry, his lawyers said.

These distributors, in turn, each cultivated their own networks of “resellers” — some of whom were convicted criminals. For example, the man known as “Bee” who inducted Lalić into the world of Sky phones was a convicted drug trafficker named Domingo Sean Abug. He is believed by French investigators to have been the de facto director of Global Wireless Solutions, one of Sky’s biggest distributors. He was also found guilty in Canada on three charges of drug trafficking in 2006. (Abug was among those indicted in France this August for his role in distributing Sky, and a warrant has been issued for his arrest in that case. He did not respond to requests for comment.)

Abug wasn’t alone. It turns out that every one of the distribution company’s founding directors had a criminal record in Canada, according to reporting from CBC/Radio-Canada, a partner in the Crime Messenger investigation.

• Long Minh Vo pleaded guilty to cocaine trafficking in 2003 and was sentenced to two years in prison.

• Terry Nguyen was sentenced to five years in prison for a violent home invasion in 2005, committed while he was out on bail for a heroin trafficking charge.

• A third founding director had a criminal record dating back to 1999, according to a Canadian court registry. 

Global Wireless Solutions, founded by these men in 2015, turned out to be one of Sky’s most effective conduits for getting phones into the hands of users. It worked with some 350 resellers and agents around the world by the time Sky was shut down, including Lalić — who was known in Serbian tabloids as “the Smiling Butcher” — and a convicted French-Serbian drug trafficker called Filip Bukvički.

The higher-ups at Global Wireless Solutions appear to have been well aware that they were working with criminals. In a 2020 chat between Bee and the three founding directors, one boasts of having cornered the street gang market: "We got all the … ghetoo street guys on locked lol."

Another time, one sent a screenshot to another of this chat between a prospective customer and Sky tech support:

There was also at least some concern that their criminal pasts would affect the company: Corporate documents show that the third director was removed from the position within a few days of Global Wireless Solutions’ incorporation. “He “preferred his name not to appear” because he had a “background,” French investigators wrote in a document describing a decrypted Sky group chat between people working at Global Wireless Solutions.”

And not all the violence was in the past. About seven months after Global Wireless Solutions was incorporated in 2015, Nguyen was arrested again after two men burst into a high-end Toronto restaurant where the couple was dining and fired four shots at them. When police arrived on the scene, they found that Nguyen had an illegal semi-automatic handgun in a satchel, violating an order restricting him from carrying firearms. He did not respond to requests for comment.

Nguyen was sentenced to two years in prison for the gun incident, with a judge noting that he still had ties to criminals, and had no legal employment or business.

“He has a criminal record for drug trafficking, a brazen home invasion, and gun-related offenses,” the judge wrote. “Despite his youth, he has twice been sentenced to penitentiary-length terms of imprisonment. Despite the severity of these sentences, he appears to have done little if anything since his release to disengage from criminal gangs and their violent rivalries.”

A few days after this arrest, his name was removed from Global Wireless Solutions’s board of directors. But he does not appear to have actually stopped working there. When he was arrested yet again in 2020, chats analyzed by French investigators capture the alarm of his business partners and a lawyer who provided services to the company at the prospect that the arrest would lead to scrutiny for the firm.

“The problem is how T looks with the company,” the lawyer said at one point. “I think he is in the office more than anyone in this room, so the assumption [by police] is he either owns or [has] a major role in the company.”

Two of the founding directors also appear to have discussed wiping Nguyen’s phone, according to messages intercepted by French police investigators.

They discussed ways to disassociate from him, including quickly drawing up a termination letter and firing him. But if they did that, the lawyer said, it would be difficult to explain why he was receiving dividend checks.

They also floated the idea of reorganizing the company as a secret trust or “going offshore.” Nguyen’s arrest, the lawyer said, was a “good wake up call” and the group should take the opportunity to restructure, potentially even creating a new company they would call Global Sky Works.

Global Wireless Solutions and its directors did not respond to requests for comment, including one sent via the lawyer who participated in these chats. He declined to comment but said he would forward the questions to a contact person at the company. Lawyers for Sky would not comment specifically on Nguyen and Global Wireless Solutions.

Solid Communications

Sky’s top distributor, by share of sales, was the Vancouver-based Solid Communications, co-owned by Tuan Minh Hoang “Tommy” Phan and Aaron Isack, which brought in $149 million in revenue for Sky through a network of nearly 300 resellers across the world, according to the French indictment.

One of these resellers was allegedly a key member of a Croatian drug smuggling group with links to the notorious Serbian drug kingpin Darko Šarić.

Investigative files also show that Solid provided tech support to Bosnia-born drug lord Edin Gacanin, better known as “Tito,” who was arrested in Dubai in November 2022 alongside other alleged drug kingpins accused of running a “super cartel” suspected of controlling around one third of Europe’s cocaine trade. (He was sentenced in absentia by a Dutch court to seven years in prison for drug trafficking. He did not reply to a request for comment.)

At some point in early 2021, shortly before European police moved against Sky, Tito had a conversation over Sky with Phan, according to French investigators. Their chat focused on Sky ECC itself — specifically, “technical questions about contacts and deleting them.”

Another Sky phone user, convicted Canadian arms trafficker Aydan Sin, was a business partner of Phan’s. In June 2017, Phan and Sin incorporated a company together. Two weeks later, Sin was arrested by Canadian authorities after a U.S. investigation found him conspiring to illegally export weapons to Dubai and Colombia.

According to the U.S. indictment against Sin, he and two associates tried to illegally purchase weapons from an undercover agent posing as an arms dealer. They provided the agent with a Blackberry equipped with Sky and helped him configure the phone’s settings. He was told the phone was a safer way to communicate and could be remotely erased in an emergency.

When the agent set up his new phone, he received a message from Sin: “Hi my friend. Finally, we can talk to each other freely.”

Two months later, Sin’s group became suspicious and stopped working with the man. Shortly after that, his phone was remotely erased.

Sin pled guilty to arms trafficking in 2019 and was sentenced to 46 months in prison. He did not respond to a request for comment.

Phan and Isack were both indicted in France this August for their role in selling Sky phones, and warrants have been issued for their arrest. They did not respond to requests for comment.

LevUp Tech

Another key Sky Global distributor was a Vancouver-based firm called LevUp Tech. One of its employees, Thomas Herdman, was indicted by the U.S. alongside Eap in 2021 after he was caught by an undercover officer offering to help “repatriate purported drug proceeds” to the country, according to a U.S. Department of Justice report sent to French authorities. Herdman allegedly sold the undercover officer, who was posing as a member of a drug-trafficking organization, three Sky phones. He was arrested in Spain in June 2021 and transferred to custody in France, where he remains.

Vancouver-born Herdman, 63, began working for LevUp in 2017 as a business development specialist, he told French investigators A Telegram chat between Herdman and LevUp’s owner, Grant Persall, was retrieved by French police and provides many insights into how Sky Global’s distributors operated.

Initially, Persall appeared to be trying to bring Herdman onboard. Explaining to him the potential client base for Sky, Persall rattled off a few possibilities: prostitutes, spies, rappers, corporate executives, people in the marijuana business, loan sharks in Macau, and “government officials that are up to shady shit” in the Philippines.

Herdman raised concerns about Sky’s model of working with independent distributors that all marketed the phones separately, saying it was bound to create confusion.

“You have to remember there are 3 master distributors and we are all pretty close with the owner,” Persall responded, adding that “Jean” had “3 guys working for him that’s built him an empire.” 

By August 2017, Herdman was working with LevUp, and the chat turned to client issues. Parts of the conversation suggest the two men knew the phones were used by criminals.

In a discussion about taking over customers from another reseller, Herdman complained about a competing distributor he said had ties to the “HA,” an apparent reference to the Hells Angels organized crime group.

Later that year, Herdman was trying to turn cryptocurrency into “undetected cash.”

Persall asked if Herdman’s prospective clients should be brought to visit Sky’s Vancouver office, but Herdman said he was unsure about this because they were “African mafia.”

The next day, Herdman referred to another group of unsavory customers, expressing concern that Serbian “gangs” could be vulnerable to tracking by authorities due to a type of identification number known as IMEI. It’s not known which customers Herdman is referring to in this chat, but French investigative files show that his resellers included a Serbian married couple who allegedly shared a Sky ID while the husband was on the run from a prison sentence for armed robbery.

Herdman’s lawyer declined to comment for this article, but in a letter to the investigating judges in 2021, lawyers from the firm representing him said there was no evidence that Sky had been developed “to serve criminals,” nor that the people behind the company had “turned a blind” to criminal use of the application.

The lawyers said Sky was targeted at governments and private companies to help them combat state-level and industrial espionage. It said Sky had committed to providing data on any criminal activities to Canadian authorities, and that the European investigators should have requested information from their counterparts in Canada rather than target all Sky users.

“The application was never designed for criminals, but criminals have been attracted to this product, to the point of monopolizing a part of its clientele,” the lawyers wrote.

Persall said he was unaware of the Telegram chat and that Herdman had been an independently operating licensed distributor for LevUp. 

“LevUp Tech offered technical support to Mr. Herdman when required,” he said. “However, LevUp had no involvement in the business and allowed Mr. Herdman free rein to operate the business with full autonomy. To be clear, as part of our distribution agreement, LevUp Tech prohibits the sale of any device for the purpose of conducting illicit activities.”

The Compliance Department

At its peak, Sky Global had 70 employees and the trappings of any other Vancouver tech startup, holding game and movie nights for its staff. Eap’s lawyer, Ashwin Ram, emphasized in an interview with reporters that the company’s head office had “ten-foot glass ceilings” — a metaphor, he said, for the transparency it embraced.

But employees said they found other aspects of the firm to be strange. For one thing, it was difficult to get answers on who its customers were.

“I was always confused about SKY's commercial policy,” said a graphic designer questioned by French judges as part of their investigation. “There was always a kind of secret atmosphere around this product and how customers got their phone, the installation of the application and the security of the encryption.”

He said he was told the company was aiming for a higher-end market and not “Mr. and Mrs. Everyman,” and that it appeared to have a clientele in Hong Kong, but otherwise he “never quite understood” who would buy the phones.

There was also no budget for marketing Sky ECC. The firm’s former marketing director told judges that very little was done to promote the phones, other than sending brand guidelines to resellers. 

“How do you explain then with minimal or non-existent marketing, the Sky ECC application has had such success all over the world, especially in Europe or America?” the woman was asked during her witness hearing.

“I would reply that I don’t know,” she said.

An Australian woman who worked as a marketing manager for Sky was also interviewed by judges. She said the company claimed that celebrities, rappers, and politicians used the service, but she had never been able to find any of these customers — which she would have liked to do to advertise the platform. 

“The most difficult thing in marketing is when you don't know your users,” she said. “But it was too complicated.”

Sky Global had a two-person compliance team that looked out for examples of misuse, and the French files contain some examples of this. Sky Global also filed a package of evidence to the Paris Judicial Tribunal in 2022 describing the efforts it had made to police the use of its phones, including monitoring social media for references to criminality.

“Sky took affirmative steps to ensure compliance,” said the company’s lawyer, Ram, in an interview, explaining that postings about the product had to be approved by Sky Global and that prospective distributors had to fill out a questionnaire.

But much of Sky’s compliance effort appears to have focused on making sure there were no public references to criminality, and that the resellers were not undercutting each other, according to the French investigators.

In one case, the compliance department noticed that a seller in Brazil had made references to organized crime on its own website. Compliance emailed the seller asking it to remove that language, but does not appear to have followed up to look into the seller.

Eap praised the compliance department for the catch, but added: “[D]o you think it is a problem?”

But in some cases, even issues reported to compliance were apparently ignored. The Australian marketer told the French judges that she had come across a news report about an “authorized partner” of Sky who was arrested in Belgium for criminal activity. Worried about possible bad press, she reported the incident to the senior Sky official handling compliance.

“I said this partner should be removed because he had not respected the conditions of service,” she recounted. “But [the official] said he wasn’t going to remove him as a partner because this article, in his opinion, wasn’t proof and wasn’t sufficient.”

Frédéric Zalac (CBC/Radio-Canada) contributed reporting.