Balkan Criminals Planned Murders Using Encrypted Phones from Canadian Start-Up Sky Global

“Boom, Mare hits him in the head. … He got a brutal beating, by then, bro, he was already seriously unconscious. … Afterwards, bro, he was all black. He didn’t resist much, didn’t cry, nothing. He was in terrible shock.”

The messages were pouring into the group chat: Srđan Lalić, a member of a notorious Serbian criminal group, and several of his “brothers” were giving their bosses a blow-by-blow account of a murder they had just committed, complete with photographs of the man’s mutilated body.

But Lalić wasn’t just a ruthless gangster — he had a day job too. He was an authorized reseller for a Vancouver-based encrypted phone company, Sky Global, which promised its users they could communicate in absolute secrecy — as long as they also had a Sky phone. 

By his own account, Lalić generated as much as 120,000 euros per month in sales for Sky Global, even as he and his group used its flagship product — the Sky ECC encrypted phone — to organize the torture, dismemberment, and murder of their enemies.

“We didn’t use regular phones,” he told French judges last year, testifying as a witness in a case they were mounting against Sky Global and its distribution network. “It was a way of avoiding possible investigations.”

A world of violence and mayhem unfolded inside the secret confines of Sky phones, which were used to plan murders, cocaine smuggling routes, and heists across Europe from 2016 to 2021. When the encryption was finally cracked in a 2021 joint operation by French, Belgian, and Dutch police, messages involving criminal activity in different countries were passed to law enforcement agencies across Europe. In France earlier this year, investigators concluded a multi-year probe into the Sky Global universe and laid charges against 31 people they said had facilitated crime by distributing Sky phones.

For years in Serbia, Lalić’s organized criminal group, the Principi, had enjoyed what many believed was government protection. But the evidence found on the phones — images of tortured and murdered rivals, swapped in jovial group chats — was apparently too shocking to ignore. Lalić and dozens of other Principi members, including accused gang leader Veljko Belivuk, were arrested in 2021. 

The following year, Lalić cut a deal with Serbian prosecutors and agreed to testify about his criminal activities, which included taking part in six murders inside a house in a Belgrade suburb nicknamed “The Slaughterhouse,” since victims lured there were often dismembered or run through a meat grinder after being killed. Serbian tabloids breathlessly covered Lalić’s testimony, dubbing him “the Smiling Butcher” after an image of the gangster grinning next to a badly beaten corpse was leaked to the press.

Against this lurid backdrop, the detailed statement he gave about his work selling Sky phones attracted less attention. But it provides some of the best insight we have into how the phones made their way into the hands of criminals around the world: often through other criminals acting as resellers.

Lalić told the French judges he had always assumed the company knew its user base included members of organized criminal groups — and claimed he had been told as much in his orientation sessions.

“Sky was well aware that its system was being used by criminal organizations and wanted to avoid prosecution,” he said. “With this in mind, they advised us not to leave any trace and not to say that Sky was being used for criminal purposes.”

Sky Global, the Canadian company that sold the encrypted phones, has insisted that it only ever wanted to create a tool to enable private communication. The company says its terms of use prohibited criminal activity, although like any tech tool, it could be abused by a determined user. But evidence obtained by reporters as part of the Crime Messenger project shows that some of the phone's most prolific users were organized crime figures.

The Crime Messenger investigation, a collaboration between 13 media partners across Europe and Canada, is the most comprehensive look to date at Sky Global and how its products were sold and used. It is based on a leak of around 3,800 files from the criminal case in France, where the Paris Judicial Court has centralized European proceedings against people associated with the company. 

Resellers were critical figures in the Sky universe: In addition to drumming up local clientele for the phones, they were responsible for handling tech support issues. When a problem arose that they couldn’t solve, they helped their clients liaise with Sky. And if their clients were arrested or needed to cover their tracks, resellers could also erase the contents of the phones. (This happened in several cases identified by reporters, although Sky said it was against its terms of service and that it refused to wipe phones if they were in police custody.)

Until now, Lalić was the only criminal whose work as a Sky reseller had been reported. But the materials obtained as part of the leak enabled reporters to identify at least five other Sky resellers who appear to be tied to Balkan organized crime or who have criminal convictions. 

One of them was an alleged member of a Croatian criminal group linked to an infamous Serbian drug lord. Another was a convicted bank robber who appears to have worked with his wife to sell Sky phones while on the run in Spain. A third appears to have been friends with a number of gang members of Škaljari, the equally violent archrivals of the Kavač group, with which Lalić and the Principi were aligned.

By 2020, the year before the police operation against Sky, the Kavač and Škaljari were locked in an escalating gang war that was racking up dozens of casualties on both sides. The groups had originated on different sides of the same mountain on the Montenegrin coast before taking their cocaine-selling business — and brutal rivalry — global. OCCRP reported that year that the Kavač-Škaljari war had already led to several dozen murders across Europe. Today, the number is believed to be at least 85.

The Crime Messenger investigation shows that this rift also played out inside the world of Sky resellers: Evidence from Serbian court cases and French investigative files show that each group bought phones from different resellers. So while Lalić was selling Sky phones to the Principi, the Škaljari purchased from another man, Saša Vasilijević, whose role as a phone vendor to Serbia’s criminal underworld has never been reported before. (He has denied any criminal activity or involvement with Sky phones.)

The findings underscore the extent to which Sky Global enabled organized crime in countries like Serbia, even as it publicly claimed to cater to clients who needed extra privacy, like journalists, politicians, and celebrities.

“This application was crucial for members of criminal organizations in coordinating international operations, such as drug trafficking and money laundering,” said Saša Ðorđević, a senior analyst at the Global Initiative Against Transnational Organized Crime. 

“It’s particularly interesting that English, Albanian, and the languages of the peoples of the former Yugoslavia were the most represented in the conversations, which shows how much members of Balkan criminal groups relied on Sky ECC,” he said.

Srđan Lalić

Lalić was known among the Principi as their most tech-savvy member, helping his fellow gangsters set up GPS locators and surveillance cameras when they wanted to tail their enemies. He first started using Sky in 2017 after the gang’s leader, Belivuk, bought him an account as a gift a year earlier. 

“It was the only means of communication — we didn’t use a regular phone,” he told French investigating judges who questioned him last year. (Lalić also described his work for Sky while testifying before a Serbian court about the Principi’s criminal activities in 2022. This story draws on both of these sources.)

Later, he told investigators, he bought his own Sky account from a man he knew only as Ivan, who ran a phone shop on a busy street corner in Belgrade. He then applied to become a reseller by filling out a form on Sky’s website, and was contacted by a person nicknamed “Bee,” who also managed Ivan. (Everyone on Sky used a nickname as well as having a unique numerical PIN — Lalić’s was “Barry Mills,” after the notorious American neo-Nazi prison gang leader.)

Lalić seemed to believe that Bee, who used a skyecc.com email address, worked directly for Sky, but French investigators would later identify him as a senior figure at Global Wireless Solutions, one of Sky’s biggest distribution companies.

(Read more about Sky’s layered set-up, which insulated the company from dealing directly with some of its worst clients.)

Bee told him that Sky had around 70 employees and 800 sales agents around the world, and explained how it would work to become a reseller.

“We talked about sales conditions and capacities,” Lalić said in court. “We reached an agreement in principle, and he insisted that I open a company.”

He decided to set up a firm in the Czech Republic called “Panzerbox,” through which he would conduct his business as a Sky reseller. (Czech corporate records confirm his account. But a Principi boss later ordered Lalić to transfer the Czech company to other members of the group to use for narcotics trafficking, he said, since it was a “clean” company without a record of having been used for crime.)

After Lalić was taken on as a reseller, he said he was “trained by Sky management” on how to use and sell the phones. It was important for him to understand the phone’s capabilities since he would then go on to train end-users.

“We, as agents or distributors, directly trained users and we presented them with all the advantages, that is, the possibilities of the Sky application that they could use to protect themselves from investigative authorities,” he said.

The training initially took place over emails and messages, on both Sky and another encrypted app, Threema. Later, he said, Sky set up a site called the “Sky Learning Academy,” which had “educational materials,” for resellers, as well as tests they were required to take to keep their licenses.

When Lalić was fully onboarded, he got access to a portal that helped him manage the accounts he sold. Since one of his Sky nicknames was “Panzer,” he was given the email address pancer@skyecc.net. He started a promotional website called Pancersky.com, which was translated into eight languages.

At first Lalić had to charge Sky’s standard prices — around 1,000 euros for a six-month subscription, or 550 euros for three months — but as he acquired more clients, he was allowed to offer discounts.

Eventually, he grew so successful — and was so “responsible and timely,” he boasted in his testimony — that Bee offered him a new title, what he called Sky’s “Balkan representative.” He began to acquire and manage his own stable of resellers, who nurtured their own clientele: “Balkan SKY” in Serbia, “Alfa Pro” in Croatia, “Hugo” in Montenegro, “Joker” in Austria, “Junior” in North Macedonia, Albania, and Switzerland, and “Zeus” in Slovenia. (Their real names are not identified in court files.)

At one point, Lalić said, he was generating 80,000 to 120,000 euros a month for Sky, collecting the money from his agents in cash and sending it to the company. Initially, he used bank transfers, but as the sums grew larger he was instructed to use Bitcoin or other cryptocurrency, routed through an exchange in the Netherlands.

Meanwhile, he remained involved in gang warfare — sometimes even using his position as a reseller to gain an advantage. In 2020, he managed to trick Sky’s technical support into helping him look up several IDs belonging to rival gang members, even though they were not his clients and he should not have been able to see their information. Using this subterfuge, he learned that they were in Greece. He passed this information to his “brothers,” who hunted down the men and killed them.

“At that moment it was a key clue to finding them,” Lalić said of his discovery. “For that, [an associate] promised me a kilogram of cocaine, which he did not pay me.”

Saša Vasilijević

Saša Vasilijević owns an unassuming phone repair shop called iGadgetz in Čačak, a mid-sized town in central Serbia. But his business has involved more than just fixing iPhones: He also sold Sky phones to 1,504 customers between 2016 and 2021, making him the company’s main reseller in the Balkans, according to a French judicial police report.

Unlike Sky’s other Serbian resellers, he keeps a low profile and has left few traces in public records. He has never been convicted of a crime. Local authorities told reporters they had never heard of him. 

But Vasilijević’s Sky messages reveal his familiarity with Serbia’s criminal underworld. A number of them include photographs of weapons or drugs. After examining the material, French investigators concluded that he was “a reseller affiliated with the Serbian mafia.”

While other resellers in Serbia received their instructions from one of Sky’s distribution companies, Vasilijević worked directly under Jeroen van der Werf, a Dutch man who went by the alias Sky111 and worked directly for Sky Global.

The two men appeared to be close, with Vasilijević referring to van der Werf as “brother” and confiding in him about his fears for his family amid Serbia’s escalating gang war.

He appeared to have friends among the Škaljari, the rivals to the Principi group. His messages show he was frightened by revelations of the Principi’s cruelty — and that he knew Sky resellers were among them. 

In March 2021, Serbian President Aleksandar Vučić held a televised press conference to announce an operation against the Principi, and displayed gruesome photographs extracted from their Sky phones of the violence they had meted out against the Škaljari. (This marked the beginning of the revelations about the “slaughterhouse” in the Belgrade suburbs.)

The next day, Vasilijević sent van der Werf a photo of one of the bodies that had been shown on television, writing, "1st one was my friend, bro.”

“[A]ll those scoundrels who killed my friends, cut off their heads and sent [photos to] each other to Sky, they have opened their device and many of resellers who worked together with them are under surveillance now,” he wrote in broken English.

“I have plenty proofs what they do for that piece of shits who killed at least 30 of my friends and some of the resellers been directly involved in one kill,” he said in another message.  

Van der Werf’s response is not logged in the investigative files, and it is unclear what he did with the information shared by Vasilijević. He did not respond to a request for comment.

But in an earlier incident described in French investigative files, van der Werf and the founder of Sky Global, Jean-Francois Eap, had become aware that Vasilijević had himself apparently violated company protocols by openly referring to drugs in a group chat. In a private conversation decrypted by investigators, Eap instructed van der Werf to “remind Sasa of the correct protocols”— but they then agreed to re-register him as a new agent.

Vasilijević was not among other Sky figures indicted earlier this year. The Public Prosecutor’s Office for Organized Crime in Serbia said it had not received a request from French investigators to interview Vasilijević. The Paris court did not respond to a request for comment. 

Reached for comment by KRIK, Vasilijević denied having ever sold Sky phones. When journalists read him the messages he allegedly exchanged with Sky111, he said he didn’t recognize them: “I don’t know what I did five days ago, let alone in 2020.”

Ante Vrcan

Ante Vrcan was allegedly a key member of a Croatian drug smuggling group with links to the notorious Serbian drug kingpin Darko Šarić. He, along with other alleged members of the group, was indicted last year for smuggling at least 609 kilograms of cocaine — worth over $18 million — from Ecuador to Europe between 2019 and 2022. Vrcan’s role, according to Croatian prosecutors, was to finance the purchase of the drug and to extract it from containers arriving in Croatia.

The indictments were based on evidence extracted from Sky phones and sent to Croatian authorities — but it has not been reported before that Vrcan was also a Sky reseller. According to French prosecutors, Vrcan oversaw logistics, money transfers, and maintenance of Sky phones for his criminal network. Vrcan did not reply to a request for comment sent via his lawyer.

Like Lalić, Vrcan said he had become a reseller by contacting the company directly. And like Lalić, he ended up working for one of Sky’s main distribution companies — in this case, the Vancouver-based company Solid Joint, co-owned by Tuan Minh Hoang “Tommy” Phan. (Phan did not respond to a request for comment.)

Interviewed by Croatian prosecutors at the request of the French judges investigating the Sky case, he confirmed that he had sold Sky phones, but denied knowing Phan. (Vrcan is not charged in the French case.) He described himself as an “agent,” finding resellers for Sky, which would then pay him a commission, he claimed.

“The reseller paid Sky … they informed me whether the payment had been made, and if it had not, the subscription would be terminated,” he said. It was, he added, “an ideal job.”

Vrcan said that he had worked with resellers in Colombia, Panama, and Ecuador. To avoid paying taxes, he collected his commissions through an offshore company he set up in Belize. Sky, he said, “did not object to such a payment method.”

But the company was bothered by the fact that he was offering better prices than other agents, he said. Vrcan claimed that he had found a bug in the Sky portal that allowed him to download information about his competitors. He began to keep track of others working in Latin America and trying to win over their customers by offering better terms. Competitors reported him, and Sky warned him that this behavior would not be tolerated, he said.

“Other agents found out about my intention, they complained to the head office in Canada and I received a warning that if I continue with such actions, they will disconnect me from the system.”

In March 2010, three men wearing wigs and masks and carrying bouquets of flowers burst into a bank in the southern Serbian city of Niš, making away with almost 50 million Serbian dinars (about $657,000) after beating up the security guards. The dramatic robbery — “like something out of a film,” local media reported — made national headlines, even in a country inured to the outrageous exploits of its organized criminal groups.

One of these bewigged men was Miodrag “Misha” Kostić, who fled the scene and managed to escape the country. Although he was convicted in absentia for the armed robbery, he spent a decade on the run until he was finally caught in Spain and extradited back to Serbia, where he pled guilty in exchange for a five-year prison sentence in 2022. 

During Kostić’s time on the run, either he or his wife, Sanja Petković, began selling Sky phones, according to French police, who said they believed the couple both used the Sky PIN 28762B. That user had transmitted multiple personal photos of Kostić, as well as a scan of Petković’s passports and images of drugs and weapons.

The user also sent messages negotiating a cocaine sale, and exchanged 269 messages with Thomas Herdman, a high-level distributor of Sky devices who was indicted in the U.S. in 2021 alongside Sky CEO Jean-Francois Eap.

At several points in their conversations, Herdman demanded money — “I have been very kind in giving Misha and you time to pay,” he wrote — and instructed the user behind Sky PIN 28762B  to pay an intermediary in the Frenchtown of Evian, who would then transfer the money to Paris to be exchanged for bitcoins. (This was a common method Herdman used to launder money, he allegedly told U.S. undercover agents who approached him to buy Sky phones. Herdman’s lawyers declined to comment for this story, but in a 2021 letter to French investigating judges they said Sky was “never designed for criminals” and was instead intended for governments and private companies. They said there was no evidence the people behind Sky had encouraged or ignored criminal use of the application.)

Petković was interviewed by French investigating judges last year and denied having used Sky or selling its phones. A few months later, Kostić was also interviewed. He admitted to using Sky, but said it was only to keep in touch with his family. He denied being a reseller or working for Herdman. Neither Kostić nor his wife was indicted in the French case, and there is no indication they are  under investigation in France or formal suspects.

Kostić said he couldn’t remember his Sky username and had no idea who was using Sky PIN 28762B. He could not explain why this account transmitted personal images of him, or why Herdman addressed that user by the name “Sanja.”

Reached for comment by KRIK, Kostić reiterated that he had used Sky phones to stay in contact with his family while on the run, but that he did not sell them. He says that the numerous phones and cards that the police found in his house were "ordinary phones," although French investigating judges said that they were actually Sky phones.

"That's all... How can I explain it to you, these are ordinary phones, that... It's nothing. These are ordinary [SIM] cards," Kostić said.

Filip Bukvički

Bukvički, a French citizen of Serbian descent, was convicted of cocaine trafficking by a French court in September 2020 and sentenced to one year in prison. He was indicted once again in August this year — this time for his role as a reseller of Sky phones.

French prosecutors claim that Bukvički sold Sky phones to his friends and associates from his hometown of Clermont-Ferrand in central France. He also allegedly used Sky to organize his own criminal activities, including smuggling drugs and weapons, according to the French indictment.

The indictment alleged that Bukvički was “at the heart of a large network in the Clermont-Ferrand region that is primarily focused on smuggling cocaine and weapons with suppliers from South America, but also with connections in the Balkans.”

A key piece of evidence against Bukvički is testimony from one of his friends — and Sky clients — who told police he smuggled drugs with Bukvički from mid-2019 to the end of 2021. He confirmed that Bukvički went by the nickname "Mister Freeze,” which was also one of his Sky usernames.

"I am deeply saddened that a longtime friend would lie about me like this," Bukvički said of this witness during one of several interrogations about his work with Sky and alleged drug trafficking. 

He has insisted he had no connection to the app. Bukvički did not respond to a request for comment.

Bukvički did not respond to a request for comment sent via his lawyer.

Nikola Mikić

In early 2021, French police noticed that a Serbian living in Paris frequently pinged the same cell towers as a Sky user with the ID 7F7HH8. They came to suspect he might be a major reseller of the encrypted phones. 

Early in the morning on March 23, 2021, police raided the man’s apartment and arrested him, but he said he had nothing to do with Sky and instead blamed his friend, another Serbian named Nikola Mikić, who had been staying with him for several months. He claimed that Mikić frequently traveled with him, which might explain the cell tower pings. Mikić already had a criminal record in Serbia, having been convicted of drug trafficking in 2009 and sentenced to three years in prison.

Shortly after his friend accused him of reselling Sky phones, Mikić was arrested and confessed to police that he had indeed been a Sky reseller using the 7F7HH8 account. He said he started selling the phones in 2019, after he met a man in Serbia named “Nenad,” who had explained to him how the phones worked and showed him the company website.

“He explained that it's not legal, but not illegal either. And then he offered to find me customers in France,” Mikić told police.

He claimed he received 100 euros per phone, but had only sold about 17.

Mikić later backtracked, however, and said that “Nenad” didn’t exist. Instead, a man named “Vuk” had given him the phones — but he’d been so afraid of Vuk he hadn’t wanted to mention him, he said. 

The numbers didn’t add up, either. According to French police, 7F7HH8 had had 374 known clients — most of whom were involved in drug trafficking — and had made a profit of 472,500 euros from selling Sky phones.

Mikić claimed he eventually came to realize that “this kind of phone and structure are used for illegitimate things” and quit the business.

“I saw that I don’t belong in this world,” he said. “I'm not made for this. It's not my nature. I'm trying to earn a bit of money, but it's not my character — and I couldn't find any customers.”

But Sky messages extracted from the phone of 7F7HH8 also found the user was a member of a Sky group chat in which participants seemed to be talking about the sale of 300 kilograms of drugs. Mikić offered to help find a contact in Spain for one member of the group.

Mikić told reporters that he didn’t earn anything from selling Sky phones. He said he had taken over another agent’s Sky account, and the clients mentioned by the French prosecutors had belonged to that person. His own clients were not criminals, he said.

"I asked people in my environment [to buy Sky phones] and I only know people who have companies, who are lawyers, who sell real estate. I don't have a circle of people around me who do cocaine, sell weapons," he said.

Mikić said he had not been jailed ahead of trial, but that his passport had been confiscated so that he could not leave France.

"I don't know how it will turn out,” he said.

Sofija Bogosavljev, Tamara Todorović, Sofija Parojčić, Milica Vojinović, Bojana Jovanović, and Stevan Dojčinović contributed reporting.