Research report: Beyond the wiretap: criminal activity networks in court cases built on captured encrypted data

When police breached the encrypted phone networks EncroChat, SkyECC and Anom, they gained access to millions of messages that most users believed were invisible to law enforcement. A new study of 195 Swedish district court cases decided between 2019 and 2024 shows what those intercepted conversations were actually used for: overwhelmingly serious drug offences, tightly linked to violence, weapons and cross-border trafficking. The research, published in the journal Crime Science, analysed 667 individuals and 1519 prosecuted offences, amounting to 3417 years of prison time in total, with life sentences counted as 25 years.

The study, by Alberto Chrysoulakis, Kim Moeller and Manne Gerell, is the first to appraise court cases built on captured encrypted data as a research data source and to compare criminal contents across the three platforms. The researchers obtained a list of case numbers from the Swedish Police Authority covering cases where an EncroChat, SkyECC or Anom phone was used as evidence, confiscated, or otherwise part of the investigation. They then scraped the court rulings, coding the date of the hearing, the offences, the sentence length in months, and which platform or platforms featured in each case.

The three services were breached in sequence. Swedish police received millions of messages from EncroChat in June 2020, and subsequently many times more from SkyECC and Anom. The phones themselves were purpose-built for secrecy: they carried Pretty Good Privacy encryption alongside a conventional operating system, had microphones, cameras and satellite positioning removed, included an instant wipe function for messages and contacts, and were sold anonymously for around 1500 euros plus a subscription of roughly 2200 euros per year. Owning one, the authors note, was itself a costly signal of criminal intent.

Across all three platforms, drugs were the most common crime type, but the profiles differed. In cases built on Anom material, drug offences accounted for 66 per cent of all offences, compared with 56 per cent for SkyECC and 44 per cent for EncroChat. Violent crimes appeared in 17 per cent of EncroChat cases, 9 per cent of SkyECC cases and 6 per cent of Anom cases. Compared with Swedish prison sentence statistics from 2018, the court case material contained a higher share of domestic drug offences, drug trafficking and money laundering, while fraud, kidnapping and threats, theft and robbery, and traffic offences were more common in the official registries than in the encrypted-chat cases.

A network analysis of how crime types co-occurred within court cases found that drug offences, violence and weapons offences were the central activities on all three platforms. Domestic drug distribution sat at the heart of every network, connecting to the other central crime types. But there were platform-specific differences: weapons offences had higher eigenvector centrality in Anom cases than in SkyECC cases, while cross-border drug trafficking scored higher in SkyECC than in the other two. Serious drug offences were strongly connected to violence and weapons in EncroChat, to cross-border drug trafficking in SkyECC, and to weapons offences in Anom. The authors note that the link between drugs and weapons aligns with prior research showing that drug seizures are more likely within cases involving firearm seizures.

Perhaps the most striking finding concerns sentencing. The mean sentence length did not differ significantly between the platforms: 64.2 months for Anom, 66.5 months for EncroChat and 62.6 months for SkyECC. Given that the platforms were breached one after another, with each breach becoming public knowledge, the authors argue this suggests offenders continued using the successor services to plan serious offending even after it was revealed that EncroChat had been compromised. In some court cases, chat conversations in SkyECC explicitly mentioned the breach of EncroChat, yet the users continued using SkyECC anyway.

The temporal pattern of the cases broadly follows the sequence of the breaches. EncroChat cases peaked in 2021, Anom cases in 2022, and SkyECC cases in 2023 and 2024. The cases that increased from 2023 to 2024 were drug trafficking and money laundering, which the authors note may be more difficult to prosecute. Seven individuals in the sample were involved in cases based on material from different platforms, and one in ten individuals appeared in more than one court case, supporting the picture of users migrating between services as each one fell.

The study is careful about the limitations of its data source. Court documents are a funnelled version of the offending described in the original message corpus: not all messages were secured or decrypted, offenders self-selected into using these expensive services, and Swedish police prioritised pursuing criminal groups, violence, drugs, money laundering, weapons and explosives. The Hells Angels, for example, are absent from the Swedish court material despite being a known active criminal group. Attribution between anonymous accounts and individuals was also a challenge, and a large part of the court documents addresses how police triangulated chat information with external evidence such as financial movements, cell tower location data and photographs of physical meetings. Thirteen per cent of the defendants were not convicted of any crime.

The authors also stress that the data is not affected by institutional priorities or resources in the way conventional police intelligence is, and that without the captured chats most of these cases would likely never have been prosecuted. The material revealed large communication networks between individuals who had not previously been identified by law enforcement. They hope the availability of similar court cases in other countries could usher in what they call a golden age of research into organised crime, comparable to how online data transformed the social sciences more generally.

The use of this evidence has drawn legal criticism. Scholars have argued that defences are disadvantaged in establishing how the data were acquired and how accurate they are, raising concerns under the European Convention on Human Rights. Swedish courts approved the evidence under the principles of free evidence admission and free evidence testing, finding no indication that French police captured the data illegally. Meanwhile, the authors suggest the encrypted phone market may follow the trajectory of cryptomarkets, where the closure of large platforms gave rise to a series of smaller, regionally focused services that proved harder for law enforcement to disrupt. Smaller PGP-phone services have already appeared, and the authors conclude that information from encrypted chat services remains an important supplement for research, policy and practice concerning criminal groups.

Subject of Research: Court cases built on captured encrypted chat data from EncroChat, SkyECC and Anom as a data source for studying organised crime in Sweden

Article Title: Beyond the wiretap: criminal activity networks in court cases built on captured encrypted data

Article References: Chrysoulakis, A., Moeller, K., & Gerell, M. (2026). Beyond the wiretap: criminal activity networks in court cases built on captured encrypted data. Crime Science, 15(1), Article 32. https://doi.org/10.1186/s40163-026-00298-6

Image Credits: AI Generated

DOI: 10.1186/s40163-026-00298-6

Keywords: EncroChat, SkyECC, Anom, organised crime, drug trafficking, encrypted communications, Sweden, court cases, network analysis, sentencing, weapons offences, law enforcement