Canadian arrests formed part of an international operation announced on September 18, 2024 against Ghost, an encrypted communications platform that police said had been built for serious organized crime. Europol coordinated the effort with judicial and law-enforcement authorities across several countries.
Investigators targeted a service, not encryption itself
Ghost offered modified devices and encrypted messaging functions, including a feature that could remotely destroy messages. Police alleged that its administrators knowingly catered to criminal networks involved in large-scale drug trafficking, money laundering and violence.
Secure communications also have legitimate uses, so the relevant allegation concerned the service’s operation and customers rather than a claim that encryption is inherently criminal.
The investigation was international
An operational task force created at Europol in 2022 brought together Australia, Canada, France, Ireland, Italy, the Netherlands, Sweden and the United States. Iceland also participated in the enforcement action, while Eurojust supported judicial coordination.
Authorities synchronized searches, arrests and evidence collection so suspects could not simply move activity across borders.
Police announced dozens of arrests
Europol reported 51 arrests during the initial action, with more expected. Australian police arrested a man alleged to be the platform’s administrator, and other suspects were detained in participating countries, including Canada.
An arrest is not a finding of guilt; each defendant remained subject to the law and courts of the relevant jurisdiction.
Ghost was a closed criminal ecosystem, police alleged
According to Europol, several thousand people worldwide used the platform and about 1,000 messages were exchanged each day. Access reportedly involved specialized handsets sold through a reseller network rather than an ordinary consumer download.
Investigators said intercepted exchanges helped prevent threats and exposed alleged trafficking and money-laundering activity.
Canada’s role reflected the platform’s reach
Canadian police took part in the task force and enforcement phase because users and suspected criminal conduct crossed national boundaries. Public announcements did not mean every user, device or message had the same evidentiary significance.
Charges and court filings were needed to establish the precise Canadian allegations.
Digital evidence must withstand scrutiny
Investigators must demonstrate how data were obtained, attributed and preserved. Defence lawyers can challenge search authority, device ownership, message context and continuity of evidence.
International operations add questions about which country’s laws governed interception and how material was lawfully shared.
The operation continued a broader pattern
Police have previously penetrated or disrupted criminal communications systems such as EncroChat, Sky ECC and AN0M. Those operations can generate many investigations, but they do not eliminate demand for secret communications or organized crime.
Networks often migrate to new tools, making financial investigation and conventional evidence important alongside technical access.
Claims should stay tied to official evidence
The takedown demonstrated extensive cooperation and a potentially valuable intelligence source. It did not establish that all encrypted platforms facilitate crime or that authorities should receive unrestricted access to private communications.
A trustworthy account therefore separates Europol’s operational claims, the charges laid in each country and later court findings. It also recognizes the unresolved policy tension: governments need lawful tools against serious crime, while journalists, businesses and ordinary citizens depend on strong cybersecurity and confidential communication.
Future reporting should track prosecutions, dismissed cases and judicial rulings rather than treating arrest totals as the final measure of success. That evidence will show how much of the announced intelligence translated into proved offences.
