Episode

EP 105 — Secret Cells

23 November 2021 Official episode · Official transcript

cybercrime

The episode examines encrypted-phone companies used by criminals and the increasingly aggressive law-enforcement operations used to infiltrate their devices, servers, and communications.

Topics: Encrypted-phone platforms and closed user networks, PGP-encrypted email, Remote wiping of seized devices, Law-enforcement deployment of malware to endpoints, Malicious software updates and update-server compromise, Supply-chain attacks involving fake devices or applications, Server misconfiguration and exposed encryption keys, Real-time collection of encrypted-message content, Honeypot communications platforms, SIM-swapping, End-to-end encrypted messaging, Law-enforcement offensive cyber operations, RICO prosecutions involving encrypted-phone companies

Official episode-page sources

Links published on the Darknet Diaries episode page. Not LLM output.

Entities (33)

Claims (24)

Qualified statements from this episode, not graph facts.

Phantom Secure DEVELOPED_BY Vince Ramos

Joseph states that Vince Ramos created Phantom Secure.

Explicit Confidence 99% · Joseph Cox EP 105 Details

“The person who created Phantom Secure was Vince Ramos.”

Joseph Cox · offsets 7898–7952

Phantom Secure USES BlackBerry

Phantom Secure took BlackBerry phones and customized them for its service.

Explicit Confidence 99% · Joseph Cox EP 105 Details

“take a BlackBerry, load it with sort of custom PGP-encrypted e-mail software”

Joseph Cox · offsets 5330–5406

Phantom Secure USES PGP

Phantom Secure devices provided PGP-encrypted email.

Explicit Confidence 99% · Joseph Cox EP 105 Details

“custom PGP-encrypted e-mail software”

Joseph Cox · offsets 5370–5406

Phantom Secure USES remote wipe

Phantom Secure offered customers the ability to remotely wipe data from phones.

Explicit Confidence 99% · Joseph Cox EP 105 Details

“They also introduced a feature where you can remotely wipe what was stored on the phone.”

Joseph Cox · offsets 5440–5528

Phantom Secure takedown INVOLVES Phantom Secure

The Phantom Secure takedown concerned the company and its encrypted-phone operation.

Derived Confidence 91% · Jack Rhysider EP 105 Details

“the feds took it down in 2018”

Jack Rhysider · offsets 26363–26392

Encrochat USES remote wipe

Encrochat devices included wipe functionality.

Explicit Confidence 98% · Joseph Cox EP 105 Details

“It also had a wipe functionality.”

Joseph Cox · offsets 26989–27022

Encrochat malware operation INVOLVES Encrochat

The operation targeted Encrochat's infrastructure and devices.

Explicit Confidence 98% · Jack Rhysider EP 105 Details

“the French police got a warrant to access the data center and Encrochat’s server”

Jack Rhysider · offsets 29328–29408

Encrochat malware operation INVOLVES malicious update

French police used a malicious update distributed through an Encrochat update server.

Explicit Confidence 99% · Joseph Cox EP 105 Details

“pushed this malicious update to the Encrochat devices”

Joseph Cox · offsets 30235–30288

Encrochat malware operation INVOLVES spyware

The operation involved malware that silently copied messages and potentially GPS data from Encrochat devices.

Explicit Confidence 99% · Joseph Cox EP 105 Details

“this piece of malware, it would silently send copies of the messages sent and received”

Joseph Cox · offsets 30404–30490

Operation Venetic INVOLVES Encrochat

Joseph says Encrochat data was placed under the Operation Venetic umbrella in the UK, with some uncertainty.

Uncertain Confidence 90% · Joseph Cox EP 105 Details

“when the Encrochat data came in, I believe they put it under that umbrella as well”

Joseph Cox · offsets 36911–36993

Sky ECC USES remote wipe

Sky advertised self-destruct messaging functionality.

Explicit Confidence 97% · Jack Rhysider EP 105 Details

“The website lists the features of the phone, saying it’s got a self-destruct messaging capability”

Jack Rhysider · offsets 42351–42448

Sky fake-device operation INVOLVES Sky ECC

The operation involved fake Sky devices or apps being introduced into European markets.

Attributed Confidence 94% · Joseph Cox EP 105 Details

“somebody introduced fake Sky devices to the markets in Europe”

Joseph Cox · offsets 44458–44519

Sky fake-device operation INVOLVES supply chain attack

Jack characterizes the suspected interception and compromise of devices before sale as a supply-chain attack.

Derived Confidence 96% · Jack Rhysider EP 105 Details

“I would call this a supply chain attack.”

Jack Rhysider · offsets 45243–45283

Sky fake-device operation INVOLVES Sky ECC

The suspected fake-device operation concerned Sky phones and applications.

Explicit Confidence 96% · Jack Rhysider EP 105 Details

“These weren’t the official Sky chat apps that were supposed to be secure.”

Jack Rhysider · offsets 44981–45054

Ennetcom server misconfiguration ASSOCIATED_WITH Ennetcom

Joseph attributes the ability to decrypt Ennetcom communications to a possible server-side encryption misconfiguration or implementation issue.

Uncertain Confidence 95% · Joseph Cox EP 105 Details

“it appears that there was some sort of misconfiguration with how Ennetcom encrypted these communications”

Joseph Cox · offsets 48873–48977

MPC USES Ennetcom

MPC's operators used Ennetcom before deciding to create their own encrypted-phone company.

Explicit Confidence 98% · Joseph Cox EP 105 Details

“They did use Ennetcom for a while”

Joseph Cox · offsets 53793–53826

MPC ASSOCIATED_WITH James Gillespie

Joseph identifies James Gillespie as one of the brothers running MPC, while noting that his brother was also involved.

Attributed Confidence 88% · Joseph Cox EP 105 Details

“James Gillespie and his brother as well”

Joseph Cox · offsets 58753–58792

MPC ASSOCIATED_WITH Martin Kok

Joseph reports that MPC worked with Martin Kok on branding and advertising before Kok was assassinated; he further says the assassination was reportedly carried out with MPC's consent and help.

Attributed Confidence 84% · Joseph Cox EP 105 Details

“this was an assassination with the consent and the help of MPC”

Joseph Cox · offsets 57972–58034

ANOM ASSOCIATED_WITH Honeypot

ANOM was secretly presented as an encrypted phone while functioning as an FBI honeypot.

Explicit Confidence 99% · Jack Rhysider EP 105 Details

“It was a honeypot created entirely by the FBI to snoop, spy, and gather incriminating evidence from criminals.”

Jack Rhysider · offsets 61901–62011

Operation Trojan Shield INVOLVES ANOM

Operation Trojan Shield was the FBI operation involving ANOM phones.

Explicit Confidence 99% · Jack Rhysider EP 105 Details

“This was dubbed Operation Trojan Shield in the FBI, and their ANOM phones”

Jack Rhysider · offsets 62517–62590

Operation Trojan Shield INVOLVES Honeypot

The campaign used ANOM as a covert honeypot to collect evidence from users.

Derived Confidence 98% · Jack Rhysider EP 105 Details

“a honeypot created entirely by the FBI”

Jack Rhysider · offsets 61908–61946

Silent Circle DEVELOPED_BY Phil Zimmermann

Joseph says Silent Circle was made by Phil Zimmermann, the creator of PGP.

Explicit Confidence 99% · Joseph Cox EP 105 Details

“that is made by Phil Zimmermann, the creator of PGP”

Joseph Cox · offsets 63398–63449

Phil Zimmermann ASSOCIATED_WITH PGP

Phil Zimmermann is identified as the creator of PGP.

Explicit Confidence 98% · Joseph Cox EP 105 Details

“the creator of PGP”

Joseph Cox · offsets 63431–63449

Signal USES PGP

No claim extracted; Signal is described as using end-to-end encryption, but the episode does not identify that encryption as PGP.

Uncertain Confidence 0% EP 105 Details

Transcript references

Works mentioned in the transcript. Distinct from show-note sources.

Extraction provenance

Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:21:54.485539+00:00