Police win high-stakes challenge to legality of Operation Ironside encrypted app AN0M

A Supreme Court judge has ruled in favour of the AFP, finding their ground-breaking encrypted app AN0M was used legally in Operation Ironside.

The AFP’s AN0M app.

The Australian Federal Police have scored a significant legal ­victory, with a Supreme Court judge ruling the technology underpinning Operation Ironside, the AFP/FBI sting of the century, was used legally.

In a ruling in the South Australian Supreme Court on Wednesday, Justice Adam Kimber found the AFP’s encrypted communications app, AN0M, had not been used in breach of the Telecommunication (Interception and Access) Act 1979.

The ruling refers only to two individuals charged during Operation Ironside in 2021, known only as TB and CD. However, the finding is expected to have flow-on effects for similar challenges which have been launched in ­Adelaide and in Sydney.

The legal challenges came after Operation Ironside was revealed in June 2021, when police launched raids across Australia and ultimately charged 390 people with 2351 offences.

Globally, a further 993 suspects were arrested.

The raids brought down bikie gangs, organised crime networks and Mafia leaders.

It was built around an encrypted app known as AN0M, which police planted into the criminal underworld by tricking “influencers’’ into believing it was a safe and secure way to communicate without being seen by law enforcement.

In fact, police were copying 28 million messages sent over the app, and have been using the contents of the messages as evidence in court cases across Australia.

The two South Australian defendants are jointly charged with participating in a criminal organisation and offences involving firearms. They argued the messages should not be admissible, arguing the police had obtained them in breach of the Telecommunication Act which required a warrant for interception.

Police in response had argued that the way the copy messages were obtained was not a technical interception, and therefore no warrant was required.

Justice Kimber found in favour of the police, finding that the messages had been copied within the AN0M app, and that the copying of the message did not occur during the passage of the message via the telecommunications system.

The judge’s ruling also gave a fascinating insight into how police pulled off the biggest crime bust in Australian history, in a ruling likely to be examined closely by cyber security experts.

“The AN0M application was programmed to function in the following way,’’ Justice Kimber said. “When user A prepared a message in the application and pressed the send button with the intention of sending the message to user B, A’s message would be sent to B using the telecommunications system.

“However, when A pressed the send button and before A’s message left the application, a separate copy message was created within the application. The copy message was a copy of A’s message to B but with additional data added.

“The creation and existence of the copy message was unknown to A and B. The copy message having been created, that copy was sent using the telecommunications system to a server in NSW. The AFP then obtained the copy messages from that server.”

In dismissing the application, he found: “The way the AN0M application functioned did not amount to an interception in breach of s 7(1) of the TIAA.”

“The prohibition in s 7(1) of the TIAA is upon recording (i.e. – copying) a communication in its passage over the telecommunications system. That prohibition was not breached.”