Beyond the wiretap: criminal activity networks in court cases built on captured encrypted data

Purpose Police authorities breached several encrypted chat services in a series of data driven investigations. These services are mostly used by offenders, and the results were thousands of arrests. Limited research has studied the ensuing court cases. In this study, we discuss the strengths and limitations of this data source, and compare the contents of three services: EncroChat, SkyECC, and Anom. Methods We use a sample of 195 court cases from Sweden between 2019 and 2024, where evidence from the encrypted chats was used. The cases involved 667 individuals and 1519 prosecuted offenses, mostly serious drug offences. Results Network analysis indicates that serious drug offences are strongly connected to violence and weapons in EncroChat, cross-border drug trafficking in SkyECC, and weapons offences in Anom. The average sentence length did not differ between the platforms. Given the sequential breach of the services, this suggests that offenders continued using them for planning serious offending, despite public knowledge of the police interventions. Conclusions Information from encrypted chat services is an important supplement for research, policy, and practice concerning criminal groups.