Cracking the app’s code and the investigation into organized crime in Athens.
In July 2021, Dutch journalist Peter R. de Vries was murdered in an armed ambush in the center of Amsterdam. On the cell phone of one of the perpetrators, the Dutch police discovered an encrypted application that no one knew about until then: MATRIX.
Law enforcement was able to crack the app’s code and recover a huge amount of data from the criminals’ communications –text messages, photos, and audio files. Last April, the Directorate for Combating Organized Crime of the Hellenic Police, the so-called “Greek FBI” in Athens, was officially informed that a portion of the recovered MATRIX data was of Greek interest.
Peter R. de Vries, 64, an Emmy Award-winning investigative crime journalist with a long-standing television presence, had uncovered major organized crime cases and was also a witness in high-profile trials in the Netherlands, including those for the Moroccan mafia.
On the afternoon of July 6, 2021, he left a broadcast studio where he had been a guest and walked alone down the street. At 7.28 pm on Lange Leidsedwarsstraat, in the center of Amsterdam, he was approached by an unknown man dressed in black and shot five times at close range.
Less than an hour later, two suspected attackers –Dutchman Delano G., 21, an aspiring rapper, and Polish Kamil E., 35– were arrested on a motorway near The Hague. In their car were found a gun and a cell phone on which an encrypted messaging application was installed. It was the first time the Dutch authorities saw MATRIX.
De Vries died on July 16, 2021, nine days after the attack. His assassination caused grief and shock, with the King of the Netherlands, Willem-Alexander, calling it “an attack on journalism, the cornerstone of our constitutional state, and therefore an attack on the rule of law.”
It was later revealed that the journalist was speaking to a protected witness in the trial of a leading member of a criminal organization, although the person who ordered the murder remains unknown. On the other hand, in June 2024, the two actual perpetrators and another accomplice were sentenced to 26 and 28 years in prison.
Why Any Reporter Can Now Source Free, Quality Satellite Images of Almost Anywhere on Earth
Journalists can now get free high-resolution satellite images from around the world in minutes, without any specialized knowledge.
“He’s “Sleeping”, Don’t Worry”
In the car of the perpetrators, as noted in an Amsterdam court decision (note: this concerns a fourth man with a peripheral role in the murder), was found a Google Pixel mobile phone device. “The phone data was encrypted with Pretty Good Privacy (PGP) software for use with the MATRIX application,” the court order said.
The user of the device was identified by a nine-digit code number (referred to as the “MATRIX ID Number”), which exchanged messages with a corresponding encrypted phone code, believed to be carried by the perpetrators’ accomplice – unknown where, but far from the scene of the attack.
According to the court decision, the communication on MATRIX began at 4.40 pm the day before the murder and continued until the moment the two shooters were arrested on the highway outside The Hague. Users exchanged photos and also text messages in Dutch and Polish relating to the details of the attack.
De Vries was shot at 7.28 pm. The perpetrators returned to the car and two minutes later, they received a message on MATRIX in Polish (some phrases are in slang): “What happened? Hasn’t he arrived yet?” The co-driver writes: “Brother, hahaha […] He’s dead […] Two bullets went through his head […] He’s “sleeping”, don’t worry.”
The perpetrators wrote that they were heading for the highway. Half an hour later, at 7.59 pm, one of the suspects in the car writes on MATRIX: “Police behind us”, and the accomplice replies –“They will catch us. Destroy the phone. Eat the SIM card.” At 8.13 pm, the police car is about to stop them. The co-driver types on MATRIX: “Turn it off. Take care of me fam […]” and the accomplice writes “Turn off the phone”. After that, all communication ceases.
The MATRIX
Three and a half years later, on December 3, 2024, Europol announced the “cracking” of MATRIX. As noted, the investigation was triggered by the findings on the mobile phone of the suspect in the murder of de Vries. In the ensuing operation, codenamed Passionflower, Dutch and French police recovered 2.3 million messages in 33 different languages. Investigations were also carried out in Spain, Germany, Italy and Lithuania.
Europol describes MATRIX as “a messaging service created by criminals for criminals.” The bulk of the data was related to communications for drug trafficking, money laundering, and arms trafficking. The owner and manager of MATRIX is believed to be a 52-year-old Lithuanian man who was arrested in Spain at the request of Dutch authorities.
The cost for a device and the first six-month subscription to the service ranged from €1,300 to €1,600. Approximately 8,000 accounts were identified, most of them in southern European countries, according to Dutch police. MATRIX could only be accessed by invitation.
“For three months, authorities have been able to intercept messages from suspected criminals, which will now be used to support new investigations,” Europol said.
The “Dark” Greek Telegram
The encrypted messaging platform appears to be revising its policy of cooperating with law enforcement. The latest data for Greece.
The Greek Files
In mid-April last year, a team from the Hellenic Police’s Directorate for Combating Organized Crime, the so-called “Greek FBI”, was summoned to Europol’s headquarters in The Hague. Other police representatives from their counterparts in the Member States were invited to the same meeting. The purpose of the trip was for them to be informed about MATRIX. Europol told the Athens team that among the recovered files there was a volume of messages of Greek interest.
According to a reliable source, the Attica Narcotics Squad is expected to receive the first package of data recovered from the service in the near future. In addition, the first meeting between Greeks and officers from other countries at the level of national police services has been scheduled to conduct a joint investigation of a major case.
Jan-Jaap Oerlemans, Assistant Professor of Criminal Law at Leiden University in the Netherlands, told iMEdD that criminal organizations chose MATRIX because it was considered difficult to intercept communications using traditional surveillance methods. “In addition, the MATRIX phones had the ability to self-destruct data if a user was caught, making it difficult to recover information,” he said.
Oerlemans noted that law enforcement first encountered “crypto-phones” or “PGP phones” in 2016. The investigation focused on Ennetcom encrypted communications service, which was used with BlackBerry phones that could only exchange messages with each other.
Since then, European law enforcement services have cracked eight other encrypted mobile services –including Ironchat, EnchroChat, SKY ECC and Ghost. MATRIX is the last link in the chain, the most technically advanced application.
In 2021, Europol coordinated a transnational police operation to crack the SKY ECC application, which was mainly used by international drug traffickers. The Hellenic Police received the file at the end of 2023.
“It was a labyrinthine archive, with countless files,” one police officer told iMEdD. The Narcotics Squad analyzed a large amount of data and compiled the first two case files. In one of them, the defendant is a police officer who allegedly communicated with drug traffickers.
Defendants have argued that the authorities’ access to the encrypted messages was retroactive, without any stipulation for declassifying the communications. Both cases remain open and will be heard by the Athens Court of Appeal in the coming months.
“What you actually see are two codes talking to each other. The difficult part of the investigation is identifying the people using the app,” said the same officer. “However, as the criminals feel completely protected, in both cases there are users who have sent selfies, photos of their desks and even documents from previous cases involving themselves.”
