A smartphone sells for two thousand dollars.

It looks ordinary. A Google Pixel. Android.

Open the calculator app. Enter a specific numeric sequence. Press equals. The calculator disappears. In its place opens an encrypted messaging client.

Between late 2018 and June 2021, approximately twelve thousand of these devices circulate through the global criminal underworld. They are bought by Italian mafia cells, Albanian organized crime groups, Australian outlaw motorcycle clubs, South American drug trafficking organizations, and public officials accepting bribes in at least five jurisdictions.

Every message sent on every one of those phones is copied, in real time, to the Federal Bureau of Investigation.

The phones were designed by the FBI. The network was operated by the FBI. The encrypted brand that criminals trusted — ANOM — was an American government front.

For thirty-three months, the United States ran a communications company for the international drug trade. And read everything.

This is a case file about the most successful law enforcement sting operation in the history of digital communications.

The origin of the operation sits in an older prosecution.

2018. San Diego. The FBI takes down Phantom Secure, a Canadian company that had for years sold encrypted BlackBerry devices to criminal organizations. Among its customers: the Sinaloa Cartel. Phantom Secure's founder, Vincent Ramos, pleads guilty to racketeering. The company is dissolved.

The takedown creates a market vacuum.

Criminal organizations, suddenly without their preferred communications platform, begin migrating to alternatives — most notably Sky Global and EncroChat. These too come under eventual law enforcement pressure. EncroChat is penetrated by French and Dutch authorities in 2020. Sky Global is indicted in March 2021.

But before any of that, in late 2018, a San Diego field office handler meets with a confidential human source.

The source is known in court filings only by the pseudonym Afgoo.

Afgoo had been a distributor for Phantom Secure. Facing federal charges, he cooperates in exchange for a reduced sentence. He brings with him something more valuable than testimony — a product in development.

A new encrypted communications device. Not yet released. Branded ANOM.

The San Diego office sees the opportunity. Afgoo will introduce the device into his existing distribution networks. The FBI and the Australian Federal Police will insert themselves into the architecture before launch.

Every message on the platform will be copied.

The operation is named Trojan Shield. In Australia, Ironside. In Europe, coordinated by Europol, Greenlight.

The technical architecture is deliberate.

ANOM devices are Google Pixel smartphones, purchased at retail and then re-flashed with a custom Android ROM called ArcaneOS. ArcaneOS strips the device of all standard functionality.

No voice calling. No email. No camera roll synchronization. No location services. No third-party app installation. No Google account.

What remains: a messaging application, a basic calculator, a clock, and a settings menu.

The messaging application is hidden.

On first power-up, the user is presented with what appears to be a locked-down secondary phone. Pressing the calculator icon opens a functional calculator. Entering a specific mathematical sequence and pressing the equals key triggers a hidden handshake. The calculator closes. The encrypted messenger opens.

The app pairs with other ANOM devices through what are advertised as secure proxy servers. Messages are end-to-end encrypted between devices. A remote wipe is triggered if a specific duress PIN is entered. The number pad randomizes between uses to defeat shoulder-surfing.

Every security feature that a criminal end user would verify in marketing materials — is real.

There is one additional function. Not in the marketing materials.

Every outbound message generates a silent duplicate. The duplicate is encrypted to a master key held by law enforcement. It is routed to a server the FBI designates internally as the iBot server.

The iBot server is not on U.S. soil.

This is a legal design choice. U.S. Fourth Amendment case law imposes requirements on the interception of communications within the United States. Routing the collection infrastructure offshore — through a third-country partner — allows the surveillance to proceed without triggering those requirements.

The partner is the Australian Federal Police. The collection server operates under Australian legal authority. The intercepted content is shared, through mutual legal assistance treaties, back to U.S. investigators.

The architecture is a silent carbon copy. Encryption is honored for every adversary of the user — except the one the user does not know exists.

Distribution is the hardest part of the operation.

Encrypted phone products in this market do not advertise. They spread entirely through word-of-mouth referral within criminal networks. A cartel lieutenant recommends the device to a distributor. A distributor recommends it to another organization. Trust propagates through existing criminal trust relationships.

Afgoo, the confidential source, supplies the initial seeding. He provides the first ANOM devices to three of his former Phantom Secure distributors in October 2018.

Adoption is slow through 2019. By October of that year, the network has a few hundred users.

Then — acceleration.

In March 2021, French and Dutch law enforcement penetrate EncroChat and shut it down. Sky Global is indicted by the United States. The remaining encrypted phone market consolidates. ANOM, perceived as uncompromised and having operated under the radar for over two years, absorbs a significant share of the displaced customer base.

By May 2021, the FBI affidavit states there are eleven thousand eight hundred ANOM devices distributed across more than one hundred countries. Approximately nine thousand are in active use.

The network has spread into Australia, Germany, the Netherlands, Sweden, Serbia, Finland, Spain, Colombia, and parts of the Middle East. The Swedish national police alone hold active surveillance on six hundred users. The New Zealand police identify fifty-seven.

Across the full network, Europol will later confirm the collection of twenty-seven million individual messages.

Between 2019 and 2021, the FBI San Diego field office builds the operational center.

More than one hundred agents and analysts, supported by eighty linguists, run the daily intelligence flow. Translators handle content in Albanian, Italian, Mandarin, Serbo-Croatian, Spanish, Arabic, Dutch, German, and Turkish. Collection is continuous. Analysis is triaged for threat-to-life situations first, operational intelligence second, prosecutorial evidence third.

The operation produces explicit direct quotes. "There is two kilos put inside french diplomatic sealed envelopes out of Bogota."

That is one intercepted message. It refers to a specific shipping method used by one organization on one date. In isolation, it is useful to investigators in three countries.

Multiplied by twenty-seven million, across three years, it is an intelligence corpus of unprecedented density on the global drug trade.

Public officials appear in the traffic. Corruption investigations open in multiple jurisdictions based solely on ANOM-derived content. Port authorities are named. Customs officers are named. Police officials in at least four countries are named by the users who are paying them.

The operation is not shut down because of failure.

It is shut down because of scale.

June 7 and 8, 2021. The United States Department of Justice, Europol, and the Australian Federal Police announce the operation publicly.

The initial numbers are staggering. More than eight hundred arrests across sixteen countries in coordinated raids. Eight tons of cocaine seized. Twenty-two tons of cannabis. Two tons of methamphetamine. Fifty-five luxury vehicles. Forty-eight million dollars in cash and cryptocurrency.

In Sweden alone, one hundred fifty-five arrests. In Germany, more than seventy. In the Netherlands, extensive operations against an Albanian-linked network.

By the time prosecutions stabilize in subsequent years, the arrest figure climbs above twelve hundred. Seventeen foreign nationals are charged in San Diego federal court under the Racketeer Influenced and Corrupt Organizations Act — accused of knowingly distributing the ANOM platform to support organized crime.

As of April 2025, eight of the seventeen have been extradited to the United States. All have pleaded guilty. The first to be sentenced, Osemah Elhassen, a Lebanese-Australian extradited from Colombia, receives sixty-three months in federal prison in November 2024.

The remainder are in various stages of litigation.

Several defendants have filed motions to dismiss on jurisdictional grounds. Their argument: the United States designed a surveillance platform, deployed it globally, and used the resulting intercepts to prosecute crimes that occurred outside U.S. territory, by non-U.S. citizens, under non-U.S. jurisdiction. In September 2024, U.S. District Judge Janis Sammartino rules against them. Jurisdiction, she finds, is established because ANOM traffic was routed through servers that briefly touched American infrastructure — and because some of the criminal activity coordinated over the platform had a San Diego nexus.

The ruling establishes a precedent. Digital jurisdiction is constructible.

Two reasons are given for the public disclosure.

The first is operational. ANOM's wiretap authorizations were approaching the end of their renewal cycle. U.S. courts had permitted the collection on a rolling basis, but perpetual renewal of wiretap orders against an entire platform — as opposed to individual subjects — was legally untested ground the Department of Justice did not want to test further.

The second reason is strategic. The FBI wanted the existence of the operation to become public.

Jamie Arnold, assistant special agent in charge of the San Diego field office, states the strategic goal at the announcement. "Criminals worldwide will fear that the FBI or another law enforcement organization may, in fact, be running their platform."

The objective was not to maximize any single operation's duration. It was to compromise the broader market. Every encrypted phone company — legitimate or illicit, present or future — now operates under the implicit question of whether its architecture is still its own.

Trust in the category has structurally shifted.

Between 2018 and 2021, every major hardened encrypted phone platform serving criminal organizations has been either dismantled by prosecution, penetrated by intelligence services, or secretly operated by them.

The market category is effectively closed.

Criminal organizations adapt. Reporting since 2022 indicates a migration toward widely used end-to-end encrypted consumer messengers — Signal, Telegram, WhatsApp — mixed with operational security practices like device rotation and disposable accounts. None of these offers the vertically integrated control of a dedicated hardened device. All of them offer something better. Ubiquity. Cover traffic. The cover of the ordinary user.

The unresolved elements of the case file are procedural and constitutional.

The jurisdictional precedent remains contested in appellate courts. The legal question of whether a U.S. government front company, operated extraterritorially, with collection infrastructure in partner nations, can generate evidence admissible against non-U.S. citizens for crimes committed abroad — has not been definitively resolved.

The next encrypted platform operation — if one exists — will not be announced. That is the entire operating theory.

Afgoo, the confidential human source who developed ANOM, received a reduced sentence and has never been publicly identified. He is, by the terms of his cooperation agreement, protected.

Seventeen defendants remain in various stages of U.S. prosecution.

Twenty-seven million intercepted messages remain in U.S. intelligence archives.

Eleven thousand eight hundred ANOM handsets were manufactured. A small number have surfaced in secondary markets in Lithuania and Australia, purchased secondhand by security researchers and reporters. The units still work. The hidden calculator function still opens the messenger. The servers no longer respond.

Fragment Zero will track the case file.

The deeper question posed by Trojan Shield is not whether the FBI will do it again.

It is whether they already are. And which brand it is wearing.