Listen to an audio adaptation of this story on CYBER, available on all podcast apps.
Everyone crammed into the Las Vegas hotel suite was asleep except for Vince Ramos. The Wynn luxury hotel, with its indoor gardens, seafood restaurants, and extravagant shopping, had been this group’s world for the past few days, with law enforcement officials from the U.S., Canada, and Australia grilling Ramos. Four or five officials lay down after another session of questioning their suspect.
Videos by VICE
Ramos had short breaks to see his wife and one of his children, who were staying in their own room nearby. Fearing he wouldn’t be able to see his family if he didn’t do so, Ramos spoke at length with the agents. Ramos looked like a ghost during those breaks when his family saw him, they said.
His trip to Vegas had been a setup.
He’d travelled to meet an associate as part of his multi-million dollar business, selling encrypted phones under the brand name Phantom Secure. Phantom’s customized BlackBerry phones used dedicated software designed to make an ordinary wiretap impossible. The associate and Ramos planned to attend a fight in Vegas. But instead the FBI were waiting and cornered Ramos, dangling charges above his head usually reserved for taking down mob bosses. Biker gangs in Australia, drug traffickers in California, and even members of the Sinaloa Cartel all used Phantom’s phones. Rather than treat Phantom as an innocent third party to crime like Apple or Google when criminals use phones made by those companies, authorities said Ramos himself was part of criminal conspiracies. The agents had Ramos on tape suggesting he made the phones to help drug smugglers. On the other side of that hotel room door, when the agents finally stopped asking their questions, there was likely a long prison sentence.
But with the agents asleep, Ramos saw an opening.
He slipped out into the corridor without waking his captors. Ramos walked to his wife’s room and said goodbye. He had a chance to get up to Washington state and cross the border back to his home in Canada.
He headed downstairs, moved through the boiler area and basement, and left the hotel. Embarrassingly for the agents still in the suite, the person they had been hunting for years had just walked away.
Ramos had always been a businessman. Before launching Phantom Secure and becoming the target of an international investigation, he worked with multi-level marketing company Amway, and went on to corporate sales for Rogers, the Toronto-headquartered telecom conglomerate. Ramos received employee of the month awards both for selling bathtubs and then for selling phones, a family member said. His mother was a nurse; his father, a janitor.
“He was very business-savvy. His whole life, he was sales,” the family member said. Ramos was “definitely a businessman to the core. Not a gangster in the slightest,” a source with knowledge of Phantom’s operations added.
Ramos coached his son’s flag football team, the Richmond Raiders. He practiced jujitsu with one of his daughters and wore a Hello Kitty backpack while making bracelets with his children.
He also got involved with a wide range of companies and ventures. Ramos gave a video testimonial for Allysian, a wellness and nutritional supplements company. In the clip on YouTube, Ramos said in a quiet, slightly nervous tone, that he looked up to Rod Jao, the founder of Allysian, because he had “always seen him as being a successful entrepreneur.”
Ramos was a bit of a positive power kind of person, the source with knowledge of Phantom’s operations added. Ramos didn’t want to hear complaints. In his Allysian testimonial, Ramos said, “I tried the Mastermind, the Genesis, and the vitamins, and the chocolates,” referring to some of the company’s products.
“All natural ingredients, what I’m putting into my body, actually makes me feel really good,” he said. “I feel like I have a lot more energy, and, you know what, I even have that extra motivation to go to the gym, and work extra hard.”
Motherboard spoke to over half a dozen sources around Phantom, including family members of Ramos, distributors who sold Phantom phones in multiple countries on his behalf, and people with knowledge of the company’s operations. In most cases, the sources requested anonymity to protect them from retaliation, especially from law enforcement and criminals. Four of Ramos’s co-defendants, people who allegedly helped run the company or sell phones, remain wanted international fugitives. Motherboard also obtained multiple documents from within Phantom and a law enforcement file that gives deep insight into the investigation.
Many of the sources described Ramos not as a hardened criminal, but as a person who was naive and ignorant about the situation he put himself in. They described him as negligent, not malevolent. But as the company expanded, and eventually competition ramped up, something changed, and Ramos knowingly served the criminal market.
In 2008, Phantom started innocuously. Ramos got approval from lawyers in Canada to create the firm, went through the proper channels, and got his business license, according to the family member. Business records show Phantom Secure Communications was registered in Richmond, Canada.
“It was a legitimately run company,” the family member said.
On the company’s early, barebones website, Ramos, under the handle “CEO,” laid out in part why he said he started Phantom.
“I truly believe in our right to privacy and like many internet users I have always had a concern with the security of my email storage and communications,” Ramos wrote. He said that he used to send emails that contained seemingly trivial details, like dates and times when he was coming home, but also more important information like specific business details. Realizing that email as a medium was not especially private, he looked for a way to protect his communications over the internet.
Ramos wasn’t much of a tech guy; he was never really a nerd or geek, his family member said. Instead, another person, the company’s chief technology officer (CTO), handled the technical aspects of the operation. Court records don’t name this person, instead referring to him as Individual A and a “high-ranking officer of Phantom Secure.” Motherboard found his identity and a photo of him in an FBI document, and uncovered Canadian corporate records related to secure communications companies that mention his name. Motherboard is not naming him publicly because he has not been charged with a crime, and when reached for comment he feared for his and his family’s safety.
“He was a very difficult person so Vince [Ramos] kept him away from the clients,” the source with knowledge of Phantom’s operations said of the CTO.
Do you know anything else about Phantom Secure? We’d love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com.
Phantom’s phones used a version of Pretty Good Privacy, or PGP encryption, meaning that only the intended recipient is supposed to be able to decrypt messages sent to them. Phantom went further, however, and also physically removed the GPS functionality from the BlackBerry, as well as the microphone and camera. With this drastically locked down device, a user couldn’t make ordinary calls on the phone and instead could only send encrypted emails. Phantom also introduced a remote wipe feature, where a user could contact the company, and Phantom would delete messages on the phone without having physical control of the device. The company ran its infrastructure outside of Canada, and routed data through servers in Panama and Hong Kong in an attempt to keep it out of the reach of third-parties.
The privacy protection on messages from encrypted phones typically only works if the user is texting someone else who also has an encrypted phone, and sometimes companies force their devices to only communicate with phones from the same manufacturer. That way, if there was someone you needed to chat to and they had such a phone, you had to buy one too. From a business perspective, it was a way to pull in and retain customers.
Bruno (not his real name) said he started using Phantom phones in 2008 when he worked in Toronto’s nightlife. Motherboard granted him anonymity to speak more candidly about the potentially grey area of selling encrypted phones. This was the heyday of BlackBerry’s own messaging system, BBM, when typing out texts on a clunky QWERTY keyboard was considered stylish. Bruno said having a Phantom phone was originally a status symbol with VIP crowds, ranging from businessmen to escorts, and Ramos described the devices as the Louis Vuitton of the phone world. A phone cost thousands of dollars a year in subscription fees. Phantom marketed itself as the only full privacy solution, and its marketing worked, Bruno added.
“I had to be in contact with VIP clients to cater to their every need for bookings, reservations, etc,” Bruno said, adding that he’s worked with real estate agents and accountants who purchased Phantom devices.
Ramos gave free Phantom phones to rappers and athletes, including members of the Toronto Raptors, who would then use the devices with their own social network, Bruno said.
Mitsy Ramos, Vince Ramos’ ex-wife and a Los Angeles-based Instagram model, said she worked for Phantom Secure and a connected company called VMD Ventures, according to social media posts. “I’ll give you a deal,” she tweeted to a Miami modeling agency in September 2011, along with a link to the Phantom website. Mitsy Ramos did not respond to multiple requests for comment.
“Vince was selling BB’s [BlackBerries] like he sold Amway. He was always talking about direct marketing, etc,” the source with knowledge of Phantom’s operations said. Ramos read books about sales, the source added. Much of the exposure was done through word-of-mouth, multiple sources said.
Later on, Phantom coated its website in a slick, black and chrome design, with silhouetted figures holding their phones. Images showed men in black suits and ties and luxury Bentley cars.
“Designed exclusively for the sophisticated executive,” Phantom’s website later read. Some people who sold Ramos’ phones included photos of Phantom devices surrounded by gold jewelry on their social media accounts.
In a Phantom promotional video, a guitar twangs as the screen displays the company’s logo. The video is littered with stock footage: men smoking cigars, leather seats, and a towering skyscraper with the company’s logo obviously photoshopped onto its side.
“A True Private Experience, goes Beyond Perfection,” the video says at one point.
“Offshore Swiss Account password,” one fictional text between Phantom users in the video reads, demonstrating what sort of sensitive information clients might want to use the phones to send to one another.
Dance music kicks in, along with stereotypical cyber and security imagery like glowing padlocks.
“Did you know that using cell phones is the least secure form of communication?” the video asks. “Did you know regular email is similar to sending post cards? Did you know that SMS texts are sent in plaint text?”
Ramos typically didn’t directly interact with his user base, which at the time was primarily Canadian. Administrators for Phantom handled new subscriptions, initiated device wipes, or removed accounts, according to court records. Bruno, who visited a Phantom office in Vancouver, said it was a 300-square-meter modern, clean office, but wasn’t like an ordinary tech or startup space. Below the administrators, Ramos hired distributors, who essentially acted as middlemen between individual agents who sold phones to users, and the main Phantom company itself that the distributors would send their cut back up to. Bruno graduated from being a Phantom user to a distributor; a common route among other encrypted phone companies. Eventually he became a wholesaler.
Bruno and the source with knowledge of Phantom’s operations both said that the company had a customer support center based in India. Website registration and online corporate records reveal a company linked to Phantom’s CTO which does remote customer support and has a branch in Jalandhar, Punjab.
With Phantom’s structure, Ramos was fairly hands-off with a large chunk of his customers, letting the workers sell the phones in their own geographic territories.
“We were free to do what we want when we want,” Bruno added.
But Phantom had holes in how it hired distributors. Bruno said he moved to Asia to start selling the devices there. At first, Bruno said he simply sold the phones in exchange for envelopes of cash, but soon tried to tighten up the operation. He said he started to carry out due diligence on the sellers underneath him to make sure he was providing phones to legitimate industries and clients. He requested personal details so he could work out banking compliance and asked distributors to fill out anti-money laundering (AML) forms, where they provided names, addresses, and a form of identification so the company could verify who they were dealing with. Bruno provided Motherboard with a cache of internal Phantom documents, including filled out AML forms and bank statements, as well as driver licenses of distributors, to demonstrate some of the checks he carried out.
Early on, there were signs that Phantom’s client base included criminals. Bruno said he turned down some “unsavory characters” looking to do business, “simply out of fear, let alone God knows what they were doing.” Bruno filtered out the more suspicious individuals, he said.
Ramos, meanwhile, wasn’t asking for much of this verification himself, according to Bruno. One of Phantom’s policies was that it did not collect client names, but parts of the company also weren’t verifying who was selling phones in the first place.
“Lack of screening anyone who resold the product, lack of formal contracts based on jurisdictions,” Bruno said. Bruno added that he had to make a contract for Ramos to sign and return because Phantom itself never got around to making one. Bruno provided Motherboard with a copy of the contract.
“As [Ramos] built the business, he didn’t really know who he was dealing with,” Ramos’ family member said. But ultimately, “we knew there were probably some people who were getting it for more nefarious purposes.”
And some distributors were clearly keen to sell Phantom’s phones to criminals. “I sold to people only that we’re [sic] recommended or were from the zoo,” a worker who used to advertise Phantom devices online said, using a slang term for prison. “That’s how I kept law enforcement out; even if someone contacted my site, I wouldn’t answer.” This reseller also uploaded images with the phrase “Snitches Get Stitches” to their Instagram account.
When Ramos would visit Bruno, he would be more interested in partying than sitting down to conduct business, Bruno said.
“Don’t get me wrong. He was a super nice guy. Soft-spoken, friendly, and cool to be around. But I was always pushing for a more professional relationship. Instead I got a guy who wanted to hang out as bros and party,” he added. Rather than looking to solve conflict or tackling problems head on, Ramos wanted to be everyone’s friend, Bruno said.
“It was a shit show how he ran the business,” Bruno said. “I warned him to take things more seriously, and to enforce some form of compliance as the carelessness of his actions and the actions of other distributors was bad for his company and myself and others.”
Ramos kept saying he wanted to be like Uber—just flood the market with devices and figure out regulations later, Bruno said. Soon, Phantom would have a monopoly over one country in particular.
A kilogram of cocaine in Australia can go for over eight times what it costs in the United States because of how difficult it is to smuggle drugs into the country. And top-level drug dealers needed a tool they could rely on and wouldn’t let law enforcement listen in.
Here, Phantom found a new market.
“Uncrackable phones provided by Phantom Secure linked to murder of Hells Angels bikies,” the headline on a March 2014 ABC article read. The report said that Australian law enforcement agencies were unable to monitor the communications of powerful criminals because of their use of encrypted phones. Even the Australian Signals Directorate, the country’s version of the NSA, could not break through the encryption, it added. Intelligence agencies often can’t crack encryption itself—instead, they work around it by hacking phones or introducing vulnerabilities themselves—but prospective viewers didn’t need to know that.
ABC also aired a TV-spot including interviews with cyber security experts explaining Phantom’s remote wipe feature and how that could specifically help if law enforcement seized the phone, as well as how Phantom deletes credit card information after a customer has paid for their device.
In the article, the outlet wrote that “the ABC does not suggest the company itself is aware its products are being used by criminals, only that criminals have become aware of the phone’s utility and have taken advantage.” Phantom did not respond to a request for an interview from ABC at the time, the report added.
In private, Ramos was ecstatic.
“This is the best verification on what we have been saying all along—proven and effective for now over 9 years,” Ramos wrote to a Phantom employee in a message after the article was published, according to a copy of the text published in court records. “It is the highest level of official authority confirming our effectiveness. It can’t get better than that.” For Ramos, that criminals were using Phantom wasn’t an issue, but a business opportunity. One Phantom reseller uploaded the ABC TV-spot to their own YouTube channel, promoting their devices.
That media attention “put Phantom on the map,” Bruno said.
Phantom’s use exploded in Australia, with distributors in the country selling the devices to criminals. Li Wang, one Phantom seller, had around 800 clients from different criminal networks, and his apartment was littered with BlackBerries, tens of thousands of dollars in cash, and meth, according to Australian media reports.
Phantom distributors based all across the country were selling the phones, according to an FBI document obtained by Motherboard. Queensland, Victoria, New South Wales, and other areas all had teams of people selling Phantom phones. The FBI document added that Phantom initially got a foothold in the country because it partnered with large scale drug traffickers—or “influencers”—who required anyone wishing to do business to also use a Phantom device.
One former Phantom distributor in Australia who is named in the FBI document told Motherboard that selling the phones “was perfectly legal, our company was registered.”
The New South Wales Crime Commission, an Australian government body that aims to reduce organized crime in the region, wrote in one of its annual reports that “the prolific use of encrypted Blackberry devices continued unabated and, as in previous years, these devices were used to facilitate drug trafficking.” Australia’s national criminal intelligence agency specifically named Phantom as a go-to choice for organized crime groups, as well as the encrypted messaging app Wickr.
One legal document obtained by Motherboard describes how lawyers for a Phantom seller had “high level meetings with executive members of the Australian Crime Commission (ACC) concerning Phantom Secure’s operations in Australia.” The letter is from several years after Phantom had already attracted the attention of Australian law enforcement. (The Australian Criminal Intelligence Commission, which the ACC merged into in July 2016, declined to comment).
Documents show that while Ramos saw hindering law enforcement as good publicity, he may have gone further and ignored Australian authorities when they tried to speak to Phantom.
“Primarily my main concern is whether Phantom Secure is addressing official requests from law enforcement in their investigations,” one document sent to Ramos by Bruno reads. “From my knowledge Phantom Secure has failed at times to reply to Australian police inquiries. THIS IS UNACCEPTABLE.” Bruno added that although he understood the sensitive nature of their business—protecting the privacy of their clients—”it doesn’t take a legal expert to understand that ignoring official law enforcement requests is a recipe for disaster and potentially illegal.”
Phantom was so popular in the country, and so trusted, that “Phantom was almost like a religion in Australia,” the source with knowledge of Phantom’s operations said.
From Ramos’ standpoint, he was not actually dealing with these drug dealers, one of his lawyers would recall later in a court hearing.
“They are one or two steps away from me; I am selling a phone; I am in a business,” the lawyer said, relaying Ramos’ train of thought.
One of those clients was Owen Hanson, a tanned, muscular former USC football player. Like Ramos, Hanson also had a penchant for Louis Vuitton: the silver-plated AK-47 in Hanson’s office was emblazoned with the designer’s logo. Hanson had moved through real estate to running a highly successful online sports gambling business. But Hanson wanted more. Hanson, also known by his long-running nickname “O-Dog,” turned to drug trafficking.
He was arrested for possession of steroids. Then he moved onto dealing cocaine, GHB, and ecstasy. Then he upgraded to bulk quantities. As the operation rapidly grew, Hanson shipped thousands of kilograms of cocaine from Mexico, into Southern California, and on to Chicago. Hanson was also cashing in on the Australia gold rush, selling kilograms of cocaine on the island for $175,000 each, according to court records.
“This wasn’t somebody who was trying to smuggle drugs, you know, a couple carloads of drugs from Mexico to the United States,” The Honorable William Q. Hayes, a judge, would say later in a hearing about Hanon’s case. “He was an international drug trafficker. He was very, very successful. And he had access to huge amounts of cocaine. I mean, he moved—he moved hundreds of kilos sometimes a month from Mexico to the United States or to Canada or other places. It is astounding that somebody has access to literally hundreds of kilos a month, and all over the globe.”
Investigators were already probing Macho Sports, the online gambling business Hanson’s own firm was connected to, when they discovered he had moved into smuggling narcotics. The San Diego FBI tapped his phones, a text messaging app he used, and email accounts, according to court records. Hanson gave associates burner phones. There was one line of communication that would have been off-limits to the investigators, though: his and his co-conspirators Phantom devices.
Hanson’s organization used around six Phantom devices to coordinate a shipment of more than a ton of cocaine, according to court records. The Phantom users were spread across Mexico, Los Angeles, San Diego, Chicago, New York City, and New Jersey, the records say.
Phantom lets customers choose their own nickname on the Phantom network. Hanson picked Don Corleone, a reference to The Godfather movies, according to court records.
It wasn’t just the name; Hanson constantly projected the almost cliched image of a mob boss. Beyond the Louis Vuitton AK-47, he invested in a restaurant and insisted that the backroom be decorated with posters of the Mafia and dubbed the “wise guy room.” He stored bundles of cash under bathtubs, hidden compartments inside cars, and private vaults that required a retina-scan to enter.
In a dramatic arrest in the car park of one of the country clubs that he was a member of, with a helicopter overhead and agents pointing weapons, the FBI grabbed Hanson. His downfall was largely thanks to an undercover that authorities planted inside Hanson’s organization—the undercover got their own Phantom device when Hanson vouched for him to the company, according to court records. It doesn’t matter if you have the strongest encryption in the world if someone inside the conversation flips.
Ramos’ family member said that Ramos never met or knew of Hanson. But that didn’t matter for the investigators. Now that the FBI had busted someone who was using the phones to ship drugs into the U.S., it had a reason to look into Phantom too.
Motherboard obtained an FBI-authored document that lays out in detail the chronology of the FBI’s and other law enforcement agencies’ investigation into Phantom, that gives unprecedented insight into how they ultimately took down Ramos.
The document—a 30 page slide presentation—appears to have been created to summarize the investigation for other law enforcement agencies. Slides outline an initial investigative strategy, a revised strategy, and a takedown strategy that includes a two-prong approach: a covert phase to investigate Ramos and an overt phase to take down Phantom’s infrastructure internationally.
The document itself is marked as unclassified, but it contains sensitive information such as the identity of Phantom’s CTO, names of distributors who sold phones in Australia, and other intelligence that law enforcement agencies gathered about Phantom which is not mentioned in the case’s public court documents. Beyond Motherboard’s own sources, some of the timeline of the law enforcement investigation into Phantom explained in this piece is based on that document.
When officials from the San Diego FBI flew to Vancouver to meet with the Royal Canadian Mounted Police (RCMP) in May 2016, the RCMP had already been investigating Phantom for several years. Canadian and Australian law enforcement had found that Phantom distributed its phones internationally, had more than 15 business owners linked to the company, and estimated sales that exceeded that $32 million.
The RCMP had encountered Phantom’s vouch system, where at least some sellers would not provide a phone unless the buyer was recommended by a current customer. The agency tried to buy phones through the company’s website, or by just walking into their office, in six separate undercover attempts, according to the FBI document. (Bruno and the source with knowledge of Phantom’s operations both disputed the idea that Phantom, overall, had a vouch system; Bruno said he would sell the devices openly online for people to buy).
When the RCMP did manage to get hold of a phone, undercover employees pretending to be drug dealers asked a Phantom support representative to wipe the device, but made it clear the intent was criminal.
“So, he picked up the load and I think he’s been arrested and I need, there’s a lot of evidence and fuckin’ shit on my BlackBerry,” the undercover wrote, making a veiled reference to a shipment of narcotics.
“You wanna wipe both of them?” a Phantom staffer replied, according to court records and an FBI document.
“Yes,” the user wrote.
“One sec,” the Phantom representative replied, before reassuring the undercover agent that law enforcement can’t access Phantom data.
The RCMP had also managed to obtain log-in information for a panel used by Phantom sellers, which gave an idea of the city and country the workers logged in from, according to an FBI document.
In their eyes, Canadian and Australian authorities had a problem. Selling the phones wasn’t illegal in their own countries, and they didn’t have the legal framework to treat Phantom as a criminal organization. The U.S., meanwhile, did: it had the Racketeer Influenced and Corrupt Organizations Act, or RICO, a law used for prosecuting mafia heads who had underlings carry out their dirty work to try and keep their own hands somewhat clean. It’s also the same law U.S. authorities used to go after Hanson and his drug trafficking gang.
Controversially to multiple sources around Phantom, Canada and Australia needed the U.S. to get involved to take down a company that wasn’t breaking the law in their own territories. The FBI document acknowledges this, and says that the RCMP was eager to join forces with the FBI.
The U.S. Drug Enforcement Administration had some information too: they already had recorded conversations implicating Michael Gamboa, also known as Chino, an alleged Phantom distributor who sold phones in Los Angeles. Gamboa sported a buzzcut and a shirt and tie in one photo included in the FBI document. Authorities also had their eyes on Christopher Poquiz, another distributor also from Los Angeles.
The FBI’s initial plan was to take one of their informants from another investigation to target Gamboa and Poquiz, and then eventually introduce an undercover FBI employee offering to sell phones to their own network and become part of Phantom. If the FBI could have an employee work as a distributor, they could work their way up to potential meetings and conversations with people higher up in Phantom. The ultimate goal was to reach Ramos and the CTO, according to the FBI document.
On the other side of the world, the Australians were working on a similar plan. In another law enforcement meeting later that year in September 2016, FBI San Diego traveled again, but this time to Sydney, Australia. After the meetings were over, representatives from the Queensland Police Service pulled the FBI aside and offered a particularly valuable asset: they already had a confidential human source (CHS), a Phantom distributor in Australia. The FBI didn’t even need to introduce an undercover employee as a distributor; the Queensland Police Service already had someone on the inside.
Every case of this size needs a big break, the FBI document reads. This was their way in.
Phantom didn’t stop at Australia. Online records show Phantom had web domains and companies registered in Bulgaria, Ireland, and Singapore. Classified ads in local, English language newspapers show Phantom Secure-linked companies hiring in Thailand.
“Over time, the money was just coming in,” Ramos’ family member said.
Some of Phantom’s revenue included large amounts of cryptocurrency, gold coins and silver bricks, and hundreds of thousands of dollars in various bank accounts and safe deposit boxes in Los Angeles and Beverly Hills, according to court records. Ramos had a personal net worth of at least $10 million, with properties in Canada and Vegas, the documents say. Ramos and his wife’s Vegas high-rise, gated condo came with community tennis courts, a swimming pool, and a gym, property records show. Ramos owned a Lamborghini.
In all, Phantom sold around 7,000 to 10,000 phones, according to court records. A map included in the FBI document showed the spread of some of the devices: Central and South America, Europe, the Middle East, South East Asia, and North America.
Phantom had gone global.
Ramos “said it was going too good, and that it was something that he couldn’t stop,” his family member said.
But for all of its glitz and marketing, Phantom’s product essentially hadn’t upgraded since it launched nearly 10 years ago. This was the mid-2010s, and BlackBerries certainly weren’t as popular as they used to be. Other companies based their products on Android and had more features, such as an encrypted communications system that felt more like instant messaging rather than sending emails back and forth. One internal Phantom document obtained by Motherboard described how some distributors would give their customers refurbished BlackBerry devices with the Phantom software installed, but with keyboard keys falling off or cracked screens. The company was lagging behind.
Bruno and the source with knowledge of Phantom’s operations said Phantom commissioned the development of an Android app, but it failed. The app “was a disaster” the source said, adding that the person who made it “could barely code.”
Phantom did innovate with another app called Privé Chat that ran on Samsung KNOX, Samsung’s own security-focused version of Android.
“It was decent but it was about two years too late,” Bruno said. The company launched buy-one-get-one-free promotions.
Ramos also tried to more directly evolve Phantom from BlackBerry to Android hardware by sourcing large quantities of devices preloaded with other security-focused operating systems.
“Hi, we are a Privacy, Secure Messaging company,” a 2016 email written by Ramos to an Android phone company, obtained by Motherboard, reads. “We are interested in learning more about your hardened phones and potentially buying some in the 100s or 1000s.” The owner of the Android company told Motherboard that Ramos later said he wanted to buy around 12,000 to 15,000 devices.
“He was grasping at straws to increase his hardware,” the company owner said. “He was asking for massive amounts of devices.” Ramos wanted to pay with Bitcoin, but the owner told Ramos the company does not use that sort of currency, the owner added.
“That’s when he disappeared,” the owner added.
Competition in the encrypted phone market grew more aggressive. While firms like Encrochat, which offered a similar product, had cornered much of the European market, others pushed more directly into Phantom’s territory, especially in Australia.
“Our sales were going down fast due to cheaper competitors like Ciphr and others,” Bruno said, referring to another encrypted phone company that was particularly popular in the country. “His [Ramos’] product was no longer that cool nor was it cheap either.”
“Ciphr and Sky started moving into the Australian market with superior products,” the source with knowledge of Phantom’s operations said. “Ciphr was cheap and aggressive. Sky did free promos.”
Bruno said he had previously met with Ciphr representatives, and “was terrified.”
“I felt like I was in a mafia-esque situation during that meeting,” he recalled.
While competition ramped up and its business fell behind, banks that some Phantom workers did business with seemingly started causing problems, too. Bruno said HSBC closed several of his accounts without warning. The source with knowledge of Phantom’s operations also said authorities seized payments and bank accounts.
But Ramos and his agents needed the business to survive.
“Vince [Ramos] lived lavishly. He had to support his lifestyle,” Bruno said. “I’m not complaining. I made damn good money in the beginning but his own greed was his downfall.” Bruno said he thinks Ramos got desperate in finding new clients, and so allowed himself to do business with anyone.
Then Ramos agreed to a meeting in Vegas that would solidify his willingness to help organized criminals.
The FBI and its new CHS, the Phantom distributor feeding information to law enforcement, got to work. The investigation, officially called Operation Safe Cracking, was ramping up.
Having eventually gotten closer to Ramos, the CHS met with him for two days in Los Angeles, according to the FBI document. When the CHS described Phantom’s clients as criminals, Ramos corrected him, saying that all Phantom customers are to be referred to as “executives.”
The pair chatted over WhatsApp and their Phantom phones. The exact context is unclear, but the pair seemingly discussed how, if they did more explicitly turn to a life of crime, they may be very good at it.
“But if we turned [in] to executives we would be the top executives out there, lol,” Ramos wrote to the CHS in one message. “But not gonna lie have so much exec blood running through. Former execs lol.”
“Oh if we turned back [into] exec the it wouldn’t be a problem, the CHS replied. “This business opens so many doors.”
“Yes bro,” Ramos wrote. “We are all former execs, We gonna do big things…I’m constantly networking.”
Escalating their relationship, the CHS arranged a meeting between Ramos and a group of alleged drug traffickers in Vegas in February 2017. The group wanted a particularly large order: 200 Phantom devices, working out at potentially $600,000 worth of phones in one deal. Dressed in a tight black t-shirt and smiling, Ramos huddled with the potential customers on a couch while an NBA game played on the TV.
Rather explicitly, the clients said what they wanted the devices for.
“Three of my main guys are in prison,” the new client said, adding that they lost 50 kilos from Colombia. They wanted to expand their drug trafficking business into South America and Europe.
“Okay. You don’t have to tell me that, but it’s okay,” Ramos replied.
“Yeah, well, we’re all friends,” the trafficker replied.
“Just saying it out loud,” Ramos added, as if he did not want the traffickers to discuss what they were using the phones for.
Although they were being clear about the industry they worked in, the client seemed hesitant to start working with Ramos.
“You know, we don’t know you,” they said.
“Of course. That’s what I’m saying,” Ramos added. “You don’t know me. But, yeah that’s exactly what I’m saying, right. We made it—we made it specifically for this too.”
The traffickers moved onto asking about what would happen if a member of their organization was using a Phantom phone and got arrested.
“What’s the first thing we should do if we get word that someone got pinched and we need to just kind of—having them fall off the radar,” one of the traffickers asked.
Ramos recommended using Phantom’s wipe feature, but cautioned that the phone needs to be connected to the network to receive the command.
“Because what they do now with that they have a Faraday bag. You can put the device into a bag and it does not emit any signals if you put it into like, a lab to avoid wipes,” Ramos explained.
“Who has that?” one of the traffickers asked.
“What I’m saying, the authorities, the ‘unfriendlies’ do,” Ramos added.
The clients had more questions, specifically on whether Phantom could keep the GPS enabled on certain devices in case they needed to track one of their own users. Ordinarily, Phantom physically removed this feature. And as Ramos explained and tapped through the settings on a phone to demonstrate to the client, a user could just turn off the GPS feature if they didn’t want to be tracked.
The trafficker instead suggested what they might tell one of their members to make sure that the GPS remain enabled: “Yeah don’t fight—don’t, don’t, don’t, don’t fuck with the phone. If you turn it off, we’ll turn you off.”
“Right, right, right, right,” Ramos replied.
Ramos had made a serious mistake.
He had suggested that Phantom’s phones were made for drug smuggling. And he had said that if a Phantom user was arrested, the company could try and issue a wipe command to the device. Unbeknownst to him, Ramos’ admission was not some fleeting comment to a prospective client. These drug traffickers were undercover agents from the RCMP, and were secretly recording the conversation. The CHS had led Ramos into a trap. This wasn’t a business deal; authorities had descended on Vegas and lured Ramos in an attempt to build a case on him.
After that meeting, Ramos’ trust in the CHS increased, and his role was elevated, according to the FBI document. The CHS was placed in direct contact with other top-level Phantom distributors, including those who oversaw distribution in Thailand, Hong Kong, Dubai, Turkey, and Australia, according to the document.
Ramos stepped further and further away from plausible deniability. In one text message exchange, he wrote how undercovers had tried to get one of his employees to wipe a phone allegedly used for drug smuggling.
“My worker ended up wiping the device and they tried to get him for obstruction of justice.. He got off but cost a lot in lawyer fees,” Ramos wrote. “So word of advice… Never acknowledge anything illegal.”
He leaned into his criminal client base, and said he secured business with one of the most technologically advanced and violent criminal groups in the world. At the time he had no idea about the mistake he had made with the agents in Vegas; if anything, business was getting better again.
“He did learn to manage gangsters as clients,” the source with knowledge of Phantom’s operations said.
“We are fucking rich man,” Ramos’ February 2018 text message to a Phantom employee read. He was back in Vegas, and appeared to be celebrating. Ramos had just been in Mexico City, where he traveled to pitch Phantom devices to potential customers, according to court records. The trip had been a success.
“Get the fucking Range Rover brand new. Because I just closed a lot of business. This week man,” Ramos’ text, sent using the encrypted messaging app Signal, continued.
“Sinaloa Cartel that’s what up,” Ramos said. “And my boy is Punjabi cartel lol. Straight up,” he added. The rest of his text suggested he was currently at the Spearmint Rhino stripclub in Vegas with Richard Sherman, then a star for the Seattle Seahawks. Bob Lange, vice president of communications for Sherman’s current team the San Francisco 49ers, wrote in an email “I spoke with Richard and he does not know this gentleman.”
How exactly Ramos ended up traveling to Mexico City, meeting with the Sinaloa Cartel, and what that deal entailed is unclear. Motherboard did correspond with Ramos over months through email and physical letter, but he didn’t go into great detail.
“I am thinking of what I can put out there,” he wrote in one email, talking generally about his case. “To be honest I’m at a crossroads of how much I want to put out there.”
“I probably do have some questions and comments… I just have to find a way to word them. I do want to have some input in what you write as well…,” he said in another message.
But shortly after Motherboard sent a final list of specific questions to Ramos to give him a chance to respond, including how he met members from the Sinaloa Cartel, the Bureau of Prisons cut off our communications with him.
“This message informs you that you have been blocked from communicating with the above-named federal prisoner because the Bureau has determined that such communication is detrimental to the security, good order, or discipline of the facility, or might facilitate criminal activity,” a message sent by the prison’s email system read. “The prisoner with whom you were communicating is being informed of this block. You may appeal this block within 15 days of the date of this message by submitting a written request to the Warden of the prison where the prisoner is located. You should include a copy of this notice, an explanation of your appeal request, and any additional documents or information you wish to be considered.”
Motherboard appealed the decision, but received no explanation from the prison as for why it stopped Ramos from replying.
David Fathi, director of the American Civil Liberties Union’s National Prison Project, said this sort of block is not something he’s heard of before.
“Based on this limited information, this appears to be a disturbing attempt to interfere with communication between an incarcerated person and the news media—communication that the courts have ruled is protected by the First Amendment,” he said in a statement.
“What’s especially concerning is that essentially no information is provided about the reason for blocking communication. ‘Detrimental to the security, good order, or discipline of the facility’ doesn’t actually tell you what the journalist or the prisoner has allegedly done wrong. Without that information, it’s impossible to meaningfully challenge the decision,” he added.
Ramos’ celebrations in Vegas over his new customer didn’t last long. Shortly after, Ramos was supposed to attend a fight. Cyborg was fighting Kunitskaya as part of an UFC tournament that Saturday. But instead Ramos was in that suite in the Wynn hotel with the law enforcement agents. Authorities had a warrant for his arrest and were ready to lump Ramos with conspiracy to traffic drugs charges, in part because of what he had told the undercover RCMP agents posing as drug traffickers a year earlier. The authorities said Phantom fell under RICO.
Agents questioned Ramos for days in the hotel, while giving him those breaks to see his wife, the source with knowledge of Phantom’s operations and the family member said. Authorities showed Ramos photos of persons of interest, the first source added said.
“Vince [Ramos] said he built a good relationship over the days,” the source added. “They trusted him. Hours were exhausting on all parties.”
Law enforcement officers went through his phone. Worryingly for the RCMP agents, someone had sent Ramos a message earlier.
“You don’t know me. I have information that I am confident you will find very valuable,” one email to Ramos allegedly read. The alleged source, investigators would later find out, was Cameron Ortis, a director-general with the RCMP’s intelligence unit, who was suspected of selling sensitive law enforcement information to criminals.
But right now, the group of agents didn’t arrest Ramos on the spot. Instead, they gave a proposition: could Ramos create a backdoor to Phantom’s network? In short, a backdoor is an extra way into a network or the information it contains, and could potentially let the FBI identify Phantom’s customers; the actual drug traffickers themselves.
“He was given the opportunity to do significantly less time if he identified users or built in/gave backdoor access,” the family member said. The source with knowledge of Phantom’s operations also described the access as a “backdoor.”
The family member said Ramos didn’t install one “out of integrity and his values for privacy.”
Ramos did not have the technical know-how to actually do it anyway. He wasn’t the tech guy, and Victor Sherman, one of Ramos’ lawyers, said Ramos didn’t know how to do it. The person who could, the CTO, was across the border in Canada, not a Vegas hotel suite.
When the agents were asleep after another long session of questioning, Ramos made his dash through the corridors of the Wynn hotel and into the basement. An associate picked him up, and started to drive him to the border, the source with knowledge of Phantom’s operations said. As the pair barreled north, Ramos used the driver’s phone to message other people close to Phantom and warn them of what had happened, the source said. He kept the specifics vague, and it wasn’t clear whether Ramos was being overdramatic or not. He hoped he could see a lawyer and put this behind him; Ramos even thought he could keep the business afloat, the source said.
“Ramos is the eternal optimist,” the source added. “He knew the situation was grave, but he refused to accept.” Ramos then told the source he was going offline.
Ramos left his driver, and found himself in Bellingham, Washington, a quiet town of 90,000 people just south of the Canadian border. He stopped for food in Over Easy Café, a diner that shares a carpark with a Trader Joe’s.
Dressed casually in shorts and a t-shirt, Ramos quietly sat alone among the yellow walls and chairs of the cafe. He faced outward, with his back against the wall, letting him see who else was in the restaurant, Jamie Bohnett, the owner of Over Easy said. It was around 12:30, and not many people were in the cafe, Bohnett added. A local media report said Ramos ate chicken and waffles; Ramos’ family member denied that.
Ramos had spent decades building Phantom from a word-of-mouth, cool-to-have gadget, through to a moderate sized business, and eventually a network preferred by organized crime. Now he was on the run, and although it wasn’t clear what would actually happen if he managed to cross the border, he could perhaps still get there. For the moment, it was quiet.
Two figures who looked like businessmen entered the cafe and stopped at the bar with menus. They were nervous looking, “hyper,” Bohnett added. The men said they weren’t ready to order. Shortly after, one of the men went outside for a phone call. Then five or six men entered the cafe and walked over to Ramos. He didn’t resist. Instead he stood up, turned around, and the men cuffed Ramos’ hands behind his back. It was over.
After agents arrested Ramos on his way to Canada, authorities shut down the Phantom Secure network itself, and took over more than 180 web domains it used. The Australians, Canadians, and Americans executed 30 search warrants across offices associated with Phantom as well as the homes of criminal users of the phones. In their March 6, 2018 searches, Australian authorities seized over 1,000 Phantom devices.
A few days later, in place of the business-figure stock art that had more recently populated the Phantom Secure website, stood a message from the three law enforcement agencies that had come together to target Phantom, and a small text box where visitors could enter their email address if they wished.
“Domains and handles listed at this website were identified as related to Phantom Secure during a joint investigation involving the Federal Bureau of Investigation, the Royal Canadian Mounted Police and the Australian Federal Police,” the message read. “To check if an account is subject to this investigation enter the email address.” It is unclear what law enforcement agencies did with any of the information, such as their email and connecting IP address, that Phantom users provided to the site.
The agencies took their victory lap.
“The indictment of Vincent Ramos and his associates is a milestone against transnational crime,” FBI Director Christopher Wray said in a press release published 10 days after Ramos’ arrest. “Phantom Secure allegedly provided a service designed to allow criminals the world over to evade law enforcement to traffic drugs and commit acts of violent crime without detection. Ramos and his company made millions off this criminal activity, and our takedown sends a serious message to those who exploit encryption to go dark on law enforcement.”
“The action taken in the U.S. directly impacts the upper echelons of organised crime here in Australia and their associates offshore,” Neil Gaughan, the Australian Federal Police (AFP) Assistant Commissioner Organised Crime, said in the AFP’s own announcement. “Using this equipment, criminals have been able to confidently communicate securely and control and direct illicit activity like drug importations, money laundering and associated serious, often violent criminal offending, yet have remained removed from these criminal acts,” he added.
The week after announcing Ramos’ arrest, an additional indictment named Gamboa and Poquiz, the Phantom distributors in Los Angeles, as alleged co-conspirators, as well as Younes Nasri from Dubai, United Arab Emirates, and Kim Augustus Rodd from Phuket, Thailand. All remain fugitives. Phantom’s CTO was not charged.
In October 2018, Ramos pleaded guilty to running a criminal enterprise that facilitated drug trafficking.
“Are you familiar with the U.S. federal sentencing guidelines?” Ramos later wrote in an email to Motherboard from prison. “Are you also aware of what percent of federal cases end up in a plea bargain or guilty plea and what happens if you actually do go to trial?”
Ramos’ family member said, “He was threatened with 25 years to life if he went to trial, that’s why he signed the plea bargain.”
In a May 2019 sentencing hearing in a San Diego courtroom, Ramos, dressed in a khaki jumpsuit, addressed the judge when asked if he wanted to make any comments.
“Yeah, good morning, Your Honorable Hayes. For the past several months I’ve been thinking about what I would say when given this chance,” he started. “What I can say is the truth and from my heart. I am sorry and accept responsibility for my actions that have led me to where I am today. I apologize to the Court, the government, and anybody that may have been negatively impacted by my conduct. I apologize to my family and thank them for their support. To my wife, I thank you for everything that you do. I love and appreciate you.”
“Your Honor, I deeply regret and I am remorseful for my actions and negligence that allowed my company to grow the way that it did. I made mistakes and decisions that I cannot take back. I should have acted more responsibly. As I stand here in your courtroom today with my fate and future in your hands, I ask and hope for your leniency when making your decision when imposing your sentence. I am truly sorry, Your Honor. Thank you,” Ramos said.
In an earlier letter to the judge, Ramos wrote, “I would be lying if I said that I wasn’t aware of what was going on.”
“The reality was that I turned a blind eye and didn’t want to face reality. I was making money and providing for my wife and children,” he added.
Both Sherman, one of Ramos’ lawyers, and Assistant U.S. Attorney Andrew Young agreed that this was an unprecedented case, according to a transcript of the hearing. This was the first time the U.S. had targeted a company for its role in providing a criminal organization with technology to help them “go dark” or evade law enforcement detection of their crimes.
“Now, it is a kind of two-edged sword to be honest,” Sherman said, referring to the extraordinary nature of the prosecution against Ramos. Although acknowledging that Ramos should have realized that providing such a service to criminals could do great damage, there wasn’t a rule “that would tell him that he was doing something wrong.” It’s not illegal to sell phones, even to criminals, in and of itself.
But the evidence suggested Ramos was deliberately helping drug traffickers. For lawyers, it may be obvious that selling a phone that you know is being used in some kind of illegal way would fall under a conspiracy law, Sherman elaborated. “I don’t think that it was obvious to Mr. Ramos,” he added.
Young, on the other hand, made a distinction between someone knowing that something is illegal, and believing that you are not going to get prosecuted for it.
“I think this defendant fell in the latter category,” Young said. “He was not prosecuted because he was selling encrypted communications and encrypted devices to criminals. He was prosecuted because he was in agreement with these people providing them the technology that they could use to facilitate their crimes, and the criminals that are spilling into this industry are the most sophisticated in the world.”
Young stressed this case wasn’t just about encrypted phones. People who may make other tools that criminals could use, such as particular cryptocurrencies, or perhaps elements of the so-called dark web, “are watching what happens here today.”
“And they are making decisions based on whether or not they are going to continue to provide these products and technology to criminals and whether it is worth the risk,” Young added.
In December 2017, Judge Hayes sentenced Hanson, the former UFC footballer turned drug trafficker, to 21 years in prison. Now in his remarks building up to delivering Ramos’ sentence, Hayes said “The history and characteristics of Mr. Ramos, as with many individuals who come before the court: mixed.” He is a gentleman, well spoken, and obviously a very talented businessman and very successful in legitimate employment before this case, Hayes added.
“But at some point he became very successful in the business he was in,” and “he was committing crimes by doing it,” Hayes continued. “And at some point I have no doubt that he understood what he was doing was criminal;” that is, assisting drug traffickers. Weighing up factors such as the scale of the operation, the fact that Ramos had no prior criminal record, and that many of the people Ramos assisted likely would have committed their crimes with or without Ramos’ help, Hayes came to a decision.
The judge sentenced Ramos to nine years in prison.
This was significantly less than the 14 years prosecutors asked for. Ramos may be able to transfer to Canada after five years in an American jail. After release, he will also be barred from engaging “in the employment or profession relating to developing and maintaining encryption services and devices,” Hayes said during the hearing.
Multiple sources in and around Phantom did not see a RICO case coming against the company. Some civil legal problems from importing SIM cards perhaps. But not the law used to specifically take down criminal organizations.
“Many people believed that what I was doing was completely legal and that this was a war on privacy,” Ramos said in an email from prison. He is currently incarcerated in USP Marion, a medium security jail in south Illinois. Ramos was referring to the wave of attorneys, privacy advocates, and other people interested in his case that he said contacted him after the FBI announced his arrest.
“Nobody actually thought selling to [criminals] was illegal. It isn’t in Canada. Or Australia,” the source with knowledge of Phantom’s operations said. “It is under RICO in the USA.”
“If the Kangaroos can’t take you down they’ll call the big Eagle. And the Eagle can take anyone down,” Bruno said.
Serious organized criminals continue to use encrypted phones to communicate, moving from one provider to another as law enforcement agencies chip away at them bit-by-bit. Some drug traffickers used the services of a firm called Ennetcom, before Dutch authorities shuttered it. Other criminals have even gone so far as to create their own encrypted phone companies; firms such as Scottish-based MPC were literally created by and for organized crime.
Law enforcement agencies’ operations against the phone companies have escalated too. In March of this year, French police managed to infiltrate Encrochat. But they went a dramatic step further, and pushed malware onto the Encrochat devices themselves, letting investigators read users’ messages before they were sent layered in encryption. Authorities obtained tens of millions of text messages, and arrested hundreds of suspected criminals.
In parallel, the use of encrypted or privacy-focused messaging apps has skyrocketed, by criminals but mostly among the wider public. Wickr is a free encrypted messaging app that offers extra features to enterprise customers; Signal is another similar app developed by a non-profit organisation and which also provides the cryptographic code that powers many other encrypted messaging apps, including WhatsApp.
Ramos could have “had a Wickr or Signal before they even hit the scene,” Bruno said.
“Had he invested in the right team, structure, management, advisory etc,” he added. “But he just wanted to party and drive expensive cars… such a waste.”
