Inside the Italian Mafia’s Encrypted Phone of Choice

In March 2021, Bruzzaniti, an alleged member of the infamous ‘Ndrangheta mafia group and who says Milan belongs to him “by right,” asked his brother Antonio to go fetch something else crucial to the traffickers’ success.

“Go right now,” Bruzzaniti wrote in a text message later produced in court records. “It’s needed urgently.”

Investigators know what Bruzzaniti said because European authorities had penetrated an encrypted phone network called Sky and harvested around a billion of the users’ messages. These phones are the technological backbone of organized crime around the world.

The thing Antonio needed to urgently fetch was a phone from a different encrypted phone network, one that the authorities appear to have not compromised and which the mafia have been using as part of their operations. To that phone, a contact sent one half of the shipping container’s serial number.

A reporting collaboration between Motherboard, lavialibera, and IrpiMedia has identified that encrypted phone as being run by a company called No. 1 Business Communication (No. 1 BC). The investigation has found members of the mafia and other organized crime groups turning to No. 1 BC as authorities cracked down on other platforms. The collaboration has identified multiple key players in No. 1 BC’s development, sales, and legal structure.

“Take the bc1 right away,” Bruzzaniti wrote in another text, referring to the No. 1 BC phone.

Last week, European authorities arrested 132 members of the ‘Ndrangheta, the infamous mafia organization that Bruzzaniti was part of. The 'Ndrangheta is accused of top-tier cocaine trafficking from South America, weapons smuggling out of Pakistan, money laundering across Europe, and a series of other crimes around the world, according to a press release from Europol. A Europol spokesperson told Motherboard that the operation was a result of intelligence from Sky and another hacked network called Encrochat. 

As part of those arrests, Italian courts unsealed another cache of documents which say that the content of a mafioso’s encrypted messages on No. 1 BC were “not intercepted.” Bruzzaniti remains a fugitive.

Intercepted messages from Sky included in court records also show an Albanian organized crime group discussing No. 1 BC, explaining they paid over 10,000 Euros for around half a dozen phones. This group believed that No. 1 BC was more secure than Sky at the time, according to the court records.

“We need 8 pieces,” one of their messages reads.

Names linked to No. 1 BC identified as part of this investigation include a high profile American investor and businessman, a Ukrainian technologist, and a convicted drug trafficker and money launderer. The investigation paints a picture of an organization that has existed in the shadows for years, but which recently gathered more significance among organized criminals after law enforcement agencies knocked out No. 1 BC’s main competitors, like Sky and Encrochat.

One former No. 1 BC seller told Motherboard the company was at some point “big on the market.” Motherboard granted multiple sources in this story anonymity to speak more candidly about industry developments.

“The revolutionary solution for protecting voice communication,” No. 1 BC’s website read in 2009 shortly after it launched. In a German language press release from the same year, No. 1 BC’s manager director Anton Isser said the company had “high hopes” for its product. At the time, that was software installed on an SD card that offered “tap-proof” calls according to the press release. Today. No. 1 BC offers an encrypted messaging app available on iPhones, according to its website. Isser did not respond to a request for comment.

No. 1 BC is part of the encrypted phone industry. Some of these started as legitimate companies before later leaning into their adopted criminal customer base. Others were created by, and for, drug traffickers. Often, authorities argue these companies are criminal entities in their own right. Some are allegedly designed to specifically facilitate criminal activity, separating them from mainstream communications and phone companies like Apple, Google, or Meta. 

Typically companies in this underground industry will offer an encrypted messaging app that comes preloaded onto a phone. The devices also often have a wipe feature, where a customer or their associates can contact the vendor and request that all data on the phone be remotely destroyed. This is an especially valuable feature to criminals if authorities seize their phone. 

Like other companies in the encrypted phone industry, No. 1 BC uses a distributed system of resellers to sell its phones. On its website, No. 1 BC invites people to become such a seller. The former No. 1 BC seller told Motherboard they filled out a No. 1 BC application form to become one of the company’s distributors. This form asks for the prospective seller’s personal and bank details likely for payment, according to a copy available on No. 1 BC’s site. 

Even from its earliest days, No. 1 BC’s sellers included people who would go on to be convicted of various crimes. In 2010, a man called Roy Livings listed on No. 1 BC’s website incorporated a UK version of the company, according to corporate records. A year later he was appointed director of other No. 1 BC companies with names that suggested links to the Netherlands, Belgium, and Spain, according to other corporate records. Livings was later convicted of importing 168kgs of cocaine from Bermuda into Portugal via a yacht in 2014, according to court records. Livings and at least one of his contacts used No. 1 BC phones during the trafficking operation, which at the time used BlackBerry handsets, the records add.

In a section of the records labeled “unproven facts,” Livings said that No. 1 BC had military and government institutions, financial companies, and celebrities among its clients.

By 2013, Livings and another man called Eli-Meir Gampel had created a German incorporation of No. 1 BC too, according to German corporate records. Gampel was later convicted for laundering millions of Euros of Colombian drug money.

The Mirror reported Livings’ and Gampel’s links to No. 1 BC and their criminal convictions in 2020. That piece mentioned that the UK’s National Crime Agency believes a “Ukrainian tech wizard” created No. 1 BC, but did not name them.

Motherboard found that No. 1 BC’s website was registered to a Vyacheslav Zlatogursky. Zlatogursky describes himself as chief technology officer up until October 2020 on his LinkedIn profile, but WHOIS records for another No. 1 BC domain still include his name as recently as last year.

Zlatogursky appears to know at least some of the No. 1 BC-linked individuals who were later convicted of crimes. Zlatogursky commented on a Facebook photo of Gampel’s in 2016, for example. Zlatogursky did not respond to multiple requests for comment.

By at least 2016, No. 1 BC advertised sellers all around the world on its website, including in China, Hong Kong, Belarus, and Ireland.

Today, No. 1 BC has other players in charge of distribution. An encrypted phone industry source said that Hamid el Hamdi handles sales of the phones in the Netherlands, and that another group controls sales in the UK. Hamdi’s name is also on an incorporation of No. 1 BC with suggested links to the Netherlands. Hamdi did not respond to a request for comment. 

A second source said No. 1 BC was “big” in other countries such as Croatia, Serbia, and Slovenia. The former No. 1 BC seller said a phone costs 1,450 Euro for 6 months of service.

One of the sources said that No. 1 BC loads their app onto iPhones with a mobile device management (MDM) tool. After plugging the iPhone into a Mac and downloading the No. 1 BC profile, the MDM tool will then install the app on the phone. According to a video on No. 1 BC’s website, the company uses BlackBerry’s MDM solution for pushing and updating apps to users’ phones. BlackBerry did not respond to a request for comment.

On its website, No. 1 BC lists its current postal address as an office in Malta. When a reporter went to the address, there was no evidence of No. 1 BC being active there.

Starting in November 2019, Maltese corporate records list an American accountant named Jack D. Burstein as the director of the Malta incorporation of No. 1 BC. Burstein is also the CEO of a “global merchant banking and financial services organization” called Strategica, according to that company's website. 

Motherboard does not know if Burstein is aware of No. 1 BC’s sales of phones to organized criminals. Burstein did not respond to multiple requests for comment sent by voicemail, text message, and physical letter. When Motherboard phoned a number listed as belonging to him, the voicemail inbox message identified the number as being Burstein’s, but he did not pick up the phone.

In recent years law enforcement agencies from the Netherlands, U.S., France, and other countries have increasingly targeted encrypted phone companies, sometimes hacking them or otherwise obtaining the content of users’ messages on a massive scale. After authorities disclosed they hacked Sky in March 2021, the largest encrypted phone provider at the time, some users migrated to No. 1 BC, Belgian media reported at the time. Court records obtained as part of this collaboration show that some criminals switched to No. 1 BC when they suspected Sky was compromised.

The San Diego FBI, which secretly ran its own encrypted phone company called Anom and shut down another firm called Phantom Secure years earlier, said it was aware of No. 1 BC but declined to say whether it was investigating the company.

At the moment, No. 1 BC still appears to be operational, with some apparent hiccups. Around the time that Dutch authorities closed down another phone company called Exclu, No. 1 BC closed one of its offices, according to a source in the industry. The source believes No. 1 BC sent people posing as potential resellers to spy on his own business.

In January, No. 1 BC administrators posted a noteworthy message to the company’s website: it said No. 1 BC was updating its signing certificates, which are used to confirm that an app update comes from them and not a third-party. In the message, No. 1 BC administrators wrote that “we are distributing our new and improved No.1 Live application that will replace the No.1 BC Live application.”

Anything concerning a change in an encrypted phone company’s infrastructure is likely to gather some attention from users in case it may impact their security. For example, French police previously hacked Encrochat by pushing a malicious update to the firm’s phones.

The source in the encrypted phone industry said that, although it may have been an innocent change, the No. 1 BC message was “Definitely strange.”

Subscribe to our cybersecurity podcast, CYBER. Subscribe to our Twitch channel.