Canadian businessman Thomas Herdman is awaiting trial in France for his alleged role in the distribution of modified smartphones installed with the Sky ECC app.
The 63-year-old was arrested in June 2021, despite cooperating with US investigators over his involvement with the encrypted communications firm Sky ECC. He has spent 45 months in pre-trial detention since.
Computer Weekly spoke to Herdman’s daughter, Julie Kawai Herdman, 24, who says her father is innocent, citing inaccuracies in the evidence and flawed legal processes.
“It’s been a tough four years in limbo, waiting endlessly to see what happens. I was really disappointed that his bail application failed,” she said.
Herdman was the Sky ECC account manager for Vancouver-based startup LevUp Tech when Belgian and Dutch police infiltrated Sky ECC, then the world’s largest encrypted communications network with around 70,000 users. Authorities accessed over a billion messages exchanged between June 2019 and March 2021, Europol estimates.
The operation led to mass arrests of suspected criminals, drugs gangs and money laundering operations across France, Belgium and the Netherlands, and the conviction of corrupt government officials, judiciary and police in Montenegro.
French prosecutors have indicted more than 30 individuals who owned or worked for four companies that distributed Sky ECC software. Sky Global’s founder and CEO, Jean-François Eap, is also named in the indictment. Herdman is the only individual in French custody.
The Sky ECC infiltration came during years of increasing tension between global law enforcement and providers of encrypted communication services, with companies such as Encrochat, Phantom Secure and Exclu being shut down by police.
Fascinated by blockchain
Before his involvement with Sky ECC, Herdman maintained a portfolio career, working for an oil field equipment manufacturer – run by Iranian-Canadian brothers – selling specialist engineering tools to Iran, alongside a handful of part-time tech roles.
According to Kawai Herdman, her father became fascinated with blockchain technology after reading about the work of Satoshi Nakamoto, who claims to have invented bitcoin.
“My father read Satoshi’s whitepaper in 2012, and saw financial freedom and privacy as a solution to the corruption underlying the 2008 financial crisis,” she said.
Herdman went on to study blockchain with the radical, artist-run group DCTRL Vancouver, whose members include technologists and developers in the city’s most prominent companies. He joined a firm named TGA Associates, developing chain analysis software for a Chinese veterinary project that used chips to detect farm animals’ vital statistics.
It was his role at TGA Associates that led him to cross paths with Sky Global’s Eap around February 2017.
“TGA was owned by former options trader Grant Persall, whose wife was the high school best friend of Jean’s fiancée,” explained Kawai Herdman.
In June 2017, Persall – who is also named on the French indictment – asked Herdman to launch his startup, LevUp Tech, to distribute Sky ECC software to resellers who would install it on smartphones.
Sky Global had 50 employees, including a communications team, an accounting department and a legal department. “It was hardly the appearance of a criminal organisation,” said Kawai Herdman.
By October of that year, the US had withdrawn from its nuclear agreement with Iran, ending cooperation between the two countries. Herdman’s business interests in selling completion equipment in the region came to an abrupt halt.
“My father figured he had nothing to lose by selling Sky’s software full-time,” said Kawai Herdman. “For my dad, like many tech guys, encryption was cool and exciting. But, sadly, he had no clue that danger was waiting, as global police were planning to spy on all the clients of these services.”
“For my dad, like many tech guys, encryption was cool and exciting. But, sadly, he had no clue that danger was waiting, as global police were planning to spy on all the clients of these services”
Julie Kawai Herdman
French prosecutors allege that Herdman oversaw 9,050 Sky ECC activations between June 2017 and September 2020, equivalent to 1.5% of the distribution.
Herdman worked long hours dealing with enquiries and tech support requests. He looked for business development opportunities among his international contacts, though – ironically – he had no resellers or users in France, where Sky ECC messages were routed through three servers and where he is now being prosecuted.
It seemed like a typical workplace call when, in June 2019, a “prospective client” contacted Sky Global, expressing interest in using Sky ECC. He was from the US, where the company had no distributors or resellers, so the enquiry was forwarded to Herdman, who emailed across a technical brochure.
“This guy, Oleg, requested a meeting in LA,” said Kawai Herdman. “It was strange, as everything was outlined in the brochure. But Grant was adamant that the US market was important, so my dad set up a meeting for October 2019.”
When Herdman met Oleg and his colleague, it became clear that they weren’t looking to become resellers. They simply wanted a few devices.
“My dad wasn’t keen on selling direct to users without a reseller for tech support, as the app often crashed, requiring specialist support,” said Kawai Herdman.
No business was done that day.
Oleg phoned Herdman in December 2019 to request three Sky ECC devices. At the time, Herdman was in Lisbon pitching an on-premise privacy solution to the Serbian Embassy, which was already testing 10 Sky ECC devices supplied by another distributor.
This distributor, also from Vancouver, joined Herdman at the meeting with the Serbian official in Lisbon.
“My father tried to talk Oleg out of the order. It was too much hassle to get three devices, load them and ship them to LA. But Oleg kept begging him.”
In the end, Persall sourced and paid for three iPhones, set them up and mailed them to California. Oleg paid in bitcoin.
Criminal investigation
Dutch and Belgian authorities infiltrated the Sky ECC network from 15 February 2021 to 9 March 2021, raiding 200 properties, arresting 48 people and seizing €1.2m in cash and 17 tonnes of cocaine.
On 12 March 2021, Herdman and Jean-François Eap were indicted – in the Southern District of California – under the RICO Act, which targets the “professional enablers” of organised crime. In the indictment, prosecutors argued that Herdman was a top Sky ECC executive and that he sold software to criminals.
“When he saw the indictment, my father guessed that the LA businessmen were undercover cops. He still didn’t think he did anything illegal though,” said Kawai Herdman.
While my dad can only view the evidence against him in a secure part of the prison, after being strip-searched, 4,000 documents from his case were leaked to the media Julie Kawai Herdman
She said Herdman’s links to the Southern District of California, where he was indicted, were at best tenuous. “The only tie to Southern California was this meeting. He only made one sale in the US, and it was to those guys.”
Herdman cooperated with the US Department of Justice and San Diego prosecutors. He attended a three-day meeting in Madrid with defence lawyers – at a cost of over $100,000 to himself – and representatives from the US Marshals Office and Drug Enforcement Administration (DEA).
US officials interrogated him about his involvement with Sky ECC. They confirmed his suspicions about the LA meeting. His sales pitch, where he claimed he was Eap’s “right-hand man”, had been audio-recorded and used as evidence.
“A vague conversation about my dad’s colleagues at well-known crypto exchanges was seen as an offer to help launder the proceeds of crime. US marshall John Shindledecker commented that every BTC [bitcoin] exchange is money laundering,” said Kawai Herdman.
In April 2021, Herdman was collaborating with US officials investigating Sky ECC. US prosecutor Meghan Heesch requested that Herdman relocate to Madrid to work with the DEA. They signed a proffer agreement stating that Herdman would provide information about Sky ECC, but it wouldn’t be used against him legally.
Herdman moved to the city. Yet in June 2021, Spanish police, acting on a French-European warrant, arrested him. He spent 14 days in Prisión de Estremera in Madrid, before being extradited to France and remanded in Maison d’arrêt de Fleury-Mérogis in Paris.
It wasn’t until 20 March 2025 that Herdman received an English copy of the evidence against him. “But the recording of this LA meeting – the main evidence against him – hasn’t been disclosed. Instead, the French cited a US letter stating that it exists,” said Kawai Herdman.
“While my dad can only view the evidence against him in a secure part of the prison, after being strip-searched, 4,000 documents from his case were leaked to the media.”
Serbian links
Organised Crime and Corruption Reporting Project (OCCRP) journalists revealed that Herdman was accused of using Miodrag Kosti?, son of a late Serbian politician, as a reseller. Kosti? was on the run in Spain, with partner Sanja Petkovic, after a 2010 bank robbery in Niš, Serbia. He was extradited to Serbia in 2020 and sentenced to five years in prison.
In January 2023, Serbian police, at the request of French prosecutors, searched the pair’s house in Niš and questioned Petkovic, asking her to give evidence against Herdman. She denied selling Sky ECC devices and refused to testify, while Kosti? denied involvement when questioned three months later.
The couple remain uncharged.
Knowledge of criminality
In August 2017, WhatsApp messages between Herdman and Persall hinted that they knew that Sky ECC phones were used by criminals. Herdman complained about a competitor linked to “HA” – believed to be Hells Angels. He also mentioned “African mafia” clients and raised concerns that Serbian “gangs” could be tracked via IMEI.
“The mafia comment was a joke to describe some rude family friends,” said Kawai Herdman. “And it’s a bit of a stretch to say the Hells Angels are criminals. They’re a biker club. Harley-Davidson even did a brand partnership with them in the 1990s.”
She added: “Though OCCRP reported on the alleged conversation about Serbian gangs, prosecutors were unable to verify whether the messages were sent by my father, so they aren’t being used in the case against him.”
But for now, with the trial of Herdman and his co-defendants still pending, the case remains a contentious point in the global crackdown on encrypted communications.
