Referred to as: Threema · Threema messaging app
No picture yet. Upload one or paste an image URL.
Three encrypted messaging applications - Threema, WhatsApp, and Telegram - were found on devices linked to the investigation and were used for communications related to the case.
“Encrypted messaging applications. I discovered the use of three encrypted messaging applications, Threema, WhatsApp, and Telegram...”
The last screenshot related to Threema was from July, with no screenshots around June related to or from Threema.
“There was never any screenshot around June with the relation to, or nor from Threema. So this is the last one.”
There was a successful extraction of data from May 24th referring to a container recovered in Aeroton.
“From page 15, if we checked the date, it is May. So it is May the 24th. So I suspect there was another container before this conversation of the 1st of April. And I will say this, this conversation talks about the container that was recovered in Aeroton.”
The conversation on the 1st relates to the container recovered in Aeroton, which was the last Threema conversation about that container.
“This conversation of the 1st. Yes. It relates to the container that was recovered in Aeroton. This is the last Threema conversation regarding the container in Piers, or Pier 1 or Pier 2. So this is the last one where they talk.”
Threema messaging app does not keep messages and permanently deletes messages after they are sent.
“Threema messaging application uses encryption, open source technology, and does not require an email or phone number to sign up. It protects your metadata and permanently deletes messages after they are sent.”
Screenshots are used to capture messages in Threema because the app deletes messages permanently after sending.
“One will need to either save it on its screenshots so that it can forward it to the next person. So that is why it was saved on Mashaba, on Tumelo Nku's phone, because he wanted to relate what is in the message to the other person”
Threema messages permanently disappear from both sender's and receiver's devices and the server as soon as messages are sent and read.
“No metadata. The app is designed to leave no data trail. Messages are deleted from the servers as soon as they are delivered. ... It is dead on both sides. ... And indeed on the server itself.”
Screenshots presented in the report come from Threema and WhatsApp applications.
“The first sequence is from Threema ... The second and the third, those ones are from? WhatsApp.”
The first sequence of text is identified as being from Threema, not WhatsApp, based on certain identifiable features such as captions and encryption indications seen in screenshots.
“the first one , we said it was sent , they got it via Threema , then captured on the screenshots of Tumelo ... it shows that it is through those encrypted chats of Threema”
The DPCI provided downloads of phones' data, which enabled confirmation that certain screenshots with bell and phone icons were from the Threema app found in the gallery of Mr Nku's downloads, with metadata indicating when screenshots were taken rather than when messages were sent.
“the DPCI did provide us with the downloads of the phones . And how we were able to confirm that this is Threema is that all of these ones that are grey and a light green that have a bell and a little phone icon at the top were all found in the gallery of Mr Nku's downloads . And if you look at the metadata of it , it specifies just the phone that it was taken . So all of the ones that come from Threema appear like that . And what you can get from it is just the date on which the screenshot was taken and not necessarily when the messages themselves were sent .”
Encrypted communication occurred on Threema, not WhatsApp.
“it shows that it came from this encrypted communication known as Threema. It shows that it was not WhatsApp, it shows that they were communicating on Threema”