Intercepted Communications as Evidence: The Admissibility of Material Obtained from the Encrypted Messaging Service EncroChat
Cerian Charlotte Griffiths, Adam Jackson · The Journal of Criminal Law · 2022
The infiltration by police investigators of the EncroChat messaging service, dubbed the "Crime Chat Network" by major media outlets, has so far led to over 800 arrests and multiple prosecutions across Europe.This has included members of Organised Crime Groups (OCGs) engaged in serious and significant criminal offending.Encrypted digital data platforms are legal and there can be genuine and legitimate motivations for their use however, the potential benefits of encrypted platforms for organised crime have not gone unnoticed by OCGs and criminal enforcement agencies.One such platform was EncroChat.The EncroChat system utilised software on Android handsets allowing users to engage directly in encrypted communication with other EncroChat users through a unique identifier or "handle".According to Europol, by "early 2020, EncroChat was one of the largest providers of encrypted digital communication with a very high share of users presumably engaged in criminal activity."(https://www.europol.europa.eu/media-press/newsroom/news/dismantling-of-encrypted-network-sendsshockwaves-through-organised-crime-groups-across-europe,accessed 22.05.2022).The present case arose from the infiltration of the EncroChat system, and the subsequent gathering of material on the platform by French and Dutch law enforcement agencies.At some point in 2019 French authorities developed the capability to infiltrate the EncroChat system under 'Operation Emma', described in the judgment as follows:… the EncroChat servers were in France and the French Gendarmerie had discovered a way to send an implant to all EncroChat devices in the world under cover of an apparent update.That implant caused the device to transmit to the French police all the data held on it.This was called the Stage 1 process ….Thereafter, in the Stage 2 process, the implant collected messages which were created after Stage 1.The Stage 2 collections occurred after what was called "the infection", which was the point at which the implant first arrived on the device and executed Stage 1. (at [12]).EncroChat became aware of the existence of this implant on 13th June 2020 and advised its users to throw away their handsets as "Today we had our domain seised illegally by government entities(s) [sic]".Contrary to EncroChat's protestations of illegality, it was accepted in the present case that "all of the necessary legal instruments [were] in place" (at [13]) to ensure that the extraction of material from compromised devices was lawful under French law.A Joint Investigation Team (JIT), coordinated by Europol and involving French and Dutch investigators gathered data from the EncroChat system ('EncroChat material') from the 1st April 2020 until the 13th June 2020.