Thomas Ross QC

In my last article on this topic I predicted widespread legal challenges to attempts by prosecutors to lead evidence obtained as part of the ‘Encro Hack’ – carried out by French police in May 2020. That article focused upon an unsuccessful attempt by C to pursue judicial review proceedings designed to challenge the European Investigation Order (see R v Director of Public Prosecutions [2020] EWHC 2967 Admin). In rejecting C’s argument the High Court (Queen’s Bench Division) observed that there “is an adequate alternative remedy in the form of the ability to exclude evidence under section 78 of PACE”. This article considers C’s attempt to make use of that remedy at the trial court.

C (along with co-defendants A, B and D) took his fight to the Court of Appeal (Criminal Division) following upon a judgment in the Crown’s favour at Liverpool Crown Court (see A, B, D & C v R [2021] EWCA Crim 128). As it was succinctly put by Chief Justice Lord Burnett of Maldon in the Court of Appeal, “the issue in this appeal is whether evidence obtained from a mobile phone system known as EncroChat, which was marketed to its users as totally secure, can be admitted in evidence in criminal proceedings or is excluded by the Investigatory Powers Act 2016”. The answer to that question, so far as proceedings in England and Wales are concerned, was given on Friday 5th February 2021.

The trial of A, B, D & C is yet to come, but the Court of Appeal allowed reporting on the basis that “there are a significant number of cases pending in England and Wales derived from EncroChat material … For this reason it is important that legal admissibility issues in this case should be determined in a judgment of this Court which can now be published”.

When the case came before Liverpool Crown Court the judge (Dove J) directed that a preparatory hearing should be held to determine the admissibility of the EncroChat evidence. That hearing ran for 15 days - between 16th November and 3rd December 2020 – and involved a great deal of oral evidence, including expert evidence. Ultimately Dove J ruled that the EncroChat evidence was admissible and parties went off to the Court of Appeal.

The EncroChat material was obtained by a Joint Investigation Team (JIT) of French and Dutch investigators and prosecutors by interfering in the EncroChat communications system. It then supplied the material obtained to UK authorities where it was used in a large number of criminal investigations, including the one that led to this prosecution. The Judge accordingly required to make findings in fact about how this occurred and then apply UK law as set out in the Investigatory Powers Act 2016.

To win the argument, the defence first required to persuade the court that the material obtained was ‘intercept material’ (classically phone tapping) which would then allow a discussion of whether the 2016 Act prohibited its admission. The contrary argument of course was that the court was not dealing with ‘intercept material’ at all – it was not ‘intercepted’ in the classic sense, simply recovered from storage. This came to be the key conflict in the case.

The judge summarized the nature of the EncroChat system in this way: “EncroChat is a system of encrypted communication. It operates using specific handsets provided by the EncroChat system operator and functions on the basis that the EncroChat devices can only communicate with other EncroChat devices. The EncroChat devices have dual operating systems, one being the EncroChat operating system itself and the second being a standard Android system with no functionality. Depending upon how the handset is switched on, it will start in either EncroChat or the Android system mode. In order for one user of EncroChat to speak to another it is necessary for them to know the unique user identification, or handle, of that person. Akin to other systems of encrypted communication, any message using the EncroChat system is encoded or encrypted as it passes through the EncroChat server between one handset and another, being decoded or de-encrypted at the receiving handset so that the user can read it.”

The Joint Investigation Team called its harvesting of EncroChat material ‘Operation Emma’ and Dove J went onto summarise the way in which it had proceeded. The EncroChat servers were in France and the French Gendarmerie found a way to send an implant to all EncroChat devices in the world under cover of an apparent software update. That implant caused the device to transmit to the French police all the data held on it. Importantly Dove J found that the French police had all the necessary legal instruments in place to undertake the lawful extraction of the material from the devices all over the world as a matter of French law.

The judge then embarked upon a technical description of the way in messages were sent, received and stored. Ultimately this led him to the conclusion that the messages had not been ‘intercepted’ – the EncroChat date was not ‘being transmitted’ at the time when it was taken by the French police - and was properly to be taken as ‘stored in or by the system’ and thus subject to section 4(4)(b) of the 2016 Act.

The principal question for the Court of Appeal accordingly was whether the Dove J was correct in this conclusion (as the Crown submitted) or whether the communications fell within section 4(4)(a) (as the appellants submitted). This would involve deciding whether, at the point when they were intercepted, the. Communications were ‘stored in or by’ the telecommunications system by which they were transmitted, or whether they were ‘being transmitted’ at that point. Were it the latter, the defence submitted that the material should as a result be excluded in terms of section 56 of the 2016 Act.

The key findings of Dove J on this question are to be found at paragraph 63 of the judgment: “(Dove J) found that the communications were extracted directly from the handset of the user and not while they were travelling to, through or from any other part of the system. This is a process which is like any other means of downloading the content of a mobile phone handset. It is done remotely, but it is done by interrogating the RAM of the phone, not by intercepting the communication after it has left the phone. In the case of the sender the material was recovered in the form of unencrypted messages stored in the RAM of the device in a form in which they existed before they were transmitted from the device to the servers in Roubaix, via the telecommunications system. This provides the answer to the statutory question. The material was STORED when it was intercepted. It was within section 4(4)(b)”.

In short, the Court of Appeal agreed with this analysis and held that the interception of the stored material was rendered lawful by the Targeted Equipment Interference Warrants issued under section 99 of the act. In conclusion, the court stated (at paragraph 79) ‘we have concluded that the only substantial question which the judge was required to answer was whether the EncroChat material was stored by or in the telecommunications system when it was intercepted. Like him, we consider that the communications were not being transmitted but stored at that time. That being so, the appeal is dismissed’.

It remains to be seen whether the Scottish courts might take a different view. The fact that Dove J found that the material was obtained in compliance with French Domestic law in undoubtedly important, as is the fact that the Investigatory Powers 2016 is (by section 272) extended to Scotland. The views of the Justices of the Court of the Appeal will no doubt carry great weight north of the border. On the other hand, the admissibility of evidence in Scotland is largely regulated by the common law and section 78 of the Police and Criminal Evidence Act 1984 has no application.

I await developments in England, and particularly the first Scottish prosecution based on EncroChat, with interest. If any legal professionals have any enquiries regarding the issues raised in this article please contact me at www.benchmarkadvocates.co.uk.