Encrochat was a European wide, secure mobile telephone provider, allegedly based in the Netherlands but holding its servers in France. The telephones worked on an ‘Android’ system that was fully encypted from power on. The system allegedly guaranteed anonymity for the user as there was no way to associate the sim card to the customer account. To prevent further identification of the user, the telephone was not provided with a camera, microphone, GPS or USB data port. An advanced burn system allowed a user to force wipe their own messages from another user’s device using a timer countdown. After a set amount of password attempts on a device, all data was wiped.

The Encrochat facility offered an apparently Global wide system that was fully secure. It is clear that the system was available to criminal organisations. However, it was also used by legitimate organisations that wished to keep their communications private.

Whilst the systems were said to be secure, on or about 16th June 2020, subscribers received the following message on their telephones:

Emergency for Encro users

Today we had our domains seized illegally by government entities. They repurposed our domain to launch an attack to compromise the carbon units.

With control of our domain, they managed to launch a malware campaign against the carbon to weaken its security.

Due to the level of sophistication of the attack and the malware code, we can no longer guarantee the security of your device. We took immediate action on our network by disabling connectivity to combat the attack.

You are advised to power off and physically dispose (of) your device immediately. Period of compromise was about 30 minutes and the best we can ascertain was about 50% of the carbon devices in Europe (due to Updater schedule).

French investigators were able to access Encrochat, an encrypted military grade communications system used by 60,000 people worldwide.

So far, some 200 users have been arrested for serious criminal allegations based on data provided. Whether that data can be adduced in evidence in criminal trials is now being tested.

From 2000, the law with regard the use of police intercepts, was specified within Regulation of Investigatory Powers Act 2000 (RIPA). Aspects of RIPA were effectively transcribed into Investigatory Powers Act 2016. Section 3 defines the offence of unlawful interception but restricts the offence to an interception carried out in the UK.

So how does potential evidence from the hacked Encrochat system fit into current UK statute or caselaw.

UK Law

R v Knaggs (and others) [2018] EWCA Crim 1863 considered aspects of disclosure. It must be said that the majority of UK cases dealt with disclosure rather than the issue of admissibility of foreign intercept evidence.

In R v Aujla [1998] 2 Cr.App.R 16, the appellants were charged with facilitating illegal entry, and the evidence against them included calls from two Dutch offenders in Holland which had been intercepted under authorisation granted, without the knowledge of the English police, by the appropriate judicial authority in Holland. The statute then in force in this country was the Interception of Communications Act 1985. The Court concluded that admissibility turned on the application of s.78 of PACE, including consideration of the circumstances in which the evidence was obtained.

Finally, the court underlined that even if it were to emerge that there was some breach of Dutch law, and it could be said that there was some breach of Article 8, that would not necessarily result in the exclusion of the evidence.

In R v P [2002] 1 AC 146, the public prosecutor in another country had obtained an order from a magistrate authorising the interception of calls made by a drug smuggling suspect. The intercepts resulted in tape recordings being made of telephone conversations between the suspect and each of the Appellants – including calls from the other country to the UK and vice versa, or when both parties were either in the other country or in England. The English prosecuting authorities, via a Letter of Request, sought and, after judicial approval in the other country, obtained the recordings and proposed to put them in evidence. Approving the decision in Aujla (above), the House of Lords held that although the proposed use involved an interference with the accused’s article 8 rights no breach had been shown because all had been done in the other country pursuant to statutory authority and subject to judicial supervision.

The House also noted that a defendant is not entitled to have unlawfully obtained evidence excluded just because it has been so obtained. What he is entitled to is an opportunity to challenge its use and admission in evidence, and a judicial assessment of the effect of its admission upon the fairness of the trial as is provided for by s.78 PACE

In 2013 before the Lord Chief Justice in R v Coulson and others [2013] EWCA Crim 1026, consideration was given to the interaction between UK and European law. The European directive which led to the enactment of RIPA was discussed. In para 31 Article 5(1) of the 1997 Directive was highlighted which effectively prohibited the unlawful interception.

Finally, in the case of Jasper v UK [2000] ECHR 90, the European Court of Human Rights considered issues of disclosure and whether issues of restricted disclosure and the use of special counsel in Public Interest Immunity Applications was consistent with Article 6 (right to a fair trial). In a majority decision the Court found in favour of UK procedures.

In 1990 French law was placed in question with regard to telephone intercepts and the contradiction with Article 8 (right to private life). French law is based on written statute rather than common law. At this time procedure concerning intercepts had not been firmly determined in law. Accordingly the ECHR found that Article 8 was breached as it held that an intercept must be in accordance with law. CASE OF KRUSLIN v. FRANCE (Application no. 11801/85) [1990] ECHR 10, (1990) 12 EHRR 544

CASE OF HUVIG v. FRANCE at the same date similarly found that Article 8 had been breached.

Summary

Aspects relevant to this case were considered in the Administrative Court before Lord Justice Singh and Mr Justice Dove (The Queen on the application of C [2020] EWHC 2967 (Admin)). This case considered the issue of a European Investigation Order (EIO) and its legitimacy with regard to Operation Emma (the French link). The High Court rejected the application for Judicial Review but highlighted (at para 61) that there remained an alternative remedy in the form of the Crown Court to exclude evidence under S78 PACE.

The above law assists the Court as to whether the ‘Encrochat evidence’ is prime facia admissible or otherwise. What becomes clear is that any intercept must initially be considered unlawful and in breach of Article 8 unless properly and lawfully authorised whether in the UK or otherwise. In this case the initial intercept occurred in France.

Should it be determined that the evidence is prima facie admissible then its admissibility should be further considered by reference to fairness of proceedings particularly with regard to the S78 Police & Criminal Evidence Act 1984:

The provenance or probity of receipt/retention by the agency obtaining the evidence is of crucial consideration. In all probability the challenge will be as to reliability of evidence and thereafter whether the evidence can be attributed to a particular defendant.