Judges have decided that communications collected by French and Dutch police from the encrypted phone network EncroChat using software ‘implants’ are admissible evidence in British courts.
Police have made over 1,000 arrests in the UK after French and Dutch investigators compromised the EncroChat phone network.
UK law prohibits law enforcement agencies from using evidence obtained from interception in criminal trials.
But three judges found on Friday [5 February] that material gathered by French and Dutch investigators and passed to the UK’s National Crime Agency were lawfully obtained through “equipment interference”.
“If upheld, the ruling appears to mean that tapping is only now tapping if a radio, cable, or optical signal is split and copied, but not if data is copied from temporary memory. The consequences from this will be significant,” he said.
Computer Weekly can report legal arguments around the case for the first time today following the removal of some previous reporting restrictions imposed in the case.
Ban on intercept evidence.
Historically the UK has prevented the use of intercepted communications as legal evidence in court and has restricted its use to intelligence gathering to protect the secrecy of surveillance methods.
This contrasts with most other countries, including France and the Netherlands, which routinely permit the use of intercept material in court.
However, the Investigatory Powers Act 2016 – known as the Snoopers Charter – also allows communications obtained from mobile phones and computer equipment to be used in evidence if they are received by “equipment interference” – equivalent to hacking a computer.
“It would appear that Parliament has decided that the need to keep the techniques used in the interception communications secret does not extend to techniques used in extracting data from equipment even if they may recover communications,” the judges wrote.
Was the communication stored when intercepted?
The three judges said that the question they needed to answer to determine the admissibility of messages from EncroChat as evidence was whether the communications were stored “in or by the system” at the time they were intercepted.
They dismissed arguments from expert witnesses that law enforcement obtained messages from EncroChat phones while the communications were being transmitted rather than in storage.
Lord Burnett of Maldon, Justice Edis, and Justice Whipple found that while the experts had an important role in explaining how a system works, they had “no role whatever in construing an Act of Parliament.”
“They appear to have assumed that because a communication appears in RAM [computer memory] as an essential part of the process which results in transmission, it did so while ‘being transmitted’,” they said. “That is an obvious error of language and analysis.”
The judges compared the transmission of a message on EncroChat to sending a letter. “Only the last act involves the letter being transmitted by a system,” they said. That requires a letter to be written, put in an envelope, have a stamp attached, and placed in a post box.
The judges said they didn’t need to define exactly where transmission starts and ends. “We do not accept that communication transmission started when the user pressed ‘send’.”
They said that data taken from the EncroChat phones were “not what has been transmitted, but a copy of it or what, in older forms of messaging, might be described as a “draft.”
The appeal court decided that “all forms of storage are caught [by the Investigatory Powers Act], whether or not they enable the intended recipient to access the communication,” said Campbell.
He said that data in communication like a mobile call typically spends 99.9% of its transmission time at rest in some format, in hundreds of memory storage locations, in dozens of en-route devices.
Implants allowed the French and Dutch to access crypto phones
A Joint Investigation team Team) of French and Dutch law enforcement officers penetrated the EncroChat network by installing ‘implants’ on tens of thousands of mobile phone handsets.
The French authorities have not disclosed how implants planted on EncroChat phones worked.
Computer Weekly has reported that the phone network was found to have 60,000 users worldwide and about 10,000 in the UK.
The operators of EncroChat charged up to £1,500 for a six-month contacontractne for their £2,5000 handsets, which came with pre-loaded instant messaging apps, encrypted VoIP, and a remote kill switch to wipe them.
They warned users that the network had been compromised on 13 June 2020.
The UK’s National Crime Agency said that the sole use of EncroChat was coordinating and planning the distribution of illicit commodities and money laundering and had been used by some criminals for plotting to kill rivals.
Lawyers representing the defendants said in their grounds for appeal that communications from EncroChat were intercepted while they were in the transmission rather than while they were being stored in the handsets.
They also questioned the validity of the UK’s Targeted Equipment Interference [TEI] warrant.
They argued that the UK had requested assistance from the French concerning the interception of communications when there was no mutual assistance warrant authorizing the making of that request.
The judges found that previous decisions made by courts on interception were irrelevant as they had been “decided under different statutory regimes”.
The sThey that the Investigatory Powers Act 2016 was a new statustatutewhich, there is no relevant authority.”
The judges found that communications passed on from the French and the Dutch to the UK were obtained not while being transmitted but stored. “That being so, the appeal is dismissed.”
Eric Kind, a visiting Lecturer at Queen Mary University London, specializing in criminal justice and surveillance technologies, and director of data rights agency AWO, said the verdict would likely be appealed.
“The court today has given the green light for this new kind of hacked material to be used in evidence, concluding material obtained using such means wasn’t intercepted. The big question is whether this will be appealed given the ramifications for so many future trials,” he said.
