BSQ Briefing on Encrochat Prosecutions in 2024: Part 2 – The Key Legal Issue – Hacking v Interception

BSQ’s expertise in handling high-profile cases involving serious crimes have seen us at the forefront of legal challenges involving Encrochat evidence. BSQ partners Goran Stojsavljevic and Roger Sahota provide an insight into the current landscape of legal challenges to Encrochat evidence in 2024, marking four years since the first Encrochat implant became operational.

In part 2 of our BSQ briefing on Encrochat Appeals 2024, BSQ will examine the key legal issue that has been raised in the ongoing legal appeals concerning Encrochat evidence – i.e. whether the evidence obtained by the French police should be admitted in criminal proceedings in this jurisdiction. 

Unlawful Interception or Lawful Hacking - R v A, B, C and D (ABCD) (2021) EWCA Crim 128

The first major appeal case on Encrochat was heard on the 25th February 2021. The main point for the Court of Appeal in R v A,B, C and D to consider was whether the evidence gathered by the French police’s Trojan implant constituted "interception" evidence falling within the definition outlined in section 4 of the IPA 2016. Section 56 of the same Act prohibited the use of such material in criminal proceedings. Therefore, the Defence contended that all the Encrochat material should be deemed inadmissible and excluded under s.78 of PACE 1978.

The consequences of such a finding would have been far-reaching, potentially leading to the collapse of the case against the accused in R v A, B, C and D and jeopardizing many other Encrochat prosecutions. It could also entail the re-opening of many cases on appeal where many defendants had pleaded guilty due mainly to the weight of Encrochat evidence against them.

To provide context, unlike many European nations, intercepted communications cannot be relied upon as evidence in criminal prosecutions in the UK, primarily due to a government policy decision (save for exceptions outlined in Schedule 3 of the Investigatory Powers Act 2016 (IPA 2016). In the UK, security agencies have historically benefited from this strict prohibition which ensures that intercepted communications are used only as "intelligence" material in investigations and that information about the technology relied on thus does not have to be made public.

An email sent on 30 January 2020 from Emma Sweeting of the NCA to M Jeremy Décou, an officer working in the digital crime unit of the French Gendarmerie who was the Director of Investigation in relation to the disruption of the EncroChat communication system, clearly shows that the National Crime Agency were aware of the problems that could arise if the implant was found to amount to interception in transmission:

 Apologies for not being clear at EuroJust, but yes we can intercept on a judicial case, we just cannot use it as evidence in court. We can use this as ‘intelligence only’ in the investigation. In practice this means we would try to parallel the intelligence we receive, for example, we could carry out surveillance at a specific time and place based on the intelligence received through intercept. In court, we would then present what happened during the surveillance as our evidence, not the intercept material itself. I see this is very different to how you use the material but yes we can intercept under our legislation so we are extremely keen to access the material, as you say there will likely be great information in there that we could use.

However, we only view material collected in live time as intercept. If the material is collected from the database in the devices, we might consider this to be what we refer to as ‘Equipment Interference’ instead and may be able to use this in evidence. We can work out these details with our prosecutors but yes there is a way for us to use your intercept on our cases.” 

By the 5th of February 2020 it was clear that the NCA had decided that the implant amount to targeted device interference-

 “Our current understanding is: We know: […]– The technique used will be based on TEI, not TI.”  “Confirm that the data collected falls within the UK’s definition of Targeting Equipment Interference rather than Targeted Intercept. The current UK understanding is that this will be TEI and not TI but this needs to be established for the purpose of authorities.”

 In R v A, B, C and D, the Court of Appeal confirmed this view in deciding that the Encrochat phones had been “hacked” by law enforcement, allowing access to messages already "stored in or by" the device, rather than intercepting messages during transmission. This did not qualify as "interception" evidence under the terms of section 4 of the IPA 2016 in the Court’s view:

“The communication is that which is transmitted. What remains on the device is not what has been transmitted, but a copy of what, in older forms of messaging, might be described as a “draft”. That is so however quickly after transmission the obtaining of the copy takes place, or even if the copy is extracted while the original encrypted communication is being transmitted. The fact that what was obtained was an unencrypted message, means that what was on the phone, and what was intercepted, was not the same as what had been transmitted because what had been transmitted was encrypted. It cannot therefore have been “being transmitted” when it was intercepted: it can only have been “being stored”.”

Furthermore, Lord Chief Justice Burnett (presiding) cautioned other Encrochat defendants that any future applications rehashing these same arguments regarding admissibility would receive short shrift: 

 "If it is intended to repeat this kind of process in other pending cases involving EncroChat material, those involved should not be surprised if the trial judges deal with them rather more briskly".


The protracted legal proceedings in R v A, B, C, and D, along with the criminal trial that preceded the appeal in Liverpool, received extensive coverage in Computer Weekly. It is worth noting that throughout the trial and subsequent cases discussed below, defence lawyers have vigorously challenged the credibility and motives of NCA officers who provided testimony regarding their interactions with French officials in early 2020. Allegations of late disclosure of critical evidence and suggestions of a "cover-up" were central to this critique, with the pertinent meetings detailed above and in Part 1 of our blog. However, the Courts have gone on to dismiss these claims as unfounded. Additionally, the Court of Appeal declined to certify R v A, B, C, and D for further consideration by the Supreme Court.


Expert Evidence from Professor Anderson – R v Atkinson (2021] EWCA Crim 1447 and R v. Murray & Ors [2023] EWCA Crim 282

Any hope that the decision in R v A, B, C and D would bring a decisive conclusion to this debate were soon dashed. Prof. Ross Anderson, an expert in Security Engineering from the Universities of Edinburgh and Cambridge, has played a central role in subsequent criminal appeals and an Investigatory Powers Tribunal case that have followed R v A, B, C, and D.

Despite the French police's reluctance to share detailed information about the Trojan implant operation, Prof. Anderson's analysis of the available material revealed, in his view, significant alterations made by the French police's Trojan implant to nearly every aspect of the Encrochat communication system. This included modifications to both the handset application and the Encrochat servers. From a technical standpoint, in Prof. Anderson's assessment, these modifications indicated "interception" rather than hacking.

The appeal R v Atkinson, where Prof. Anderson’s expert report was adduced, was dismissed. The full decision in that case remains embargoed. Subsequently, Professor Anderson is (famously) no longer taking instructions in Encrochat cases. Nonetheless, his influence persists. An attempt to adduce his report ‘by the backdoor” in R v Murray from another expert, who argued Prof. Anderson’s findings were ‘plausible” was refused by the Trial Judge on the basis the new report lacked independent conclusions separate to his. The Court of Appeal upheld this decision, along with rejecting another ground of appeal for the trial in R v Murray to be delayed pending the outcome of ongoing IPT proceedings, considered below. 

Investigatory Powers Tribunal

Running in parallel to the criminal appeals has been an application by several Accused questioning the legality of the Targeted Equipment Interception (TEI) warrants. These were relied upon by the NCA to acquire the Encrochat data from Europol by means of a European Investigation Order. The TEI warrants were granted by Sir Brian Levenson, the Investigatory Power’s Commissioner to the NCA on the 26 March 2020.  

In the IPT case Prof. Anderson’s evidence was cited to support an application to quash the TEI warrants on the same factual basis – i.e. the warrants authorized the collection of "intercept" material which cannot be used in criminal proceedings (s.56(1) of the IPA 2016). The case is before the IPT because the criminal courts do not have the jurisdiction to quash a TEI warrant (pursuant to section 11 of the IPA 2016).

Unfortunately, the IPT has yet to deliver a decision on this issue. On May 11, 2023, in SF and Ors v NCA IPT 21 05 CH as well as dismissing various technical arguments raised by the Applicants, the IPT decided not to rule on Prof. Anderson’s evidence until the arguments raised by him had been dealt with in the claimant’s ongoing criminal cases.

Defence Lawyer’s Open Letter

In 2023, various Defence lawyers and the Fair Trials organisation published a letter expressing their concerns that “the current handling of the EncroChat issue threatens the Rule of Law and fundamental rights protected by EU law that, if it is allowed to pass unchecked, this sets a worrying precedent.” Highlighted within the letter were concerns that the secrecy and lack of transparency surrounding the working of Trojan implants meant that defendants were deprived of a fair trial as they were unable to check the accuracy of the methods used by the French authorities.  

The letter called for European Commission and the European Parliament to ask all concerned Member States to impose a “moratorium on (new) prosecutions until evidence is duly disclosed, as required to safeguard the right to a fair trial.”

The Future for Encrochat Appeals

As of April 2024, the Interception v Hacking debate has not entirely run its course. There remains a possibility of a further appeal to the High Court even after the IPT reaches a final verdict, and the public dissemination of the judgment in R v Atkinson is still awaited.

However, the likelihood of new material emerging on how the Trojan implant functions appears remote. Despite references in the IPT judgment to a pending forensic examination involving the reverse engineering of a seized device by the NCA, in January 2024, a French Investigating Judge classified details regarding the specific techniques employed by the French police to extract Encrochat data as a "state secret" in France.

Notwithstanding defence complaints regarding technical data disclosure and transparency failings, all legal challenges to the admissibility of Encrochat evidence on grounds of unlawful interception techniques have been firmly rejected by courts both domestically and abroad.

Recently, the French and Dutch Supreme Courts dismissed similar challenges to the admissibility of Encrochat evidence in criminal trials in their jurisdictions. There is no indication of EU intervention as requested in Fair Trial’s Open Letter. These developments suggest that in weighing competing interests, the authorities across Europe believe that the public interest in prosecuting the Encrochat accused outweigh any concerns over individual rights raised by the Defence.

Domestically, criminal courts continue prosecutions under the assumption that Encrochat evidence is prima facie admissible. For defendants choosing to challenge Encrochat evidence in ongoing criminal trials, defence strategies now focus on targeted and fact-specific challenges to the reliability of attribution, cell-site, or co-location evidence.

In conclusion, while the likelihood of a judicial reversal of the decision in R v A, B, C, and D on interception seems slim, legal challenges to the admissibility of Encrochat evidence on other grounds persist. For instance, BSQ is currently involved in an ongoing privately funded appeal raising questions of jurisdiction concerning intercepted Encrochat messages transmitted outside the UK and EU. Given the substantial sentences typically handed out in these cases, there will always be a strong incentive for Encrochat Accused to explore every avenue of appeal available to them.

BSQ has extensive experience in handling serious and organized crime cases, with a proven track record of successful outcomes for our clients. Please call our London offices on 0203 858 0851 if you require further support and would like advice from leading criminal defence solicitors. Our specialist Encrochat lawyers would be happy to discuss your case.

Previous
Previous

BSQ Press Release on Behalf of Yadi Zhang - May 24th 2024

Next
Next

BSQ Briefing: Binance’s AML Failings Analysed as Founder of World’s Largest Crypto-Exchange Sent to Prison