Court of Appeal ruling opens door to admissibility of messages sent via Encrochat 

Could Court of Appeal ruling open the door to more convictions based on Encrochat messages?

A vast number of cases are awaiting a criminal trial that will rely, to a greater or lesser extent, on the admissibility of communications made via the supposedly highly-encrypted Encrochat service.

The Court of Appeal has now issued a ruling following preliminary rulings at Liverpool Crown Court. Whilst this ruling does not mean that guilty pleas are inevitable, for some defendants it will nonetheless present a significant hurdle for them to surmount.

The Case

The main question was whether the communications were intercepted at the time they were being transmitted or, as the judge found, were recovered (intercepted) from storage. If the judge was right, subject to a number of subsidiary arguments, the evidence would be admissible.

The EncroChat material was obtained by a Joint Investigation Team (JIT) of French and Dutch investigators and prosecutors by interfering in the EncroChat communications system. It was then supplied to the United Kingdom authorities where it was used in a large number of investigations, including the one which led to the present case. The judge was required to hear evidence about how this occurred, and then to make findings of fact. He then had to apply the United Kingdom domestic law governing the admissibility of such material, which is found in the Investigatory Powers Act 2016 (“the 2016 Act”).

The “2016 Act”

The 2016 Act adopted a domestic law framework which is unique in Europe and which resembles previous regimes. Historically, intercept material (classically phone tapping, but not limited to that) could be lawfully obtained by the authorities. Subject to a number of immaterial exceptions, it could not be used in evidence in proceedings but was reserved for intelligence use. The policy justification for that approach has been debated on many occasions and centres around protecting sensitive capabilities and wider operational and practical concerns.

All were discussed in Intercept as Evidence, December 2014 Cmnd 8989 which was the report of a review of Privy Councillors provided to Ministers. In many other jurisdictions, including France and the Netherlands, there is no blanket prohibition on the admission into evidence of intercept material. The 2016 Act superseded the law found in the Regulation of Investigatory Powers Act 2000, which itself replaced the Interception of Communications Act 1985.

Major changes between the current regime and the one established in the 2000 Act concern the new regulatory and supervisory system established by the 2016 Act. The law relating to admissibility of intercept material, and the definition of what is and is not intercept material also changed in important ways.

Targeted Equipment Interference / Interception Warrants

The essential point before the Court of Appeal was the submission, rejected by the judge, that the EncroChat material is intercept material and inadmissible in criminal proceedings because of section 56 of the 2016 Act. It was also further suggested it was unlawfully obtained under a Targeted Equipment Interference warrant, when its obtaining should have been identified as a kind of interception which would require a Targeted Interception warrant.

Targeted Equipment Interference warrants are governed by Part 5 of the 2016 Act and may produce material which can be used in evidence. Targeted Interception warrants are governed by Part 2 of the Act and the product is inadmissible in evidence in almost all criminal proceedings, including these.

The judge found that the EncroChat material in this case was obtained under Part 5 warrants. These were approved by Sir Kenneth Parker, a Judicial Commissioner, on 5 March 2020, and Sir Brian Leveson, the Investigatory Powers Commissioner, on 26 March 2020, prior to the obtaining of the EncroChat material.

The second warrant was needed in order to widen the scope of the first for reasons which are not material to the issues before us. The issue is whether that approach was correct, or whether on a true understanding of the way the data were obtained, and of the 2016 Act, they comprised material obtained unlawfully under the wrong warrant and, in any event, were inadmissible.

The prosecution submitted that:

i) the EncroChat messages were admissible and fell within the exception provided by section 56(1) and schedule 3 paragraph 2 of the Act because the messages were “stored in or by the system” at the time when they were intercepted; and, in any event,

ii) that the material was not obtained as a result of “interception related conduct” because none of the five classes of such conduct (as contained within section 56(2) of the Act) applied to the present case, alternatively it was not conduct carried out in the United Kingdom within the scope of section 4(8) of the Act.

The key question was whether at the relevant time the communications were “being transmitted” or were “stored in or by the telecommunication system.” The judge found the latter to be the case. The EncroChat messages were properly regarded as falling within section 4(4)(b) of the 2016 Act and they had been obtained in accordance with a Targeted Equipment Interference warrant. He decided that for the following reasons:

i) At the relevant time when the messages were made available they were not “being transmitted;” it was clear from the evidence in relation to the data exfiltrated from the receiving device that the data was not made available whilst being transmitted. The incorporation of the nickname for the sender from the data held in the receiver’s device demonstrated that the transmission process of the data had finished. The judge indicated that he had no trouble in concluding that the EncroChat data was not being transmitted at the time that it was taken and was properly to be regarded as “stored in or by the system (whether before or after transmission)” and subject to section 4(4)(b) of the 2016 Act. The judge ruled that he did not consider that the distinction between RAM and Realm as described by the defence experts equated to the distinction between “being transmitted” and being “stored” as set out in the statutory provisions. The defence approach sought to extend the notion of transmission well beyond anything which was contemplated by the 2016 Act.

ii) The Equipment Interference Code of Practice was published pursuant to Schedule 7 of the 2016 Act and was admissible as evidence in criminal proceedings. It addressed the exercise of functions under Part 5 of the 2016 Act and the authorisation of Targeted Equipment Interference warrants and their operation. The judge considered that these provisions from this Code of Practice were consistent with the conclusions that he had already made in relation to this issue.

iii) Having considered the provisions of section 99 of the 2016 Act, which contained the power to make a Targeted Equipment Interference warrant and the scope of such a warrant, the judge decided that the interceptions were carried out in accordance with the warrant that had been obtained. The warrant application accurately described the way in which the implant was to operate and the warrant authorised what was then done. This was a finding of fact set out in paragraphs 161 and 162 of the judge’s ruling. It was a finding of fact to which he was entitled to come, and there is no challenge to it in this appeal.

What did the Court of Appeal rule?

The Court held:

“We agree with the judge. The communication is that which is transmitted. What remains on the device is not what has been transmitted, but a copy of it or what, in older forms of messaging, might be described as a “draft”. That is so however quickly after transmission the obtaining of the copy takes place, or even if the copy is extracted while the original encrypted communication is being transmitted. The fact that what was obtained was an unencrypted message, means that what was on the phone, and what was intercepted, was not the same as what had been transmitted because what had been transmitted was encrypted. It cannot therefore have been “being transmitted” when it was intercepted: it can only have been “being stored”.

That being so, the harvesting was interception but was rendered lawful by the Targeted Equipment Interference warrants issued under section 99 of the Act.”

and that:

“We have concluded that the only substantial question which the judge was required to answer was whether the EncroChat material was stored by or in the telecommunications system when it was intercepted. Like him, we consider that these communications were not being transmitted but stored at that time. That being so, the appeal is dismissed.”

How can we help?

If you have concerns about the use of encrypted messages as evidence, do not hesitate to contact our specialist lawyers. If you would like to discuss any aspect of your case, please call us now on 0161 477 1121 or email us if you have any questions in relation to this article.