Admissibility of EncroChat communications in criminal proceedings
The news that French Authorities had gained access to the EncroChat communications network sent shock waves of panic through its community of users and those who defend them. The ruling in A, B, D and C v R [2021] EWCA Crim 128 found such communications to be admissible in criminal proceedings.
Introduction
On 4 January 2021, Dove J ruled that material obtained by the National Crime Agency from the EncroChat systems was admissible as evidence against the appellants. Dove J rejected submissions that the EncroChat material should be excluded under section 78 of the Police and Criminal Evidence Act 1984 and that he should stay the criminal proceedings as an abuse of the process of the court. The admissibility of the material was the only issue advanced in and consequently considered by the Court of Appeal. The key question for the Court of Appeal was whether EncroChat material could be admitted in evidence in criminal proceedings or whether it is excluded by the Investigatory Powers Act 2016 (‘the 2016 Act’).
What is EncroChat?
EncroChat is a mobile ‘phone system which was marketed as being an entirely secure and therefore covert method of communicating. It is an encrypted system of communication that operates using specific EncroChat handsets. These handsets have dual operating systems, one being the EncroChat system and the other is an Android operating system. The user selects the preferred operating system when turning on the handset and the user must know the unique user identification or handle of an intended recipient in order to send a communication. When a message is sent from one EncroChat system to another, it is encrypted as it passes through the EncroChat server. The communication is then de-encrypted at the receiving handset so that the user can read it.
This encrypted method of communication has facilitated the illicit activities of criminals across the globe. In 2019, French Authorities used malware to successfully access the encrypted communications. They did this by sending an implant to all of the EncroChat systems in the world under the cover of a system update. This implant caused the EncroChat systems to transmit all of the data held on them to the French Authorities. By 2020 the National Crime Agency also had access to this EncroChat material.
Issue on appeal
The Court was tasked in deciding whether the communications were intercepted at the time they were “being transmitted” (contrary to section 4(4)(a) of the 2016 Act) and therefore inadmissible under s56 of the 2016 Act, or whether the communications were intercepted at the time they were “stored in or by” an EncroChat system (contrary to section 4(4)(b)). The appellants submitted that the communications were intercepted as they were being transmitted and so should be deemed inadmissible.
Investigatory Powers Act 2016
Section 4 – Definition of “interception” etc.
Interception in relation to telecommunication systems
(1) For the purposes of this Act, a person intercepts a communication in the course of its transmission by means of a telecommunication system if, and only if –
(a) the person does a relevant act in relation to the system, and
(b) the effect of the relevant act is to make any content of the communication available, at a relevant time, to a person who is not the sender or intended recipient of the communication.
(4) In this section “relevant time”, in relation to a communication transmitted by means of a telecommunication system, means –
(a) any time while the communication is being transmitted, and
(b) any time when the communication is stored in or by the system (whether before or after its transmission).
Section 56 Exclusion of matters from legal proceedings etc.
(1) No evidence may be adduced, question asked, assertion or disclosure made or other thing done in, for the purposes of or in connection with any legal proceedings or Inquiries Act proceedings which (in any manner) –
(a) discloses, in circumstances from which its origin in interception-related conduct may be inferred –
(i) any content of an intercepted communication, or
(ii) any secondary data obtained from a communication, or
(b) tends to suggest that any interception-related conduct has or may have occurred or may be going to occur.
Discussion
The Court held that the appellants were ‘simply wrong’ to submit that the Court must first consider section 4(4)(a) of the 2016 Act and determine whether a message was intercepted while being transmitted. If such interception had been found to occur, the appellants averred that the Court could not then go on to consider whether a message or communication was also being stored at the same time as being transmitted under section 4(4)(b). Rejecting these submissions, the Court reminded the parties that the conjunction connecting sections 4(4)(a) and 4(4)(b) of the 2016 Act is ‘and’, not ‘or’. The Court also confirmed that the language used in section 4(4)(b) is ‘clear and unambiguous in its meaning’ and that ‘It extends to all communications which are stored on the system, whenever that might occur’ (emphasis added). Despite the criticism of the appellants’ submissions, they seemingly directed the Court to consider the statutory question of whether the communications were stored in or by the system at the time when they were intercepted.
Dove J concluded that the communications were extracted directly from the handset of the user and not while they were being transmitted to, through or from any other part of the EncroChat system. The Court agreed with this finding and concluded that the communications were downloaded from the storage within the EncroChat systems. The Court provided a comparison to the writing and posting of a letter in order to explain their narrow interpretation of the term ‘being transmitted’ within section 4(4)(a). It was detailed that although there may be many acts that are critical to enabling a transmission (such as writing the letter and placing it in a stamped envelope), it is only the final act of posting the letter that involves it being transmitted by a system. For the purposes of EncroChat communications, the Court detailed that transmission takes place after a communication has been put into its final form by the computer. It was held that a transmission is then complete once the recipient’s device receives and decrypts it. The Court confirmed that at the time they were intercepted by the French Authorities, the EncroChat communications were not being transmitted but were stored in or by the EncroChat system. These communications were therefore deemed admissible under the 2016 Act.
Albeit this ruling may prove fatal for some defendant’s cases – depending on the degree to which the messages explicitly reveal criminality – there may be scope for the issue to be revisited in the future. The Court was satisfied by the appellants’ assertion that no-one who gave evidence before Dove J knew exactly how the French Authority’s malware worked. If information regarding how the malware operates became available in future, this could be capable of challenging the categorisation of EncroChat material as being intercepted at the time they are “stored in or by” an EncroChat system contrary to section 4(4)(b) of the 2016 Act.
Categories: News
