united-kingdom privacy european-union evidence human-rights
Was the EncroChat Hack Legal? If not, is there a legal mechanism which could allow the evidence to be used?
<p><strong>Disclaimer:</strong> I am aware there are a lot nuances within law, particularly within each country, as such this question only concerns the wider EU law and UK law as these are the courts I am interested in specifically. However, if you have a generic answer around illegally or potentially legally obtained evidence, please feel free to answer.</p>
<hr />
<p><strong>Summary:</strong> If you're unaware of the backstory, here's a quick summary. <a href="https://en.wikipedia.org/wiki/EncroChat" rel="nofollow noreferrer">EncroChat</a> was a crypto-phone provider. Their service was created in 2016 and sold via their website. Their &quot;unique&quot; selling point was guaranteed anonymity &amp; security via their own hardware units &amp; mobile network. While the platform was not designed for criminals or even exclusively used by criminals, it was thought to be used somewhat heavily by criminals. This led to the platform being hacked in a joint effort by: Dutch, Belgian, French and British police &amp; intelligence operators The ultimate result of this hack was a lot of data &amp; evidence of criminal activity.</p>
<h2>Was the Hack Legal?</h2>
<p>My first instinct is no, it was not legal to infiltrate this platform. There's a lot of misinformation &amp; confusion online about whether or not the hack itself was legal in the first place. The intelligence community claims that the hack <strong>was legal</strong> because the platform was riddled with criminal activity. But is that an accurate &amp; legal justification for such an action? Again, my first instinct is no.</p>
<p>As an example, Signal is a secure messaging service, it was founded in 2014 and it was designed entirely with privacy &amp; security in mind. This means that Signal is used both by ordinary every day citizens as well as criminals. It is also used by journalists, politicians, dissidents and many more groups of people which may or may not need such levels of privacy &amp; security. Whether or not these people need privacy is neither here nor there they are entitled to it and Signal provides that platform.</p>
<p>This leads me into my next point. Signal itself is a privacy platform, and like EncroChat, it is also used by criminals however, as far as we know, no hacking attempts have been made by intelligence agencies. I am unable to come up with a valid reasoning as to why this might be the case. It could be the case that intelligence agencies have tried to hack it &amp; failed and so, nothing has been published. But there is one key difference between Signal &amp; EncroChat, Signal is open-source. This leads me to believe that intelligence agencies have shied away from hacking attempts not because they don't want to destroy the privacy of its users but because they know more eyes are on it. EncroChat however was a closed source platform, perhaps this might be a reason why intelligence agencies targeted it, who knows? Irrespective of all of that, it still begs the question whether hacking a platform is legal at all?</p>
<p>Everyone has a right to privacy, over 150 national constitutions recognise a right to privacy. So I have to wonder how it could possibly be legal for an intelligence agency to hack any platform which is perpetuating that right either via hardware, software, etc. If so many countries recognise a right to privacy, how is it that leading intelligence agencies can pick a target (in this case EncroChat) and perform border-line cyber terrorism against it all because <strong>some</strong> users are using it for malicious or criminal activity. It would be as if SSL/TLS was banned, outlawed, back-doored or hacked because <strong>some</strong> terrorists used it on their systems.</p>
<p><strong>What are the legal specifics within the EU around governments performing hacking against companies?</strong> <strong>What evidence do governments need in order to prove that these type of activities are in-fact necessary and legal?</strong></p>
<h2>If the Hack was Not Legal Can the Evidence be Used? If so, how?</h2>
<p>If the attack on the platform was not legal (which I don't think it was) then how could the evidence still be used? Or could it be used at all?</p>
<p>The reason I ask is because on the news today, I saw the first UK criminal to be convicted and all of the evidence used against him was cited from the evidence gathered during the EncroChat attack. This lead me to believing <strong>A.</strong> he has a terrible lawyer. <strong>B.</strong> perhaps the attack was ruled legal? <strong>C.</strong> the evidence isn't admissible and this is corruption at the highest degree.</p>
<p>This also led me to wondering, say the evidence is ruled as being legally obtained, what would the legal process be for this gentleman? Would this go to the appeals court or would it have to go much higher than that?</p>
<p><strong>Finally, has either the EU or the UK made an official ruling on the data collected from the hack or is that still under investigation?</strong></p>

<p>It's just been answered by the Court of Appeal:</p>
<ul>
<li>BBC News, <a href="https://www.bbc.co.uk/news/uk-55953247" rel="nofollow noreferrer">Encrochat: Secret network messages can be used in court, judges rule</a> (5 February 2021)</li>
<li><em>A, B, D &amp; C v Regina</em> <a href="https://www.judiciary.uk/wp-content/uploads/2021/02/A-v-R.pdf" rel="nofollow noreferrer">[2021] EWCA Crim 128</a> (5 February 2021)</li>
</ul>
<p>The rationale for the decision is:</p>
<p>Interception of messages renders them unable to be used as evidence.  But the Encrochat system used end to end encryption, and the captured messages were in plain text and not decrypted by authorities.</p>
<p>Therefore the captured evidence data could not have arisen from &quot;interception&quot; of messages. They were not intercepted messages, but on-device captures of the phones memory/RAM <strong>prior</strong> to encryption and sending.</p>
<p>Corroborating this, the court observed that the captures also apparently included device data that was <strong>not</strong> part of any transmitted message,showing again, they were not &quot;intercepted&quot; data.</p>
<p>It appears it was captured by some kind of software introduced onto the phones by French authorities, perhaps with UK involvement  its not clear to me.</p>

<p>The United Kingdom <a href="https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016" rel="nofollow noreferrer">Investigatory Powers Act 2016</a> would permit this.</p>
<p>Under the IPA the Home Secretary can issue a <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/473751/Factsheet-Bulk_Interception.pdf" rel="nofollow noreferrer">Bulk Interception Warrant</a> for communications relating to serious crime. These warrants have to be countersigned by a &quot;Judicial Commissioner&quot;. These warrants can remain secret indefinitely. They are described as being targetted at overseas individuals and organisations, but there doesn't seem to be anything in particular restricting their scope to outside national borders. Nor does there seem to be anything preventing the use of other material not covered by the original warrant (e.g. if a warrant issued to find terrorist plots were to uncover evidence of drug dealing, well thats considered fair game).</p>
<p>So yes, if a Bulk Interception Warrant were signed which targetted a serious crime that was being conducted over EncroChat, then hacking EncroChat and using anything found in subsequent prosecutions for unrelated crimes would be just fine.</p>
