In the midst of the pandemic last year, unbeknownst to its users at the time, the EncroChat service was infiltrated by malware which installed an identical application on their EncroChat devices. This application, as well as functioning as it normally would, now also sent all message data to intelligence teams across Europe. The National Crime Agency applied to obtain the data and used it to make hundreds of high-profile arrests. This was known as ‘Operation Venetic’.

The EncroChat service, which guaranteed anonymity for its customers at a charge of approximately £1,500 for the use of a phone for 6 months, was widely used to organise serious criminal activities, often internationally. Upon realising that the service had been infiltrated, EncroChat released a message in June 2020 to all users stating that the domain had been ‘seized illegally by government entities’. The message also advised customers to ‘power off and physically dispose of [their] device immediately.’

Once the devices had been disposed of, the concern for those using the devices was then whether the material obtained would be admissible in criminal proceedings. Historically, the position in England and Wales was that intercept material (usually evidence from phone tapping) was not admissible as evidence, although it could be lawfully obtained for intelligence purposes. Stored data however (for example, a phone download of stored data) is permissible. The issue of admissibility came before the Court of Appeal in the case of R v A, B, D and C [2021] EWCA Crim 128 earlier this year. The relevant legislation is section 56 of the Investigatory Powers Act 2016, which states, in broad terms, that material is not admissible if it can be inferred or suggested that it originated from ‘interception-related conduct’.

However, section 56, under Schedule 3(2)(1)(a), ‘does not prohibit disclosure of the content of any communication, or any secondary data obtained from a communication, if the interception of that communication was lawful by virtue of: (a) sections 6(1)(c) and 44 to 52.’

Section 6(1)(c)(i) provides that there is lawful authority to carry out an interception if, ‘in the case of communication stored in or by a telecommunication system’, the interception is carried out in accordance with a targeted equipment interference warrant under Part 5 or a bulk equipment interference warrant under Chapter 3 of Part 6.

It was agreed in this case that a targeted equipment interference warrant was obtained and approved by the Investigatory Powers Commissioner.

The case therefore boiled down to whether the communications fell within sections 4(4)(b) or 4(4)(a) of the Investigatory Powers Act – i.e. whether, at the point of interception, the communications were ‘stored in or by’ the system by which they were transmitted, or were ‘being transmitted’. The Appellants submitted that if the communications were ‘being transmitted’ at the relevant time the communication was inadmissible under section 56 as the exception under section 6(1)(c)(i) would not apply.

The Court of Appeal ultimately held that the material was stored in or by the telecommunications system at the relevant time. They pointed out that sections 4(4)(a) and 4(4)(b) are not mutually exclusive; they have the word ‘and’ between them. Therefore, whether the communication was stored before or after the transmission was irrelevant and the communication could, in theory, be stored whilst also being transmitted. The Court of Appeal reiterated the judge’s finding of fact – that the communications were downloaded from the handset. While this download was undertaken remotely, it was not intercepting communication after it had left the phone but downloading ‘stored’ communications for the purposes of the legislation.

Defendants charged in EncroChat cases across the country have been following the developments in the cases of R v A, B, D and C [2021] EWCA Crim 128 and R v Coggins & Others closely.  These prosecutions will, for now at least, be bolstered by the admissibility of EncroChat messages obtained via Operation Venetic. Provided that attribution can be established, it appears that the options open to defendants wishing to challenge the admissibility of the intercept evidence are limited.

Some commentators consider this decision to have overturned the will of Parliament, which could at any time have made intercept material explicitly admissible – as has been done in many other countries. Indeed, the review on Intercept as Evidence (the 8th review since 1993) which ran from January 2011 and culminated in a paper in August 2014, concluded that ‘it is not possible to find an intercept as evidence model that is consistent with both legal requirements of fairness at trial and the operational requirements set out in the 2008 Privy Council Review.’  Some of the concern in that review related to funding, but equally suggested that there would be a risk from the disclosure of sensitive techniques which might reduce the benefits even with full funding.

The benefits of allowing intercept evidence to remain purely for intelligence gathering purposes are obvious; criminals would continue to talk, relatively freely, on these systems without knowledge of the methods of intercepting such systems. Crime agencies could then use any intelligence gathered to secure prosecutions based on evidence obtained as a result. Equally, some might argue that the hundreds of arrests following the success of Operation Venetic would result in far fewer convictions if the messages were not admissible at trial.

There are reportedly many other legal challenges being prepared in respect of EncroChat admissibility. However, for the time being, EncroChat evidence is admissible in criminal cases.