Lawyers are seeking leave from the Court of Appeal (Civil Division) to challenge a decision by Britain’s most secret court that the UK’s National Crime Agency (NCA) acted lawfully when it accessed millions of intercepted messages and images from an encrypted phone network that police say was widely used by organised criminals.
Defence lawyers are seeking to overturn a ruling by the Investigatory Powers Tribunal (IPT) that concluded the crime agency had lawfully obtained surveillance warrants to access supposedly encrypted messages sent by 9,000 UK users of the EncroChat phone network.
The IPT rejected claims that the NCA had failed in its duty of candour by not disclosing key facts to the independent judicial commissioner responsible for authorising the crime agency to obtain copies of EncroChat messages in the UK intercepted in a hacking operation by French and Dutch police.
Convictions may be quashed
The move comes as defence lawyers are bringing a series of separate legal challenges over the admissibility of EncroChat in criminal proceedings.
Thomas Schofield, a criminal barrister at No.5 Barristers’ Chambers, told Computer Weekly that if EncroChat was found inadmissible, large numbers of people convicted of the most serious offences were likely to seek to have their cases overturned through the Criminal Cases Review Commission (CCRC).
“We may see convictions quashed on a scale similar to the Post Office scandal, which saw dozens overturned because of flawed computer evidence” Thomas Schofield, No.5 Barristers’ Chambers
“Ultimately, we may see convictions quashed on a scale similar to the Post Office scandal, which saw dozens overturned because of flawed computer evidence,” he said.
Police have made more than 6,500 arrests worldwide and seized nearly €900m following three years of investigation after the French Gendarmerie infiltrated and collected 115 million messages and photos from the EncroChat network in 2020.
In the UK, more than 1,240 offenders have been convicted and police have recovered more than 173 firearms and over nine tonnes of heroin and cocaine. As of August 2023, police had charged more than 2,000 suspects identified by the National Crime Agency’s response to EncroChat – Operation Venetic.
The novel hacking operation has led to multiple legal challenges in the UK and overseas as defence lawyers question whether the evidence obtained from EncroChat phones is legally admissible in criminal prosecutions.
The IPT refused defence lawyers permission to appeal against its ruling that the NCA had lawfully obtained surveillance warrants, in a decision on 19 September 2023.
Defence lawyers representing 11 defendants are now seeking leave to appeal the ruling directly from the Court of Appeal.
The appeal hinges on three legal grounds:
Whether the Investigatory Powers Tribunal was right to categorise multiple police investigations into criminal groups using EncroChat as a “single investigation”.
Whether the tribunal had breached the defendants’ human rights by blurring the distinction between thematic warrants and more intrusive bulk warrants.
Whether the tribunal had placed too much weight on claims made by the National Crime Agency’s strategic threat assessment that EncroChat was exclusively used by criminals.
Single investigation
If the appeal is allowed to go ahead, lawyers are expected to argue that the National Crime Agency was wrongly granted a thematic equipment interference (TEI) warrant to obtain EncroChat data of UK EncroChat phone users from the French police.
Under Section 101(1) C of the Investigatory Powers Act 2016, TEI warrants – which permit surveillance of multiple targets – can only be issued for the purposes of “a single investigation” or a “single operation”.
The tribunal found in its 11 May decision that the use of TEI warrants was justified and the investigation could be classified as a single investigation into the criminal use of EncroChat.
The NCA obtained French data from 9,000 EncroChat phone users in the UK
“The fact that once the material was obtained and analysed, it was conveniently divided up so that different aspects of the illegal behaviour could be prosecuted does not diminish from the overarching investigation,” it said.
However, defence lawyers are expected to argue that Regional Organised Crime Units and police forces across the UK carried out multiple investigations into criminal groups that were using EncroChat phones does not meet the definition of a single operation under the Investigatory Powers Act.
Bulk warrants
Defence lawyers are also expected to argue that the IPT had “blurred the distinction” between bulk warrants, which allow mass collection of data only for national security purposes, and thematic warrants, which can be used to collect data on multiple targets for fighting crime.
This has the effect of widening the National Crime Agency’s ability to collect mass communications data without the safeguards imposed by the bulk warrant regime, which requires the authorisation of the secretary of state and only allows data to be used for intelligence purposes.
This was contrary to a ruling by the European Court of Justice that “general and indiscriminate” gathering of telecommunications traffic data cannot be justified in a democratic society and Article 8 of the European Convention on Human Rights, which protects the right to private communications.
Use by criminals
Defence lawyers also take issue with claims made by the National Crime Agency in a classified version of its 2019 Strategic Threat Assessment that EncroChat phones were exclusively used by criminals.
They argue that the tribunal wrongly refused requests to examine the entire intercepted dataset of EncroChat material.
The IPT heard evidence during hearings in 2022 that later investigations showed that out of 7,404 UK EncroChat phones investigated, some 294 had not demonstrated a clear link to criminality.
The tribunal found, however, in its decision on 19 September 2022 that, even if it was later discovered that EncroChat was used for non-criminal purposes, only the information available at the time of the warrant was relevant.
It said that although material that emerged after the warrant was issued showed a “small number” of cases where there was no evidence of criminal use, there was no evidence of non-criminal use.
Compensation claims could match Post Office scandal
In the meantime, defence lawyers are challenging the admissibility of EncroChat evidence in a number of cases in the Crown Court.
The arguments hinge on whether French investigators obtained the EncroChat messages while they were stored in phone handsets or whether they intercepted the messages during the course of transmission.
Under current UK law, electronic communications intercepted during transmission are inadmissible in criminal proceedings.
No5’s Schofield told Computer Weekly: “There remain serious questions over the way in which EncroChat evidence was obtained and there is a real possibility that it will ultimately be found to be inadmissible as evidence in the UK.”
People convicted solely on the basis of evidence from EncroChat would be able to seek redress from the Criminal Cases Review Commission on a scale that matched the Post Office scandal, he said.
Schofield added: “Law enforcement agencies need to ensure that the methods they use adhere to the required evidential standards. It is questionable whether this is currently the case, and I would not be surprised to see challenges to the admissibility of EncroChat evidence succeed in the coming months and years.”
The Investigatory Powers Tribunal said in its May 2013 ruling that it would consider further legal issues raised by defence lawyers, including whether the EncroChat operation breached human rights law, once Crown Court proceedings had resolved the question of whether messages intercepted by EncroChat are admissible in criminal courts.
