Messages exchanged through the EncroChat messaging app between handsets were designed to be end-to-end encrypted. In effect, the app provided secret communications. The company also developed a type of Android operating system and smartphones commonly referred to as "carbon units" for the purposes of exchanging the encrypted messages.

In June 2020, the company warned that the handsets had been compromised. French and Dutch police experts managed to place a piece of malware (disguised as an ‘update’) on all of the EncroChat phones, ensuring that a copy of each message was sent to the police, along with data potentially identifying the persons using the phone. Typically, the malware collected the last seven days’ worth of messages. The French authorities disclosed information from UK based phones to the UK’s National Crime Agency; a step that resulted in over 1,000 arrests during summer 2020. However, the French police did not disclose how the malware worked and this caused some uncertainty about how the data should be regarded in UK criminal proceedings. Should the evidence be excluded by the Investigatory Powers Act 2016?

Defendants already at the Crown Court challenged the use of this data in criminal proceedings, arguing that it amounted to ‘intercept evidence’. This type of evidence is highly regulated. In basic terms, warrants permitting its collection and admissibility have to be authorised by a secretary of state and approved by a judge. Intercept evidence is defined as "making available the content of a communication to someone other than the sender or intended recipient during the course of its transmission”.

The defendants submitted that the EncroChat material was inadmissible by reason of the exclusionary rule in section 56 of the 2016 Act because the data was “being transmitted”. There was also argument on whether the UK had made an unlawful request for assistance to the French authorities, contrary to prohibitions contained in sections 9 and 10 of the 2016 Act. Thirdly, the defendants argued that the evidence should be excluded under section 78 of the Police and Criminal Evidence Act 1984; and that the judge should stay the criminal proceedings as an abuse of the process of the court. Only the first argument proceeded to the Court of Appeal and the others are not discussed in detail here.

The prosecution argued the admissibility exception provided by section 56(1) and schedule 3 paragraph 2 of the 2016 Act because the messages were “stored in or by the system”. They also argued that the material was not obtained as a result of “interception related conduct” (because none of the five classes of such conduct as contained within section 56(2) of the Act appeared) and that the relevant conduct was not carried out in the UK within the scope of section 4(8) of the Act.

At the Crown Court, the judge heard detailed technical evidence about how the data had been gathered and how it should be described before applying the admissibility provisions in the UK’s Investigatory Powers Act 2016. Historically, intercept material (usually by phone tapping) in the UK was restricted to intelligence gathering and was not used in court, save for a few exceptions. The 2016 Act changed the definition of intercept material in important respects.

In his decision, the judge set out the nature of the EncroChat system and how the data was captured. The judge then had to decide whether the data was Part 5 equipment Interference material or Part 2 intercept material. However, the primary question for the judge (and the Court of Appeal), was whether the communications fell within section 4(4)(b) of the 2016 Act, as the prosecution submitted or section 4(4)(a) of the Act, as the defendants / appellants submitted? In essence, were the messages “stored in or by” the telecommunications system by which they were transmitted, or were they “being transmitted” at that point?

The judge decided that the EncroChat messages were properly regarded as falling within section 4(4)(b) of the 2016 Act. At the relevant time when the messages were made available, they were not “being transmitted”. He found that the defence approach sought to extend the notion of transmission well beyond anything contemplated by the 2016 Act and that the exclusionary provisions of section 56 of the Act did not apply. He also decided that the data had been obtained by conduct in France, and not in the UK. The consequence of this was that the argument about the nature of the warrantry obtained was rendered somewhat academic. In light of his findings, however, even if the data had been obtained by conduct in the UK, it had been obtained in accordance with an existing Targeted Equipment Interference warrant and was consistent with the exercise of functions under Part 5 of the 2016 Act; having rejected a submission that a Targeted Interception warrant under Part 2 should have been in place. Part 5 warrants are required for the interception of stored material, and Part 2 warrants are required for material which is to be intercepted while being transmitted.

In other words, the judge found in favour of the prosecution and part of the decision was the subject of an appeal. The appellants challenged four of the judge’s decisions, but they are dealt with together here because the appeal court’s task was essentially confined to the legal issue of the admissibility of the EncroChat material. In summary, the Court of Appeal considered whether the EncroChat material was intercept material and inadmissible in criminal proceedings because of section 56 of the 2016 Act and whether its obtaining should have been identified as a kind of interception requiring a Targeted Interception warrant. The critical issue was the construction of section 4(4) of the 2016 Act.

The Crown Court judge found that the EncroChat material in this case had been obtained for the purposes of UK proceedings under two Part 5 warrants. The issue for the Court of Appeal was whether that approach was correct, or whether on a true understanding of the way the data were obtained, and of the 2016 Act, they comprised material obtained unlawfully under the wrong warrant and, in any event, were inadmissible. Interestingly, the appeal court opened their consideration by reference to an agreement that the handsets were part of the “public telecommunications system”, and therefore that material stored on them is stored “in or by the system”. The appeal court had reservations about this, but proceeded by reference to the agreement between the parties. If the handsets had not been regarded as part of the system, then extracting the content would not have amount to interception at all, and the issue of admissibility would not have arisen.

At a hearing 20th January 2021 in the Court of Appeal, judges found that the data had been recovered (intercepted) from storage and not in the course of “transmission”. The communications were lawfully intercepted while stored on the handsets and are admissible by virtue of paragraph 2 of Schedule 3 to the 2016 Act. In arriving at this conclusion, they rejected the notion that cases would turn upon a minute examination of each system in every case. Parliament did not chose to define the relevant timing of the capture by reference to whether the information was, for example, in the device’s RAM or its permanent storage database. The words “transmission”, “system” and “stored” are ordinary English words. The judges stated that the court’s task is to –

“…understand the system and then to decide whether, as a matter of ordinary language, the communication was being transmitted or stored at the time of extraction. If the former, it is inadmissible. If the latter, it is admissible, provided the appropriate warrant was in place. On the findings of the judge the appropriate warrant was in place and the extraction was carried out in accordance with it”.

Interestingly, the Court disagreed with the Crown Court judge in respect of whether the European Investigation Order for the product of the French operation was a ‘request for assistance in connection with interception’ for the purposes of s.10 of the IPA, a further route to engaging the prohibition in s.56. The Court went on to reject the Defence argument that the evidence could not be admitted because the NCA had not applied for a mutual assistance warrant (as stipulated by s.10(2)), saying that the relevant authorisation for the request had been obtained by the exercise of a statutory power, namely the power to make the EIO itself. The court therefore found that the evidence was admissible and dismissed the appeal.

This article is co-written by Evan Wright, a partner in JMW’s Business Crime and Regulation Department and Sarah Vine, a barrister at Doughty Street Chambers who represented in the appeal.