The story so far is that those defending and prosecuting cases in which the primary evidence is based on the evidence of text messages sent via the Encrochat system are feeling nervous. Practitioners expect a further judgment this month from the Court of Appeal. However, the guidance given by a strong Court of Appeal on 5 May 2021, in what must be seen as the leading authority on the subject, is clear. The Lord Chief Justice, Lord Burnett of Maldon, gave the leading judgment in R v A, B, D and C [2021] EWCA Crim 128.
The headline is that if the police have been able to secure Encrochat messages which have been “stored” in a virtual filing system as a draft copy, regardless of whether they have the superficial appearance of being transferred from person A to person B during what could be regarded as a private communication, those messages are admissible.
It is now well-known that Encrochat phones were obtained, and almost exclusively used, by OCGs who used encrypted messaging to further organised crime, particularly drug-trafficking. “Encrochat” was marketed to its users as totally secure. Use of this system took off after the first lockdown in March 2020. The handsets were in vogue and the police looked beaten in the latest round of their cat-and-mouse game with highly organised criminals. The National Crime Agency has been permitted to use the fruits of “harvested” material from the police operation.
The technical aspects of the Encrochat system were dealt with in cursory fashion by the Court of Appeal in May this year. The Court was dealing with principle and admissibility rather than speculative technical arguments about the reliability of the system. Such arguments may follow in later Court of Appeal cases, where expert evidence is likely to be considered in more detail, but it is difficult to see the core of the judgment in R v A, B, D and C being destroyed or reversed. The Court did summarise the general way in which Encrochat messages were retrieved by the law enforcement agencies at paragraph 12.
How did the authorities obtain access to secret EncroChat material?
“EncroChat is a system of encrypted communication. It operates using specific handsets provided by the EncroChat system operator, and functions on the basis that the EncroChat devices can only communicate with other EncroChat devices. The devices have dual operating systems, one being the EncroChat operating system itself, and the second being a standard Android system with no functionality. Depending upon how the handset is switched on, it will start in either the EncroChat or the Android system mode. For one user of EncroChat to speak to another it is necessary for them to know the unique user identification, or handle, of that person. Akin to other systems of encrypted communication, any message using the EncroChat system is encoded or encrypted as it passes through the EncroChat server between one handset and another, being decoded or de-encrypted at the receiving handset so that the user can read it.”
“In short summary, the EncroChat servers were in France and the French Gendarmerie had discovered a way to send an implant to all EncroChat devices in the world under cover of an apparent update. That implant caused the device to transmit to the French police all the data held on it. This was called the Stage 1 process. It would capture all data which had not been erased, typically therefore 7 days’ worth of communications. Thereafter, in the Stage 2 process, the implant collected messages which were created after Stage 1. The Stage 2 collections occurred after what was called “the infection”, which was the point at which the implant first arrived on the device and executed Stage 1.”
Dove J. was at the heart of the decision-making at first instance. His rationale providing for the admission of EncroChat material in a preliminary ruling has been upheld. Although reporting restrictions apply, the Court of Appeal has published an anonymised decision so that legal professionals can be kept informed. This was a policy decision from the Court of Appeal, which paid courteous but relatively short shrift to the submissions, which argued that confidential communications were being intercepted by the State. The message being sent out to the legal profession is “Encrochat is in”.
I shall not attempt to wrestle with the finer technical matters of Realm and RAM memory. The heart of the judgment is whether the information obtained was:
- “stored”, as in some large virtual filing cabinet and therefore admissible; or
- “being transmitted”.
The Court of Appeal broadly agreed with the prosecution in relation to the interpretation of the Investigatory Powers Act 2016 (“the 2016 Act”). This could be distinguished from RIPA, which was primarily targeted at intercepting communications such as telephone calls. Historically the general position was that intercept material could be lawfully obtained by the authorities for intelligence use but not for use as evidence in criminal; proceedings, per [8].
In a complicated, and at times opaque, judgment in which the Court considered statutory provisions the Court of Appeal explained the legality and the route to admissibility for material “harvested” from the system. “The issue is whether the communications were intercepted while they were being transmitted or while they were stored in or by the system.” [51]
Exception to the exclusion: section 56 of the Act and why stored communication is admissible
Section 56(1) of the 2016 Act states that: “no evidence may be adduced, question asked, assertion or disclosure made, or other thing done in, for the purposes of or in connection with any legal proceedings or Inquiries Act proceedings which (in any manner)
(a) Discloses, in circumstances from which its origin in interception-related conduct may be inferred
i) any content of an intercepted communication, or
ii) any secondary data obtained from a communication, or
(b) tends to suggest that any interception-related conduct has or may have occurred or may be going to occur.”
Section 56 is subject to exceptions set out in Schedule 3.
Schedule 3(2)(1)(a) sets out that section 56(1)(a) “does not prohibit the disclosure of any content of a communication, or any secondary data obtained from a communication, if the interception of that communication was lawful by virtue of… sections 6(1)(c) and 44 to 52.”
Section 6(1)(c)(i) sets out that “for the purposes of this Act, a person has lawful authority to carry out an interception if, and only if”… “in the case of a communication stored in or by a telecommunication system, the interception – is carried out in accordance with a targeted equipment interference warrant under Part 5 or a bulk equipment interference warrant under Chapter 3 of Part 6.”
Targeted Equipment Interference warrants under Part 5 were obtained in this case, approved by a Judicial Commissioner and the Investigatory Powers Commissioner at around the time of the first lockdown in March 2020.
“As a matter of ordinary language, section 4(4)(b) is clear and unambiguous in its meaning. It extends to all communications which are stored on the system, whenever that might occur” [62]
The Court adopted the analysis that the messages in the system were essentially the same as downloading the content of a mobile phone handset remotely. The material was “stored” when it was intercepted. Therefore, it was unnecessary to determine when transmission began and ended. The logic of the Court of Appeal is set out in [66]: “The fact that what was obtained was an unencrypted message, means that what was on the phone, and what was intercepted, was not the same as what had been transmitted because what had been transmitted was encrypted. It cannot therefore have been “being transmitted” when it was intercepted: it can only have been “being stored”.”
The material obtained from the server was admissible in criminal proceedings. The harvesting took place in the summer and autumn of 2020. Encrochat closed down. The cat-and-mouse game is bound to continue.
The policy effect of this decision is akin to the rethinking of whether text messages recovered from mobile phone handsets amounted to hearsay; in R v Twist and Others [2011] EWCA Crim 1143, Lord Hughes held that messages which were based in a “common understanding” would not amount to hearsay and the messages were clearly admissible.
So, for the time being at least, Encrochat is in. Arguments at trial may be narrow and focus on attribution. However, be sure to watch this space.
