Germany: European Court of Justice hears arguments on lawfulness of EncroChat cryptophone evidence | Computer Weekly

The European Court of Justice has heard legal arguments from EU member states whether electronic communications obtained by an international police operation to hack the EncroChat encrypted phone network can be lawfully used as evidence in courts in the European Union.

Prosecutors from France, Germany, the Netherlands, Spain, Hungary, Sweden, the Czech Republic, and Ireland gave oral evidence to the Court of Justice of the European Union (CJEU) in Luxembourg during a seven-hour hearing on 4 July 2023 in a complex case focusing on European law.

Defence lawyers believe the case could have implications for hundreds of prosecutions of people accused of drug dealing and organised crime on the basis of hacked messages from EncroChat, and another encrypted phone network, Sky ECC, where there is no supporting evidence of criminality, if the CJEU finds there were breaches of EU law.

The hearing came days after a widely reported press conference hosted by Europol in which prosecutors announced that a joint French and Dutch operation to hack EncroChat in 2020, had led to 6,500 arrests of people involved in organised crime and drug trafficking and seizures of €900m over the past three years.

The European Court of Justice hearing follows a decision by a German court last year to refer a series of questions to the European Court of Justice seeking clarification whether France’s sharing of hacked EncroChat messages with other countries is lawful under European law.

German defence lawyer Christian Lödden said that the court’s Advocate General had focused on the critical legal facts and questions, rather than the “politics” of the high profile hacking operation, during the hearing.

He said that the hacking operation affected the privacy of more than 30,000 encrypted phone users in Europe whose phones were successfully hacked, and raised questions whether messages harvested from EncroChat were admissible as evidence in German courts.

Member states told the court’s 15 judges of the Grand Chamber that the EncroChat operation had been highly successful at disrupting organised crime and drug trafficking and cases of murder or torture across Europe.

Quoting figures from last week’s Europol press conference, prosecutors told the court that the EncroChat operation had led to the seizures of more than 100 tonnes of cocaine, 160 tonnes of cannabis, three tonnes of heroin, the seizure of over 900 weapons and more than 21,000 rounds of ammunition.

Legally, the case centres on the question of whether Germany can lawfully use thousands of EncroChat messages obtained and supplied by the French Gendarmerie from phones in Germany, without first obtaining legal authorisation from the German courts.

German prosecutors argue that it was unnecessary to obtain a court order from the German courts to transfer data to Germany when the data had already been obtained by the French Gendarmerie under a French court order.

The court’s Advocat General questioned whether the operation created a loophole that meant German citizens had no recourse to challenge the lawfulness of the EncroChat hacking operation – which is protected by French military secrecy – either in Germany or France.

One of the judges, Professor Dr. Thomas von Danwitz from Germany, questioned whether Germany, rather than transferring data from France to Germany to use in criminal prosecutions, had re-purposed data it had already obtained from France to identify potential threats to life (TTL) for use in criminal cases.

Prosecutors argue that transferring data gathered by France to Germany was not as intrusive to privacy given that the data had already been collected by France.

The court prioritised three out of five questions put forward by the German court for evidence in the hearing. This includes the question of whether the German public prosecutor’s office, rather than a German court, was the competent authority to apply for a European Investigation Order (EIO), given that the prosecutor’s office would have had to obtain a German court order to collect the same data had it originated in Germany.

The court has also been asked to assess whether it was proportionate to intercept data from all the handsets in a particular territory when there was no concrete evidence of criminality against individual phone users in the territory when the interception was authorised.

The court has also made it clear that it is not only considering the questions referred in relation to the EIO, but is also reviewing the general principles of cooperation in criminal proceedings.