WWW.COMPUTERWEEKLY.COM
German court finds hacked EncroChat phone evidence inadmissible
A Berlin court has raised questions over whether data from 120 million messages obtained by police hacking an encrypted phone service can continue to be lawfully used as evidence in prosecutions in Germany and other European countries.The Landgericht Berlin Regional Court has ruled that text messages intercepted by French police from the EncroChat encrypted phone network cannot be used to prosecute a suspect for alleged drugs trafficking offences in Germany.The decision, by Germanys largest criminal court, calls into question previous assumptions that under Europes mutual recognition principle, intercept evidence obtained by one member state can automatically be used as evidence in other European states.The court ruling is likely to have implications for the use of evidence obtained from future law enforcement hacking operations into encrypted communications systems, defence lawyer Christian Ldden told Computer Weekly.EncroChat is one of a series of encrypted phone and messaging services to be infiltrated by collaborating law enforcement agencies across Europe since 2020, sparking prosecutions of organised crime groups for drug trafficking and money laundering in multiple countries.French and Dutch police harvested messages from 4,600 EncroChat phone users in Germany and tens of thousands of phone users in other countries after infiltrating EncroChat servers hosted at the OVH datacentre in Roubaix, France, in a novel hacking operation in 2020.A three-year investigation by police into organised crime and drug groups using EncroChat phones led to 6,500 arrests worldwide and the seizure of nearly 900min cash and assets.The lawfulness of the use of hacked data from EncroChat and other encrypted phone networks has now been called into question following a ruling by the Berlin Regional Court.The months-long trial heard evidence from German investigators and prosecutors, and reviewed translations of evidence disclosed by the UKs National Crime Agency during criminal trials involving EncroChat in the UK.A grand chamber of the Berlin Regional Court, made up of three professional judges, a presiding judge and two lay people, found in an oral decision in December that contrary to arguments by European prosecutors, French investigators had not intercepted EncroChat data from a central server in France, but had harvested it from the handsets of EncroChat users in German territory.Read more about key EncroChat decisions in GermanyOctober 2022: Berlins Regional Court has asked the European Court of Justice to answer questions about whether the use of hacked EncroChat phone evidence complies with European law.July 2023: The European Court of Justice hears evidence on whether the collection and sharing of data intercepted by law enforcement from the EncroChat crypto phone network is compatible with European law.October 2023: Germany lawfully obtained data on German EncroChat users from France, but whether the evidence is legally admissible is a matter for national courts, says advocate general.April 2024: The Court of Justice of the European Union (CJEU) rules that EU member states must formally notify other member states when they intercept communications in their jurisdiction, opening up the way for further legal challenges.Under German law, that meant prosecutors were obliged to seek approval from the German courts to use the French-supplied data in Germany.However, the presiding judge found that prosecutors had failed to seek judicial approval and that German courts would not have authorised the hacking operation against EncroChat under German law.The decision came after the Berlin Regional Court submitted questions to the Court of Justice of the European Union (CJEU) asking whether Frances sharing of hacked EncroChat messages with Germany was permitted under European law.The European court found that, under the European Invesitigation Order (EIO) Directive, France should have formally notified Germany of the interception of EncroChat phones on German soil, and given German authorities the opportunity to object to the operation within 96 hours, if they wished.The court of justice found, contrary to previous German court decisions, that the protections offered by Article 31 of the EIO Directive were designed to protect the rights not only of the country receiving evidence from another EU state but also the individual users of telecoms services intercepted by law enforcement.That contradicted earlier findings of the German supreme court that found Article 31 exists only to support the sovereignty of member states, and cannot be claimed by German citizens as a measure to protect their rights.Following the CJEUs decision, the Berlin Regional Court found in its latest ruling that the principle of mutual confidence in actions of other member states during judicial cooperation only meant Germany should recognise that Frances actions were legal under French law.The presiding judge, Kristin Klimke, found that the German court still had a duty to examine whether the French operation against EncroChat would be legal under German law. And in this case, a German court would not have approved the operation under German law because the evidence of suspicion did not meet the threshold to justify an equivalent hacking operation in Germany.The judge also found that prosecutors had not established that evidence of serious crimes could not have been obtained in a less obtrusive way than by intercepting the data of all EncroChat phone users in Germany.The principle of European cooperation is not intended to require each national law authority to adopt the same criteria for conducting state hacking operations, but is intended to enable cooperation between countries with different laws to protect the privacy and other rights of their citizens, the judge found.Although the Court of Justice of the European Union allowed German prosecutors to request EncroChat data from France, the CJEU did not go on to say that prosecutors could use the data without approval from a German court.In another legally significant decision, the judge found that the hacking operation against EncroChat was not simply a French police operation but was a joint European operation involving a number of other EU member states.France went beyond surveilling the 300 French users of EncroChat, gathering data from all EncroChat users in Europe, the judge found. France had notified its partner countries in advance of the hacking operation.However French prosecutors failed to comply with European law by failing to follow the correct procedures under EU law to inform Germany of its plans to obtain the phone data of German citizens.Frances notification should have contained details of the targets identified by phone number, IP address or email, the identity of individuals targeted, including their address, date of birth and social security numbers, as well as a description of the offence committed.The Berlin Regional Court also found that the French authorities had not disclosed their communications with German police and that no information had been supplied to the court on how the data had been intercepted raising questions over whether defendants had adequate information to challenge the validity of the data.German defence lawyer Christian Ldden, who is a member of an international group of lawyers collaborating on EncroChat and similar cases, said the court was the first to try to understand what happened before and during the EncroChat operation. The judge found that Germany, rather than simply taking data France had already obtained from EncroChat, had been informed about the hacking operation in advance and had therefore participated in the operation.At the end of the day, she said that under German and European law, the evidence is not allowed to be used in court, he added.Ldden said the decision would set a precedent for other cases heard in Germany, though courts elsewhere would make their own decisions on the admissibility of EncroChat evidence. The case is also likely to impact the use of intercept evidence in other cases in Europe, he said.Dutch defence lawyer Justus Reisinger said the Berlin courts decision could have massive implications for cases in Holland.This decision basically confirms our defence arguments in the Netherlands from the recent year. Previously, the Supreme Court rejected my arguments on this point, but along with the Berlin court, even academics are saying that an interpretation like that from the Dutch Supreme Court cant stand. So a legal landslide is quite possible and justified, he said.Bojana Franovi, a lawyer in Montengro dealing with evidence from police hacking of Sky ECC and the FBI-run Anom encrypted phone network, said the decision was likely to influence judicial decisions in her country.Italian lawyer, Daniel Fiorino, said that the Berlin court decision as an excellent result but described the legal situation in Italy as very complex.We have numerous trials still underway, he said.Everyone in the judiciary, at least in Montenegro, is very keen on what the other countries are doing and how they are dealing with those cases, she said.A final written version of the decision has yet to be published.Prosecutors are expected to appeal the decision to the Supreme Court in Germany.The Berlin Regional Court ruled that EncroChat data cannot be used in evidence in a criminal trial.Although data from EncroChat phones was obtained lawfully under French law, a German court is still required to decide whether the interception measures taken by France were permissible under German law.Under German law, the suspicion that users of EncroChat were committing crimes did not reach the threshold to justify intercepting all EncroChat communications.The principle of mutual cooperation between European member states must recognise national measures to protect citizens fundamental rights in cooperating countries.Although the European Court of Justice concluded that German prosecutors were permitted to request EncroChat data from France, that does not in itself mean prosecutors could also use the data in prosecutions.It was not established that evidence against suspects could not have been gathered by less draconian means other than by than intercepting their communications.Germanys legal role in EncroChat2017: French investigators establish that EncroChat encrypted phones were used in a number of drugs related offences.2018: French investigators copy data from an EncroChat server at the OVH datacentre in Roubaix, France. The server data reveals that over 66,000 SIM cards are registered on EncroChat. Investigators are able to decrypt 3,500 files including encrypted notes made by phone users.2018: The German Federal Criminal Police Office (BKA) discovers that EncroChat phones are being used in Germany in serious crimes.30 January 2020: A court in Lille, France, approves the use of a data interception device on the EncroChat server and on EncroChat handsets.2020: The German BKA and the Central Office for Combating Cyber Crime (ZIT), located at the Public Prosecutors Office in Frankfurt (GSta), begin discussions on an investigation into EncroChat.9 March 2020: The BKA and the ZIT take part in a video conference organised by Eurojust in the Hague with representatives of other countries to discuss how to exploit EncroChat data with the French and Dutch Joint Investigation Team (JIT) working on the hacking operation.13 March 2020: The BKA begins a preliminary investigation into unknown users of the EncroChat service on suspicion that EncroChat phone users were in small-scale trafficking of narcotics and organised crime.20 March 2020: The Lille court in France approves an order to redirect data streams on the EncroChat server to enable the capture of EncroChat data.27 March 2020: The BKA receives a message in English from the French and Dutch JIT through Europols Siena communications systems inviting police authorities in other countries to receive messages from EncroChat. The note asked participating countries to confirm they had been informed of the methods used to obtain data from devices in their jurisdiction. Participating countries could only use the intercept material in investigations after being granted permission by the JIT.27 March 2020: The BKA issues the approvals and confirmations requested by Europol after consulting with GSta Frankfurt.1 April 2020: The French and Dutch JIT installs Trojan Horse or implant software on an EncroChat server hosted in the OVH datacentre in Roubaix, France, which goes live. 3 April 2020: The BKA begins downloading EncroChat data supplied by France, through Europol.7 April 2020: The French investigation is expanded from an investigation into the illegal supply of encryption technology in France to include illegal trade in drugs and weapons offences.1 May 2020: The Lille court in France extends permission to continue technical measures against EncroChats infrastructure for one month.13 May 2020: The BKA writes to the French public prosecutor asking permission to make judicial decisions on the collection of location data and other investigative measures on suspects, without disclosing the French investigation into EncroChat.1 June 2020: The Lille court extends permission to continue technical measures against EncroChats infrastructure for a further four months.2 June 2020: The German public prosecutors office of Frankfurt issues a European Investigation Order formally requesting permission to use the EncroChat data obtained by France in prosecutions.13 June 2020: The Lille court approves Germanys European Investigation Order, giving consent to the use of the data by Germany for judicial investigations and prosecutions.28 June 2020: EncroChat administrators succeed in closing down the EncroChat network after having discovered the hacking operation.9 September 2020: The Public Prosecutors Office in Frankfurt issues a further European Investigation Order for additional data from the French EncroChat operation.2 July 2021: The Public Prosecutors Office in Frankfurt issues a third further European Investigation Order for additional data from the French EncroChat operation.1 July 2021: The Berlin Regional Court finds that EncroChat messages cannot be used in German criminal proceedings.5 July 2021: The Berlin Public Prosecutors Office issues a complaint seeking to overturn the Berlin Regional Courts decision and requesting the reopening of criminal proceedings against the defendant.31 August 2021: The Superior Court in Berlin rules that messages intercepted by French police from the EncroChat encrypted phone network can be used as evidence.2 March 2022: Germanys Supreme Court, the Federal Court of Justice (BGH), rules that EncroChat evidence provided by France to Germany could be used as evidence in Germany for investigating serious criminal offences.October 2022: Berlins Regional Court asks the European Court of Justice to answer questions about whether the use of hacked EncroChat phone evidence complies with European law.July 2023: The European Court of Justice hears evidence on whether the collection and sharing of data intercepted by law enforcement from the EncroChat cryptophone network is compatible with European law.October 2023: Germany lawfully obtained data on German EncroChat users from France, but whether the evidence is legally admissible is a matter for national courts, says the advocate general.April 2024: The CJEU rules that EU member states must formally notify other member states when they intercept communications in their jurisdiction, opening up the way for further legal challenges.December 2024: The Berlin Regional Court finds that EncroChat data supplied by France cannot be lawfully used as evidence in a long-running drugs trafficking case.
0 Комментарии
0 Поделились
32 Просмотры