French legal challenge over EncroChat cryptophone hack could hit UK prosecutions

Defence secrecy

Binsard and Martine are challenging the Gendarmerie’s refusal to reveal any details of how it carried out the interception of the EncroChat phones on the grounds of defence secrecy.

Forensic experts in the UK have argued that the Gendarmerie’s silence has led to an evidential “black hole” that has broken long-established principles which ensure that evidence is properly acquired and secured before being used in legal cases.

“We need [documents from the Gendarmerie] even if it is a defence secret. We have to have access to them. If we don’t, we cannot have a fair trial”

Robin Binsard, Binsard Martine

Under French law, the Gendarmerie is obliged to provide an explanatory note on the techniques used to obtain the intercept evidence and a certificate to authenticate the intercepted phone data and messages obtained from EncroChat phones.

“We need those documents even if it is a defence secret. We have to have access to them. If we don’t, we cannot have a fair trial,” said Binsard.

The French lawyers applied to the court of appeal in Nancy, in north-eastern France, in February, seeking further disclosure of evidence about how the hacking was carried out.

A judge has asked the Gendarmerie to provide further technical details of the hacking operation.

Hacked phones outside jurisdiction of French courts

The lawyers also argue that investigators at the French National Gendarmerie’s centre for the fight against digital crime, C3N, went beyond the legal authority granted by judges in a court in Lille.

The Lille court gave authorisation to the Gendarmerie to investigate the activity of EncroChat in France, which was accused of illegally importing encrypted devices into the country.

A judge authorised an investigation into the role of the company’s representative, identified as Eric Miguel, who leased servers for EncroChat through Virtue Imports, a company registered in Vancouver Canada, that were hosted by French software-as-a-service company OVH at its datacentre in Roubaix.

According to legal documents, only 380 of the 32,477 phones hacked by C3N were on French territory, putting nearly 98% of phones outside French legal jurisdiction.

The operation was “clearly a massive and indiscriminate capture of computer data unrelated to the alleged association of criminals led by Eric Miguel or even any criminal activity”, the lawyers said in a legal opinion.

“Almost all of the hacked phones, and therefore intercepted communications, thus do not, in reality, fall within the jurisdiction of the French judge,” it says.

Court order authorising data capture invalid

Binsard and Martine argue that a court order to divert EncroChat messages to a “capture device” controlled by the French Gendarmerie on the eve of the interception operation was also unlawful.

The order failed to specify a duration for the operation, required under article 706-102-3 of the French Code of Criminal Procedure, and should therefore be declared “null and void”.

Subsequent court orders extending the interception operation are also unlawful and should be voided by the court, they claim.

“We will ask them to destroy all of the messages,” said Binsard.

Court orders that prevented technology companies providing services for EncroChat from taking any action that could affect the operation of EncroChat’s infrastructure also face legal challenges.

They include an order to prevent domain name registrar Gandhi SAS and hosting company DNS Made Easy from taking any action that impacted the EncroChat.ch internet domain and related subdomains.

Another order required the cloud service provider OVH not to take any action that would impact the network infrastructure, virtual machines and IP addresses associated with EncroChat. 

Although French law allows for the interception of data, it does not permit “blocking” or “modification” orders, according to the law firm.

EncroChat has become politicised

Binsard said EncroChat had become politicised and that it was not clear how the courts would react to legal challenges in France.

“All of the judges want to protect this investigation, so it is difficult to predict. According to the law, we should win, but the judge may try to protect the use of EncroChat traffic, even if they have to do so illegally,” he said.

Binsard said defence lawyers may refer the case to France’s constitutional council to decide whether the French Constitution has been breached, if they are not granted access to more details about how the French Gendarmerie carried out the hacking on EncroChat.

The case may ultimately go to the European Court of Human Rights as a potential breach of Article 8 of the European Convention on Human Rights, which protects the right to privacy.

The case of Big Brother Watch and Liberty v UK in 2018 found that the UK’s mass surveillance programmes did not “meet the quality of law” and were not capable of limiting “interference” to that “necessary in a democratic society”.