French Supreme Court raises constitutional questions over EncroChat hacking secrecy

Novel hacking operation

The French Gendarmerie harvested more than 120 million supposedly encrypted messages from EncroChat phone users in 121 countries, in a novel interception operation in 2020, which caused widespread disruption to crime groups and drugs gangs in Europe and the UK.

The UK’s National Crime Agency, working in partnership with other police forces, had made 1,550 arrests, seized 5.8 tonnes of class A and B drugs, £57m in cash, 115 firearms and 2,879 round of ammunition by May last year as part of Operation Venetic, which made use of EncroChat messages intercepted by the French.

A finding that the secrecy provisions surrounding the EncroChat hacking operation – conducted by specialists at the C3N digital crime unit in Pointoise – could require French prosecutors to release evidence about the interception operation has so far been withheld from courts in France and in other countries.

Speaking after the Supreme Court’s decision, lawyer Robin Binsard said only a small percentage of constitutional arguments raised in the Supreme Court are referred to the Constitutional Court. “It is a very good decision,” he said.

“We are arguing that there are no criteria and no recourse to contest defence secrecy, so the law is not compatible with the constitution”

Robin Binsard, lawyer

“We are arguing that there are no criteria and no recourse to contest defence secrecy, so the law is not compatible with the constitution,” said Binsard.

The Supreme Court has asked the Paris-based Conseil Constitutionnel to decide whether the laws relied on by French prosecutors to extract data from the EncroChat cryptophone network affected the rights and freedoms guaranteed by the French constitution.

New constitutional issues raised

The Supreme Court found that articles in the Code of Criminal Procedure relied on in the EncroChat case could be properly considered by the Constitutional Council, as they raised a new constitutional question.

“The question raised is of a serious nature,” the decision released this week found. The public prosecutor or examining magistrate made a choice to invoke national defence secrecy for the entire EncroChat operation and “not only for decryption of data collected”, it said.

That may have had the consequence that “a great deal of information useful for checking the regularity of the operation cannot be submitted to the adversarial debate, which may constitute an excessive infringement of the rights and freedoms invoked”.

Effective remedy

The nine-member council has been asked to decide, among other issues, whether the criminal code used by prosecutors failed to provide “sufficient and adequate legal guarantees”, and whether it failed to offer “adequate [legal] recourse” to EncroChat defendants.

The council will also decide whether there was an adequate prior review of the decision to collect unencrypted messages from the EncroChat phone network by an independent court.

At issue is whether France’s code of criminal procedure affected the rights of people charged with EncroChat-related crimes to a legal defence, affected the principle of “equality of arms” in court proceedings, and impacted their right to an effective legal remedy.

The council will determine whether the legal codes used in the EncroChat operation “unjustifiably and disproportionately” infringed the constitution.

Three possible outcomes

French prime minister Jean Castex is expected to be represented during the hearing. Lawyers and other interested parties, such as associations, can also make written representations.

The council’s decision has three possible outcomes. Firstly, it can find that existing law is compatible with the French constitution.

If the council finds that the law is incompatible, it can decide either to invalidate the law covering historic cases, which would require prosecutors to release documents to defence lawyers describing technically how the EncroChat hack was carried out.

Alternatively, the council could revoke the law for future cases, which would make it more difficult for French prosecutors to invoke defence secrecy during future hacking operations.

French Supreme Court to hear arguments over legality of EncroChat

Separately, the French Supreme Court is due to hear arguments over the legality of the French operation against EncroChat at a hearing next month.

The case, which is expected to go to the European Court of Human Rights, could affect prosecutions in the UK, the Netherlands and Sweden, if the court finds the operation unlawful.

The decision comes after Paris-based lawyers Robin Binsard and Guillame Martine, founders of law firm Binsard Martine, brought a legal claim to the French Supreme Court that the interception operation against the EncroChat phone network breaches French law and the French constitution.

Binsard and Martine are challenging the French Gendarmerie’s refusal to provide defendants with information on the hacking operation on the grounds of “defence secrecy”.

They claim that for defendants to have a fair trial, the French police should explain how they obtained intercept evidence from EncroChat phones and provide a certificate to authenticate the intercepted data and messages.

The lawyers claim that French computer crime specialists went beyond the legal authority granted to them by judges in a court in Lille.

The disputed court orders include one requiring French cloud computing service provider OVH, which hosted the servers used by EncroChat at its Roubaix datacentre, to modify its network to enable the interception to take place.

Gendarmes based at the C3N digital crime unit in Pointoise, with the assistance of Dutch investigators, were able to covertly take copies of the servers and upload a “software implant” that was able to extract plain text messages sent over the supposedly secure phones in April 2020.

Forensics experts in the UK have argued that the French Gendarmerie’s refusal to release information on the hacking has led to an “evidential black hole” that has broken accepted principles that evidence should be properly acquired and secured before being used in legal cases.