NCA ‘deliberately concealed’ information when it applied for EncroChat warrants, tribunal hears

Warrant based on conversation

The warrant application was based on an account of a conversation between an NCA intelligence officer, Emma Sweeting, and Jeremy Decou, the head of the French Cyber Crime Centre, C3N, after a meeting at Europol in February 2020, the court heard.

“That account should have been treated with much less weight,” a defence barrister told the court.

He said that the NCA “deliberately concealed” information about the “tenuous basis” for the warrant application from the judicial commissioner who authorised the warrant.

“It is one thing for the National Crime Agency to proceed on tenuous information. It is another for it not to tell the judicial commissioner,” he said.

“They deliberately did not take steps to resolve the tenuous nature of that information. That was a deliberate decision,” he said. “That was a serious error”.

The judicial commissioner could have been told about the NCA’s account of the intercept technique obtained by Sweeting, he said.

“Information which could allow a judicial commissioner to make an informed decision is important information,” he said.

“The judicial commissioner could say, 'I can authorise interception. But I can’t give you a TEI warrant. I can give you a TI because that covers store and intercept'.”

Europol meeting

Former NCA technical officer Luke Shrimpton, three other NCA officers, together with two or three Scottish Police, and a man from another unidentified agency, met with French and Dutch law enforcement officers at the Europol meeting on 19 to 21 February 2020.

Cross-examined by a second defence barrister, Shrimpton agreed that during the meeting he had not been given a precise understanding of how the implant was going to work.

The court heard that Shrimpton had written “looks like it’s intercept” in his notes from the meeting. He also wrote a note asking whether the database dumps were also intercept.

There was no discussion at the meeting that the EncroChat operation would extract data in two different stages – the technique ultimately used in the operation against EncroChat - the court heard.

Shrimpton agreed that the Dutch had a greater pedigree at decryption but could not say whether the implant had been designed by the French or the Dutch.

NCA did not analyse infected handsets

The court heard during Shrimpton’s cross-examination that the NCA had not taken steps to analyse how the French implant worked by allowing one of its EncroChat handsets to become infected by the French implant.

Shrimpton was asked, “Putting what happened [at the Europol meeting] between the 19 and 21 February at its highest, it must have been apparent that there was capacity to get greater detail by allowing one of the devices to become infected?”

“I did not consider that option at the time,” Shrimpton said.

The former NCA technician agreed that allowing an EncroChat phone to be infected might provide a definitive answer to how the implant harvested messages, and that answer might be different from the information the NCA relied on to obtain its warrants.

Shrimpton said there was no instruction from the NCA not to turn on EncroChat phones after 1 April 2020 – when the French hacking operation began - to prevent the NCA’s handsets from being infected.

He said that he did not allow the EncroChat devices he was working with to go online, so as not to alert the EncroChat administrators. No other NCA EncroChat handsets were infected, the court heard.

Shrimpton was questioned about notes of the Europol meeting taken by NCA officer James Wilmott, which recorded that from the information provided at the Europol meeting, forward-looking data would only be collected from the server “as opposed to targeting every single device”.

Shrimpton agreed that he was in post-conference discussions every day during the Europol meeting with his colleagues.

But he did not recall any conversations with Wilmott about his conclusions. “If shown that, I would question the technical validity of the statement,” he said.

NCA developed its own EncroChat implant

Shrimpton agreed that the NCA had developed its own implant to intercept data from EncroChat, before the French gendarmerie infiltrated the encrypted phone network.

He said during cross-examination that he had access to images of EncroChat servers towards the end of 2018 that had not been supplied to the NCA by the French police.

But the court heard that Shrimpton could not disclose who supplied the server images because the issue was “sensitive”.

An email discussed in court showed that Shrimpton wrote to NCA technical officer Greg Elliot in January 2020 reporting that it looked like the French were planning some “significant activity” on EncroChat.

Shrimpton wrote that he suspected the French implant would exploit a CVE (security vulnerability) and would be deployed to handsets through an update server. 

He suspected that the French would intercept messages from the EncroChat server and decrypt them.

The email said that the NCA had developed its own implant, which Shrimpton was considering re-designing to make it “less persistent”.

The implant would grab the phone’s database and encryption key, and exfiltrate it before tidying up and removing itself from the device.

The note said that Shrimpton wanted to ensure that the NCA did not have an implant running on a device when the French targeted it.

Questioned about the email, Shrimpton said that he believed the French would exploit a publicly known security vulnerability to access EncroChat.

A defence barrister said that one known vulnerability with EncroChat, which used the Signal protocol, was that the random number generator, used for encryption, could be replaced by an attacker.

Shrimpton said he was not thinking of this particular vulnerability, but agreed it was a known vulnerability.

Under questioning Shrimpton agreed he had not disclosed this email to an earlier legal hearing: “I had clearly missed it.”

Shrimpton confirmed that he was able to set up an emulation of the EncroChat system using EncroChat handsets bought by the NCA in 2018.

The NCA obtained a TLS encryption key, which was needed to “spoof” the EncroChat server, in 2018, and a second TLS key from the French in 2020, to carry out forensic analysis on EncroChat handsets.

Ephemeral storage

The court heard that the NCA is arguing that information can be transmitted and stored at the same time because of the concept of “ephemeral storage”.

The defence barrister told the court that if this was the case the implications were enormous and would destroy the “principal and understood” line between what requires a TEI warrant and what requires a TI warrant.

“It does not just mean a handset, it means any physical device, its server, its load balancer, anything that a communication touches for a picosecond is a stored communication,” he said.

Reports by the surveillance watchdog, the Investigatory Powers Commissioner’s Office (IPCO), suggested that the NCA was one of the largest applicants for TI warrants.

But the lawyer said he does not understand why that would be the case if every intercept can be authorised by a TEI warrant.

“We are concerned that the interpretation in these proceedings is not the interpretation the NCA uses in practice,” he said.

“If they are right about ephemeral storage then a live video call on a phone is a stored communication because for one picosecond it is stored on the device,” he said.

The case continues.