France extradites Spanish EncroChat cryptophone distributors for complicity with organised crime

Encrypted phones legal in Spain

Although supplying encrypted phones is legal in Spain, encrypted communication devices that are not used exclusively for identity and access control can only be legally sold with permission from the French government.

“In Spain, [selling encrypted phones] is not punishable by any kind of penalty,” said López Orive. “Encrypted systems that don’t go through a kind of prior declaration, that don’t have an authorisation, are considered a crime [in France].”

Spain’s extradition law (Law 4/1985 of 21 March 1985 on Passive Extradition) requires courts to follow the principle of double criminality, which means offenders can only be extradited if the same offence exists in both countries.

In 2002, however, the Council of the European Union introduced Framework Decision 2002/584/JHA, which removed this requirement for EU member states in cases for up to 32 types of crime, including membership of a criminal organisation, drug trafficking and money laundering.

French and Dutch police co-operated in a hacking cooperation against the EncroChat network, with the support of Europol and Eurojust in 2020, which has led to thousands of arrests around the world, including the UK.

Former UK home secretary Priti Patel (pictured below) joined a police raid on two people arrested for conspiracy to supply Class A drugs in August, as part of Operation Venetic, the National Crime Agency’s response to EncroChat.

Crimes fall under French jurisdiction

Spanish police arrested two brothers, identified only as M.A. and J.A., on 21 June 2022 in response to a European Arrest Warrant (EAW).

French authorities said the crimes fall within the jurisdiction of the court in Lille because EncroChat’s server network was hosted in a French datacentre, which was run by OVH in Roubaix.

According to court documents, actions taken outside France were conducted “indivisibly” with acts committed in Canada, the Dominican Republic, Spain, the Netherlands, the UK, Germany, Hong Kong and Panama from 2017 until 6 July 2021.

EncroChat resellers

The EAW identifies brothers J.A. and M.A. as managers of an organisation using the brand name Cifratec, “which groups phone distributors as sellers of EncroChat phones”.

According to the European order, the brothers provided logistical resources to EncroChat in Spain through their Madrid-based company Inversiones Carambola, created in 2015.

In 2019, this company invoiced €458,000, in 2020 close to €262,000 and in 2021 only €48,000. EncroChat ceased operation in June 2020.

The EAW accuses the brothers of 16 crimes of laundering, computer crimes, involvement in a criminal organisation, and illicit arms trafficking and drug trafficking, which carry a maximum sentence of 30 years in prison.

According to an arrest warrant dated 7 June, M.A. is accused of being complicit to importing, acquiring, transporting and possessing narcotics, acquiring and possessing weapons and participating in a criminal organisation.

He is also accused of committing three crimes punishable by one year in prison – supplying, transferring and importing cryptographic devices without prior declaration, as required by French law.

The cryptography offences cannot be prosecuted through a EAW because they do not exist as crimes in Spain. They also carry a maximum sentence below the three years maximum penalty required for extradition under Framework Decision 2002/584/JHA.

According to lawyer López Orive, his client’s EAW was written as if his client had already been sentenced, not as if the case was under investigation. “It is a decisive error,” he said. If the form is already insufficient or confusing, he should not have been sent to France, López Orive added.

Airport arrest

On same day as the brothers were arrested,  the police carried out a search of the Madrid apartment of a third Spanish national who was arrested at the airport on his return from his vacation two days later, according to the National Court order. This person was also extradited to France, one of the lawyers who represented him in the proceedings confirmed.

Separately, in June 2022, according to French newspaper Le Parisien, Canadian citizen Paul Krusky, described as the CEO of EncroChat, was arrested in the Dominican Republic.

López Oriva affirmed that the lawyer who represents his client in France had not yet had access to his client’s case file.

“There seems to have been a change of judge in the investigation [in France] and we are waiting to be able to receive the full indictment, but they come to be the same charges that were listed on the EAW form,” he added.

France takes action against Sky ECC dealer

Court documents also reveal that France has begun proceedings against a top-level international distributor of another cryptophone network, supplied by Canadian company Sky ECC, used by organised crime groups.

A Canadian national, who was arrested in Spain, is alleged to have distributed Sky ECC encrypted phones worldwide through a network of dealers.

According to French court documents, the man is accused of collecting cash from customers who bought Sky ECC phones and converting it into cryptocurrencies to launder financial transactions.

On one occasion, he met with an accomplice in a hotel in Paris to convert €160,000 into bitcoin.

According to French court documents, Dutch investigators found that the Sky ECC encrypted handsets could only be bought through a network of resellers.

Payments were made in cash and users were given details of the reseller and after-sales service, but remained anonymous, with no ID or proof of residence required to buy the phone.

Intercepted messages showed that money was collected using a photograph of a serial number on a bank note that was used to validate the payments when collected.

Investigators identified six resellers in France offering the encrypted phones.

One reseller claimed he knew none of his customers personally and had been instructed not to ask purchasers why they were buying encrypted phones.

The reseller also told investigators that he had been asked to send out a message to his contacts, recommending that they do not show their hands in photographs taken on the encrypted phones.

The French Court de Cassation found in April that acts committed overseas in connection with Sky ECC should be regarded as criminal acts committed in France.

It found that the company’s main server and a back-up server were hosted by a French OVH datacentre, that there were 2,500 users of Sky ECC and a number of resellers, some of whom had been charged, which brought activities outside France into French jurisdiction.

The Canadian reseller and an alleged accomplice are facing charges of providing cryptography servers unlawfully in France, money laundering, narcotics and organised crime offences.

Dutch and Belgian police began investigating Sky ECC in 2016. More than 1,600 Belgian police officers carried out raids on 200 homes, while Dutch police raided 75 homes, recovering millions of euros in cash, jewellery, luxury vehicles and firearms in March 2021.

Police stored and examined “hundreds of millions” of messages from Sky ECC during a two-month hacking operation by police cyber specialists.

Sky Global, the Vancouver-based tech company, which sold Sky ECC encrypted phones, filed a lawsuit against the US government in November last year, alleging it had acted unlawfully by seizing the company’s web domains, causing irreparable damage to its business and operations.

European Court of Human Rights

López Oriva said there was a pending decision from the European Court of Human Rights over the handling of intercepted EncroChat messages, “because it is possible that it says they are illegal as evidence”, he said.

The European Court of Human Rights has received a complaint from two British citizens who were detained in 2020 in the UK and accused of cocaine sales and homicide.

According to a European Court communication: “In accordance with Article 8 of the Convention, the applicants complained of the French authorities’ intrusion into the encrypted network EncroChat, the access, seizure and copying of their users’ data and their actions with the UK authorities. They question the legality, necessity and proportionality of these interference.”

The case is waiting for the French government to respond to questions raised by the European Court on 3 January about the surveillance operation on the EncroChat system, according to a press release from the court issued in June.

Ylva Johansson, Commissioner for European Affairs of the European Commission, was asked by German MEP Moritz Körner in January 2021 about the percentage of users of EncroChat associated with criminal activities, whether the hacking of communications by the police was on individual users or indiscriminately, and whether the EncroChat system was illegal.

She replied on 13 April 2021 that it was for the courts of each country to decide whether the conduct of EncroChat users is criminal and that it is for the competent authorities of each country to assess the legality of the services provided by EncroChat.

The European Commissioner said that, as of April 2021, 1,800 people had been detained on suspicion of criminal acts within the framework of the EncroChat surveillance operation.