Italian Supreme Court calls for prosecutors to disclose information on Sky ECC hacking operation

Hundreds of millions of messages decrypted

Police in Belgium, France and Holland, collaborated in an operation to infiltrate the Sky ECC secure telephone network and succeeded in decrypting hundreds of millions of messages from phones used by organised criminals.

Police investigations, which began in Belgium, identified 170,000 people worldwide using Sky ECC phones, which were supplied by the technology company Sky Global, using computer servers based in a French datacentre. Hundreds of arrests of members of drugs crime groups followed in 2021.

According to the Italian Supreme Court verdict, first reported by Crimesite in Holland, Italian prosecutors refused to disclose information from Europol about the police interception and decryption operation against Sky ECC to Italy.

The decision was dated 15 July 2022 but has only recently been published.

Prosecutors argued that the details could not be disclosed as they were “information exchanges between police forces of different countries which could not be used in court”.

A lower Italian court had agreed with prosecutors that since the decrypted messages were passed to Italy by foreign judicial authorities, the material could be used without further scrutiny as there was a presumption that the interception had been legally carried out.

The case concerned the pre-trial detention of a 31-year-old individual born in Rome who was alleged to have a “criminal association” with drug trafficking and had requested to be placed under house arrest in another part of Italy where he was living with his family.

European Investigation Order

Italian police used a European Investigation Order to obtain encrypted messages from the Sky ECC phone network from Europol, which co-ordinated investigations by the French, Belgian and Dutch police.

The defendant asked the Italian prosecutor to supply messages allegedly sent by the defendant, including files delivered to Europol in March 2021, after police had gained access to Sky ECC’s servers, to show how Europol had acquired data from the infiltrated server.

The Supreme Court found that without access to the material it was not possible for the defendant to understand the content of information exchanged by police forces in different countries or to understand how the investigations were carried out.

Reliability of evidence

The court found that the way evidence was acquired, including the “capture and decryption of telematic flows” from Sky ECC, was important information to disclose to defence lawyers.

“All this implies inescapably the possibility of knowing the manner in which the investigative activity carried out and the procedure for the acquisition of such messaging,” to allow full rights to defence and to assess the relevance, reliability and value of the evidence, the court found.

The Supreme Court sent the case back to prosecutors at the Rome court to issue a new judgment.

Justus Reisigner, a Dutch lawyer who has studied the judgment, said that the case could influence prosecutions in other European countries.

“The Italian Supreme Court really holds on to the rights of the defence. A suspect has to be able to test the legality and reliability of evidence. That applies even while there is a principle of trust between EU member states and even when somebody is in pre-trial detention,” he said.

British police forces have made thousands of arrests of criminal gangs based on messages intercepted or hacked from another hacked phone network, EncroChat, used by criminals.

French investigators have refused to disclose how they downloaded millions of messages from the supposedly secure cryptophone network, citing “military secrecy”.

Computer forensic and legal experts have questioned the “black hole” of evidence about how the hacking operation into EncroChat was conducted.

It is not known whether UK police had access to Sky ECC messages.