Dutch Supreme Court approves use of EncroChat evidence

The Dutch Supreme Court has upheld the use of intercepted messages from an encrypted phone network, EncroChat, in a criminal conviction.

In a ruling yesterday, the court found that it was bound by the principle of mutual trust to accept that EncroChat evidence was gathered by French police lawfully under French law.

The Supreme Court’s ruling is in line with a preliminary decision by the courts’ Advocate General in September 2023 that found the conviction should be upheld.

It follows complaints from the defendant’s lawyers that EncroChat evidence could not lawfully be used as evidence in criminal cases under Dutch law.

Defence lawyers argued during the case that Dutch prosecutors should disclose the extent of Dutch involvement in a hacking operation against EncroChat, which was overseen by a Dutch and French Joint Investigation Team (JIT). They also argued that it was not possible for the defendant to have a fair trial because information about the way the hack was conducted and intercepted messages were processed were protected under French defence secrecy laws

The case concerns a suspect convicted of drugs, arms trafficking and money laundering offences during the Dutch investigation into suspected criminals using EncroChat phones codenamed “26Lemont”.

It was part of an international operation by police from the UK, the Netherlands, Germany and other countries that has led to the arrests of over 6,000 suspects and the seizure of €600m, after investigators gained access to servers used by the EncroChat network at a French datacentre in Roubaix.

The novel hacking operation has been the subject of legal challenges in the UK, France, Holland and Germany, among other countries.

Interception legal in France

The Supreme Court found that French authorities, rather than the Dutch, were responsible for the use of an interception tool to gather messages from the EncroChat phone network and operated legally under French law.

It was not up to the Dutch court to assess whether the manner in which the interception took place was in accordance with legal rules in France, the Supreme Court found.

The “principle of trust” meant that the “Dutch criminal court does not review the lawful application of powers applied by the authorities of the other member state”, it said.

The fact that the use of the interception tool meant data from EncroChat devices in the Netherlands were also collected, copied and shared with Dutch police does not lead to a different conclusion, according to the 30-page judgment.

“Whatever the defence’s position that the Netherlands may have contributed to the intellectual know-how of the interception tool, it is certain that no Dutch official with investigative powers has carried out any investigative act in France, whether or not in collaboration with investigative authorities,” it found.

Live data

According to the judgment, French authorities collected “live” telephone data from the phones of EncroChat users between April 2020 and June 2020. The telephone and server data were shared with the Netherlands, which partnered with the French in the Joint Investigation Team.

Although the Netherlands assisted in the development of a tool that led to the interception of another encrypted phone network used by organised criminals, Sky ECC, it did not provide such support for EncroChat, according to the judgment.

Fair trail

Defence lawyers argued that the defendant was unable to have a fair trial as French police had not disclosed details of how it obtained the EncroChat data, as the operation is protected by defence secrecy in France.

But the Supreme Court found the court procedure as a whole complied with the right to a fair trail guaranteed under the European Convention of Human Rights.

It said the defendant had access to the EncroChat dataset that related to the case and was able to take note of its contents and object to it.

The fact the defendant did not have access to technical information about the intercept tool used by the French did not make a difference, the court said. Inspection of documents about the interception operation would be “contrary to the principle of trust [between member states]”.

The Supreme Court also rejected arguments that the interception operation against 60,000 EncroChat phone users worldwide amounted to bulk interception in breach of European law.

The court found that EncroChat users were a defined group and that the interception operation was targeted, rather than bulk interception.

Dutch law should apply, says defence lawyer

Defence lawyer Justus Reisinger, who brought the case, said the Supreme Court was unable to challenge findings of fact by the Court of Appeal on 5 January 2023 that established that the EncroChat operation was as entirely conducted by the French.

He told Computer Weekly that since that decision, further information had come to light from prosecutions in the UK and elsewhere that showed the Dutch had played a more active role in the EncroChat hacking operation than had previously been disclosed.

Reisinger said that defence lawyers had complained that the Dutch Public Prosecutor had not been transparent about the role of the Dutch authorities in the EncroChat hacking operation.

“The hack took place first from servers in France, but then they exploited an implant on every individual EncroChat device all over the world, in this case, an encrypted device in the Netherlands,” he said. “So, there was an investigative measure on Dutch territory, and that is whey we argued that Dutch law applies and that you have to test whether the operation conforms with Dutch law.”

The decision means that if an investigation is found to have taken place in France and there is no “intense” collaboration with the Netherlands and France, said Reisinger, Dutch judges cannot rule on it.

Reisinger said the Supreme Court decision relied heavily on findings of fact contested by defence lawyers and that defence lawyers are expected to argue in EncroChat cases in the lower courts that the interception operation amounted to a joint investigation between the Dutch and the French.

Defence to appeal to Human Rights Court

Reisinger said he also plans to appeal to the European Court of Human Rights, that the prosecution breaches the right to a fair trial, and that the legality and admissibility of EncroChat evidence should be tested, even when it is supplied by another country.

“This is especially necessary from out point of view to get the answers on the principal matters of international law, which right now are not being addressed by the Dutch Supreme Court at all,” he told Computer Weekly.

Dutch ‘had no involvement with design of intercept tool’

Dutch prosecutors accused the UK of damaging confidence by disclosing letters in court in 2021 that disclosed the Dutch role in the French operation against EncroChat.

The disclosures prompted the Dutch Prosecution Service to write to Dutch prosecutors in March 2021, according to a letter obtained by Computer Weekly stating it had no involvement with the design of the EncroChat intercept.

“The French authorities have made it known that the interception tool was developed by them,” it stated, adding that the French had declared the interception technology as “a military state secret”, the letter said.