Public prosecutors in Berlin have been told they can use messages intercepted by French police during a sophisticated hacking operation into the EncroChat encrypted phone network in German courts.
The Superior Court in Berlin this week overturned a ruling by the Berlin Regional Court that found millions of text messages gathered by French and Dutch police in a hacking operation against EncroChat users could not be used legally in evidence.
The Berlin public prosecutor announced the verdict on Twitter: “Our complaint was successful.” The court confirmed the usability of “EncroChat in accordance with the higher court case law in Germany”.
French and Dutch investigators obtained millions of supposedly secure messages from EncroChat phone users between April and June 2020 after being granted a court order to place a data interception device on an EncroChat server which was uploaded to tens of thousands of handsets.
This week’s ruling comes two months after a judgment restricting the use of EncroChat messages by a Berlin court.
The case concerns a 31-year-old accused of drug dealing, but has wider implications for the admissibility of EncroChat evidence in legal proceedings.
The public prosecutor confirmed it had re-issued an arrest warrant against the individual, who has been living with his family for the past two months following release from custody. Prosecutors said the individual was a flight risk.
Since July, according to German press reports, more than 550 prosecutions against 135 suspects have been initiated on the basis of EncroChat data in Berlin.
Courts in the UK, France and Holland face similar legal challenges over the admissibility of EncroChat evidence. At least 20 defendants are understood to have made complaints to the UK’s Investigatory Powers Tribunal, which is expected to make rulings next year. Other legal challenges are being considered in crown courts.
The question of admissibility of EncroChat evidence in Germany is due to be addressed by the German Supreme Court, which is considering a number of EncroChat-related cases. A verdict is not expected until spring 2022.
Speaking after this week’s verdict, Christian Lödden, a criminal defence lawyer familiar with the case, said the Berlin Superior Court’s verdict was weak and poorly reasoned, given Germany’s strict privacy laws.
Last year, he said the state approved 21 phone taps using malware across the whole of Germany, tiny in comparison to the 3,350 EncroChat phones in Germany that were hacked by the French Gendarmerie’s computer crime unit, C3N.
“The hurdles to get warrants for tapping phones, for going into phones and reading messages, are really high in Germany. You need concrete suspicions, named people and strong criminal violations. You cannot do it for every offence,” he said.
Lödden said every regional court in Germany had at least one EncroChat case and that judges in the country were dealing with the cases in different ways.
“At the end of the day, the Supreme Court will find a final decision for this legal question. Is it admissible? Is it not?”
The case will now be sent back to the Berlin Regional Court where it will be it will be heard by a new set of judges.
EncroChat prosecutions are moving slowly in Germany, said Lödden.
First court to halt EncroChat trial
The Berlin Regional Court became the first court in Germany to halt a trial based on evidence from the EncroChat encrypted phone network, which was harvested through a novel hacking operation led by French police last year in collaboration with the Dutch.
The court found on 1 July 2021 that even if the interception operation against EncroChat handsets is legal under French law, use of the data from EncroChat data gathered on German territory was in breach of German law.
The hacking operation by French Gendarmerie placed more than 30,000 phone users in 122 countries under surveillance, whether there was evidence of individual criminality or not, the court then found.
“The Regional Court considers the surveillance of 30,000 EncroChat users to be incompatible with the principle of proportionality in the strict sense. This means that the measures were unlawful,” the court ruled in a 22-page judgment.
Decision overruled
That decision has now been overturned by the Superior Court in Berlin.
It found that although investigative measures carried out by the French did not appear to meet the requirements of German law, that did not prohibit German courts from using the knowledge and information gained by the French.
German law allows surveillance to be carried out against an individual to recover specific information only where there is clear suspicion of crime by the individual under surveillance.
But evidence gathered by the French could be used as an “accidental discovery” to bring prosecutions against German EncroChat users, the court found.
“The fact that there was no qualified suspicion…at the time of the [surveillance measures]…does not prevent the use of the knowledge once gained,” it said.
German courts were not entitled to question actions initiated by other EU member states that are legal under their own law, provided the evidence is not based on a German request for mutual assistance, the court said.
To do so would undermine the “mutual trust” between member states.
The fact that the investigative measures carried out by the French did not seem to meet the requirements of German law for monitoring telecommunications and internet traffic did not prevent the knowledge gained being used in Germany, the court said.
Use of EncroChat provides grounds for suspicion
In its July decision, the Berlin Regional Court found that the mere use of an encrypted phone, even one with a high level of encryption, was not an indication of criminality.
The German Federal Government is actively encouraging the use of cryptography, through the Federal Government digital agenda, and has been reluctant to oblige telecoms and internet companies to implement “backdoors” to allow government to access private data, the judge said.
The mere possession of an EncroChat phone did not provide grounds for surveillance, in much the same way that possession of crowbars or bolt-cutters does not provide sufficient grounds for a search warrant.
But in the latest ruling, the Berlin Superior Court found that the way EncroChat devices were sold and their high cost, coupled with other findings from French investigators, did provide grounds for suspicion.
In 2017 and 2018, French police seized EncroChat phones during seven independent investigations, including five investigations into drug offences, the theft of luxury vehicles and other crimes.
The EncroChat website advertised the phones as offering “guaranteed anonymity, a personalised Android platform, a double operating system, the very latest technology, automatic deletion of messages” and hardware encryption.
The company lacked an official headquarters and had no identified staff. It did not sell phones on its website but EncroChat phones were available on eBay at a cost of €1,600 for a six-month contract.
A “guide” sent to an Australian EncroChat phone dealer obtained during the hacking operation advised resellers to stay undercover from the police, to accept payments for the phones using cryptocurrencies where possible and to avoid attracting attention.
French investigators took a forensic image of one of the EncroChat servers in December 2018 and were able to decrypt encrypted notes made by users of the phone, which were stored on the server.
The information recovered suggested that some users were involved in illegal activities. One user’s note, for example, likely showed his involvement in drug trafficking and his ability to launder money in Paris through Morocco.
Mother country behind human rights
“When considering the admissibility of the use of evidence, in addition to the considerable risk to the public’s health, the threat posed by the organised crime structures promoted and financed through illegal drug trade must also be taken into account,” said the Berlin Superior Court.
The verdict also found that the failure to use intercept material from France would violate the sense of justice of German citizens.
“The failure to use legally obtained information about such serious crimes by the authorities of the Republic of France – a founding member of the European Union and one of the mother countries behind human rights – would “significantly violate the general sense of justice of the law-abiding population”, it said.
The court accepted that the French authorities had an obligation to inform the German authorities that they were conducting surveillance on the telecoms traffic of individuals on German territory.
But a failure by France to notify Germany does not prohibit the exploitation of surveillance material.
“The German authorities have made it clear through their further conduct that they do not object to the investigative measures,” the court said. “It can be assumed that the German authorities would have consented to the surveillance of the accused if they had been informed.”
German procedural rules do not contain a general prohibition on exploitation of unlawfully obtained evidence but allow the evidence to be weighed by the court, the court said.
The data obtained does not, as far as can be seen, affect any core information relating to an individual’s private life.
Spontaneous transmission
The court found that the German authorities were not involved in the operations led by the French investigative authorities.
“Rather the data obtained were initially spontaneously transmitted to the German police without prior consultation,” it said.
Germany had not – at the time it received the data in April – submitted a request for mutual legal assistance to obtain the information from France, according to the court verdict.
It was only two months after the hacking operation began, on 2 June, that German prosecutors submitted a European Investigation Order to the French, formally requesting the right to use the intercepted data from EncroChat.
It has emerged in evidence in other court cases in Germany, however, that German prosecutors attended a meeting at the European Union agency for criminal justice cooperation Eurojust at the Hague, to discuss the exploitation of hacked data from EncroChat as early in March 2020 – before the hacking operation commenced.
This has raised questions over whether Germany was simply a passive recipient of the data obtained by the French, as prosecutors suggest.
Decision was ‘political’
Lödden said that, with an election for a new chancellor taking place next month, the Superior Court decision was partly political.
The Berlin higher court’s verdict that EncroChat evidence could not be used led to criticism in the press, he said.
“There were a lot of voices that said it can’t be. Why is it that every country in Europe can charge the criminals and only we, in Germany, are not able to do it because we were hiding behind our laws,” he said. “So there was a lot of pressure from public opinion.”