Lawyers are heading to the French supreme court to challenge the legality of a police operation which intercepted millions of messages from the EncroChat encrypted phone network.
The lawyers applied for an immediate hearing in the Cour de Cassation in Paris after the court of appeal in Nancy declared, without giving immediate reasons, that the EncroChat operation was legal under French law.
The case, which is expected to go the European Court of Human Rights, could affect prosecutions in the UK, the Netherlands and Sweden if France’s highest court finds that the operation was unlawful.
Paris-based lawyers Robin Binsard and Guillame Martine, founders of law-firm Binsard Martine, claim that the interception operation against the phone network, which has caused widespread disruption to organised crime groups in Europe, breaches French law and the French Constitution.
The French Gendarmerie harvested more than 120 million messages from EncroChat phone users in multiple countries, in a novel interception operation that provided a rich source of intelligence and evidence on the activities of criminal groups.
Julie André, assistant to the national member for France at Eurojust, disclosed in May that the French desk at the European Union Agency for Criminal Justice Cooperation had received 250 European Investigation Orders (EIOs) requesting the use of the EncroChat data in judicial proceedings. She said the number was growing daily.
Binsard told Computer Weekly that the court of appeal in Nancy had yet to give any reasons for an oral finding that the EncroChat operation complied with French law, but that the case raised major questions for the supreme court.
“It is a very important case for French judges because the EncroChat hacking is the origin of hundreds of criminal proceedings,” he said. “It is a sensitive case that involves important legal arguments around defence secrecy, global hacking, and the difference between data capture and interception.”
Defence secrecy
Binsard and Martine are challenging the French Gendarmerie’s refusal to provide defendants with information on the hacking operation on the grounds of “defence secrecy”.
They argue that, for defendants to have a fair trial, the Gendarmarie should provide an explanation of how it obtained the intercept evidence from EncroChat phones, and provide a certificate to authenticate the intercepted data and messages.
The lawyers also argue that investigators at the French National Gendarmerie’s centre for the fight against digital crime went beyond the legal authority granted to them by judges in a court in Lille.
They argue that a number of orders issued by the Lille court breach article 706-1-2-3 of the French Code of Criminal Procedure and should therefore be declared null and void.
The disputed orders include one requiring the French cloud computing service provider OVH to modify its network to enable the interception to take place.
Gendarmes based at the C3N digital crime unit in Pointoise, along with Dutch investigators, traced the servers used by the EncroChat phone network to OVH’s flagship datacentre in Roubaix after recovering EncroChat phones during drug raids in late 2017 and 2018.
They were able to covertly take copies of the servers and upload a software implant that was able to bypass encryption of the supposedly secure phones in April 2020.
Forensic experts in the UK have argued that the French Gendarmerie’s refusal to release information on the hacking has led to an “evidential black hole” that has broken long-established principles that evidence should properly acquired and secured before being used in legal cases.
Binsard said he was not surprised that the court of appeal in Nancy had not found against EncroChat.
“It’s a very sensitive and maybe political case because the French Gendarmarie have spent a lot of time and a lot of money to do this hacking. So a judge has to be really courageous to cancel this hacking and to cancel hundreds of criminal procedures”
Robin Binsard, Binsard Martine
“It’s a very sensitive and maybe political case because the French Gendarmarie have spent a lot of time and a lot of money to do this hacking. So a judge has to be really courageous to cancel this hacking and to cancel hundreds of criminal procedures,” he said.
Binsard has applied for an extradited hearing in the supreme court, which, if accepted, would take place within six months. If not, it may take a year to hear the case.
He said that legal challenges in Germany, the UK, Holland and elsewhere meant it was likely the legality of the EncroChat operation would ultimately be decided the European Court of Human Rights.