A senior Swedish prosecutor cited diplomatic immunity after being summoned to answer questions in court about Sweden’s role in the international police operation to infiltrate the EncroChat encrypted phone network used by organised crime groups.
Prosecutors said Solveig Wollstad, head of the Swedish desk at Eurojust, the EU agency for diplomatic cooperation in the Hague, had diplomatic status that meant she was unable to give evidence about her work during an international police operation to hack into the EncroChat phone network.
Defence lawyers claim that the decision by a Swedish court not to call her to testify about the EncroChat operation has left important questions unanswered about the legality under Swedish law of the interception operation, which enabled the French police to covertly harvest messages from Swedish citizens who were using EncroChat phones.
The lawyers claim the interception may have been unlawful as there is no evidence that Sweden sought approval from a Swedish Court to authorise France to conduct the mass interception of EncroChat encrypted phones, which were widely used by organised crime groups, in Sweden.
The French-led operation to hack EncroChat by implanting malware on phone handsets in 2020 has led to thousands of arrests and investigations into drug dealing and organised crime in 13 countries, including Germany, Sweden, Holland and France.
In the UK, the National Crime Agency, working with other police forces, had made 1,550 arrests and seized 5.8 tonnes of class A and B drugs, £57m in cash, 115 firearms and 2,879 rounds of ammunition by May last year.
Defence lawyer Alparslan Tügel said: “Almost no information has been provided by the Swedish prosecution agency regarding how this information was gathered by the French authorities and how it was handled by the French authorities. And very little information has been given over the legal analysis of whether this is in accordance with Swedish law.”
Tügel and lawyer Thomas Olsson are representing a 30-year-old man accused of aiding and abetting a murder that took place in the Old Town of Gothenberg in May last year, in a case that makes use of evidence from EncroChat messages.
The Swedish desk at the European Union agency for criminal justice cooperation, Eurojust, headed by Swedish prosecutor Sloveig Wollstad, carried out much of the legal legwork for Sweden in the EncroChat operation.
Wollstad, a member of Eurojust’s executive board, supported by five Swedish prosecutors and a specialist in economics, was responsible for liaising with France and other countries over the legal aspects of the hacking operation.
Eurojust held five coordination meetings with France and the Netherlands to plan a hacking operation against the EncroChat phone network in Spring 2020. Sweden, the UK, Norway and Spain were invited to two of the meetings.
“By exchanging the data at a very early stage, the Swedish police managed to interrupt plans on killing people, on kidnapping people, and on trafficking different kinds of drugs,” Wollstad said in a videoed interview on October 2020 during a Eurojust Open Day.
The defence lawyers intended to question Wollstad about Sweden’s liaison with the French authorities over the EncroChat operation, codenamed Operation Emma in France and 26Lemont in Holland.
They also wanted to know about Eurojust’s contacts with representatives of Sweden’s National Operations Department (NOA), a police body that coordinates police operations.
The Court of Appeal for Western Sweden sent a summons to Solveig Wollstad at an address in Sweden, calling her to testify in person at the court.
It came after Linda H. Staaf, head of intelligence at NOA, submitted a letter as evidence to the court which identified Wollstad as the individual responsible for judicial cooperation between Sweden and France on the operation against EncroChat.
“The legal aspects of the information sharing from France to Sweden were handled via Europol by the Swedish representative in Eurojust. Further questions on this matter are therefore referred to the Prosecutor’s Office,” the note said.
Secrecy law invoked
Sweden’s prosecutor general, Petra Lundh, subsequently informed the court that she had decided that Wollstad could not testify.
Lundh argued that any testimony from Wollstad concerned matters of intergovernmental relations that were protected by Swedish secrecy law.
The disclosure of any information that had not already been made public could damage Sweden or its international relations with other countries, she said.
Defence lawyers told the appeals court that Sweden’s chief prosecutor had no legal mandate to prevent Wollstad giving evidence.
Wollstad working over Christmas
On 30 November 2021, Sweden’s chief prosecutor informed appeal court that “Wollstad will be serving at Eurojust during the Christmas holidays” and would not therefore be in Sweden on the day of the court hearing.
The Gothenburg court acknowledged that Wollstad, as a member of Eurojurst, had a duty of confidentiality but nevertheless agreed to issue a European Investigation Order requesting that Wollstad give evidence by an audio and video link from The Hague.
Five days before the hearing, Dutch prosecutors sent a message to the court of appeal saying that Wollstad was protected by diplomatic immunity and could no longer give evidence. The prosecutor wrote that Wollstad “cannot revoke her diplomatic immunity. This can only be done by Eurojust as an institution”.
Two days before the planned remote hearing, an officer from the Swedish court phoned Eurojust’s head of legal affairs to make enquiries about whether Wollstad’s diplomatic immunity could be waived. She was told that the court would have to make a written request to the president of Eurojust, who would have to convene member states to consider it – an impossible task in the time available.
The defence lawyers pushed for the court to summon Wollstad to Sweden to testify in late January on a day set aside for by the court for any overruns in the hearing.
“We argued in court that this is a very important piece of information for us that could have a big impact for the court’s decision and also the defence,” said Tügel.
But Wollstad told the court that she was unavailable to attend the hearing on 24 January.
On 18 January, the Court of Appeal dismissed the proposed hearing with Wollstad. It found that reasonable efforts had been made to hear the Eurojust prosecutor but that the case should not be delayed further.
No information about Swedish legal process
Tügel said the decision left defence lawyers with no clear idea of the legal process followed by Sweden to obtain the French intercepted material.
“Almost no information has been provided by the Swedish prosecution agency on how information was obtained from Swedish phones by the French authorities, and how the evidence was handled by the French authorities,” he said.
Under Swedish law, a court order is required to give permission for the French authorities to conduct interception of phones in Sweden, but Tügel said there is no evidence of such a court order being made.
Read more about encrypted phone networks used by organised crime
- France’s Conseil Constitutionnel to decide whether ‘defence secrecy’ over state EncroChat cryptophone hacking breaches French constitution
- French lawyers claim that investigators are unlawfully withholding details of a cryptophone hacking operation in a case that could impact UK prosecutions.
- French lawyers are challenging the legality of a French police operation to harvest tens of thousands of messages from the EncroChat encrypted phone network in a move that could overturn criminal prosecutions in the UK.
- The Dutch Public Prosecution Service claims Britain has damaged confidence by disclosing details of an international investigation into the EncroChat encrypted phone network to the courts.
- Appeal court finds ‘digital phone tapping’ admissible in criminal trials: On 6 February 2021, judges decided that, despite UK law prohibiting law enforcement agencies from using evidence obtained from interception in criminal trials, communications collected by French and Dutch police from EncroChat using software “implants” were admissible evidence in British courts.
- Belgian police raid 200 premises in drug operation linked to breach of encrypted phone network: On 9 March 2021, Belgian police raided 200 premises after another encrypted phone network with parallels to EncroChat, Sky ECC, was compromised, in what prosecutors described as one of the biggest police operations conducted in the country.
- Arrest warrants issued for Canadians behind Sky ECC cryptophone network used by organised crime: Following the international police operation to penetrate the Sky ECC network and harvest “hundreds of millions” of messages, a federal grand jury in the US indicted Sky Global’s Canadian CEO, Jean-François Eap, along with former phone distributor Thomas Herman, for racketeering and knowingly facilitating the import and distribution of illegal drugs through the sale of encrypted communications devices.
- Computer forensic experts involved in the review of police use of data hacked from the ultra-secure EncroChat phone network assess the impact of the Appeal Court ruling on future legal use of intercept evidence.
- UK courts face evidence ‘black hole’ over police EncroChat mass hacking: Forensic experts say that French investigators have refused to disclose how they downloaded millions of messages from the supposedly secure EncroChat cryptophone network used by organised criminals – leaving UK courts to grapple with a forensic ‘black hole’ of evidence.
“We would have liked to ask questions to Solveig Wollstad regarding how that could be, because in her capacity as Swedish member of Eurojust, she was the liaison point between Swedish authorities and the French authorities,” he said.
Swedish prosecutors have previously disclosed they do not know how the French Gendarmerie intercepted millions of messages from EncroChat phones.
“Due to the mutual trust between European countries, it is not Sweden’s role to question, or even ask, how the material came about,” the public prosecutor said in a statement on 22 April last year.
Defence lawyers question gaps in evidence
The NOA’s Staaf confirmed in court on 21 December that the Swedish Police had given French investigators permission by email to investigate the use of EncroChat phones by Swedish citizens.
Staaf, who also writes crime novels, went on to play a key role in the interception of encrypted messages from an encrypted phone network, Anom (also known as An0m), secretly run by the FBI in a joint operation with the Australian Federal Police.
During a witness hearing at the Court of Appeal of Western Sweden, Staaf confirmed that Swedish prosecutors had received an electronic message from a joint investigation team (JIT) made up of French and Dutch police inviting Sweden and other countries to receive intelligence from the EncroChat hacking operation.
The email, sent on 27 March 2020 through Europol’s Sienna Information Exchange, required Swedish officials to confirm that they had “been briefed on the methods that had been used to generate data from devices in their jurisdiction”. They were also asked to confirm that they understood the “legal basis for the deployment” of the investigative measures used in France.
Asked whether the JIT understood the reply from the NOA as a consent to the conditions stated in the email, Staaf said she understood this to be the case. Staaf also stated that it was the international division at the NOA that replied to the email and that she had not been personally involved in the process of answering the e-mail from the Netherlands.
In a separate one-page letter submitted to the court, dated 16 July 2021, Staaf wrote that the Swedish Police received information available in France from the “EncroChat server” through an operational taskforce (OFT) at Europol.
The information Sweden obtained from EncroChat could be used for intelligence purposes under the agreement.
When the EncroChat operation became public in July 2020, Sweden was able to send European Investigation Orders to ask for permission to use EncroChat intercept in each individual pre-trial investigation.
Server or handset?
Defence lawyers have attempted to raise questions about claims by Swedish prosecutors that French police intercepted messages from EncroChat from servers in France, rather than from handsets in Sweden.
The claim appears to contradict the findings of the appeals court in the UK, which found the EncroChat messages had been extracted not from a server in France, but directly from phone handsets in the countries where the phones were used.
The origin of the messages is crucial, said Tügel, as evidence intercepted from handsets in Sweden without a court order from a Swedish court does not comply with Swedish law, and should not be admissible or be granted less weight.
“We have asked the prosecution authority on numerous occasions to give us reasons why they are stating that the information was gathered from the server,” he said.
“The only piece of evidence they presented during the district court trial and court of appeal was a document drafted and written by Linda H Staaf, stating that the information came from the server,” he said. Staaf, in turn, said she was given that that information by the Swedish prosecutor.
“So there is not a single piece of evidence, and I can say this without exaggerating, stating that the information came from the server,” said Tügel.
Ted Esplund, an employee of the intelligence division within the National Operations Department, also gave evidence during the case.
In his oral testimony in court, he stated that he was responsible for projects like EncroChat and other projects where there is close cooperation with international counterparts such as foreign Police departments and Europol.
16 June 2020: Defence lawyers requested that police interview chief constable Linda H Staaf as a witness, a common procedure in the Swedish courts. The prosecutor said Staaf did not have time to be interviewed by the police. Instead, she provided a signed memo, dated 16 June 2020, which said the legal aspects of information sharing between Sweden and France were handled by the Swedish representatitive in Eurojust, Solveig Wollstad.
21 June 2020: The Gothenburg District Court rejects defence request for chief constable Linda H Staaf to be interviewed by the police on Sweden’s collaboration with the French on EncroChat.
12 January 2021: Swedish police's National Operations Department (NOA) produces an unsigned memo, a Swedish translation of publicity material published by Eurojust, for use as evidence in court.
29 July 2021: District Court issues a judgment in the case, which involved 12 co-defendants.
15 September 2021: The Court of Appeal for Western Sweden decides there are no grounds to require Linda H. Staaf, head of intelligence at the Swedish Police National Operations Department (NOA), to be interviewed by the police on Sweden’s role in the EncroChat operation.
11 October 2021: Defence lawyers Thomas Olsson and Alparslan Tügel ask the Swedish court to summon chief prosecutor Solveig Wollstad, head of the Swedish Desk of Eurojust, and chief constable Linda H Staaf to give evidence on Sweden’s role in the EncroChat operation. The aim of the questioning was to show that the interception of messages from Swedish phones was illegal under French and Swedish law.
18 November 2021: Sweden’s attorney general, Petra Lundh, refuses permission for Wollstad to give evidence on the grounds that the hearing would concern matters of importance for Sweden’s relationship with another state. She argues that all members of Eurojust have an obligation of professional secrecy.
24 November 2021: Defence lawyers inform the appeals court that Sweden’s chief prosecutor has no legal mandate to prevent Solveig Wollstad giving evidence.
30 November 2021: The chief prosecutor, Roger Waldenström, informs the Court of Appeal, that Solveig Wollstad will be “serving at Eurojust during the Christmas holidays” and will therefore not be in Sweden on the date of the planned hearing.
1 December 2021: Defence lawyers respond to objections made by the attorney general Petra Lundh. They argue that the duty of confidentiality under Eurojust’s rules is not decisive. The matter must be examined under Swedish law.
2 December 2021: The Public Prosecutor’s Office asks the appeals court to reject the defence application for Solveig Wollstad to appear as a witness. It argues that the facts to be proved in a hearing are irrelevant to the case because general descriptions of the processes followed by Eurojust and international cooperation have already been provided.
2 December 2021: Defence lawyers say there is no reason to reject the evidence of Solweig Wollstad. The hearing has been called to prove, among other issues, “that the EncroChat material has not been obtained in accordance with the law”.
December 2021: The public prosecutor’s office submits a supplementary legal opinion arguing that Solveig Wollstad should not give evidence. A hearing may jeopardise Sweden’s future opportunities to cooperate with other countries through Eurojust to combat serious crimes in Sweden.
9 December 2021: The Court of Appeal for Western Sweden says it will request a remote video hearing with Wollstad from the Netherlands.
21 December 2021: Linda H Staaf, head of intelligence at the Swedish Police National Operations Department (NAO), confirms in court that the Swedish Police had given French investigators permission by email to investigate the use of EncroChat phones by Swedish citizens.
14 January 2022: A prosecutor in The Hague informs the Court of Appeal of Western Sweden that Solveig Wollstad is required to invoke diplomatic immunity and cannot be heard as a witness.
17 January 2022: An officer from the Swedish court telephones Eurojust’s head of legal affairs. She is told that the court would have to make a written request to the president of Eurojust to waiver Wollstad’s diplomatic immunity. The president would have to call a meeting of national members to decide the matter. This was unlikely to be possible in time for the proposed court hearing.
17 January 2022: Defence lawyers argue that Solveig Wollstad’s evidence is crucial to the court and to the defence case. They argue that Solveig Wollstad should be asked to come to Sweden, where diplomatic immunity would not apply, on a reserve date set aside by the court of 24 January.
18 January 2022: Solveig Wollstad informs the court she cannot attend on 24 January. The court rules that summoning Solveig Wollstad to give evidence would take too long and the judgment should not be postponed. It said that reasonable efforts had been made to raise the hearing and court proceedings should not be delayed further.
Read more on IT risk management
Germany: European Court of Justice hears arguments on lawfulness of EncroChat cryptophone evidence
Three years on, EncroChat cryptophone hack nets 6,500 arrests and seizures of €900m
Cops make arrests and seize drugs after hacking Exclu encrypted messaging app
Top 10 crime, national security and law stories of 2022