French supreme court dismisses legal challenge to EncroChat cryptophone evidence

The French supreme court has dismissed a legal challenge over the lawfulness of evidence obtained by a police hacking operation into the EncroChat encrypted phone network.

The Cour de Cassation in Paris yesterday (5 September 2023) rejected claims that French prosecutors failed in their duty to provide a certificate to verify the accuracy of EncroChat data used as evidence in criminal prosecutions.

The decision is the latest in a long-running series of legal challenges to a novel operation by French and Dutch police to harvest millions of encrypted messages from the EncroChat encrypted phone network, widely used by organised crime groups.

French defence lawyers said in a statement following the court’s decision that they would launch further appeals to the European Court of Human Rights (ECHR) and the Constitutional Council, France’s highest legal authority.

“According to our analysis, this decision is contrary to European and constitutional law. We will therefore be taking our case to the ECHR and lodging a new appeal with the Constitutional Council,” lawyer Guillaume Martin wrote on X, formerly Twitter.

Details of the EncroChat hacking operation are protected from disclosure under French “defence secrecy” laws, but lawyers argue that the Gendarmerie should disclose information about how the EncroChat data was obtained, and certify its authenticity, to enable them to mount a proper defence.

French cyber experts harvested 120 million messages from EncroChat phone users in multiple countries between April and June 2020, providing intelligence and evidence on the activities of criminal groups. The operation led to 6,500 arrests of people involved in organised crime and drug trafficking and seizures of €900m over the past three years, Europol announced in June 2023.

The novel hacking operation has led to legal challenges in the UK, Germany, France and at the Court of Justice of the European Union, as the courts grapple with untested areas of law.

Defence lawyers in seven countries have claimed the “unprecedented secrecy” around the police hacking operation had made it impossible for their clients to have a fair trial – a claim that is disputed by police and prosecutors.

The Cour de Cassation’s decision follows an appeal by lawyers against a January 2023 ruling by the Court of Appeal in Metz in north-east France, which found no legal grounds for disclosing more information about the hacking operation.

The Metz court found that EncroChat messages were collected by the French police in unencrypted form. In a 30-page ruling, it said this meant there was no requirement under French law for prosecutors to provide a certificate of authenticity to verify the data, which the court found is only required under French law when data is decrypted.

The court also refused a request from defence lawyers to provide technical details of the how French police carried put the hacking operation, on the grounds that the relevant section of the criminal code requiring disclosure of technical details did not apply in the EncroChat operation.

“It cannot therefore be claimed that all the data from the EncroChat messaging was captured illegally and that its capture and exploitation would be invalid,” the court ruled.

Commenting on the supreme court’s decision to dismiss the appeal against the Metz ruling, defence lawyer Robin Binsard said in a statement that the Cour de Cassation’s conclusion that a certificate of authenticity is only required to verify data that has been decrypted appeared inaccurate.

He said this interpretation appeared contrary to the position taken by the Cour de Cassation in an earlier decision on 8 April 2022.

“This is why we intend to refer a new priority question relating to the conformity of this case law with the constitution,” said Binsard. “More broadly, it appears inconceivable, under the prism of the right to a fair trail and the rights of the defence, that the use of defence secrecy by investigators is not accompanied by any safeguards.”

In addition to appealing to the European Court of Human Rights, Binsard said he planned to raise further legal challenges relating to the French capture of data outside of French jurisdiction.