Court finds EncroChat hacked messages admissible as former footballer is jailed

Storage vs transmission

The case is the latest to address the question of whether EncroChat evidence can be lawfully used as evidence in courts.

Under UK law, phone calls or data intercepted during the course of transmission are prohibited from being used as evidence, and cannot be referred to during a court hearing to protect the methods used by intelligence agencies and law enforcement.  

The restriction, however, does not apply if the same data is obtained from storage in an electronic device through a hacking – also known as equipment interference – operation.

The French have refused to disclose how the infiltration operation against EncroChat was carried out, citing defence secrecy. 

Prosecutors argued that French police infected EncroChat phones with a software implant that obtained the supposedly secure encrypted messages from electronic storage in phone handsets, and were therefore admissible under UK law.

Lawyers representing the defendants, however, argued there was evidence that EncroChat messages were intercepted during the course of transmission, and instructed expert witnesses to reverse-engineer EncroChat phones to discover how the interception process worked.

The defence arguments were dismissed by Dean in a ruling dated 18 March that found EncroChat messages were intercepted at a time they were “stored in or by the (telecommunications system)”, rather than during the course of transmission.

He said the issue had been litigated at least twice, including during two preparatory hearings that were scrutinised by the Court of Appeal.

Brief storage is still storage

According to submissions made by the French government to the European Court of Human Rights in April 2020, the French police used a “special investigative technique” to bypass EncroChat encryption that was capable of recording key strokes, capturing screen shots, and accessing and collecting data contained in a “digital terminal”.

The judge said an analogy used in the French submission, which compared the hacking operation to a search of a building containing illegal items such as drugs or fire arms, is consistent only with the French government regarding all the data as having been collected from storage in handsets.

The French implant collected data in two stages. During stage 1, both sides agreed the implant retrieved historic data, such as undeleted messages, from storage in a database on the EncroChat handsets.

Stage 2 was more controversial. Defence lawyers argued that evidence showed messages were captured live or in real time, during the course of transmission, while prosecutors argued the messages were obtained from storage in the phone handsets.

The judge concluded that references to “live” or “real-time” interception in evidence presented during the case referred to data captured and collected from storage before it was transmitted to the French authorities. Any “storage” before the implant collected the data would be “very brief”, but “very brief storage is still storage”.

Abuse of process

Defence lawyers argued that the defendants did not have the opportunity to present expert evidence on how the EncroChat evidence was obtained. They said the Crown had deliberately limited the disclosure of technical evidence, and delayed or concealed disclosure of evidence to prevent the defendants discovering how EncroChat data was intercepted.

The judge said there were elements of the Crown’s approach to disclosure that were less than optimal, and that “some criticism” of its conduct is not misplaced, but that there was “no misconduct”.

Between March 2022 and March 2023, defence lawyers asked the NCA to disclose technical information and infected EncroChat phones to assist an expert witness, Ross Anderson, professor of security engineering at Cambridge University, and later, Czeck company Invasys, to reverse-engineer the implant.

The process exposed “disclosure problems” and revealed a “sometimes sub-optimal approach by the Crown”, but the judge found that failures in disclosure were a consequence of the scale of the EncroChat cases in the UK and the early distribution of EncroChat data to disparate police forces.

Public interest immunity

Dean issued an order requiring the NCA and prosecutors to disclose two EncroChat phones and the technique used by the NCA to extract EncroChat APK files from the phone to defence experts to aid their understanding of how the phones worked, on 13 March 2020.

Prosecutors applied for Public Interest Immunity (PII) on 13 April, and on 17 May, the judge issued an order to prevent the disclosure of the APK technique and the infected handsets. The PII ruling also prevented the disclosure of new information that, according to prosecutors, “definitively establishes that the EncroChat material was … intercepted, at a time when it was stored on the relevant EncroChat handsets”.

Dean wrote in his ruling on 18 March: “Although I agree that there is always something unsatisfactory about any trial process in which relevant evidence cannot be deployed, unsatisfactory is not unfair.”

Simon Csoka KC, defending, had told the court the NCA and CPS had championed an at-best obstructive and at-worst dishonest approach to disclosure. The judge acknowledged that Csoka did not make these assertions gratuitously, but had pointed to evidence he described as a CPS strategy of dishonesty and obfuscation.

The judge found that the evidence was not consistent with a “malign and unlawful strategy”, but rather with a prosecution team discussing and sometimes struggling with the complexities of the EncroChat investigation and prosecution, and with the “sheer scale of their task”.

No oral evidence heard

Judge Dean rejected calls from defence lawyers to hear oral evidence during the trial from Emma Sweeting, the intelligence operations manager at the NCA, Luke Shrimpton, a former NCA senior technical expert, and Jeremy Decou, an officer at the French Gendarmerie.

The judge found that Emma Sweeting and Jeremy Decou were largely reporting things they had been told by others in written evidence about the French hacking operation, but rejected claims by defence lawyers that they amounted to “multiple hearsay” and should not be admitted.

The judge also found that any technical evidence Shrimpton had given in previous cases was no longer helpful in determining the facts relevant to storage versus transmission, and decided not to consider it.

The judge also rejected defence arguments that a letter of request by CPS to the French asking for clarification of how the implant worked told the French what the CPS wanted to hear, and signposted the catastrophic consequences of giving an answer that did not support the Crown’s case that EncroChat messages had been taken from storage.

Defence lawyers also argued that the French reply deliberately answered a different question in order to avoid telling an outright lie. The judge said that the argument was “fanciful”.

Leading junior scorer at Liverpool FC

Jamie Cassidy had been a leading scorer for Liverpool Football Club’s under-16s, and was described as a prodigy before his career was cut short with injuries.  

The court heard that Jamie Cassidy had been drawn into a conspiracy to import large quantities of drugs by his brother, Jonathan Cassidy.

The three men used anonymous handles on EncroChat. Jonathan Cassidy used “whiskywasp”, Amed used “dottetdaw” and Cassidy used “nucleardog”.

The court heard that Jonathan Cassidy had joked that he shared the same birthday as El Chapo, a drugs kingpin featured in an episode of Narcos.

Nasar Ahmed admitted acting as a money transfer agent for deals arranged by Jonathan Cassidy to import cocaine to the UK from the Netherlands.

The court heard that in April 2020, Ahmed switched from an EncroChat phone to another encrypted phone, Sky ECC, amid concerns EncroChat may have been compromised. He was arrested at his home on 15 June 2020, two days after the administrators of EncroChat put out a warning that the network had been infiltrated and was no longer secure.

Jonathan Cassidy flew to Dubai after learning about Ahmed’s arrest, where he considered buying a villa with a budget of £2.3m, which he intended to furnish with a £22,000 bed. He was arrested at Manchester Airport when he returned to England in October 2020.

Detectives estimated that Jonathan Cassidy and Nasar Ahmed were involved in importing close to £26m of drugs to the UK.

Sentencing, Dean said that although EncroChat phones were used by organised crime groups, there were relatively loose ties between Ahmed and Jonathan Cassidy. “It would not be accurate to say that Jonathon Cassidy and Nasar Ahmed were part of an organised crime group,” he added. “They were operating independently, but to their joint mutual benefit.”

The judge said Jamie Cassidy had a more limited involvement in the drug conspiracy. The court heard that he worked as a prison listener with the Samaritans.  

Tenacious legal challenge

Wayne Johns, the NCA’s Operation Venetic senior investigating officer, said: “The Cassidy brothers and Ahmed pleaded guilty in this case after years of tenaciously challenging the legality of the case against them. The NCA and Crown Prosecution Service worked with GMP to robustly defend the challenge, and we now see the trio where they belong."

Detective Constable Marc Walby from the Greater Manchester Police Serious Organised Crime Group said the three men were from the upper echelons of organised criminals that operate in Greater Manchester.

“Jonathan Cassidy and his colleagues got far too comfortable with their encrypted phones and began bragging about their personal lives, but this just confirmed what we already knew about them,” he said. “Ironically, it was this bravado and these messages which have landed them in jail for a long time.

“This has been a long-running and complex case, and I would like to thank the NCA and CPS for their pursuit in defending the legal challenges associated with this case. Without, these convictions may not have been possible.”

Jonathan Cassidy of Whitewood Park, Liverpool, was jailed for 21 years and nine months for conspiracy to import cocaine, conspiracy to supply cocaine, and conspiracy to conceal, transfer and disguise criminal proceeds. Nasar Ahmed of Moreton Drive, Bury, was jailed for 21 years and nine months for conspiracy to import cocaine, conspiracy to supply cocaine, and conspiracy to conceal, transfer and disguise criminal proceeds. Jamie Cassidy of Knowsley Lane, Knowsley, was jailed for 13 years and three months for conspiracy to supply cocaine, and conspiracy to conceal, transfer and disguise criminal proceeds.

A manhunt is underway for another suspect, Joshua Avis, who absconded during pre-trial hearings.