Barrister Jessica Sobey comments on encrypted devices and digital evidence in CSO Online

Barrister Jessica Sobey comments on how law enforcement agencies gain access to encrypted devices, the legal challenges surrounding the gathering of  digital evidence and recent developments in EncroChat evidence.

Jessica’s comments were published in CSO Online, 31 January 2025, and can be found here.

Legal powers

“Pre-1985, the UK was able act as if it had unrestricted power to intercept communications data. However, following criticism from the ECHR, the government enacted three historic pieces of legislation concerning the covert monitoring of communications data:

• The Interception of Communications Act 1985
• The Regulation of Investigatory Powers Act 2000 (RIPA)
• The Investigatory Powers Act 2016 (IPA)

“Importantly, the IPA does not prevent activities that were previously carried out under common law. It is in fact arguable that whilst the legislation brings transparency to covert activities, the powers it affords have also been expanded as a result of this.

“The powers of law enforcement in regards to this legislation are limited by necessity and proportionality, which has been broadly interpreted by the courts and are subject to review by the Investigatory Powers Commissioner (IPC). Complaints against the use of powers can also be bought before the Investigatory Powers Tribunal (IPT), as we have seen in the case of EncroChat.

“However, even the IPT as a Government led organisation is not wholly independent. In short, there is no review process available for evidence heard secretly by state actors.”

EncroChat evidence

“Perhaps the most significant legal challenge of recent years bought before the IPT and concerning the collection of digital evidence was in relation to the EncroChat network.

“Under S.56(1) of the IPA 2016, evidence which tends to suggest interception-related conduct has or may have occurred is inadmissible, subject to the exceptions in schedule 3. In this case, the prosecution therefore relied on the exception under 6(1)(c), namely that the data was stored and that the interception was carried out in accordance with a TEI warrant.

“The IPT rejected the defence argument that the NCA withheld critical information when it applied for a warrant to obtain messages from the EncroChat network. It ruled that the use of a TEI warrant was justified, and that the investigation could be classified as a single investigation into the criminal use of EncroChat. Defence lawyers, however, continue to argue that the IPT has blurred the distinction between bulk warrants and thematic warrants and this could still prove to be fertile ground for legal challenges concerning the gathering of digital evidence from encrypted devices.

“The question as to the admissibility of EncroChat evidence was referred back to the criminal courts and arguments as to whether the data was obtained from storage of during transmission, continue to be litigated in criminal proceedings.

“In these proceedings, the prosecution continues to withhold the means by which the encrypted data was obtained by French authorities on grounds of national security. This means that the defence are deprived of disclosure of the methods used to infiltrate the data and any processing that it underwent before being passed to UK authorities via Europol.

“However, the UK criminal courts have continued to find evidence admissible on the basis that the evidence suggests that encrypted EncroChat data was taken from storage and crucially not in transmission.”

Recent developments in EncroChat evidence

“Significant recent proceedings in Germany have further called into question the assumption that intercept evidence obtained by one member state can automatically be used as evidence in another.

“Last week, the Berlin Regional Court ruled, interpreting ECJ guidance, that EncroChat data obtained lawfully under French law still required a German Court to decide whether the interception measures taken by France were permissible under German law. Although the ECJ concluded that German prosecutors were permitted to request data from France, that did not mean that they could automatically use the data in prosecutions. In considering whether interception would be permissible under German law, the court found that:

• Suspecting the commission of crime by EncroChat users did not reach the threshold to justify interception of all EncroChat communications.
• The principle of mutual cooperation between European member states must recognise national measures to protect citizens fundamental rights in cooperating countries.
• It was not established that the data could not have been gathered using less draconian means other than by intercepting their communications.

“Of course, this decision is not binding on other jurisdictions and each much interpret the ECJ decision in accordance with their own domestic law, however, there is no doubt that it will impact the use of intercept evidence in other cases within Europe.”