Partner Bambos Tsiattalou writes for The Times regarding EncroChat investigation

Writing for The Times, Partner Bambos Tsiattalou examines the EncroChat investigation, its implications on the right to privacy and whether the investigation sets a precedent for prosecutors to widen their investigation powers.

Bambos’ article was published in The Times, 25 February 2021, and can be found here.

Appeal judges recently dismissed an attempt to stop prosecutors using messages in court from mobile phones that were part of the encrypted EncroChat communications network.

According to the ruling, French police obtained the messages through hacking phones, but not through “interception”. Instead, they were taken from the phones’ memory milliseconds before the data was sent and “in transmission” or after it was “received”.

Under English law, evidence from interception cannot be used in court. However, the EncroChat judgment redefines the entire approach to digital material, moving significantly from the position under the old law which, for example, was applied in the trial of Andy Coulson and others at the News of the World for conspiring to intercept voicemails. In that case, the court was clear that it was an offence to hack and therefore invade the privacy of citizens by accessing their private communications stored on voicemail.

After that ruling, the Investigatory Powers Act 2016 significantly changed the law, giving mass surveillance powers to the police, investigation agencies and the security services. It also changed the meaning of “interception” in important ways.

The EncroChat judgment is the first time the Court of Appeal has considered these provisions and would appear to have significant ramifications for the privacy rights of individuals whose private communications are targeted.

The 2016 legislation contains protections, but their practical and effective quality have been largely untested. For the rule of law and due process to prevail, it is essential in a democratic society that those responsible for ensuring compliance meet their responsibilities, irrespective of the consequences. There is little point in having protections if there is no effective means of ensuring their observation.

The precise legal implications for privacy and cybersecurity remain to be seen, but are potentially wide-ranging. The approach to EncroChat messages has redefined the legal boundaries between messages that are protected and those that are not under the 2016 act. Inevitably, investigating agencies will want to exploit the full extent of those boundaries until the judiciary draws a firm legal line.

Prosecutors are reportedly anxious to avoid public scrutiny of EncroChat and the investigations leading to its demise. To ensure open justice, public scrutiny is necessary so that the investigation and the methods deployed can be reviewed and a determination made as to whether justice has been administered properly.

These issues should provide some insight into how lawyers will defend due process irrespective of populist views. It may not always be popular, but due process is the foundation of our criminal justice system. Without it, there is just a criminal system.