Disclaimer: I am aware there are a lot nuances within law, particularly within each country, as such this question only concerns the wider EU law and UK law as these are the courts I am interested in specifically. However, if you have a generic answer around illegally or potentially legally obtained evidence, please feel free to answer.
Summary: If you're unaware of the backstory, here's a quick summary. EncroChat was a crypto-phone provider. Their service was created in 2016 and sold via their website. Their "unique" selling point was guaranteed anonymity & security via their own hardware units & mobile network. While the platform was not designed for criminals or even exclusively used by criminals, it was thought to be used somewhat heavily by criminals. This led to the platform being hacked in a joint effort by: Dutch, Belgian, French and British police & intelligence operators The ultimate result of this hack was a lot of data & evidence of criminal activity.
Was the Hack Legal?
My first instinct is no, it was not legal to infiltrate this platform. There's a lot of misinformation & confusion online about whether or not the hack itself was legal in the first place. The intelligence community claims that the hack was legal because the platform was riddled with criminal activity. But is that an accurate & legal justification for such an action? Again, my first instinct is no.
As an example, Signal is a secure messaging service, it was founded in 2014 and it was designed entirely with privacy & security in mind. This means that Signal is used both by ordinary every day citizens as well as criminals. It is also used by journalists, politicians, dissidents and many more groups of people which may or may not need such levels of privacy & security. Whether or not these people need privacy is neither here nor there they are entitled to it and Signal provides that platform.
This leads me into my next point. Signal itself is a privacy platform, and like EncroChat, it is also used by criminals however, as far as we know, no hacking attempts have been made by intelligence agencies. I am unable to come up with a valid reasoning as to why this might be the case. It could be the case that intelligence agencies have tried to hack it & failed and so, nothing has been published. But there is one key difference between Signal & EncroChat, Signal is open-source. This leads me to believe that intelligence agencies have shied away from hacking attempts not because they don't want to destroy the privacy of its users but because they know more eyes are on it. EncroChat however was a closed source platform, perhaps this might be a reason why intelligence agencies targeted it, who knows? Irrespective of all of that, it still begs the question whether hacking a platform is legal at all?
Everyone has a right to privacy, over 150 national constitutions recognise a right to privacy. So I have to wonder how it could possibly be legal for an intelligence agency to hack any platform which is perpetuating that right either via hardware, software, etc. If so many countries recognise a right to privacy, how is it that leading intelligence agencies can pick a target (in this case EncroChat) and perform border-line cyber terrorism against it all because some users are using it for malicious or criminal activity. It would be as if SSL/TLS was banned, outlawed, back-doored or hacked because some terrorists used it on their systems.
What are the legal specifics within the EU around governments performing hacking against companies? What evidence do governments need in order to prove that these type of activities are in-fact necessary and legal?
If the Hack was Not Legal Can the Evidence be Used? If so, how?
If the attack on the platform was not legal (which I don't think it was) then how could the evidence still be used? Or could it be used at all?
The reason I ask is because on the news today, I saw the first UK criminal to be convicted and all of the evidence used against him was cited from the evidence gathered during the EncroChat attack. This lead me to believing A. he has a terrible lawyer. B. perhaps the attack was ruled legal? C. the evidence isn't admissible and this is corruption at the highest degree.
This also led me to wondering, say the evidence is ruled as being legally obtained, what would the legal process be for this gentleman? Would this go to the appeals court or would it have to go much higher than that?
Finally, has either the EU or the UK made an official ruling on the data collected from the hack or is that still under investigation?