4

Disclaimer: I am aware there are a lot nuances within law, particularly within each country, as such this question only concerns the wider EU law and UK law as these are the courts I am interested in specifically. However, if you have a generic answer around illegally or potentially legally obtained evidence, please feel free to answer.

Summary: If you're unaware of the backstory, here's a quick summary. EncroChat was a crypto-phone provider. Their service was created in 2016 and sold via their website. Their "unique" selling point was guaranteed anonymity & security via their own hardware units & mobile network. While the platform was not designed for criminals or even exclusively used by criminals, it was thought to be used somewhat heavily by criminals. This led to the platform being hacked in a joint effort by: Dutch, Belgian, French and British police & intelligence operators The ultimate result of this hack was a lot of data & evidence of criminal activity.

Was the Hack Legal?

My first instinct is no, it was not legal to infiltrate this platform. There's a lot of misinformation & confusion online about whether or not the hack itself was legal in the first place. The intelligence community claims that the hack was legal because the platform was riddled with criminal activity. But is that an accurate & legal justification for such an action? Again, my first instinct is no.

As an example, Signal is a secure messaging service, it was founded in 2014 and it was designed entirely with privacy & security in mind. This means that Signal is used both by ordinary every day citizens as well as criminals. It is also used by journalists, politicians, dissidents and many more groups of people which may or may not need such levels of privacy & security. Whether or not these people need privacy is neither here nor there they are entitled to it and Signal provides that platform.

This leads me into my next point. Signal itself is a privacy platform, and like EncroChat, it is also used by criminals however, as far as we know, no hacking attempts have been made by intelligence agencies. I am unable to come up with a valid reasoning as to why this might be the case. It could be the case that intelligence agencies have tried to hack it & failed and so, nothing has been published. But there is one key difference between Signal & EncroChat, Signal is open-source. This leads me to believe that intelligence agencies have shied away from hacking attempts not because they don't want to destroy the privacy of its users but because they know more eyes are on it. EncroChat however was a closed source platform, perhaps this might be a reason why intelligence agencies targeted it, who knows? Irrespective of all of that, it still begs the question whether hacking a platform is legal at all?

Everyone has a right to privacy, over 150 national constitutions recognise a right to privacy. So I have to wonder how it could possibly be legal for an intelligence agency to hack any platform which is perpetuating that right either via hardware, software, etc. If so many countries recognise a right to privacy, how is it that leading intelligence agencies can pick a target (in this case EncroChat) and perform border-line cyber terrorism against it all because some users are using it for malicious or criminal activity. It would be as if SSL/TLS was banned, outlawed, back-doored or hacked because some terrorists used it on their systems.

What are the legal specifics within the EU around governments performing hacking against companies? What evidence do governments need in order to prove that these type of activities are in-fact necessary and legal?

If the Hack was Not Legal Can the Evidence be Used? If so, how?

If the attack on the platform was not legal (which I don't think it was) then how could the evidence still be used? Or could it be used at all?

The reason I ask is because on the news today, I saw the first UK criminal to be convicted and all of the evidence used against him was cited from the evidence gathered during the EncroChat attack. This lead me to believing A. he has a terrible lawyer. B. perhaps the attack was ruled legal? C. the evidence isn't admissible and this is corruption at the highest degree.

This also led me to wondering, say the evidence is ruled as being legally obtained, what would the legal process be for this gentleman? Would this go to the appeals court or would it have to go much higher than that?

Finally, has either the EU or the UK made an official ruling on the data collected from the hack or is that still under investigation?

Improve this question
6
  • I can assure you that it was marketed at and primarily sold at criminals. The estimate is that about 50,000 of 60,000 customers used it for criminal purposes. The data is fully used in investigations, and a large number of arrests have been made. The sheer numbers make it hard to investigate every single case quickly.
    – gnasher729
    Feb 4, 2021 at 12:42
  • That is a rather sweeping statement to make. Firstly, how can you assure me it was marketed for crime. Looking at their website, there is absolutely zero indication that it was designed exclusively for crime. There are hundreds of crypto-phone providers, are you now going to suggest that because they provide such a service they're all marketed for crime? Secondly, that's an estimate. What is that estimate based on? That's based on numbers published by the very agencies which hacked the platform in the first place. Those numbers are also published via media companies which purposefully-
    – user24806
    Feb 4, 2021 at 12:44
  • 1
    Fear monger and exaggerate claims in order to get extra clicks on their site and extra purchases of their newspapers and any other media. We absolutely should not be trusting these figures, it is more than likely nonsense and/or exaggerated and has no bearing on whether the hack was legal. Just because a platform is heavily used by criminals, that does not mean that the platform itself is aware of the activities of those people, the whole idea of a secure and private platform is that the platform doesn't know what you're using it for.
    – user24806
    Feb 4, 2021 at 12:45
  • I'd also like to point out: criminals flocking to a specific platform doesn't mean the platform itself encouraged criminals to flock there. It can simply be a case of criminals assuming that it was the most secure platform via word of mouth, which is usually the case.
    – user24806
    Feb 4, 2021 at 12:54
  • 3
    Regardless of the stated or actual use of the service, law enforcement operates by rules. One of those rules is that evidence must be obtained in a legally-acceptable way, or it isn't usable in a prosecution. This is to deter abuse of power. There are exception, but they dont overturn that rule - they just make clear that evidence is acceptable when obtained in other ways, if other circumstances happen to have existed. Its still rules-based. So the question is 100% valid, and merits a legal answer.
    – Stilez
    Feb 4, 2021 at 13:51

3 Answers 3

Reset to default
3

It's just been answered by the Court of Appeal:

The rationale for the decision is:

Interception of messages renders them unable to be used as evidence. But the Encrochat system used end to end encryption, and the captured messages were in plain text and not decrypted by authorities.

Therefore the captured evidence data could not have arisen from "interception" of messages. They were not intercepted messages, but on-device captures of the phones memory/RAM prior to encryption and sending.

Corroborating this, the court observed that the captures also apparently included device data that was not part of any transmitted message,showing again, they were not "intercepted" data.

It appears it was captured by some kind of software introduced onto the phones by French authorities, perhaps with UK involvement its not clear to me.

Improve this answer
7
  • This reads very much like the court ignored the part where the French police carried out a malware attack against EncroChats servers in order to install malicious firmware on the devices in order to get those messages in plaintext without having to break the end-end encryption. What I am saying is, how in the world is this considered a reasonable ruling. The court is basically saying: "well they didn't intercept them so they're fair game". Except the method in which they got those messages as they state in plaintext, was via a malware attack. I find this pretty ludicrous.
    – user24806
    Feb 6, 2021 at 0:10
  • This ruling does worry me a great deal. Am I right in saying that this now sets a legal precedent where if another countries intelligence agencies carry out a hack against a platform in the same fashion as this one, i.e, hacking the servers and sending a malicious update with custom code and British users are involved in the data collected then that data can be used in court? Because, as the appeal court says; the attack will have not been carried out via interception making the evidence perfectly legal.
    – user24806
    Feb 6, 2021 at 0:14
  • The question asks if it was legal. Not "should it have been legal" or "do we need stronger safeguards".
    – Stilez
    Feb 6, 2021 at 4:10
  • 2
    Its useful in UK law (commonlaw is precedent based), to find parallels. Here's one: suppose a bailiff hacks the firmware of your electronic home security, so that the windows all open wide while you're at work. Legality of hack aside, can they then enter and take stuff, and argue that the seizure is legal since the property could be entered without force, and the software asked for a firmware download and wasn't "forced" to accept it, and the servers are a separate entity? I don't think its a perfect analogy but worth thought.
    – Stilez
    Feb 6, 2021 at 4:15
  • 1
    @J.J The US has already decided, a few years back, that feds "hacking" people, even in other countries, was legal and that a single warrant could permit mass dragnet attacks against people.
    – forest
    Feb 8, 2021 at 2:35
2

The United Kingdom Investigatory Powers Act 2016 would permit this.

Under the IPA the Home Secretary can issue a Bulk Interception Warrant for communications relating to serious crime. These warrants have to be countersigned by a "Judicial Commissioner". These warrants can remain secret indefinitely. They are described as being targetted at overseas individuals and organisations, but there doesn't seem to be anything in particular restricting their scope to outside national borders. Nor does there seem to be anything preventing the use of other material not covered by the original warrant (e.g. if a warrant issued to find terrorist plots were to uncover evidence of drug dealing, well thats considered fair game).

So yes, if a Bulk Interception Warrant were signed which targetted a serious crime that was being conducted over EncroChat, then hacking EncroChat and using anything found in subsequent prosecutions for unrelated crimes would be just fine.

Improve this answer
2
  • 2
    I think you need to address the admissability of intercept data under UK law. Some good analysis here: 5sah.co.uk/knowledge-hub/articles/2020-07-03/…
    – richardb
    Feb 4, 2021 at 16:53
  • There has been a court decision in this case, where the judge found that the information was not intercept data. With the simple reasoning: The police was not able to decrypt any encrypted messages, they copied unencrypted messages. All messages were encrypted while in transit. Therefore everything the police copied was not in transit, and no intercept data was used.
    – gnasher729
    Feb 9, 2021 at 23:32
-3

Sorry. I know this will be downvoted.

Sovereigns are not bound by laws, they are bound by channels of obedience. If the sovereign says it is legal, then it is legal. If the sovereign says it is illegal, then it is illegal. This includes sovereigns composed of systems.

Not everything falls under lawful or unlawful. There is just and unjust as well as power and strength vs powerlessness and meekness.

Don't believe this, ask Assange.

Improve this answer
2
  • 1
    "Sorry. I know this will be downvoted." This is what is elsewhere called a "self-fulfilling prophecy". As far as Assange is concerned, he f***ed up. He could have spent six months in a prison on Sweden and gone back to Australia or New Zealand with no problems. And there are much worse places to be than jail in Sweden.
    – gnasher729
    Sep 27, 2021 at 22:52
  • @gnasher729 People can't handle the truth doesn't mean I wont speak it. North Korea has laws, so does China, and Hitler's Germany had lot's of laws, and judges, and everything was legal.
    – paulj
    Sep 29, 2021 at 17:54

You must log in to answer this question.