The EncroChat encrypted telephone network, hacked by police in 2020, turned out to be a place of communication for criminals who dealt in weapons, drugs and spoke frankly about murders or kidnappings in messages. However, this led not only to a number of arrests, but also to lawsuits from the criminals themselves – they considered such a hack illegal.
Malicious software that law enforcement officers secretly installed on an encrypted system, exposed more than 100 million messages showing the inner workings of the underworld.
German lawyer Christian Lödden in October 2020 talked to potential clients about only one thing: his clients, against whom criminal proceedings were initiated, claimed to use EncroChat and were worried that their devices were broken and could potentially reveal evidence of crimes.
Course
MANAGER FOR WORK WITH CLIENTS
Become a sought-after specialist and receive your dream offer.
REGISTER!
“I had 20 of these meetings,” Lodden says. “Then I realized that a natural disaster was coming.”
The suspects were searched, thousands of kilograms of drugs were seized. Many EncroChat users across Europe, including in the UK, Germany, France and the Netherlands, are already in prison, with some trials still pending.
However, some people question the hacking operation of the police. Lawyers argue that hacked messages should not be used as evidence in court – they say that the rules for sharing data were violated, and the suspects did not receive fair trials.
At the end of 2022, one such case in Germany was referred to the highest court in Europe, and if it is decided in favor of the suspects, it could potentially blow up hundreds of other similar cases. Experts say that this has a negative impact on trust in end-to-end encryption around the world.
“Even bad people have rights. We do not protect criminals. We protect the rights of the accused,” Lodden says.
EncroChat Hack
EncroChat was founded in 2016, at the time of the hack in 2020, it had about 60,000 registered users.
Users paid thousands of dollars to use a specially customized Android phone that, according to the company’s website EncroChat, could “guarante anonymity.” The phone’s “secure features” include encrypted chats, notes, and calls using a version of the Signal protocol, as well as “alarm delete” capability. all on your phone and real-time customer support.
The police probably didn’t break the network’s encryption, but compromised the EncroChat servers in Roubaix, France, and finally downloaded malware on the device. While little is known about how the hack happened or what type of malware was used, according to court documents, 32,477 out of 66,134 EncroChat users in 122 countries were affected.
Courts in many European countries have ruled that EncroChat messages can be used as evidence. However, these decisions are now being challenged. Each country is known to have its own legal system with separate rules regarding the types of evidence that can be used and the processes prosecutors must follow. For example, in the UK it is generally forbidden to use “intercepted” evidence in court.
Appeals in the higher courts
In October, the Berlin regional court sent an appeal in the EncroChat case to the Court of Justice of the European Union (CJEU), one of the highest courts on the continent. The authority must make a 14-point decision on how the data was transferred across Europe and how it was used in criminal cases.
Lödden, who is not involved in the case sent to the CJEU but is coordinating with a dozen other lawyers, says judges offered people lucrative deals and commuted plea sentences in some of the first cases.
The lawyer used several lines of defense: often raising the question of what legal framework was used to justify collecting data from people’s devices and examining the data itself.
“You don’t know how the French got the data. The only thing that is clear is that this is not complete data, because there are gaps and the information is not fully deciphered, ”says the lawyer.
The date when the case will be heard by the EU Court of Justice has not yet been set. In another high-profile lawsuit, two British EncroChat users have filed an appeal with the highest European court of human rights. Also in October, France’s Court of Cassation questioned EncroChat’s previous court rulings and said they should be reviewed.
What EncroChat Users Did
The data obtained after the hack has become a real treasure for law enforcement officers – Arrests of organized criminals in Germany rose by 17%, and at least 2,800 people were arrested in the UK. Among them: two men who planned to shoot for revenge (sentenced to 18 years each); a drug dealer who sold 8 kilograms of cocaine and heroin (prisoned for 14 years); six more people were arrested for smuggling ecstasy and sentenced to 140 years.
In the Netherlands, six people were arrested after police found seven transport containers converted into “torture chambers” – they did not have time to use, thanks to the hacking of the criminals’ phones.
Last June, police in the Dominican Republic reportedly arrested possible organizers of the EncroChat network itself.
The military police of the French National Gendarmerie, the UK’s National Crime Agency and Germany’s federal investigative police agency declined to comment on the court cases. Jan Op Gen Oort, a spokesman for Europol, says the investigation was carried out as part of the work of the Joint Investigation Team:
“The data in the case were collected on the basis of the provisions of French law and with judicial authorization through the framework of international judicial and law enforcement cooperation.”
Encryption Hunters
EncroChat isn’t the only encrypted telephone network hacked by the police. The law enforcers carried out operations against Ennetcom, Sky ECC and Anom (the latter was covertly taken over by the FBI and operated the network), highlighting the strong focus on encryption.
For years, police have complained that encryption prevents access to data, and laws are being proposed in Europe and the US that could weaken it. Hacking phone networks that are considered encrypted and highly secure (some may be legal and others more shady) also raises questions about law enforcement tactics and transparency.
“We are seeing law enforcement actually normalize practices that set a dangerous precedent in terms of surveillance,” says Laure Bodrigae-Gerard, legal director of Fair Trials, a non-profit criminal justice organization in Europe.
One court in Finland has already ruled that data collected by the FBI from Anom cannot be used—the severity of the alleged crimes did not justify the way the data was accessed, local reports argued. Meanwhile, the Italian Supreme Court has said that the methods used to access Sky ECC messages must be disclosed.
More than 100 Dutch lawyers have warned that the police are on a “slippery slope” by using hacks and hiding their methods. In an open letter, human rights activists noted that Signal or WhatsApp could become targets in the future:
“These services are already under suspicion, based only on the use of strong encryption and protection of one’s own privacy.”
Source: Wired, BBC
