UK's National Crime Agency wins major legal challenge over Encrochat hack

Britain’s National Crime Agency (NCA) won a major legal challenge on Thursday that had threatened to undermine thousands of arrests based on evidence gathered when French and Dutch police hacked the Encrochat messaging service.

The Investigatory Powers Tribunal — the only court in the U.K. that can hear complaints about the intelligence services and the use of surveillance powers — ruled the NCA had not failed to obtain the proper warrants to access those messages.

Encrochat was a bespoke encrypted communications platform widely used by serious organized crime groups in Europe. Although its creators claimed it was developed for celebrities who needed additional privacy, law enforcement agencies argued that the vast majority of Encrochat’s customers were actually criminals.

For a subscription fee of around €1,000 per device, its customers were provided with modified mobile phones that were designed with physical privacy protections — their cameras and GPS functionality were physically removed — and contained a hidden feature offering a secret communications platform.

This platform was compromised in 2020 by cyber specialists working for French and Dutch police, and the intelligence law enforcement agencies gleaned from the operation was subsequently used to arrest thousands of suspects across the continent.

As of March 2022, the NCA said in Britain alone there had been 2,864 arrests out of more than 9,000 users, and that police had seized more than 9,296kg of Class A drugs, alongside almost £77 million ($96 million) in criminal cash. However the agency said it would not be providing further updates due to ongoing legal challenges.

Handing down its judgment in response to those challenges, the Investigatory Powers Tribunal said that the NCA had not failed to obtain the correct warrant for accessing material obtained when European law enforcement agencies hacked the Encrochat system.

However the Tribunal also said it had not been able to come to a decision about whether the NCA complied with legal distinctions requiring police and security agencies to use different warrants to access information stored on a system versus intercepting messages while they are being transmitted.

Such a decision would be necessary in the future, the judgment said, adding the Tribunal would address the issue following the conclusion of ongoing Encrochat proceedings in the Crown Court.