The EncroChat hack intercepted 115 million encrypted messages that led to 6,558 arrests including 197 High Value Target, €739.7 (£639.1m) in cash seized and a further €154.1m (£133.1m) frozen in assets or bank accounts.

Further, drugs, vehicles, and weapons were seized and “crime as a service” – such as assassination, kidnaping, extortion, and in some cases torture –  offerings were discovered and foiled.

EncroChat was an encrypted phone network used widely by organised criminals, was dismantled by French and Dutch police in 2020.

As part of the investigation, French authorities shared information with the UK’s National Crime Agency (NCA), which led to over 746 arrests domestically in the summer of 2020 as part of ‘Operation Venetic’. 

Operation Venetic also seized £54 in criminal cash, two tonnes of class A and B drugs, along with weapons and vehicles. A specialist NCA team also used the investigation to mitigate over 200 threats to life by organised crime groups in the UK. 

“The police are having a field day,” read messages on intercepted UK handsets. 

Nikki Holland, NCA director of investigations said at the time: “The infiltration of this command and control communication platform for the UK’s criminal marketplace is like having an inside person in every top organised crime group in the country.

“This is the broadest and deepest ever UK operation into serious organised crime.”

Since that time, debates in the UK and abroad have taken place over the admissibility of the intercepted messages as evidence both in the UK and abroad. 

In the UK, the evidence was challenged under section 56 of the Investigatory Powers Act 2016. Specifically, s 4(4) which examines if the messages were stored by the telecommunications system or being transmitted at the point of interception, both of which require warrants to access. Ultimately, the court found the evidence admissible and dismissed the appeal. 

In Europe, the investigation led to the establishment of joint investigation teams (JIT) in the EU, which is a legal agreement between competent authorities of two or more states for the purpose of carrying out criminal investigations.

Despite this, criminals from implicated EU states challenged the admissibility of evidence in court on the grounds that rules around data-sharing were broken, and the secrecy of the hack meant suspects did not receive a fair trial. In May of last year, a case from the EncroChat hack was sent to Germany’s highest court, where the use of evidence was lawfully upheld. 

Carole Etienne, chief prosecutor at the judicial tribunal in Lille, which oversaw the EncroChat investigation said: “The investigations into the EncroChat structure were complex, given the structure of the organisation itself, but above all given its location on various continents, and required numerous acts of international corporation, some of which are still being prepared and/or implemented,” according to Computer Weekly. 

“The illegal use of encrypted communications continues to receive major attention from  judicial  and law enforcement agencies across the EU,” said an Europol statement. 

Recommended

• How MadeBrave is Fostering Creativity in a Post-Pandemic Workforce
• Scotland’s 10-year Plan For “World-class” Entrepreneurial Campuses
• EHRC: UK’s Proposed AI Regulations “Do Not Go Far Enough”

According to Europol, EncroChat phones were marketed to criminals offering perfect anonymity, discretion and no traceability for users for roughly €1,000/device and subscriptions for worldwide coverage at €1,500/month. The service had 60,000 global users, roughly 10,000 of which residing in the UK according to the NCA. 

Intelligence Investigators supplied a software implant to phones disguised as a software update. The implant harvested historic data from infected phones, noting the phone’s International Mobile Equipment Identity in the process. 

The implant then proceeded to intercept incoming and outgoing messages, transmitting them to a server in Pontoise, France.