British prosecutors can make use of evidence gathered by the French and Dutch police from encrypted messaging service Encrochat’s servers thanks to a legal interpretation of whether RAM counts as data storage, the Court of Appeal has ruled.

The judgment, handed down on the afternoon of 5 February, has far-reaching repercussions for criminal defendants identified and arrested on suspicion of serious crimes – with their identification being possible thanks to police reading the contents of their messages.

In addition, the judgment also sheds more light on Britain’s Byzantine and occasionally opaque surveillance laws, which regulate how police can lawfully spy on people.

Critically, police and other law enforcement agencies are banned from outsourcing unlawful methods of evidence collection to foreign countries’ agencies – and the Encrochat defendants in this case lost their argument that that was what British police did in mid-2020 under the codename Operation Venetic.

Had they succeeded, a number of criminal trials – including some test cases in Liverpool – would potentially have collapsed.

“We have concluded that the only substantial question which the judge was required to answer was whether the EncroChat material was stored by or in the telecommunications system when it was intercepted. Like him, we consider that these communications were not being transmitted but stored at that time,” said the Lord Chief Justice, Lord Burnett of Maldon.

Multiple reporting restriction orders are in force on most EncroChat cases currently before the criminal courts – though those restrictions are not being applied to police forces and the National Crime Agency, both of which have been boasting since last year about EncroChat-linked arrests and convictions, and even the contents of EncroChat messages.

Thanks to the reporting restriction orders we cannot lawfully link to any of the police press releases.

Data in transit and at rest

The main law in play during this appeal was the infamous Snoopers’ Charter, the Investigatory Powers Act 2016. Broadly speaking, intercepting communications over a “telecommunications system” is illegal unless there’s a proper warrant in place, as set out in section 4 of the Act.

Different types of warrant apply depending on whether the intercepted message was being transmitted or was in storage somewhere on the system. If it’s at rest, police need to apply for a Targeted Equipment Interference (TEI) warrant; if it’s in transmission, they need a Targeted Interception (TI) warrant. The NCA obtained a TEI warrant, as previously reported, arguing that the data harvested from EncroChat was being stored at the time that European police forces accessed it.

The Court of Appeal explained that in a previous judgment about EncroChat evidence, a Crown court had held that messages in a device’s RAM were to be treated as being stored for legal purposes. That ruling also described how EncroChat worked when a user wanted to send a message, or so it summarised:

When an EncroChat phone received a message, a similar process occurred:

Matthew Ryder QC argued that based on this, prosecutors’ claims that sent messages were being stored was wrong. As described, he said, holding EncroChat messages in RAM constituted part of “transmission” as defined in law. Both prosecution and defence agreed that messages couldn’t be “stored” and “transmitted” at the same time.

Matters were complicated by nobody from the police testifying exactly how their malware worked. When the French and Dutch police hacked EncroChat they remotely deployed a man-in-the-middle technique onto its network which took snapshots of each end-user device (a smartphone running a “clean” version of Android alongside EncroChat’s own OS) and beamed their contents back to police. These included messages described in a previous High Court ruling as “ongoing… as they were stored in handsets after transmission”.

The Court of Appeal said: “It is not known when or how the malware extracted the messages. There was no evidence about this. No one who gave evidence knew exactly how the malware works, and the French authorities were concerned that this should continue to be the case.”

Despite all this the Lord Chief Justice, Lord Justice Edis and Mrs Justice Whipple sided firmly with prosecutors, saying: “We do not accept that this issue requires a minute examination of the inner workings of every system in every case,” stating:

What this means

Even when a message is being transmitted, as far as the law is concerned it’s still being stored somewhere and was therefore fair game for the NCA, the Court of Appeal appeared to have ruled.

Tech lawyer Neil Brown of decoded.legal blogged about this, writing: “I think this means that, if a communication is available by virtue of access to a device, then it is inherently a ‘stored’ communication, irrespective of whether a copy of it is also in the course of transmission. I’d need to give that some further thought, and I note that the Court itself recognises that this is not a universally held position.”

The judges also criticised defence expert witnesses, saying: “The experts have an important role in explaining how a system works, but no role whatever in construing an Act of Parliament. They appear to have assumed that because a communication appears in the RAM as an essential part of the process which results in the transmission it did so while ‘being transmitted’. That is an obvious error of language and analysis.”

It appears that the Court of Appeal has just rendered useless a large part of the protections in the Snoopers’ Charter. Why would a British police force need to bother with TI warrants in future when even messages in the act of being transmitted are, legally, “in storage” and can therefore be hacked from abroad by foreign police or intelligence agencies with impunity provided UK police get a TEI warrant?

Legal protections against unlawful interception, in section 3 of the Snoopers’ Charter, don’t apply to data in storage targeted by police hackers under a TEI warrant. This part of the Court of Appeal’s ruling is likely to have big implications. ®