German courts refer the legality of EncroChat evidence to the CJEU

A judge at Berlin Regional Court has lodged a preliminary reference request with the Court of Justice of the European Union (CJEU) to verify whether the sharing and use of evidence obtained from the EncroChat hack in 2020 complies with European Union (EU) law. The preliminary ruling request focuses on several aspects of the transfer and use of EncroChat evidence, in particular the legality and proportionality of the European Investigation Order (EIO) used by German prosecutors as well as the consequences of using evidence in a criminal case that was potentially obtained in violation of EU law.

Background

EncroChat was a Europe-based communications network and service provider, which sold specially designed encrypted messaging mobile devices, with maximum privacy settings and functions enabled. Devices came with pre-installed applications including encrypted messaging apps, voice-encrypted call services, and encrypted private notes. In 2020, a Europe-wide police operation was able to covertly access and monitor a hundred million encrypted messages sent through EncroChat. It represented one of the largest law enforcement infiltrations of a communications network ever.

Thousands of people across Europe have since been arrested, detained and prosecuted based on evidence obtained during the hack of EncroChat. The data obtained by the French police authorities was sent to Europol, which transferred the data to law enforcement agencies in other EU countries. However, details about how the network was infiltrated, the technical parameters of the hack and the accuracy of the obtained data, as well as what underlying data was retrieved have been suppressed by the French authorities on the grounds of ‘defence secrecy’.

Legality and proportionality of the EIO

First the Berlin Regional Court asks a number of questions about the legality of the EIO issued by the German authorities in order to gain access to the evidence obtained by French authorities following the hack. In particular, the German court has doubts whether Article 6(1)(b) of the EIO Directive allows the issuing of an EIO to transmit telecommunications data if the surveillance measure of the executing State (France) on which the collection of the data is based would have been inadmissible under the law of the issuing State (Germany) in a comparable domestic case. Under German law, the use of secret telecommunications surveillance measures is only permitted where there is specific suspicion against targeted individuals. Secret surveillance through telecommunications presents a serious interference with the right to a private life. Proportionality of that interference is ensured by limiting its use to cases involving offences of a certain gravity and by the requirement that suspicion against particular people needs to be based on certain verifiable facts.

By posing this question the Berlin Regional Court contests an earlier ruling of the German Federal Court of Justice (the Supreme Court), which found that EncroChat evidence could be used as evidence in Germany for investigating serious criminal offences. According to the Berlin Regional Court those rulings should be overlooked because the secrecy of the communication with Europol and Eurojust had led the Supreme Court to an incorrect assumption that the data had been transmitted to the German authorities “spontaneously” and without German instigation or participation in the data skimming. Documents obtained by defence lawyers after delivery of those rulings reveal that assumption to be false.[1]

Use of evidence obtained in breach of EU law

Secondly, the German court poses a set of questions about the legality of use of evidence potentially obtained in violation of EU law. In particular, the Berlin Regional Court asks whether the principle of effectiveness under EU law requires that evidence obtained by means of an EIO that is contrary to EU law should be excluded from criminal proceedings. It also asks the CJEU to clarify whether the principle of equivalence under the EU law prohibits the use of evidence if the manner (measure) in which it was obtained in the executing state would be unlawful in a comparable domestic case and would render the evidence obtained inadmissible in criminal proceedings under the law of the issuing state, namely, Germany.

An important aspect highlighted by the Berlin Regional Court in this context is the right to a fair trial and defence’s ability to challenge evidence presented by the prosecution. Methods used by the French authorities to carry out EncroChat hack are covered by comprehensive defence secrecy which makes it impossible, even for the French authorities themselves to independently verify the accuracy and reliability of data obtained. Fair Trials has previously raised serious concerns about the use of evidence obtained from EncroChat hack in criminal proceedings that neither the authorities of the executing state nor the suspects or accused persons can access or challenge. The preliminary ruling request poses a direct question to the CJEU to clarify whether Article 6(1)(a) of the EIO Directive prohibits the issuing of an EIO for the purposes of obtaining data if the integrity of the data obtained by the surveillance measure cannot be verified by the authorities in the executing State because of comprehensive secrecy. In this context the preliminary reference request underlines the importance of fair trial rights in particular the ability to challenge evidence, as an aspect in the proportionality assessment of the EIO:

“The technical methods by which the EncroChat data was intercepted, extracted, stored and finally made available for download on Europol’s server, sorted by country, raise various complex issues, particularly in relation to the integrity of the data (i.e. its correctness, completeness and consistency). The ability to verify these issues is central to an effective defence. EncroChat data is the only evidence in almost all cases, including this one. Since the offence of narcotics trafficking charged in this case (as in the majority of the German parallel proceedings) is already fulfilled by the mere serious negotiation of a narcotics sale (cf. for example the charges under 2. and 3. of the indictment), it is particularly important for the defence not only to evaluate individual messages, but also the temporal and content-related relationship of sent and received messages. Technical errors and incompleteness thus harbour a particular danger that chat histories are also unintentionally distorted, without this being noticeable when reading the evaluation protocols.”[2]

Finally, the German court asks whether it would infringe EU law, in particular the principle of effectiveness, if the use of evidence obtained contrary to EU law in criminal proceedings was justified in the context of a balancing of interests by the seriousness of the offences, which was not known when the evidence was first collected. Berlin Regional Court argues that according to the principle of effectiveness, national law must ensure that the accused does not suffer any unreasonable disadvantages in criminal proceedings as a result of illegally obtained information and evidence. This can be done either by excluding the evidence or taking the infringements of law into account when assessing the evidence in question. However, the court argues that there are several reasons why exclusion should be favoured in this case. The very fact that the data requested with the EIO cannot be examined by a technical expert because of French secrecy is likely to fulfil the conditions developed by the CJEU in Steffensen, under which the court must exclude evidence. There are also the multiple formal and material safeguards disregarded under Art. 31 and Art. 6 of the EIO Directive which are either the direct responsibility of the German authorities or to which they have at least turned a blind eye. In the view of the Berlin Regional Court if all these requirements of EU law had been observed, the data of the German users would neither have been collected nor stored at Europol and certainly not transmitted to the German authorities for the purpose of prosecution. Mandatory prohibition of the use of such evidence would also be required by the principle of equivalence according to which infringements of EU law may not be sanctioned to a lesser extent than comparable infringements of national law.[3]

In 2021, Fair Trials issued a report calling on strengthening the principle of effective judicial protection and effective remedy in cases where illegally obtained evidence is used. Evidence obtained through breaches of national procedural law and EU law resulting in disproportional interferences with people’s right to private life should be excluded from criminal case files and should not be used to determine guilt or innocence in a criminal case. Right to an effective remedy is an important safeguard aimed at preserving the integrity of fundamental rights system as a whole. The effectiveness of fundamental rights protection would be called into question if illegally obtained evidence, the integrity and accuracy of which cannot be verified and that cannot be challenged by the defence, could be used as basis for a conviction.

If the evidence must not be excluded, in the alternative the Berlin Regional Court asks whether the principle of effectiveness of EU law requires that breaches of EU law in the obtaining of evidence in national criminal proceedings may not remain entirely without consequence, even in the case of serious offences, and must therefore be taken into account at least at the level of the assessment of evidence or the imposition of sentence in favour of the accused.

[1] LG Berlin, Beschl. 19.10.2022 – (525 KLs) 279 Js 30/22 (8/22), para. 31
[2] LG Berlin, Beschl. 19.10.2022 – (525 KLs) 279 Js 30/22 (8/22), para. 70
[3] LG Berlin, Beschl. 19.10.2022 – (525 KLs) 279 Js 30/22 (8/22), para. 111