NCA ‘wrong-footed’ defence lawyers after agreeing to take expert evidence on EncroChat ‘as read’

Expert evidence to be ‘taken as read’

Defence lawyers told the court that the Investigatory Powers Tribunal had ordered the NCA to cooperate with a defence expert who was conducting experiments to find out how the French intercepted messages from the EncroChat encrypted phone network.

At issue is whether the French obtained the messages while they were stored on the EncroChat handsets of users in the UK, or whether they obtained messages as they were being transmitted live by exfiltrating them from a “load balancer” or another server controlled by the French Gendarmerie.

Defence lawyers argue that if the messages were intercepted from a server during live transmission, the NCA should have applied for a TI warrant and could not lawfully have used EncroChat messages as evidence in criminal cases, under the terms of the Investigatory Powers Act 2016.

They told the court that the NCA had argued in a closed hearing that it could not comply with the tribunal’s order to assist defence experts without compromising its relations with foreign law enforcement agencies.

As a “compromise”, the National Crime Agency agreed to proceed with the tribunal hearing on the basis that the defence expert evidence, which defence lawyers say supported live interception from a server, should be “taken as read”.

NCA: defence expert evidence limited and flawed

Johnathan Kinnear, representing the NCA, told the tribunal that although they were to be “taken as read”, the conclusions of the defence’s expert evidence were limited, flawed and often based on an incorrect interpretation of the law.

He said the expert was confused over the legal definition of “interception” and that, as a result, “flawed reasoning pervaded” a report.

“The report simply does not contradict the Crown’s contention that material was collected from the handsets. It certainly does nothing to undermine the lawfulness of the warrants,” he said.

Kinnear said a second, later report found that data was encrypted from the phone handsets and then collected at the server. He told the court that this supported the Crown’s argument that EncroChat messages were taken from EncroChat phone handsets.

Kinnear said there was not a “Rizla paper” between the NCA and the defence expert report’s findings, which he said effectively found that the intercepted data came from EncroChat handsets, “but may have been collected in a slightly different way to what the Crown says”.

“It is ironic that [the expert report] appears completely supportive of the NCA’s position,” he said.

Tribunal should ‘ignore NCA submissions’

Defence lawyers said the tribunal should completely ignore Kinnear’s submissions on the expert evidence as “they completely undermine the basis” of the tribunal hearing.

The IPT had agreed to take the case on the basis that the expert evidence had been “taken as read” but the expert had been effectively cross-examined without being present in the court.

“On the critical fact of whether it was intercept taken from the server, he is saying [the expert evidence] is wrong,” he said.

“The respondents can’t have it both ways. They can’t on the one hand suggest that [the expert reports] are incomplete and tentative when they only reason that they are is because the order of this tribunal was suspended,” a defence lawyer told the court.

The NCA was trying to “have their cake and eat it” by frustrating the court order that would have allowed the expert evidence to be completed, and then seeking to exploit the fact that the expert reports had not been completed.

“That compromise of being taken as read has not been adhered to by the respondents,” the lawyer said. “And it has completely wrong-footed how we would have taken the issues before this tribunal.”

Another defence lawyer told the tribunal: “If we had known that the incomplete nature of the [expert] reports was to be exploited at this hearing we would have approached things very differently. We would have asked for another hearing so that the court could reconsider how [the expert evidence] was being taken as read.”

He said defence lawyers accepted that historic messages obtained during stage one of the EncroChat hacking operation could not be anything other than intercepted while being stored in the handsets, because they were historic messages.

He said the tribunal’s February order, overturned at the request of the NCA, would have made it possible to explain definitively how stage two of the interception operation worked.

The order would have enabled the tribunal to determine definitively how EncroChat messages were exfiltrated, the lawyer told the court. It would show whether they were taken from storage, whether they were intercepted in transmission through a load-balancer server installed by the French in the datacentre used by EncroChat, or whether they were taken from the EncroChat server.

It has been a long-standing feature of British law that material obtained through interception cannot be disclosed in criminal trials to protect the surveillance techniques used by the intelligence services and law enforcement.

The EncroChat operation is a novel interception operation which has led to legal challenges in the UK, Germany, France and other countries.

The tribunal invited defence lawyers to present further written submissions on the issue after the hearing ran out of time on the final day.

The tribunal panel, headed by Lord Justice Edis, Lady Carmichael and Stephen Shaw KC, is expected to reach a verdict by the end of January.

Lawyers expect any decision to be appealed.