#Encrochat: Legal Challenges to EncroChat Convictions in Europe and the UK: Reversals, Admissibility, and Systemic Flaws
- The DigitalBank Vault
- Apr 27
- 4 min read
The EncroChat encrypted phone network, once a favored tool of organized crime, has become a legal battleground across Europe. While law enforcement agencies tout the operation as a success—resulting in over 6,500 arrests and €900 million in seizures—courts are increasingly scrutinizing the legality of evidence obtained through the 2020 French-Dutch hacking operation. This blog examines key jurisdictions where convictions have been overturned or challenged due to procedural irregularities, unlawful evidence collection, and systemic failures in cross-border cooperation.
1. Germany: Berlin Regional Court Rules Evidence Inadmissible
Landmark Ruling in December 2024
The Berlin Regional Court delivered a watershed decision in December 2024, declaring EncroChat evidence inadmissible in a drug trafficking case. The court found that French authorities failed to comply with EU law by not formally notifying Germany of the interception of 4,600 German EncroChat users. Under the European Investigation Order (EIO) Directive, France was required to disclose details such as targeted phone numbers, identities, and offenses to German authorities, allowing 96 hours for objection—a step France omitted 412.
Key Legal Grounds
Violation of Sovereignty: The hacking operation, which extracted data directly from German handsets, required prior judicial approval under German law. German courts would not have authorized such a broad operation absent concrete suspicion for each target 12.
Proportionality Failure: The court rejected the argument that bulk interception was necessary, stating less intrusive methods could have been employed 12.
Defense Secrecy: France’s refusal to disclose technical details of the hacking method undermined defendants’ rights to challenge evidence validity 12.
This ruling sets a precedent for over 4,600 German cases and has influenced appeals in the Netherlands and Montenegro 12.
2. United Kingdom: Mounting Challenges and the "Post Office Scandal" Parallel
Admitted vs. Contested Evidence
While UK courts initially upheld EncroChat evidence (e.g., the Embossed II case, where a former footballer was convicted 7), defense lawyers are leveraging two critical arguments to overturn convictions:
Storage vs. Transmission Debate
Under the Investigatory Powers Act 2016, intercepting communications during transmission renders evidence inadmissible. Prosecutors claim messages were harvested from device storage, but defense experts argue the French implant captured data in real-time during transmission. The Manchester Crown Court dismissed these claims in 2024, but appeals are ongoing 7.
Procedural Irregularities
Disclosure Failures: The National Crime Agency (NCA) delayed releasing technical details to defense experts, hindering their ability to scrutinize data integrity 7.
Bulk Warrants: The Investigatory Powers Tribunal (IPT) controversially classified disparate police investigations into EncroChat users as a "single operation," enabling mass surveillance under a single warrant 3.
Potential for Mass Exonerations
Criminal barrister Thomas Schofield warns that if UK courts ultimately deem EncroChat evidence inadmissible, hundreds of convictions—many secured through guilty pleas—could be quashed, mirroring the Post Office Horizon scandal 3.
3. EU-Wide Implications: CJEU Rulings and Mutual Trust
CJEU’s April 2024 Decision
The Court of Justice of the European Union (CJEU) ruled that EU states must notify each other before intercepting communications within another member’s territory. This directly contradicts France’s approach in the EncroChat operation, which bypassed Germany and other states 411.
Impact on Cross-Border Cases
Mutual Trust vs. Sovereignty: While the CJEU upholds the principle of mutual recognition, the Berlin court emphasized that member states retain the right to assess evidence legality under their own laws 12.
Defense Rights: The CJEU affirmed that defendants must have a “real opportunity” to challenge evidence, complicating prosecutions reliant on classified French methods 511.
4. The Technical-Legal Quagmire: How EncroChat Evidence Was Collected
French Hacking Methodology
French authorities implanted malware via a simulated software update, capturing data in two stages:
Stage 1: Extraction of stored messages from device databases.
Stage 2: Real-time interception of messages briefly stored on devices before transmission 7.
Critical Flaws
Lack of Transparency: French authorities classified the implant’s workings as a “defense secret,” preventing independent verification 712.
Data Integrity Risks: Without access to raw data, defense experts cannot confirm whether messages were altered or fabricated 13.
5. Future Outlook: A Legal Domino Effect?
Pending Appeals
Germany: Prosecutors are appealing the Berlin ruling to the Federal Court of Justice, but the decision has already inspired challenges in Italy and the Netherlands 12.
UK: The Court of Appeal is set to review IPT’s “single investigation” classification, which critics argue enables unlawful bulk surveillance 3.
Recommendations for Reform
Transparency Mandates: Require full disclosure of hacking techniques to defense teams.
Strict Proportionality Tests: Limit bulk data collection to cases with individualized suspicion.
Cross-Border Protocols: Strengthen EIO Directive enforcement to prevent sovereignty breaches 411.
Conclusion: A Crisis of Legitimacy
The EncroChat cases expose a systemic tension between law enforcement efficacy and procedural justice. While agencies argue the ends justify the means, courts in Germany and beyond are signaling that unlawful evidence collection cannot sustain convictions. As legal challenges mount, the operation’s legacy may hinge on whether Europe’s judiciary prioritizes privacy rights or prosecutorial expediency—a debate far from resolved.
Key Jurisdictions with Reversals or Major Challenges
Germany: Berlin Regional Court 12.
UK: Ongoing appeals in the Court of Appeal 37.
Netherlands: Defense lawyers citing Berlin precedent 12.
For further analysis of ongoing cases, refer to rulings by the CJEU 411 and the European Court of Human Rights, which is expected to weigh in on EncroChat’s compatibility with privacy rights in 2025.
Comments