Encrochat 2 – IPT Proceedings

Following our EncroChat 1 blog, we now explore what has been happening at the Investigatory Powers Tribunal hearing which began on 20 September 2022.

It will first help to explain some of the events which preceded the hearing.


The EncroChat servers were located in France. The servers were hacked following an operation by the French and Dutch Joint Investigatory Team.

During the first stage of the operation, having hacked EncroChat servers, the French police sent a bogus software ‘update’ containing an implant to EncroChat devices. When uploaded, the implant caused the devices to transmit any retained data to servers operated by the French police and Europol.

By April 2020 police authorities in Europe (including the NCA in the UK) had access to millions of texts and many thousand images. Unaware of what had happened, EncroChat users (around 60,000 of them) continued to use the service until it was shut down in June 2020. During this time (the second stage), the implant continued to collect further data from their EncroChat devices.

Reportedly, there have been around 400 convictions in the UK as a result of the hack and it is believed that a further 1,200 defendants are currently awaiting trial.

Concerns about the legality of what took place in France and the actions of the UK authorities have given rise to a number of challenges in the courts both at home and abroad. Perhaps most notably, the admissibility of EncroChat evidence in criminal proceedings was considered by the Court of Appeal in 2021. The appellants argued that the material was inadmissible because it was ‘intercept material’ which was taken as it was being transmitted (S56 Investigatory Powers Act 2016 (IPA 2016)).

The Court of Appeal disagreed and found that the material was admissible as EncroChat communications were intercepted while they were stored on or by the system, rather than in the course of transmission. The Court of Appeal also found that the interception was lawful as it had been carried out with a targeted equipment interference (TEI) warrant under Part 5 IPA 2016.

How does this relate to the IPT proceedings?

The procedure for obtaining the surveillance warrant under Part 5, required a Judicial Commissioner (an independent judge) to review and approve decisions to issue TEI warrants. The IPT hearing is investigating complaints that the NCA failed to provide the Judicial Commissioner with a full explanation of its understanding of how the French hack was carried out.

The claimants allege that analysis of the IPA 2016 shows that a target intercept (TI) warrant rather than a TEI warrant was the correct surveillance warrant. The claimants submit that the NCA knew that a TI warrant would have allowed it to use EncroChat data on an ‘intelligence only’ basis and not as evidence in court.

The IPT heard that the NCA made ‘serious and fundamental errors’ in the process of applying for this warrant.

“The NCA started with the result they wanted and tried to fit that into the Investigatory Powers Act. They wanted a TEI and nothing else,” a barrister acting for the claimants told the court. “Their motive was understandable. They wanted to make the intercept available in court.”

How did the NCA apply for the warrant?

The IPT heard that the warrant application was based on the account of a conversation between NCA Intelligence Officer, Emma Sweeting and Jeremy Decou (a French Investigations Officer) following a Europol meeting in February 2020. After their conversation, Sweeting drafted an email describing how the French would use an “implant” to extract EncroChat messages from devices. Sweeting showed the draft email to Decou who verbally agreed that it was correct.

The IPT claimants submit that Sweeting’s technical understanding was flawed. She was an Intelligence Officer and did not consult with her Technical Officer, Luke Shrimpton, prior to applying for the warranty.

The claimants state that the NCA deliberately failed to disclose the premise of Sweeting’s understanding on which the warrant application was drafted and subsequently reviewed by the Judicial Commissioner. They further submit that the NCA intentionally took no steps to clarify the tenuous nature of the information produced to the Judicial Commissioner.

Shrimpton was also cross-examined extensively about the Europol meeting. He appeared to concede that he had not been given a precise understanding of how the implant was going to work. He told the court that there was no discussion about the hack extracting data in two different stages. He also conceded that the Dutch had a better understanding of how decryption would occur. He was also unable to say whether the hack had been designed by the French or the Dutch.

Shrimpton admitted that the NCA could have taken steps to understand more about how the French hack operated (for example by analysing a deliberately infected device). He acknowledged that this may have provided the NCA with different information than that which it had relied on when obtaining the warranty.

The case has been adjourned to 14 December 2022 with a three-day estimate.

If you were an EncroChat user it is important to get help at an early stage from an experienced legal professional with a clear understanding of the issues involved in these types of cases.

Contact our director, Tarsem Salhan, if you would like further advice on these matters. Good advice at the outset may significantly affect the outcome of your case. Tarsem can be contacted on 0121 605 6000.