In June 2020, several EncroChat investigations folded, resulting in many arrests. In press releases, the public prosecutor proudly spoke of the sophisticated and internationally coordinated operation, in which the Team High Tech Crime had a key role in the Netherlands. Now, a year later, the prosecution is singing a lower tune and shouting that the interception of EncroChat messages, was the responsibility of the French authorities. Why is the prosecution downplaying its own role? Does the prosecution have something to hide?

What could the prosecution have to hide?

The prosecution realises that if it is jointly responsible for the hack, disclosure will be required. In that case, it should be possible for the defence to check whether there are any breaches of form. After all, hacking is only allowed under strict conditions. After all, the invasion of the hacked person's privacy is far-reaching. The only problem for the prosecution is that it will probably not be possible to disclose the case, because the French have labelled this (technical) information a state secret.

Co-responsibility of the prosecution

The prosecution thus claims that it does not have to give the requested data because it would be a French investigation. The 'interception tool' would have been developed by the French themselves and the authorisation to place the malware on Encrochat's servers would have been given by the French court. Because of the (interstate) principle of trust, the French's modus operandi would not be reviewable. Yet, it is questionable whether this principle of trust precludes a review of the hack. Also, reports from the UK National Crime Agency (NCA) and Europol indicate that the prosecution was very closely involved in the hack, making the prosecution (formally and/or materially) co-responsible. How else could the messaging traffic have been monitored 'live' so soon after the hack? Why were authorisations requested from Dutch examining magistrates? The OM was apparently prepared to quickly collect, analyse and take action on the message flow. If the OM will be held co-responsible for the hack, its modus operandi will have to be able to be monitored.

Prosecutors find it harder to get away with breaches of form that occurred outside the preliminary investigation

In case an appeal to the principle of trust would fail, the prosecution also claims that a suspect would not be able to attach legal consequences to any procedural defects in a (foreign) investigation anyway because it would fall outside the Dutch preliminary investigation. However, the Supreme Court made an important ruling in May 2021. The Supreme Court ruled that: if an established procedural default outside the preliminary investigation had a decisive influence on the course of the investigation into and/or prosecution of the suspect, legal consequences should be attached to it. Legal consequences can be: inadmissibility of the public prosecutor, exclusion of evidence or reduction of sentence.

A modern Supreme Court ruling

This ruling is in line with legal developments on this point. The legislator has also recognised (in a draft bill) that results of investigations by foreign investigators, administrative bodies, companies and citizens will increasingly play a role in criminal prosecution. Thus, this ruling may come to play an important role if, for example, a citizen has unlawfully gathered important evidence against a subsequent suspect. This also applies to cases in which investigation results, which may be of decisive influence, have been gathered abroad, as in the EncroChat but also, for example, in the Sky ECC investigations. It will therefore be easier to hold the prosecution accountable for these breaches of form. Even if, strictly speaking, the breaches of form did not take place under the responsibility of the Prosecution.

Update 17 June 2021

In a case handled by the undersigned, the Utrecht court (Research Apple) ruled on 17 June that the data from the underlying Lemont investigation indeed appears to have had a determining influence on the investigation and prosecution of all suspects in the Appel investigation. The court also acknowledged that the prosecution's contention- that the Lemont investigation relates exclusively to Encrochat itself-cannot be sustained. The public prosecutor was therefore ordered by the court to comply with the defence's requests to add to the case file either the 126uba warrant in the Lemont investigation or the examining magistrate's report. This should provide insight into the considerations underlying the authorisation to use the data from the Lemont investigation for other investigations in the Netherlands.

That authorisation can then be assessed against treaty obligations when processing personal data. The other considerations (including proportionality and subsidiarity) can also be assessed. If it turns out that this authorisation was wrongly issued, the consequences could be far-reaching. The data from Lemont used against many suspects in the Appel investigation will then not be allowed to be used as evidence.

sound here for the ruling

Mr D.M. Penn