Sky ECC evidence declared 'unreliable' in Antwerp drug case
A British forensic expert told Antwerp's court that digital evidence from the Sky ECC network contained errors and inconsistencies. The court refused to grant a postponement for further investigation.
Antwerp court refuses postponement in Sky ECC drug case despite doubts over evidence
Antwerp's court has rejected a defence request for a postponement, even after a forensic expert had found that digital evidence from the encrypted Sky ECC phone network was "unreliable". Computer Weekly reported this based on the court hearing.
The case concerns criminal proceedings against Nordin El Hajjioui, nicknamed Dikke Nordin, who is accused of importing narcotics through Antwerp port. The prosecution's case rests largely on messages that French, Dutch and Belgian police intercepted in 2020 through a hacking operation on the Sky ECC network, based in Vancouver.
Forensic expert identifies errors and inconsistencies
British forensic expert Duncan Campbell presented findings that raise new doubts about the digital evidence provided by Belgian police. According to his report, the analysed datasets contained errors and inconsistencies that investigators had not explained or reported to the court. Campbell stated that the data may have been processed by people lacking the necessary expertise.
Specifically, his analysis pointed to significant differences between datasets submitted in 2022 and 2025, while the public prosecutor had claimed both datasets were "identical". In the most recent dataset, 108,000 messages appeared to have been added that were not present in the original data.
The prosecutor's claim that these new messages had only recently been decrypted did not hold up: the unencrypted versions of those messages did not exist in the original data, and much of it remained unencrypted anyway.
Analysis software not transparent or verifiable
It was also revealed during the hearing that Belgian police used a previously undisclosed web application called Edge, developed by the Belgian Directorate for the Fight against Serious and Organised Crime (DJSOC), to analyse Sky ECC data.
Defence counsel Justus Reisinger argued that Campbell's analysis showed that the Edge tool was not fit for purpose, had produced substantial errors and failed to meet the evidence standard required in criminal cases. Messages in spreadsheets had moreover been filtered in a way that led to duplication, alteration or incorrect linking to Sky ECC identities, timestamps or content.
The processes by which Sky ECC data was delivered to the court were neither transparent nor verifiable, the court was told. The data files had not been certified with digital fingerprints, file hashes or digital signatures — standard methods for verifying whether evidence has been tampered with.
Defence seeks access to raw data
The defence requested access to the raw, intercepted Sky ECC data and information about the chain of custody of the evidence, but these have not been provided to the court by police to date.
"There are problems and we need to establish the reliability of the data. We asked for the raw data and an explanation from police about the chain of custody, but ultimately the court decided not to allow that," Reisinger said.
The public prosecutor disputed Campbell's independence, noting that he had previously served as an expert witness in cases against drug gangs using the encrypted EncroChat network and had drawn up joint reports with a forensic expert from the British National Crime Agency.
The court said it would take Campbell's findings into consideration, but saw no reason to postpone proceedings for further expert investigation into the reliability of the data.
Broader context: Italy and Spain also question Sky ECC evidence
The hacking operation on Sky ECC gave police agencies real-time access to messages between members of organised criminal networks in 2020. This occurred via a so-called man-in-the-middle server connected to the Sky ECC infrastructure in the OVH data centre in Roubaix, France, to intercept messages and encryption keys.
In March 2021, approximately 1,600 Belgian law enforcement officers conducted raids on locations linked to drug trafficking, money laundering and bribery, after police had infiltrated Sky ECC servers in France and decrypted "hundreds of millions" of encrypted messages.
The reliability of Sky ECC evidence is now being questioned elsewhere too. The provincial court in Valencia freed fourteen suspects last week after ruling that the public prosecutor could not rely on digital evidence unless the defence had access to the raw intercepted Sky ECC data. An Italian court ordered the prosecutor separately to make raw interception data available to suspects so they could independently verify its reliability.
The case against Nordin El Hajjioui continues tomorrow.
Source: Computer Weekly