Berlin Court Rules EncroChat Evidence Inadmissible – Implications for Europe
Berlin Regional Court has declared surveillance evidence obtained by French authorities via the EncroChat encrypted network inadmissible in a drugs case. The ruling calls into question the legality of millions of intercepted messages across Europe.
Berlin Regional Court: EncroChat data from France not usable as evidence in German criminal proceedings
Berlin Regional Court has ruled in a drug trafficking case that messages intercepted by French investigators via the encrypted mobile network EncroChat may not be used as evidence in German courts. As Computer Weekly reports, the judgment of Germany's largest criminal court calls into question fundamental assumptions about the cross-border exchange of surveillance data within the European Union.
Background: European investigation operation against encrypted communications
EncroChat was one of several encrypted communication networks that European law enforcement authorities infiltrated from 2020 onwards. French and Dutch police breached EncroChat servers at the OVH data centre in Roubaix (France) and in doing so captured messages from approximately 4,600 German users as well as tens of thousands of other users in other countries. The three-year investigation resulted in 6,500 arrests worldwide and the seizure of almost 900 million euros in cash and assets.
In total, around 120 million messages were intercepted. Whether this data volume can continue to be lawfully used as evidence in Germany and other European countries remains open following the Berlin court's ruling.
Core issue of judgment: data was collected on German soil
A large criminal chamber of Berlin Regional Court, composed of five judges, established in an oral ruling in December that French investigators had not obtained the EncroChat data from a central server in France, contrary to earlier assessments. Instead, the data was collected directly from the devices of users on German territory.
Under German law, German prosecutors would have been obliged to obtain judicial authorisation in Germany for the use of the French-obtained data. However, this did not occur. Presiding Judge Kristin Klimke established that a German court would not have authorised the surveillance operation under German law in any case, because the degree of suspicion did not meet the required threshold. Furthermore, it had not been demonstrated that the information could not have been obtained through less intrusive methods.
CJEU decision: Article 31 of the EIA Directive also protects citizen rights
The Berlin ruling was preceded by preliminary reference questions to the European Court of Justice. The Court found that France should have formally notified Germany under the European Investigation Order (EIO) Directive before EncroChat phones were tapped on German soil. Germany would then have had the opportunity to raise objections within 96 hours.
Furthermore, the CJEU established that Article 31 of the EIA Directive protects not only the sovereignty of Member States but also the rights of affected telecommunications users. Thus the Luxembourg court contradicted an earlier decision by the German Federal Court of Justice, which had treated Article 31 exclusively as a provision serving state interests.
Principle of mutual recognition insufficient
Berlin Regional Court drew the conclusion from the CJEU ruling that the principle of mutual trust between EU Member States in judicial cooperation does not mean that Germany may automatically use data obtained by France. The court remains obliged to examine the lawfulness of the foreign measure against the standards of German law.
Pan-European dimension: France coordinated an EU-wide operation
In a further legally significant finding, Judge Klimke characterised the EncroChat operation not as a purely French police action but as a joint European operation involving several EU Member States. France had monitored not only around 300 French EncroChat users but had collected data on all European users of the network. Although France had notified its partner countries in advance, it failed to comply with the formal procedures prescribed by EU law. The notification should have included concrete details about target persons – telephone numbers, IP addresses or email addresses – as well as their identity.
Defence counsel sees far-reaching consequences
For defence lawyer Christian Lödden, the ruling has considerable practical scope. The Berlin judgment fundamentally calls into question previous assumptions that surveillance evidence from one EU Member State could be automatically used in other Member States, Lödden told Computer Weekly. The decision is also likely to influence future prosecutions in which authorities breach encrypted communication systems and wish to share the data obtained internationally.
The Berlin proceedings were also based on documents disclosed by the British National Crime Agency in the context of EncroChat prosecutions in the United Kingdom – an indication of the breadth of international cooperation whose legal foundations the court has now, for the first time, fundamentally called into question.
Source: Computer Weekly