Leon Francis Atkinson & Ors v R [2021] EWCA Crim 1447

[2021] EWCA Crim 1447

Case No 202102323 B2, 202102324 B2, 202102326 B2, 202102329 B2, 202102331 B2, 202102333 B2, 202102347 B2, 202102348 B2, 202102351 B2, 202102355 B2 and 202102357 B2

IN THE COURT OF APPEAL (CRIMINAL DIVISION)

Venue ON APPEAL FROM the Crown Court at Manchester

The Hon. Mr Justice Dove

T20200247, T20207228, T20207269, T20207281, T20207287, T20207331, T20200219, T20200221, T20200222, T20207153, T20207221, T20207225, T20207237 and T20207299

Venue Royal Courts of Justice, Strand, London, WC2A 2LL

Date 07/10/2021

Before

THE VICE-PRESIDENT COURT OF APPEAL (CRIMINAL DIVISION)

(LORD JUSTICE FULFORD)

MR JUSTICE MURRAY

MR JUSTICE WALL

Between

Leon Francis ATKINSON, Nasar AHMED, Ian OGDEN, Kane O'KEEFE, Adam Richard MARSDEN, Gregory BELL, Nathan POWELL, Nathan POWELL, Nathan POWELL, Ryan ATHERTON, Ricardo LARAGIONE and Ryan DENTONAppellants

REGINARespondent

Mr Csoka QC, and Mr Cook (instructed by Potter Derby Solicitors) for Appellants Ian OGDEN

Imran Shaffi QC (instructed by Middleweeks Solicitors) for Appellants Nasar AHMED

Mr Kinnear QC, Mr Payne and Mr Langhorn (instructed by The Crown Prosecution Service) for Respondent

Hearing Hearing dates: 25 and 26 August 2021

Approved Judgment

[1]This is an interlocutory appeal under section 35(1) of the Criminal Procedure and Investigations Act 1996 (“CPIA”). Pursuant to section 37 CPIA the reporting of these proceedings is prevented until the conclusion of these trials, save for specified basic facts such as the name of the accused and the offences, unless this court or the Crown Court orders that the provisions do not apply. The Crown Prosecution Service (“CPS”) is to inform the Court of Appeal Office when the proceedings in the Crown Court as regards these two operations have concluded to facilitate the publication of this judgment. Dove J’s judgment should be made publicly available at the same time, via the judicial website. In accordance with the terms of the Order issued today, the present judgment and Dove J’s judgment are to be made available to the judges, prosecuting authorities and defendants (along with their representatives) in other relevant proceedings in which these, or linked, issues potentially arise (restricted to use in those proceedings).

[2]The appellants are due to stand trial as defendants in connection with two operations. The defendants charged in Operation Embossed are Nasar Ahmed, Leon Francis Atkinson, Romiz Ahmad, Nathan Powell, Abdul Ghafar, Craig O’Brien, Ryan Charles Denton and Adam Richard Marsden. The defendants charged in Operation Estevan are Ryan Atherton, Gregory Bell, Nathan George Hodson, David John Walley, Christopher Watson, Kane O’Keefe, David Williams, Ricardo Larigione and Ian Austen Ogden. Operation Embossed involves two counts of conspiracy to supply a controlled drug of class A contrary to section 1(1) of the Criminal Law Act 1977 (counts 1 and 2) and a single count of conspiracy to transfer criminal property contrary to section 1(1) of the Criminal Law Act 1977 (count 3). Ghafar entered guilty pleas and proceedings against O’Brien were discontinued. We note that Romiz Ahmad has failed to lodge a form NG. Operation Estevan involves three counts of conspiracy to supply a controlled drug of class A contrary to section 1(1) of the Criminal Law Act 1977 (counts 1 – 3), three counts of conspiracy to supply a controlled drug of class B contrary to section 1(1) of the Criminal Law Act 1977(counts 4 – 6), a single count of acquiring, using or possessing criminal property contrary to section 329(1) of the Proceeds of Crime Act 2002(count 7)and a single count against Ogden alone of intentionally assisting or encouraging an offence contrary to section 44(1) of the Serious Crime Act 2007(count 8). Walley pleaded guilty to counts 1 and 2. We note that Hodson and Watson have failed to lodge a form NG.

[3]These prosecutions are centred on the suggested historic use by criminals of a system called EncroChat. This provided a means – aimed most particularly at those involved in serious and organised crime – of sending and receiving text messages which were not stored on any server comprising the EncroChat system and which were encrypted in transit. It is the Crown’s case that the majority, if not the entirety, of the users of this system were involved in criminality, frequently involving illegal drugs. The users communicated via encrypted telecommunications devices/handsets (commonly called “Encros”). It was suggested there were in the order of 9000 such devices in use in the United Kingdom.

[4]On various dates between 18 January 2021 and 19 July 2021at Manchester Crown Court, Dove J conducted a preparatory hearing in accordance with sections 29 – 34 CPIA. On 19 July 2021, the judge ruled that evidence relied on by the prosecution in relation to this system was admissible. The principal points advanced by the appellants and rejected by the judge were that:(i) The Crown relied on inadmissible hearsay evidence;

(ii) The prosecution could not prove that the unencrypted messages/JPEGs (viz. a format for compressing image files) were stored on and exfiltrated from the handsets; instead, it was suggested the possibility could not be discounted that the EncroChat material was extracted during transmission (“the alternative hypothesis”) (it was common ground that the messages were inadmissible if exfiltrated in transmission);

(iii) paragraph 2 of Schedule 3 of the Investigatory Powers Act 2016 Act (“IPA”) did not permit the use in evidence of stored communication which were obtained by interception-related conduct; and

(iv) the Targeted Equipment Interference warrant (“TEI” warrant) did not cover the conduct of the National Crime Agency (“NCA”) and the French authorities as this amounted to obtaining material in bulk (as opposed to targeted equipment interference).

[5]Before this court, the appellants appeal against the ruling of 19 July 2021 by leave of the judge.

The Facts (an overview)

[6]As indicated in outline above, the present proceedings in the United Kingdom were the result of covert investigations into the activities of organised crime groups (“OCG/OCGs”) and their involvement in the supply of substantial quantities of controlled drugs. The NCA had been concerned from at least 2018 about the use by OCGs of the EncroChat system, and officials sought to obtain access to the communications that it facilitated. It is the prosecution case that those involved used the Encro handsets to arrange the purchase, transportation and sale of multi-kilogram quantities of drugs. These devices and the EncroChat encrypted messaging system enabled those involved to engage in this criminality with seeming impunity, believing that the relevant law enforcement agencies were unable to gain access to the messages and JPEGs passing between them. In late 2019, however, the French authorities identified an EncroChat server at a data centre at Roubaix, and this enabled them to obtain images of the relevant EncroChat servers for the purpose of analysis, under the supervision of a magistrate at the Lille Regional Court. In due course, a technical capability (viz. a malware implant which was surreptitiously installed on each handset by masquerading as a software update from the EncroChat server) was deployed by the French and Dutch law enforcement agencies. The prosecution authorities in the United Kingdom were thereafter provided with data which included a sizeable quantity of EncroChat messages, once the security and privacy settings on the handsets had been compromised. These revealed the scale and detail of the criminal “businesses” operated by the appellants.

[7]Those charged in Operation Embossed are said to have been concerned in the supply of drugs in the Northeast of England. It is the prosecution case that Ahmed sourced the cocaine and controlled the activities of Ghafar (a courier who moved the drugs and the proceeds). It is alleged that Ghafar handed over the cash that was generated to Ahmad and others. Atkinson and Marsden are alleged to have been supplied with drugs by Ahmed. Powell and Denton acted as distributors.

[8]Operation Estevan involves the allegation that between December 2019 and June 2020 several hundred kilograms of cocaine, heroin, MDMA, amphetamine, cannabis and ketamine were distributed by the relevant appellants to various communities in Great Britain. It is the prosecution case that Bell was the main organiser and controller of this OCG, and that O’Keefe and Williams were his couriers. Ogden is said to have been a close working associate of Bell; he coordinated the sale and purchases of class A and B drugs, whilst operating independent drug supply lines. Atherton and Larigione are alleged to have been involved in storing cash and/or drugs on behalf of the OCG.

[9]The judge was provided with an agreed bundle of documents (the admissibility of which was not challenged for the purposes of the preparatory hearing), and he heard evidence from three prosecution witnesses, namely Mr Harrison (an employee at the National Technical Assistance Centre, Evidential Stored Data Department), Ms Sweeting (an investigating officer with the NCA) and Mr Shrimpton (a technical officer with the NCA). The Crown relied on, and the appellants disputed the admissibility of, the hearsay evidence of Mr Decou, a lead investigator from the French Gendarmerie working within the C3N (a unit dealing with digital crime). He had served in the Gendarmerie for 20 years and had been with C3N for two years. The appellants challenged the entirety of Mr Decou’s evidence, and in particular the preliminary investigation summary minutes of the 2 April 2020, 3 April 2020 and 26 June 2020, an investigation report dated 17 September 2020 (in which Mr Decou answered a series of questions) and Mr Decou’s witness statement dated 25 September, along with a transcript of an interview conducted with him on the same day. There was objection, additionally, to the introduction of notes made by Ms Sweeting, as recorded in her witness statement and allegedly confirmed by Mr Decou, as to what the latter told Ms Sweeting at a Europol briefing that took place between 19 and 21 February 2020. It is to be noted that the appellants challenge the accuracy and reliability of the evidence that it is suggested was provided by Mr Decou.

[10]As to the relevant chronology, on 22 January 2020 representatives from the NCA (including Ms Sweeting) and a Mr Jakura from the CPS were briefed at the Eurojust premises by French and Dutch prosecutors. The latter had formed a Joint Investigation Team (“JIT”) which was tasked with undertaking the investigation and exploitation of the EncroChat system. The French authorities explained at this meeting that they were developing a capability to enable them to collect data from the EncroChat handsets. The Gendarmerie declined to disclose the details of how the implant operated and asserted it was a French military secret. The NCA and the CPS thereafter discussed whether the material was to be characterised as Targeted Interception (“TI”) or Targeted Equipment Interference (“TEI”). By late January 2020, Ms Sweeting had made contact with Mr Decou to resolve whether the material was TI or TEI. Between 19 and 21 February 2020, Ms Sweeting and her colleagues Mr Shrimpton, Mr Wilmott and Mr Belton attended the three-day briefing workshop on the technique utilised to penetrate the EncroChat system at Europol. The JIT were conducting their work under the name Operation Emma and the NCA work, which had been called Project Venetic, was renamed Operation Venetic.

[11]The prosecution case is that the JIT explained that there were two stages to the exploitation of the EncroChat system:(i) Stage 1 – an implant was deployed to the devices (sending and receiving) in order to gather stored data including information such as usernames, handles, passwords, chat messages and notes (this was not challenged by the defence).

(ii) Stage 2 – the implant gathered messages from the storage database on the handsets (sending and receiving) on a continuing basis (this was challenged by the defence). (The JIT indicated that a European Investigation Order (“EIO”) would be required to obtain the data from the devices).

[12]The above explanation was captured by Ms Sweeting on her laptop in the form of a draft email (thereby enabling correction and verification), which was shown to Mr Decou. She told him that this information was required to obtain the necessary legal authority in the United Kingdom. Ms Sweeting gave evidence that Mr Decou read the explanation and confirmed that it accurately reflected the nature of the technique. The exact text which Mr Decou endorsed was:

“Stage 1 (historical data collection) An implant within an Application will be placed on all EncroChat devices worldwide. This will be placed on devices via an update from the update server in France. On deployment, this implant will collect data stored on the device and transmit this to French Authorities. This will include all data on the devices such as identifiers (e.g. IMEI and usernames), stored chat messages and notes (list not exhaustive). The implant will then remain installed on the device to enable stage 2. Stage 2 (forward facing collection) Communications (chat messages) on the EncroChat devices will then be collected on an ongoing basis. The messages are collected when they have been stored on the EncroChat devices. Simultaneously the messages are sent via the chat server but they will not be collected in transmission, they will be collected from the devices.”

Stage 2 (forward facing collection)

[13]This email was sent and Ms Sweeting told her colleagues that “the Gendarmerie has read and confirmed that the technical description is a true reflection of the activity”. Ms Sweeting, in the company of the other United Kingdom delegates, completed a note of the Europol meeting which she had been preparing during the meeting. They all endorsed the note as a record of what they had learnt during the discussion, as follows:

“This document includes: 1. NCA summary and next steps 2. Response to the requirements set by Gold 3. JIT/Europol formal conclusions: 1. NCA SUMMARY There will be two stages to the exploitation of the EncroChat devices. i) Historic data dump – when implant is deployed, an image of all the devices will be generated. This will be an image of the database, to include usernames/handles, chat messages and notes (not exhaustive) ii) Forward facing collection of messages – messages will then be gathered on an ongoing basis as they are stored on devices. Conclusion 1 – This amounts to Targeted Equipment Interference so a TEI Authority is required. Description of the activity was agreed with the Gendarmerie on 21/02/2010 (see below) which indicates that this activity amounts to Targeted Interference under IPA 2016 and not Targeted Intercept. This has been shared with NCA Legal (Note – the Scotland Lord Advocate needs to be consulted)”

There will be two stages to the exploitation of the EncroChat devices. i) Historic data dump – when implant is deployed, an image of all the devices will be generated. This will be an image of the database, to include usernames/handles, chat messages and notes (not exhaustive) ii) Forward facing collection of messages – messages will then be gathered on an ongoing basis as they are stored on devices. Conclusion 1 – This amounts to Targeted Equipment Interference so a TEI Authority is required. Description of the activity was agreed with the Gendarmerie on 21/02/2010 (see below) which indicates that this activity amounts to Targeted Interference under IPA 2016 and not Targeted Intercept. This has been shared with NCA Legal (Note – the Scotland Lord Advocate needs to be consulted)”

[14]It is important to observe that the prosecution’s case was that, along with his colleagues, Mr Shrimpton’s understanding of how the JIT’s technique was to operate developed as the meeting progressed, and at an early stage he made a note indicating clarification was needed as to whether it involved an intercept (viz. were the messages being gathered in transmission). In due course this possibility was discounted.

[15]Following their meetings with the JIT, the NCA proceeded on the basis that the material obtained from the exploitation of the devices would amount to TEI. On 3 March 2020, the NCA applied to the Investigatory Powers Commissioner’s Office (“IPCO”) for a TEI warrant pursuant to sections 99(1)(a) of the IPA. This was granted on 5March 2020 by Sir Kenneth Parker, a judicial commissioner at IPCO.An EIO for the data retrieved from the EncroChat devices was drafted by the CPS and sent to the French authorities who confirmed receipt of the document on 12 March 2020. The box for “interception of telecommunications” was left blank; it was indicated that there were approximately 9000 United Kingdom users, most (if not all) of whom were criminals; and that the devices underpinned serious and organised crime.

[16]On 24 March 2020, there was a further TEI application made by the NCA, reflecting the JIT’s proposal to interfere with the EncroChat handsets, including those in the UK, by installing an implant on the devices through an update from the EncroChat update server. The implant was to collect data stored on the device and to transmit it to the French authorities. It would thereafter enable the second stage of the exploitation, namely the ongoing collection by the French authorities of material, such as chat messages, as stored on the EncroChat devices. This application for a TEI warrant was approved by Sir Brian Leveson, the Investigatory Powers Commissioner, on 26 March 2020.

[17]The court in Lille issued successive warrants between January and March 2020. The data capture by Operation Emma commenced on 1 April 2020.

[18]Once the French authorities had received the EIO,they informed the NCA on 1 April 2020 of the handling conditions for the information that the JIT were proposing to share. It was explained that the use of the shared data was restricted whilst live access continued (e.g. Stage 2) but once the EncroChat server had been shut down, the information could be used in judicial proceedings. On 3 April 2020, the NCA received the first set of data from the exploitation via Europol’s Large File Exchange. It was processed by Mr Shrimpton and “packages” were sent to various law enforcement agencies.

[19]On 12 May 2020, the NCA undertook a review of the TEI warrant as the CPS had raised concerns as to the legal basis upon which it had been obtained. Further briefing material was provided and counsel instructed by the CPS (Lord Anderson of Ipswich) concluded that the strength of the evidence was such that it was more likely than not that a court would uphold the lawfulness of the warrants that had been obtained.

[20]On 12 and 13 June 2020, the administrators of the EncroChat system were alerted to the attack upon their systems. They issued a warning to their users in which they advised them immediately to “power off” the devices and dispose of them. The data collection by the French authorities subsequently ended on 1 July 2020.

[21]A further request for information in relation to the data collection was made on 1 September 2020 to the French investigator, Mr Decou. He responded on 17 September 2020. A subsequent EIO was sent on 23 September 2020 seeking clarification of certain matters and a formal witness statement was taken from Mr Decou on 25 September 2020, and there is a transcript of the interview with him on that day. There were a number of matters about which he declined to comment, stating that they related to national defence secrecy. The Submissions in the Crown Court and Dove J’s Ruling 22. Introduction

The Submissions in the Crown Court and Dove J’s Ruling

[22]As already rehearsed, the principal arguments were as follows (see [4] above):(i) Hearsay evidence: it was submitted that certain hearsay evidence on which the prosecution relied was inadmissible;

(ii) The EncroChat material: it was submitted that the entirety of the EncroChat material was inadmissible, essentially on three bases: (a) As a question of fact, the prosecution could not prove that the unencrypted messages/JPEGs were stored on and exfiltrated from the handsets; instead, it was suggested the possibility could not be discounted that the EncroChat material was extracted during transmission (“the alternative hypothesis”); (b) Paragraph 2 of Schedule 3 of the IPA precludes the admission of the EncroChat text messages; and (c) The TEI warrantry was unlawful because the obtaining of the EncroChat messages amounted to bulk interference which could only lawfully occur pursuant to a warrant under Part 6 of the IPA. Thus, the purported authorisation obtained by the NCA did not render the actions of the French authorities lawful. The Hearsay Evidence

[23]The judge determined, as a preliminary matter, the prosecution’s applications to adduce the following hearsay evidence: The hearsay evidence from Mr Decou(i) The following evidence from Mr Decou: the preliminary investigation summary minutes of the 2 April 2020, 3 April 2020 and 26 June 2020, the investigation report dated 17 September 2020 and his witness statement of, and the transcripts of an interview with him on, 25 September 2020; and Ms Sweeting’s account of Mr Decou’s confirmation of her notes

(ii) Mr Decou’s confirmation of Ms Sweeting’s notes as recorded in her witness statement (see [9] above).

[24]The first application (viz. (i) above) had been made pursuant to section 116(1) and (2)(c) of the Criminal Justice Act 2003 (“CJA”) on the basis that Mr Decou was outside the United Kingdom, and it was not reasonably practicable to secure his attendance. The relevant information was set out in the witness statement from Holly Gallagher, the CPS Liaison prosecutor, dated 11 November 2020. It was submitted by the prosecution that Mr Decou was clearly a reliable witness who occupied a responsible law enforcement position as a senior member of C3N (the Centre for Combating Digital Crime) within the Gendarmerie. He was well placed to understand and communicate information as to how the implant operated and consequently it was submitted that his evidence did not involve multiple hearsay. The prosecution maintained that Mr Decou’s evidence was relevant, in that he confirmed that the data came from the handsets and not the server.

[25]The second application (viz. (ii) above) had been made pursuant to section 114(1)(d) of the CJA and it was argued that it was in the interests of justice for the material to be admitted. The prosecution suggested that the statement had substantial probative value in relation to the factual issues in the proceedings; there was other evidence available in relation to the question of how the implant operated; the material which was the subject of the application was recorded contemporaneously by Ms Sweeting, a highly reliable witness; and there was limited prejudice to the defence. Again, it was submitted by the Crown that this was not multiple hearsay and it should be admitted as part of the evidence to be considered during the preparatory hearing.

[26]In opposing the applications, the appellants relied on several items of documentary evidence which they submitted were inconsistent with the prosecution’s account as to how the French implant operated. It was argued that(i) the notes taken from the Eurojust briefing between 19 and 21 February 2020,

(ii) the notes of an Operation Emma conference call on 2 March 2020,

(iii) an email exchange between the French lead prosecutor and Mr Jakura dated 4 March 2020,

(iv) letters provided by the French lead prosecutor, dated 1 April 2020 and 6 July 2020 and

(v) notes from the Eurojust meeting on 29th May 2020, all demonstrated inconsistencies in the prosecution’s case (see [44] below). The appellants did not accept the Crown’s contention that Mr Decou had not said that messages had been intercepted from the server. They submitted that, to the contrary, he declined to answer when asked about this issue.

[27]The appellants, additionally, emphasised that Mr Decou was not a technical officer within C3N and therefore his understanding and evidence was dependent upon the evidence of others. As a result, the additional requirements as regards multiple hearsay contained in section 121 of the CJA ought to be applied to this material. Section 121 provides:

“Additional requirement for admissibility of multiple hearsay (1) A hearsay statement is not admissible to prove the fact that an earlier hearsay statement was made unless— (a) either of the statements is admissible under section 117, 119 or 120, (b) all parties to the proceedings so agree, or (c) the court is satisfied that the value of the evidence in question, taking into account how reliable the statements appear to be, is so high that the interests of justice require the later statement to be admissible for that purpose. (2) In this section ‘hearsay statement’ means a statement, not made in oral evidence, that is relied on as evidence of a matter stated in it.”

[28]It was submitted that Ms Sweeting had been economical with the truth when she outlined the circumstances in which Mr Decou had confirmed her note setting out the technical description of the implant. The appellants argued that the evidence did not fulfil the requirements of Criminal Procedure Rule (“CrPR”) 19.9. (i.e. the rule which governs an application to withhold information from another party).

[29]As regards the material provided directly by Mr Decou (see [23(i)] above), the judge ruled that the requirements of section 116(1) and (2)(c) of the CJA (see [48] below) had been satisfied. The authorities had effectively exhausted all means of securing Mr Decou as a live witness without succeeding in doing so. Applying the leading case of R v Riat

[2012] EWCA Crim 1509

;

[2013] 1 WLR 2592

, the judge was satisfied that the witness was credible. He did not consider that the inconsistencies on which the appellants relied undermined the reliability of this evidence such that it should not be admitted, nor did he accept that there were any significant internal inconsistencies, as suggested, in Mr Decou’s evidence which precluded its admission. The judge rejected the suggestion that the material comprised multiple hearsay: given the prominence of Mr Decou in relation to the French authority’s actions and his role in the investigation, the judge was satisfied that he had direct knowledge of the operation of the implant. No submissions had been advanced to the effect that the evidence should be excluded under section 126 of the CJA. In relation to section 78 of the Police and Criminal Evidence Act 1984 (“PACE”), the judge ruled that it was important to have regard to the significance of the evidence that Mr Decou gave as part of the prosecution case. The prosecution had effectively advanced a circumstantial case as to how the implant worked in the absence of any detailed technical explanation from the JIT. Mr Decou’s evidence came from the authorities who were directly responsible for the exploitation of the EncroChat system and, therefore, whilst his evidence was not the only material as to how the implant operated, it was clearly an important part of the prosecution case.

[30]The judge noted that caution needed to be exercised before admitting hearsay evidence. He also bore in mind that the appellants had not had the opportunity to test Mr Decou’s evidence through cross-examination. Having weighed the relevant factors, the judge was satisfied that it was appropriate for the hearsay evidence from Mr Decou to be admitted. He concluded that an appropriate safeguard for the appellants would be through the judicial directions that could be given to the jury.

[31]The judge concluded that CrPR 19.9 did not have any significant bearing on the decision to be reached regarding the admission of his evidence.

[32]In relation to Ms Sweeting’s evidence, the judge noted that the importance of the material had to be balanced against the informal way in which the record had been made and the lack of confirmation as to what had been said. The judge indicated that, having seen Ms Sweeting testify, he concluded she was an honest, straightforward and reliable witness. He ruled that her testimony provided a reliable basis for the decision he needed to make and that he accepted her explanation as to why Mr Decou was not asked to verify his confirmation of her note. The judge ruled that it was in the interests of justice for the evidence to be admitted and it would not hinder a fair trial. The EncroChat Material As a question of fact, the prosecution could not prove that the data was stored on the device, nor could they prove that the unencrypted messages were exfiltrated from the handset devices

[33]As the judge observed, based on his conclusions as to the admissibility of the hearsay evidence considered above, the answer to the factual question as to whether the EncroChat messages were taken from storage on the devices was dependent on all of the evidence, including that of Mr Decou and Ms Sweeting’s account of his confirmation of her note as to how the implant worked.

[34]The defendants contended that the court could not be sure that the implant operated in the way in which the prosecution described, and they advanced an alternative hypothesis (viz. that the implant exfiltrated the messages from the server), which it was suggested was credible and plausible. It was submitted that there were inconsistences in the available documentation and the court could not be sure that the prosecution’s explanation of what occurred was correct. The prosecution maintained that their hypothesis as to how the implant worked was supported by the evidence. Mr Shrimpton, whilst accepting that the appellants’ theory was technically feasible, was confident that the messages came from the EncroChat devices.

[35]The judge found Mr Shrimpton to be an accurate and reliable witness, particularly bearing in mind that the appellants’ contention was no more than a speculative theory which was unsupported by any evidence. As already rehearsed, the judge determined that Ms Sweeting was a credible witness upon whom reliance could be placed and there was no reason to doubt the accuracy or reliability of her evidence. Mr Harrison, as with Mr Shrimpton, had assisted the court in the areas of his expertise, to the best of his ability. Although parts of Mr Harrison’s evidence were inaccurate, he had accepted his mistakes when they were pointed out to him. In this context, the judge concluded that Mr Shrimpton had a significant depth of knowledge in this field which provided a solid basis for the decisions the judge was called on to make.

[36]To reiterate under this heading, the judge was sure the implant worked in the following way: the data was received in two stages: “a stage 1 which comprised the collection of historic data stored on the phone since the last burn date together with forward facing stage 2 data collected on an ongoing basis, and collected both as to sent and received messages exfiltrated again from storage on the devices” (see Dove J’s judgment at [143]). Clear text messages were taken from “sending” devices prior to encryption and transmission and from “receiving” devices after receipt and decryption. The judge observed that the prosecution had established, from a variety of sources, a powerful and coherent case that this was how the EncroChat messages were obtained. First, there were the notes and records compiled by Ms Sweeting and endorsed by her colleagues as to how the implant worked, together with the oral evidence from Ms Sweeting and Mr Shrimpton in relation their attendance at the various relevant meetings and their final understanding of the way the implant operated. Second, the data obtained at the Europol meeting between 19 and 21 February 2020 as reflected inMs Sweeting’s notes. Third, the expert evidence from Mr Shrimpton in relation to the experiments he conducted, which supported the conclusion that the data came from the devices rather than the servers. This data included – but was not limited to – the inclusion of data as to when the message had been read and data for the same message from both the sending and receiving device with different message IDs. Fourth, notwithstanding the fact that Mr Decou’s evidence was hearsay and needed to be treated with caution, it was essentially consistent with the other elements of the prosecution’s case. Although some of the documents were inconsistent with the Crown’s case, viewed overall and bearing in mind certain material from external sources (such as the order from the Lille Court dated 28 May 2020 and the correspondence from the Dutch prosecution dated 27 March 2020) (see [67] below), there was persuasive support for the assertion that the EncroChat material had been exfiltrated from the devices.

[37]In conclusion on this issue, therefore, the judge was unpersuaded that the prosecution case was undermined by the defence hypothesis. None of the important details distinguishing the defence hypothesis from the prosecution’s case were explicitly demonstrated in the documentation; moreover, the formulation of the defence hypothesis introduced considerable complexity in the operation of the process. In light of the decision of the Court of Appeal in R v A, B, D and C

[2021] EWCA Crim 128

;

[2021] 2 WLR 1301

and the conclusions on the facts which the judge reached, the appellant’s arguments under this heading failed. The Grounds of Appeal and Analysis39. The Hearsay Evidence

40. Mr Shrimpton

[38]Although it was not the subject of formal submissions to the judge and there was no judicial ruling, as a discrete issue on this appeal the judge is criticised for relying on hearsay evidence from Mr Shrimpton (a technical officer with the NCA). It is pointed out that there had been no application to introduce hearsay evidence from this witness, who was able, as he said in re-examination, to give evidence about the briefing between 19 and 21 February 2020 which enabled those present “to gain a technical understanding (from the French authorities) of what they were doing and to discuss any issues arising around getting the data and how you process the data”. Mr Csoka Q.C., who argued this appeal on behalf of all the appellants with considerable skill, objected to Mr Shrimpton giving evidence as to whether what he saw on Ms Sweeting’s laptop accorded with what he had heard at the three-day meeting. In any event, it is argued that it was not Mr Shrimpton’s testimony that he had been told at the meetings that the messages were collected from the devices; indeed, it is suggested that his evidence was that he did not hear any explanation at the relevant meetings that accorded with Ms Sweeting’s account.

The Grounds of Appeal and Analysis

[39]We consider these contentions are without sustainable foundation. It was agreed that the bundles of documents before the court were all admissible on the various issues that had been raised. Mr Shrimpton was called with the leave of the judge as an expert witness (his report was served on 28 April 2021), albeit he also gave evidence concerning the relevant history (e.g. as regards aspects of the history of the NCA’s engagement with the JIT). On 15 June 2021, Mr Kinnear Q.C. for the Crown, to whom we are grateful for his notably clear submissions, dispensed with examination-in-chief and tendered Mr Shrimpton for cross-examination, having dealt with various conventional formalities. Mr Csoka then raised in significant detail the content of the discussions that had occurred during some of the relevant meetings, particularly as reflected in the notes that had been taken by Mr Shrimpton and others. Mr Shrimpton was asked how he interpreted the notes that he and others had made. Although during re-examination Mr Shrimpton suggested that he understood that the JIT’s technique would operate as described in Ms Sweeting’s summary, the burden of his evidence in this context had occurred during cross-examination. We reiterate that he was asked extensively by Mr Csoka as to his understanding of the way in which Stage 2 was to operate, with these questions being based to a significant extent on the contemporaneous notes that had been made during the relevant meetings. Furthermore, as regards his attendance at the Europol meeting between 19 and 21 February 2020, the defence relied on the notes he then made of his understanding as to how the data was to be captured, based on what he was told, as part of the contentions advanced as to inconsistencies. Given Mr Csoka invited hearsay evidence from Mr Shrimpton during cross-examination on these issues (in the sense of asking him to give his interpretation of the explanations that were given), we consider his objection during re-examination to the introduction of this hearsay evidence was essentially specious. The parties had reached a clear, albeit implied, understanding or agreement that this hearsay evidence could be introduced without the formalities of a hearsay application (see Shah

[2012] EWCA Crim 212

). The judge clearly approved this approach. Section 114(1)(c) of the Criminal Justice Act 2003 provides that hearsay evidence is admissible if "all parties to the proceedings agree to it being admissible" and Rule 20.5 of the Criminal Procedure Rules permits significant variation to the usual necessary formal procedures regarding the introduction of hearsay evidence. There was no objection until re-examination. What amounted to a late change of approach by Mr Csoka would have been wholly unfair to the prosecution. Having adopted the line of cross-examination set out above, it was unsustainable for Mr Csoka to object to Mr Kinnear questioning in a similar manner during re-examination. This complaint is without substance.

[40]As already summarised, in relation to Mr Shrimpton’s evidence concerning the NCA Summary prepared by Ms Sweeting of the meeting of 19 to 21 February 2020 (see [13] above), there was the following exchange in re-examination:

“MR KINNEAR: I will ask it again, firstly, how does that accord with your understanding of what had been said at the meeting? MR SHRIMPTON: In line with my understanding of what was at that meeting.”

MR SHRIMPTON: In line with my understanding of what was at that meeting.”

[41]In our judgment that is determinative of Mr Csoka’s suggestion that Mr Shrimpton did not hear any explanation at the relevant meetings that accorded with Ms Sweeting’s account. He was at the meeting and he agreed with the note.

[42]We note, finally, as regards Mr Shrimpton that his factual evidence related, certainly in the main, to the work that he had undertaken in his capacity as an expert. For instance, he had been tasked with processing the data obtained from Europol, including the evidential packages for each device. He had worked on EncroChat since 2018, during which time he had analysed the server images and experimented with two devices, reverse engineering some of the apps to understand how they work and their vulnerabilities. The central criticism of his work by Mr Csoka is that it only relates to the metadata before the malware was deployed. No emulation was attempted with infected handsets or a compromised server. The hearsay evidence from Mr Decou and Ms Sweeting’s account of Mr Decou’s confirmation of her notes Mr Decou

[43]The principal attack in the Grounds of Appeal as regards the hearsay evidence under this heading concerns the explanation provided by Mr Decou as to the way the messages were retrieved. The objections to the hearsay evidence from this witness were interwoven with the general attack on reliability of the prosecution’s contention that the EncroChat material had been exfiltrated from the devices. By way of general submissions as regards Mr Decou, it is argued that the position of the defence was undermined by the lack of “any adversarial process” and particularly the absence of cross-examination of Mr Decou. It is suggested that the judge failed to recognise or address the necessary element of “manifest prejudice”. Examples of the areas in which it is suggested such prejudice existed are the absence of evidence from Mr Decou as to whether the “off-the-record encounter with Ms Sweeting ever took place”; the lack of confirmation from Mr Decou as to whether he read and understood the note that had been made; similarly, the extent of Mr Decou’s direct knowledge of the implant; whether Mr Decou had appropriate knowledge of how stage 2 was carried out; and the absence of an explanation as to why the warrants permitted exfiltration from the server, if that was not planned. It is suggested Mr Decou “was a witness who could have been determinative of the issue the learned judge had to decide”. Mr Csoka highlights questions that Mr Decou had declined to answer. It is submitted there were important areas which merited further exploration, such as whether the technical device had enabled the authorities to retrieve data from the server; when the device retrieved the data; whether the only place where Mr Decou could see the unencrypted message was on the receiving handset; if the “side meeting” with Ms Sweeting took place; the stages at which the text/content of a message could be retrieved; and his explanation for any inconsistency on this issue in his written responses.

[44]In the submissions before the judge as indicated at [26] above, there was extensive reliance on material that was suggested to be inconsistent with the prosecution’s case as regards the operation of the implant. In particular, the notes of the Eurojust meeting of 22 January 2020 indicated that the servers would be infected, and that data would be collected from the server and the handsets for all the data for the telephones used. Mr Shrimpton wrote an email on 24 January 2020 in which he suggested that the French would be using the intercept on the server and decrypting any data that passed through it. Mr Jakura observed in an email concerning a conference on 3 February 2020 that the operational plan involved “getting content of live EncroChat server”. As regards the Eurojust briefing between 19 and 21 February 2020, Mr Wilmott’s note recorded that “forward looking data will only be domestically collected in France via the server as opposed to targeting every individual device” and Mr Shrimpton noted “data sent to OVH server” (viz. a server hosted by a French company at OVH Roubaix). Ms Sweeting was present at a meeting on 25 February 2020, of which Mr Wayne John (a colleague from the NCA) made a written record. This included the following statement from Mr Moore (a further colleague) “of note the platform very aware of their network deployment will lead to significant data draw across network, potentially knocking users offline […]”. Notes were taken of an Operation Emma conference call on 2 March 2020 which included an update from France that “problems at server level concerning the technical solution for capturing data (‘the implant’)” had been solved, followed by a note that the data “will be sent from the devices from the OVH server”. The defence highlighted inconsistencies in an email exchange on 4 March 2020 between Mr Xavier Laurent (the French lead prosecutor) and Mr Jakura: an email from Mr Laurent to Mr Jakura contained the observation that they were “concerned that these elements, and namely those about the live access to the EncroChat server, might unveil some of our action plan” andMr Jakura replied, “any complementary EIO for any new EncroChat server obtained … can dispense with the information in section A in relation to the plan for live access to the EncroChat server and reflect only that France has an ongoing investigation about the EncroChat solution”. A further inconsistency relied upon by the defendants came from within the official conclusions of the Eurojust meeting of 9 March 2020, namely “once the technical phase of interception and decoding has been completed” a further meeting could be set up. Mr Laurent indicated on 1 April 2020 that the French authorities did not raise obstacles “for the data coming from the EncroChat servers live access”. The French court’s warrant of 29 April 2020 authorised the use of a “data capture device” on the server and “on the terminals and peripherals connected to the operation with this server”, entries which the judge noted did not appear, on their face, as being consistent with the prosecution’s case. The defence highlight a note of a Eurojust meeting on 29 May 2020 in which it is noted that there is “a group working on data decryption which occurs after inception and before it is disseminated”. The defence suggest that “inception” is “interception” misspelt. On 6 July 2020, Mr Laurent stated that “data has been harvested in France, due to the location of the EncroChat servers …” (albeit he referred in the following sentence to “the digital data capture of EncroChat servers and related handsets”).

[45]As to these inconsistencies which Mr Csoka submits are relevant to the admissibility of the hearsay evidence from Mr Decou,

the judge concluded:

“126. I have set out above the inconsistencies between the evidence comprised in the application and the other evidence contained with the documentary material which is relied upon by the defendants to contend that the evidence is unreliable. In the main I accept the submissions made on behalf of the prosecution in relation to these alleged inconsistencies: they are not in my view compelling for the following reasons. In so as far as they relate to observations documented prior to the meeting at Europol between 19th and 21st February 2020, they reflect the evolutionary thinking of the NCA at that time as they were beginning to learn about the detail of the French technique, which I accept was not fully clear to the NCA prior to the attendance of their delegation at that meeting. I am satisfied that the notes taken by Mr Shrimpton and Mr Wilmot were taken during the course of that meeting, but did not reflect their final understanding which was clarified and confirmed by their agreement to Ms Sweeting’s note of the conference which they endorsed at the end of the meeting. The discussions between Mr Jakura and M Laurent at various points related to Mr Jakura’s engagement in the preparation of the EIO to obtain the server images from France, and therefore reference to the servers is unsurprising and when taken in context not inconsistent with the prosecution case taken overall. The letters of response to the EOIs sent by M Laurent are not in my view significantly inconsistent with M Decou’s evidence. That is not to say that the documentary evidence is entirely free from inconsistency, and I accept the defendants’ point in relation to the minutes of the Eurojust meeting of 9th March 2020, referring to ‘the technical phase of interception and decoding’, which is difficult to reconcile with the receipt of data in clear text as a result of the operation of the implant in accordance with the prosecution case. However, taking the material as a whole, I do not consider that the issues raised by the defendants render the reliability of the evidence such that it should not be admitted. Nor do I consider that there are any significant internal inconsistencies in M Decou’s evidence which would also preclude its admission for essentially the reasons given by the prosecution set out above.”

[46]In our judgment, these were carefully reasoned conclusions on the suggested inconsistencies which the judge was fully entitled to reach. As Mr Kinnear submitted, the NCA’s understanding of the approach to be taken to the extraction of this data evolved over time. Dove J properly concluded that the notes made by various individuals while meetings were in progress and the contents of emails that were exchanged during the ongoing discussions did not necessarily reflect the technical approach as finally adopted. As to references to material on the servers, it is to be emphasised that C3N had their own server and, moreover, access to the EncroChat servers was necessary to upload the implant that facilitated later extraction from the handsets. There was no inconsistency between members of the JIT working on data decryption after “inception” and the technical solution which the judge concluded was ultimately utilised. The judge highlighted each of the main suggested inconsistencies, he summarised the rival contentions and he applied a logical and sustainable approach to the conclusions he reached on this issue.

[47]Against that background, we turn to the way the judge addressed the steps, as identified in R v Riat

[2012] EWCA Crim 1509

;

[2013] 1 WLR 2592

(per Hughes LJ at [7]):

“The statutory framework provided for hearsay evidence by the 2003 Act can usefully be considered in these successive steps. (i) Is there a specific statutory justification (or ‘gateway’) permitting the admission of hearsay evidence: sections 116–118? (ii) What material is there which can help to test or assess the hearsay: section 124? (iii) Is there a specific “interests of justice” test at the admissibility stage? (iv) If there is no other justification or gateway, should the evidence nevertheless be considered for admission on the grounds that admission is, despite the difficulties, in the interests of justice: section 114(1)(d)? (v) Even if prima facie admissible, ought the evidence to be ruled inadmissible: section 78 of the Police and Criminal Evidence Act 1984 (‘PACE’) and/or section 126 of the 2003 Act? (vi) If the evidence is admitted, then should the case subsequently be stopped under section 125?”

[48]The prosecution’s application was made pursuant to section 116 of the CJA, which provides: “Cases where a witness is unavailable(1) In criminal proceedings a statement not made in oral evidence in the proceedings is admissible as evidence of any matter stated if— (a) oral evidence given in the proceedings by the person who made the statement would be admissible as evidence of that matter, (b) the person who made the statement (the relevant person) is identified to the court's satisfaction, and (c) any of the five conditions mentioned in subsection (2) is satisfied.

(2) The conditions are— […] (c) that the relevant person is outside the United Kingdom and it is not reasonably practicable to secure his attendance; […]” (a) oral evidence given in the proceedings by the person who made the statement would be admissible as evidence of that matter, (b) the person who made the statement (the relevant person) is identified to the court's satisfaction, and (c) any of the five conditions mentioned in subsection (2) is satisfied. (c) that the relevant person is outside the United Kingdom and it is not reasonably practicable to secure his attendance;

[49]From an early stage, the French authorities indicated to the CPS and the NCA that they did not regard the request for Mr Decou to give oral evidence as being reasonable and that it was refused. The President in Charge of Investigations at the court in Lille stated in writing that if he gave evidence he would be “likely to reveal details of the source file”, that Mr Decou was bound by a requirement of secrecy concerning these proceedings and investigation, and that aspects of his testimony would seriously compromise the outcome of the current work of the judge’s office. Against that background, Dove J was entitled to conclude that the requirements of section 116(1) and (2)(c) of the CJA were met, given the French authorities had provided a transparent and coherent explanation, which was clear and well-reasoned, for the refusal to permit Mr Decou to attend court to give evidence. The prosecution had used the appropriate channels to secure his attendance, and there was nothing else in a practical sense that the authorities could do to progress this request. On that basis, in our judgment Dove J had persuasively addressed the first of the steps in Riat.

[50]The second step in considering the admission of hearsay evidence was explained by this court in Riat as follows:

“17. If a specific gateway for admission is passed, we suggest that a court should always at that point consider the vital linked questions of (i) the apparent reliability of the evidence and (ii) the practicability of the jury testing and assessing its reliability. Section 124 is critical at this point.

(b) ”

[51]At [125] of the judgment, Dove J addressed the credibility or reliability of the hearsay evidence and the practicability of it being tested and assessed, bearing in mind the provisions of section 124 of the CJA, which provides: “Credibility(1) This section applies if in criminal proceedings— (a) a statement not made in oral evidence in the proceedings is admitted as evidence of a matter stated, and (b) the maker of the statement does not give oral evidence in connection with the subject matter of the statement.

(2) In such a case— (a) any evidence which (if he had given such evidence) would have been admissible as relevant to his credibility as a witness is so admissible in the proceedings; (b) evidence may with the court's leave be given of any matter which (if he had given such evidence) could have been put to him in cross-examination as relevant to his credibility as a witness but of which evidence could not have been adduced by the cross-examining party; (c) evidence tending to prove that he made (at whatever time) any other statement inconsistent with the statement admitted as evidence is admissible for the purpose of showing that he contradicted himself.

(3) If as a result of evidence admitted under this section an allegation is made against the maker of a statement, the court may permit a party to lead additional evidence of such description as the court may specify for the purposes of denying or answering the allegation.

(4) In the case of a statement in a document which is admitted as evidence under section 117 each person who, in order for the statement to be admissible, must have supplied or received the information concerned or created or received the document or part concerned is to be treated as the maker of the statement for the purposes of subsections (1) to (3) above.” (a) a statement not made in oral evidence in the proceedings is admitted as evidence of a matter stated, and (b) the maker of the statement does not give oral evidence in connection with the subject matter of the statement. (a) any evidence which (if he had given such evidence) would have been admissible as relevant to his credibility as a witness is so admissible in the proceedings; (b) evidence may with the court's leave be given of any matter which (if he had given such evidence) could have been put to him in cross-examination as relevant to his credibility as a witness but of which evidence could not have been adduced by the cross-examining party; (c) evidence tending to prove that he made (at whatever time) any other statement inconsistent with the statement admitted as evidence is admissible for the purpose of showing that he contradicted himself.

The judge observed of Mr Decou:

“125. […] The first point to observe is that the witness with which this application is concerned is a senior officer within the French Gendarmerie who, it is clear, has been instrumental in the investigation of the EncroChat system, and in whom the investigating judges have placed significant trust. It is clear therefore that the witness with which this application is concerned is a person who, at the very least prima facie, has an obligation to the rule of law and to the integrity and credibility of the investigations which he has been responsible for coordinating. He is, in my judgment, therefore someone to be regarded as credible.”

[53]Although Mr Decou had provided information on various aspects of the operation into EncroChat in his witness statement and in the interview conducted on the same day, the core of his evidence (certainly in the present context) was his confirmation of the accuracy of the draft email on Ms Sweeting’s laptop. Ms Sweeting informed him that this information was required to obtain the necessary legal authority in the United Kingdom. Ms Sweeting’s testimony was that Mr Decou read the explanation and confirmed that it correctly reflected the nature of the technique (see [12] above). To reiterate, he agreed that stage 1 (historical data collection) involved an implant being placed on all EncroChat devices worldwide. The implant collected the data stored on the device and transmitted it to the French authorities. This, critically, included stored chat messages and notes. The implant remained in place to facilitate stage 2 (referred to as “forward facing collection), which enabled the messages on the EncroChat devices to be collected on an ongoing basis.

[54]The reason for this somewhat roundabout approach was that Ms Sweeting appreciated that for security reasons the French authorities were unlikely to provide the NCA with a formal or written explanation of how the implant worked; indeed, Ms Sweeting was aware that MR Decou would not confirm in writing the position we have just described. She drafted, therefore, this short explanation with which Mr Decou agreed. It had been stressed to him that there was an important difference between obtaining the data from the device and from the server. Mr Decou had not designed the implant, but he would have had it explained to him. Ms Sweeting was confident that Mr Decou understood how the implant worked, without the need for technical assistance.

[55]As quoted above at [45] the judge concluded, “taking the material as a whole, I do not consider that the issues raised by the defendants render the reliability of the evidence such that it should not be admitted. Nor do I consider that there are any significant internal inconsistencies in M Decou’s evidence which would also preclude its admission”. The judge had a firm basis for concluding that this evidence from Mr Decou was apparently reliable. As Dove J set out, he had performed many years of service in the Gendarmerie, and he would have understood his obligation to the rule of law and to the integrity and credibility of the present investigation, for which he had critical coordinating responsibility. In those circumstances, the judge was entitled to determine that he is someone to be regarded as credible.

[56]The defendants deployed an extensive armoury of technical and factual arguments in their bid to persuade Dove J that the hearsay evidence from Mr Decou was unreliable, most particularly focusing on the inconsistencies (already analysed above) and the alternative hypothesis (which we address later in this judgment). These arguments provided an ample basis for the judge to test and assess the reliability of Mr Decou’s hearsay evidence, in the broad circumstances permitted by section 124(2) of the CJA. As to the areas that Mr Csoka highlighted in which cross-examination would potentially have been important, Ms Sweeting was available for questioning about the “off-the-record encounter”and whether it was a fiction invented by the prosecution. Equally, she was able to explain and to be cross-examined concerning the circumstances in which Mr Decou read the note and his apparent understanding of its contents. As to whether Mr Decou had appropriate technical knowledge of how stage 2 was carried out, the stark choice as regards stage 2 (viz. whether the collection of messages from the EncroChat devices continued on an ongoing basis or whether there was a change of approach, with the result that the messages were intercepted whilst on the server) was conceptually straightforward. The importance of this distinction to the authorities in the United Kingdom had been made clear.

[57]Given all these considerations, we are confident that the judge appropriately addressed the second step in Riat and his conclusions were entirely appropriate.

[58]As to the next relevant step in Riat, whether the admission of Mr Decou’s evidence should be refused either under section 78 of PACE or under section 126 of the CJA, the judge noted that no submissions had been advanced under the latter section. Section 78 provides:

“Exclusion of unfair evidence. (1) In any proceedings the court may refuse to allow evidence on which the prosecution proposes to rely to be given if it appears to the court that, having regard to all the circumstances, including the circumstances in which the evidence was obtained, the admission of the evidence would have such an adverse effect on the fairness of the proceedings that the court ought not to admit it. […]”

[59]Dove J’s conclusions were:

“127. […] So far as section 78 is concerned, in my view it is important to have regard to the significance of the evidence that M Decou gives as part of the prosecution case. The prosecution mount what is in effect a circumstantial case in relation to how the implant worked, in particular in the absence of any detailed technical explanation of its function from the JIT. M Decou’s evidence comes from the authorities who were directly responsible for the exploitation of the EncroChat system, and thus whilst his evidence is not the only evidence on the question of how the implant operated, it is clearly a significant part of the prosecution’s case. As set out below, that significance clearly requires caution to be exercised before admitting the evidence, and I have taken account of this. I have borne in mind that the defendants have not had the opportunity to test his evidence through cross examination. I have also borne in mind that whilst the evidential material related to M Decou’s interview and his statement was formal in character, the evidence in relation to his confirmation of the note on Ms Sweeting’s computer at the Eurojust meeting was informal and in effect an ad-hoc conversation. For the reasons given by the prosecution, I do not accept that this material is multiple hearsay, and bearing in mind the prominence of the role of M Decou in the French authority’s actions and his role in the investigation I am sure that he had the direct knowledge of the operation of the implant in order to provide the information that he did. 128. Having weighed up all of the factors engaged I am satisfied that it is appropriate for the application to be granted and M Decou’s evidence to be admitted. The evidence comes, as I have observed, from a credible witness with a law enforcement background. The challenges to its reliability do not persuade me that the evidence should be excluded for the reasons I have given. In reality the evidence is in very many respects entirely consistent with the other elements of the prosecution’s case, supporting the contention that the implant operated in the manner described in Ms Sweeting’s note. Plainly there are difficulties in relation to the defendants testing this material. However, I am satisfied that an appropriate safeguard in respect of this point is applying the directions which would be given to a jury in respect of hearsay evidence. For example, it is necessary to take account of the fact that I have not had the advantage of seeing this witness give evidence before me nor has his evidence been tested by cross examination. Further, the evidence will have to be considered in the context of all the other evidence which is available and its relationship to that evidence. Factors such as the circumstances in which the statements were made, and the fact that opportunities for verification were not taken need to be taken into account. Whilst the evidence of M Decou is a significant part of the prosecution’s case, it is not the only evidence on the question of how the implant operated. I have taken account of the significance of M Decou’s evidence and applied the necessary caution and circumspection required, but I am not dissuaded from admitting the evidence in the circumstances of this case which are set out in the reasons I have already provided. For the sake of completeness, the defendants also sought to rely upon the provisions of CPR 19.9 in relation to expert evidence to suggest that the admission of the material would conflict with this provision. I am not satisfied that CPR 19.9 has any significant bearing on the decisions to be reached regarding the admission of this factual hearsay evidence. I therefore propose to proceed to evaluate the factual questions taking account of M Decou’s evidence in the light of the self-directions which are necessary in cases involving hearsay evidence.”

[60]In our judgment those were entirely sustainable conclusions. The judge weighed in detail the relevant factors, and he was consistently careful in his approach. It was open to him, for the reasons he gave, to determine that this evidence would not have such an adverse effect on the fairness of the proceedings that the court ought not to admit it. The judge was alive to the lack of an opportunity to cross-examine, along with the importance of this evidence and the absence of confirmation from Mr Decou that he had verified the contents of the email on Ms Sweeting’s laptop. However, as we have already emphasised, there was a substantial body of materials which had been deployed in the case by which Dove J was able to test the accuracy of the account from Mr Decou, along with that of Ms Sweeting (who was called). Rule 19.9 of the Criminal Procedure Rules had no relevance to the present issue, and it was relied on by the defence in inapposite circumstances. This was not a case in which the prosecution had introduced expert evidence but had omitted information which it otherwise might have included because it was considered that that the information ought not to be revealed. Rule 19.9 is concerned with the voluntary withholding of information when expert evidence is introduced. The present case did not involve a choice, in that sense, by the prosecution. Instead, the prosecution was faced with a fait accompli: the witness, who was abroad, declined to attend and the prosecution’s only viable option – apart from not relying on the material – was to seek the introduction of hearsay evidence. Ms Sweeting

[61]Finally, the judge dealt with the application to introduce the evidence from Ms Sweeting of her discussion with Mr Decou and his confirmation of her note as to how the implant was to operate, pursuant to section 114(1)(d) of the CJA. The section provides: “Admissibility of hearsay evidence(1) In criminal proceedings a statement not made in oral evidence in the proceedings is admissible as evidence of any matter stated if, but only if— […] (d) the court is satisfied that it is in the interests of justice for it to be admissible.

(2) In deciding whether a statement not made in oral evidence should be admitted under subsection (1)(d), the court must have regard to the following factors (and to any others it considers relevant)— (a) how much probative value the statement has (assuming it to be true) in relation to a matter in issue in the proceedings, or how valuable it is for the understanding of other evidence in the case; (b) what other evidence has been, or can be, given on the matter or evidence mentioned in paragraph (a); (c) how important the matter or evidence mentioned in paragraph (a) is in the context of the case as a whole; (d) the circumstances in which the statement was made; (e) how reliable the maker of the statement appears to be; (f) how reliable the evidence of the making of the statement appears to be; (g) whether oral evidence of the matter stated can be given and, if not, why it cannot; (h) the amount of difficulty involved in challenging the statement; (i) the extent to which that difficulty would be likely to prejudice the party facing it. […]” (d) the court is satisfied that it is in the interests of justice for it to be admissible. (a) how much probative value the statement has (assuming it to be true) in relation to a matter in issue in the proceedings, or how valuable it is for the understanding of other evidence in the case; (b) what other evidence has been, or can be, given on the matter or evidence mentioned in paragraph (a); (c) how important the matter or evidence mentioned in paragraph (a) is in the context of the case as a whole; (d) the circumstances in which the statement was made; (e) how reliable the maker of the statement appears to be; (f) how reliable the evidence of the making of the statement appears to be; (g) whether oral evidence of the matter stated can be given and, if not, why it cannot; (h) the amount of difficulty involved in challenging the statement; (i) the extent to which that difficulty would be likely to prejudice the party facing it.

[62]The judge recognised that this was evidence of real importance, as it was a contemporaneous record made at the end of a long meeting and it related to the central question under consideration, namely whether the EncroChat messages were taken from storage on the individual devices. The judge focussed on the factors set out in section 114(2), and he considered the informality of the way in which the statement was taken and the lack of any later attempt at confirming its accuracy. The judge concluded that Ms Sweeting “was an honest, straightforward and reliable witness and that her testimony forms a reliable basis for decision making”. He accepted the reasons given as to why Mr Decou was not asked to verify his confirmation of her note, given there was no prospect in the circumstances of formal confirmation. The judge took account of the inconsistencies already addressed in this judgment and the difficulties for the defence in challenging Ms Sweeting’s evidence in this regard. He was addressed on the issue of the email from Mr Decou to Ms Sweeting dated 29 January 2020 in which he indicated that he was not a technician but an investigator. The judge nonetheless concluded “I am satisfied that this evidence is not multiple hearsay, on the basis that as a very senior officer at the heart of Operation Emma it is clear that M Decou would have had the necessary first-hand knowledge to confirm the operation of the implant. Having considered the matters relevant to the application as a whole, I am entirely satisfied that it is in the interests of justice for this evidence to be admitted”. As to section 78 of PACE, the judge concluded that the prejudice to the defence and the cautious approach he needed to apply did not justify excluding this evidence. We consider those conclusions to be unassailable. The judge paid due heed to all of the relevant factors and his approach to this decision was faultless. We have no doubt that this information was properly admitted.

[63]In all the circumstances, we are unpersuaded by the submission that there were compelling or substantive reasons for excluding the hearsay evidence in this case. We reject this ground of appeal. The EncroChat Material As a question of fact, the prosecution could not prove that the data was stored on the device, nor could they prove that the unencrypted messages were exfiltrated from the handset devices

[64]As the judge described it, the centre piece of the defendants’ contentions as to whether the court could be sure that the implant functioned in accordance with the prosecution’s case, was the suggested alternative hypothesis as to how it might have operated. This had been set out in the defence statement of 6 May 2021. It is markedly technical in nature, and it was summarised by the judge with commendable clarity in his judgment at [133] and [134]. It is unnecessary, for the reasons set out hereafter, to repeat the entirety of the detail of this theory and instead we highlight a few of the relevant critical features. In essence, the defence suggested that the EncroChat handsets were infected by an implant which was distributed via an EncroChat update. This initiated a process which would have undermined the encryption which was self-evidently a critical aspect of the EncroChat service. This technique would have involved the deployment of a pseudo random number generator which replaced the random number generator on the handset. The JIT would then have been able to decrypt the messages, which were exfiltrated from the server instead of from the handsets.

[65]The judge observed at [148] that nowhere in the relevant material was there any reference to a pseudo random number generator undermining the security of the encryption of the EncroChat system. It was, at least in part, an important element of the judge’s reasoning that the lack of any reference to this feature undermined the defence hypothetical alternative and, as the judge put it, this (albeit not alone) was sufficient to justify the rejection of the defendants’ case in this context. The judge concluded, moreover, that the defence theoretical alternative introduced “considerable complexity”, by requiring numerous additional steps and adaptations to be incorporated into the app and the devices. There were similar complexities created by the necessity of providing received and read receipts. The judge afforded only little weight to the contention that the defence hypothetical alternative reduced the risk of detection.

[66]The judge carefully reflected on the available documentation, especially that relied on during the hearing. He analysed the inconsistencies which tended to undermine the prosecution’s case. These included the notes of the meeting at Eurojust on 9 March 2020 (see [44] above) and the notes made by Mr John of the meeting of 25 February 2020. As to the latter event, the judge accepted that he had not heard a sufficient explanation for the fact that the technique purportedly knocked users off-line. The judge was of the view that the terms of the warrant of the French Court of 29 April 2020 (again, see [44] above) did not appear on its face to be consistent with the prosecution’s case. Other documentation was described by the judge as being equivocal. For instance, he noted that to install the implant via the update, the French authorities required full control, which needed to be maintained to capture new devices as they became active. There were certain events (viz. the construction of 96 virtual machines on the server at OVH Roubaix, the freezing of the named Domain Name System (“DNS”) and Internet Protocol (“IP”) addresses, the installation of a “loadbalancer” to divert the relevant traffic and the loss of service at OVH on 30 March 2020) which the judge concluded were, at the very least, consistent with the exercise of control of this nature.

[67]Against that background, the judge assessed the documentation globally, and he focussed on several items that came from external sources. By way of example, the order from the Lille magistrates dated 28 May 2020 authorised “the modification of the network routing rules to redirect the data stream from a technical loadbalancing device called loadbalancer, from the customer’s infrastructure to that set up by the investigation service”. There was reference, additionally, within the order to the data capture measure leading to many thousands of telephone devices “sending data to the investigation services storage server”. This was, in the judge’s view, entirely consistent with the implant capturing data on the telephones and sending the messages in clear text from the devices to the C3N server. Similarly, there was correspondence from prosecutors in Holland dated 27 March 2020 which supported the suggestion that the extracted data had come from the handsets. The Dutch sought confirmation that officials in other jurisdictions including the United Kingdom had been briefed “about the methods that are being used to generate data from devices in their jurisdiction”. As the judge described it, “stepping back and forming an overall conclusion in relation to the documentation”, it was consistent with the prosecution’s case.

[68]The judge accepted that the defendants’ hypothesis was technically feasible, in that it was possible for an implant to have facilitated the exfiltration of encrypted messages from the server and their subsequent decryption. But, as the judge observed, the question was not whether this was technically feasible but whether this possibility meant he was unsure of the prosecution’s contention as to how the implant worked. The judge found the prosecution’s explanation to be “coherent and robust”: he entirely accepted the technical evidence from Mr Shrimpton that the messages came from the handsets and he concluded that the “prosecution explanation is consistent with the contemporaneous documentation and accounts given by those responsible for undertaking the operation both at formal meetings and outside them, evidence obtained pursuant to formal legal processes under EOI’s from the French authorities as to how the implant operated and the carefully researched expert evidence provided by Mr Shrimpton”. In the result, he was sure that the prosecution’s explanation as to how the implant operated was correct.

[69]This was a decision on the facts taken by the judge after a lengthy hearing in which he heard substantial live testimony, he considered extensive documentation and he received submissions on a significant number of detailed and highly technical issues. He was, therefore, particularly well placed to assess the relevant considerations. Mr Csoka has advanced a significant number of general, as well as detailed, criticisms of the findings and the observations by the judge, suggesting their foundations were either weak or ephemeral. In the main, we consider that Mr Csoka’s criticisms are misplaced.

[70]The submissions in support of the argument that the judge erred in ruling that the EncroChat messages were exfiltrated from the handsets rather than when the messages were in transmission include the observation that this point was not adequately explored in R v A, B, D and C

[2021] EWCA Crim 128

;

2021 2 WLR 1301

. The position is that this court in A, B, D and C proceeded on the basis of the judge’s findings of fact, namely that “the communications were extracted directly from the handset of the user and not while they were travelling to, through or from any other part of the system. This is a process which is like any other means of downloading the content of a mobile phone handset” (see [63]). This had not been the subject of any dispute.

[71]It is submitted by the appellants that the Operation Venetic cases are unique in that there do not appear to have been any previous cases in which computer-based evidence (in this case concerning an implant) has been relied on without the prosecution, their witnesses or the defence having any direct knowledge as to how the implant functioned. The present appeal is, therefore, submitted to be distinguishable from R v Kelly

[2018] EWCA Crim 1893

(a case in which this court decided i) there was a high level of public interest in withholding the precise methodology by which a prosecution expert had been able to bypass the encryption software on a mobile phone said to have been used by a drug dealer, and ii) the judge had been entitled not to require that information to be disclosed because a fair trial was still possible without it). As it seems to us, the fact that this case may in certain respects be unique is essentially irrelevant; the critical and straightforward question is whether the evidence justified the judge’s conclusions.

[72]The appellants submit that how and when the messages were obtained were clearly matters for expert evidence. It is contended that although the prosecution sought to mount a circumstantial case to explain how the messages had been obtained, in the absence of any expert or direct evidence in relation to the workings of the implant, the prosecution had been unable to fulfil their disclosure obligations and any conclusions reached would be both unsafe and unreasonable. The simple answer to this complaint is that the prosecuting authorities were not in possession of any relevant material in addition to that already provided to the defence and there were no reasonable lines of enquiry to be pursued in relation to the operation of the implant, for the reasons extensively rehearsed above. There is simply no foundation for the complaint that there had been a disclosure failure.

[73]It is argued that the judge gave inadequate consideration to the wealth of documentation which was inconsistent with the prosecution’s case. With respect to Mr Csoka, this contention is entirely unjustified. The judge spent a significant part of the judgment addressing this issue (see [118] et seq.).

[74]The appellants submit that the defence hypothesis has the advantage of “less steps at the handset level”, given the only additional data that was sent was by way of extra metadata and a read receipt, whilst on the prosecution model there were at least two further transmissions of cleartext messages, along with the extra metadata that was sent to C3N. The prosecution hypothesis, it is argued, requires the covert installation of additional software, which needed to be kept running to harvest the messages (pre- and post-encryption), as well as to send the transmissions to the C3N server. It is submitted that the prosecution model was at greater risk of discovery than that of the defence because of the risk that unexpected IP addresses and a significant data increase would be detected. This has been the subject of contention. The prosecution do not accept the suggestion that their case included the requirement (as just set out) that “a received receipt was sent to C3N with extra metadata and a clear text copy of the message that had already been copied when the message was sent”. Furthermore, it is not accepted that the prosecution’s model “requires extra programmes to run on the handset”. Mr Kinnear stressed that on the Crown’s model all that was required was a single implant on the handset that was then used to extract the data; no extra programme was required. There were, therefore, significant differences as regards the strengths and weaknesses of the rival contentions, along with some of their constituent elements. These are differences we do not need to attempt to resolve because, as considered in greater detail below, the judge’s decision was not reduced to an arithmetical assessment of the strengths and weaknesses of two rival hypotheses, both of which the appellants accepted were technically feasible. The appellants’ hypothesis involved the French authorities changing the approach that had been used successfully for stage 1, and in assessing whether this may have occurred the judge needed to consider the evidence overall which included, for instance, the expert evidence from Mr Shrimpton and the confirmation from Mr Decou as to how the extraction of the messages occurred.

[75]Mr Csoka submits that the judge used hearsay evidence from Mr Decou to support other hearsay evidence which also came from Mr Decou. We do not accept this contention. Instead, at [136] the judge essentially rehearsed the history to the information provided to Ms Sweeting, her understanding of the Europol briefing and the explanation of the operation of the implant provided by Mr Decou. Thereafter, the judge summarised the position of Mr Shrimpton. This analysis simply did not involve “circularity about the same hearsay from Mr Decou”, as suggested by Mr Csoka.

[76]The appellants erroneously submit that the judge uncritically summarised and then unquestioningly accepted the prosecution’s submissions. To the contrary, the judge explored the weaknesses in the prosecution’s evidence in considerable detail in key passages in the judgment (e.g. [133] – [135]). For instance, it is suggested that the judge paid insufficient regard to references in the warrantry to data capture on the servers. It is clear, however, that the judge was well aware of this issue and, for instance, at [73] and [76] he set out the evidence on this issue with care in the context of the evidence of Mr Harrison. In a similar vein, Mr Csoka is wrong in his suggestion that the judge reached his conclusions at [142] without analysing the defence case. This analysis had occurred, commencing at [133], once the judge had concluded his rehearsal of a significant part of the relevant evidence ([6] – [100].

[77]The judge is criticised for relying on the contents of the Dutch email dated 27 March 2020 (see [36] and [67] above), given, as the judge noted, the absence of any reference to the data being collected on the servers (having been generated on the handsets). We consider it was appropriate for the judge to take this omission into account, bearing in mind the obvious importance of this fundamental element: whether the data was exfiltrated in transmission (regardless of whether the more intricate detail of the technique that had been deployed was covered by French military secrecy). It was wholly understandable, furthermore, that the judge omitted to analyse in this context a press statement from the Netherlands Forensic Institute given the nature of a communication of this kind.

[78]It is erroneously suggested that the judge placed a burden on the defence to disprove the prosecution model. This assertion involves a misreading of the judgment. The appellants had properly highlighted the evidence which was said to be inconsistent with the prosecution case and, as an inevitable consequence, the judge focussed on the extent to which the relevant material was consistent or inconsistent with the prosecution hypothesis. The judge directly and correctly referred the burden and the standard of proof during the course of the judgment (e.g. [141] “(h)aving carefully reviewed the evidence against the relevant burden and standard of proof I have formed a clear judgment that I can be sure that the prosecution’s explanation of how the implant worked is correct […]”.

[79]Mr Csoka has asserted, in our view without justification, that the judge in his review of Mr Shrimpton’s evidence at [144] wrongly conflated the origins of the relevant data and the location of its collection. To the contrary, throughout the judge’s analysis he differentiated between the possibility of data coming from the device as opposed to data being obtained during transmission or from the server. At the beginning of the paragraph the judge observed “[…] it is apparent that the experiments which he undertook clearly support the conclusion that the data which was obtained had come from the devices rather than from transmission or the server […]” In our judgment, there was no conflation at any stage by the judge.

[80]It is suggested that the judge unreasonably and unfairly highlighted the absence of any reference in the relevant documentation to the pseudo random number generator, which was a key ingredient of the defence hypothesis (see [65] above). It is argued that the prosecution were in possession of only a part of the documentation, which did not include matters covered by French military secrecy. This feature may, therefore, have been concealed and, more generally, the French authorities had not provided the NCA with technical papers as to how the implant worked. Notwithstanding these possibilities, as Mr Kinnear has observed, the documentation contained extensive references to the data coming from the handsets, thereby bypassing the difficulty posed by encryption. Given that detail of that kind was included as regards the basic underpinnings of how the extraction occurred, we consider that the judge was entitled to take into account that at no stage was there any reference to the fundamental ingredient, on the defence hypothesis, of the pseudo random number generator.

[81]It may be the case that the judge placed some undue emphasis on an aspect of the defence hypothesis, namely the need for a micro-stage 1, given (as speculated by Mr Csoka) this would theoretically only arise if the interception of the messages fell out of synchronisation with the transmission of the messages (for instance, if the intercept server crashed). Similarly, the judge may have been in error (again as maintained by Mr Csoka) in suggesting that the defence hypothesis involved altering the content of the data. In our view, however, when assessing the weight to be given to these criticisms in the context of reviewing a judgment in a case of notable technical complexity (the judge heard 13 days of evidence and submissions), it is important not to lose sight of the wood for the trees. Put otherwise, it is necessary to reflect principally on the fundamental underpinnings of the judge’s decision and not to be influenced inappropriately or side-tracked by suggested misunderstandings on a limited number of matters of detail.

[82]Against that background, we turn to our overarching conclusions as regards this ground of appeal. We do not accept that it was unsafe or unreasonable for the judge to reach his conclusions without detailed technical information from the French authorities as to how the implant operated. Dove J was entitled to review the evidence as to the way the implant operated in its entirety, given it came from a wide variety of sources. As we set out at [74] above, this was not simply an assessment of the strengths and weaknesses of two rival hypotheses. In particular, it was agreed that stage 1 involved the data being exfiltrated from the handsets and the defence provided a theory that a different, albeit feasible, model was used for stage 2. There was clear evidence that entitled the judge to reach his decision, independently of the way the two hypotheses were suggested to operate, that the defence theory was to be rejected. We simply highlight two examples. First, Mr Decou in responding to an EIO explained that if the technical system had not been set up on the sending handset but had been set up on the receiving handset, the message was retrieved “when the message arrives on telephone B where it is then decrypted”. Mr Decou was clear, therefore, that the technique used related to the handsets as opposed to the server and that the messages were obtained when they arrived on the handsets. Mr Decou clarified to Ms Sweeting that the copy of the message was collected from the sending handset when it was stored on the device, which coincided with the moment when the message was sent by the device in an encrypted form to the chat server. Second, it was clear from Mr Shrimpton (see pages 18 and 20 of his report of 28 April 2021) that the collection during phase 2 involved retrieving copies of the messages that had the same Universally Unique Identifier (“UUID”) as generated by the device during phase 1, indicating thereby that it came from the same source, namely the device. We consider this conclusion tends strongly to demonstrate from where the data was collected.

[83]These are, we stress, simply examples of the material before the judge forming a body of evidence that went beyond an assessment of the relative feasibility of the two hypotheses. Put otherwise, the relevant evidence provided a proper basis for the judge to conclude that he was sure of the prosecution’s case in this regard. It follows we reject Mr Csoka’s submission that the evidence was such that the judge could not “exclude the defence hypothesis”.

[84]In conclusion, we accept – given the nature of the hearsay evidence and the lack of any technical explanation from the French authorities – that this is undoubtedly something of an unusual case. We have set out above our analysis of the principal matters (certainly as they strike us) as advanced by Mr Csoka. We are confident, in the event, that the evidence overall provided a clear and coherent basis for the judge to decide that the messages were exfiltrated from the handsets. The judge considered the respective arguments with great care, and his judgment was based, as we have already observed, on a broad range of material. It follows we are unpersuaded by the argument that the prosecution had failed to prove that the unencrypted messages/JPEGs were stored on and exfiltrated from the handsets. In our judgment Dove J was entitled to reject the defence hypothesis that that the EncroChat material was extracted during transmission. In light of these conclusions, it has only been necessary to deal with a selection of the more notable submissions by Mr Csoka as to the respective merits of the two hypotheses.

[85]We reject this ground of appeal. Paragraph 2 of Schedule 3 of the IPA precludes the admission of the EncroChat text messages

[86]Under this heading Mr Csoka argues that, even if the material was collected from storage on handsets rather than in transit through the system, it would nonetheless be inadmissible by virtue of section 56(1)(b) of the IPA. The Crown’s case is that, in the case of material gathered from storage, the prohibition in section 56(1)(b) on using such material in evidence is displaced by paragraph 2(2) of Schedule 3 to the Act.

[87]Section 56 provides: “Exclusion of matters from legal proceedings etc. (1) No evidence may be adduced, question asked, assertion or disclosure made or other thing done in, for the purposes of or in connection with any legal proceedings or Inquiries Act proceedings which (in any manner)— (a) discloses, in circumstances from which its origin in interception-related conduct may be inferred— (i) any content of an intercepted communication, or (ii) any secondary data obtained from a communication, or (b) tends to suggest that any interception-related conduct has or may have occurred or may be going to occur. This is subject to Schedule 3 (exceptions).” (a) discloses, in circumstances from which its origin in interception-related conduct may be inferred— (i) any content of an intercepted communication, or (ii) any secondary data obtained from a communication, or (b) tends to suggest that any interception-related conduct has or may have occurred or may be going to occur.

[88]Schedule 3, paragraph 2: “(1) Section 56(1)(a) does not prohibit the disclosure of any content of a communication, or any secondary data obtained from a communication, if the interception of that communication was lawful by virtue of any of the following provisions—(a) sections 6(1)(c) and 44 to 52;

(b) sections 1(5)(c), 3 and 4 of the Regulation of Investigatory Powers Act 2000;

(c) section 1(2)(b) and (3) of the Interception of Communications Act 1985. (2) Where any disclosure is proposed to be, or has been, made on the grounds that it is authorised by sub-paragraph (1), section 56(1) does not prohibit the doing of anything in, or for the purposes of, so much of any proceedings as relates to the question whether that disclosure is or was so authorised.” (a) sections 6(1)(c) and 44 to 52; (b) sections 1(5)(c), 3 and 4 of the Regulation of Investigatory Powers Act 2000; (c) section 1(2)(b) and (3) of the Interception of Communications Act 1985.

[89]The appellants argue that paragraph 2(1) only displaces the prohibition in section 56(1)(a) and not that in section 56(1)(b). The further prohibition in section 56(1)(b) is displaced by paragraph 2(2) but only insofar as it relates to “the question whether that disclosure is or was so authorised”. Therefore, once the question set out in that sub-paragraph has been determined, the only prohibition that is displaced thereafter is that part of section 56(1)(a) which is displaced by paragraph 2(1).

[90]It is submitted by Mr Csoka that the question as to “whether the disclosure was properly authorised” has been determined at the preparatory hearing and is not an issue at trial. Therefore, the only material which is now admissible at trial is that which is permitted by virtue of Schedule 3 paragraph 2(1). That exemption relates only to “any content of a communication or secondary data obtained from a communication if the interception of that communication was lawful by virtue of any of the following provisions – (a) section 6(1)(c) …”. It is submitted that this exemption does not allow for the use in evidence of any material which reveals or suggests that a communication has been intercepted. That material can only be lawfully revealed pursuant to paragraph 2(2) which, after the preparatory hearing, has ceased to be of effect in this case. Therefore, this material could only be used at trial in a rare case in which it could be placed before a jury without revealing its source (for example, where it could be produced by way of an anodyne admission).

[91]Similarly, it is submitted that any defence application to stay the case as an abuse of process based on the way in which this material was obtained or to exclude the intercept material pursuant to section 78 PACE (possible applications in this case) would involve revealing the way in which the material was obtained which would be impermissible – as would the necessary prosecution applications to adduce hearsay evidence. It would, it is argued, also render unlawful anything said on this issue to the jury by the judge in summing up or by counsel in closing submissions.

[92]Further, it is argued that the prohibition and the exemption relate solely to the disclosure of material. Disclosure in the context of criminal proceedings is a term of art and relates to material gathered by the prosecution during the course of an investigation, including material upon which it does not intend to rely at trial, which the defence ought to see as it might serve to undermine the prosecution case or support the case being advanced by the defendant. Therefore, even if the exemption in Schedule 3, paragraph 2(1) applies, it only permits disclosure of this material sufficient to allow the prosecution to perform their duties of disclosure under the CPIA. There is no exemption allowing it to be adduced in evidence at trial.

[93]In addition, Mr Csoka submits that this result would be in keeping with the scheme of the Act which prohibits the production in evidence of material obtained pursuant to a targeted interception warrant (i.e. material obtained while it is being transmitted) in any circumstances. Why, he asks rhetorically, should the situation be different for material obtained pursuant to a targeted equipment interference warrant. Historically, he points out, material obtained by interception was permitted to be used for intelligence purposes but not in evidence. He urges us to conclude that the situation should be taken to remain as it was before the implementation of the Act.

[94]The respondent’s primary submission at first instance was that this issue had been determined by the CACD in R v A, B, D & C and that Dove J was bound by that ruling. The relevant part of the judgment of Lord Burnett CJ in that case is to be found at [67] and [69]:

“67. [The] harvesting was interception but was rendered lawful by the Targeted Equipment Interference warrants issued under section 99 of the Act. That is the effect of section 6(1)(c) of the Act. The product of that harvesting was thus rendered admissible in these proceedings by paragraph 2 of Schedule 3. […] 69. If the EncroChat material was caught by the section 56 exclusion, it was admissible in evidence by this route. The communications were lawfully intercepted while stored on the handsets and are admissible by virtue of paragraph 2 of Schedule 3 to the 2016 Act.”

[95]The applicants submit that the point presently under consideration was not argued in R v A, B, D & C and thus we should not regard that decision as being of binding authority on the point.

[96]The respondents assert that on a proper construction of the Act the effect of paragraph 2 of Schedule 3 is to render admissible material gathered from handsets if there was in place a valid warrant authorising its collection.

[97]Dove J dealt with this issue at [154] and [155]:

“154. In my view the answer to the defendant’s ground in relation to paragraph 2 of Schedule 3 is straightforward. The Court of Appeal ruled in clear and unequivocal terms that once it is found as a fact that the material was extracted when stored by or in the telecommunications system, and that this activity was covered by a TEI warrant, the ‘product of that harvesting was thus rendered admissible in these proceedings by paragraph 2 of Schedule 3’. That is a conclusion which is in my view binding on this court and dispositive of this issue. 155. Even were it necessary to do so, I do not consider that there is any merit in the submissions made on behalf of the defendants in this respect. The language of paragraph 2 Schedule 3 of the 2016 Act is clear. It pertains to disclosures of lawfully intercepted communications, and by virtue of paragraph 2(1)(a) disapplies the prohibition in section 56(1)(a) in respect of the content of communications which are rendered lawful by, in particular, section 6(1)(c) of the 2016 Act. Once those provisions are engaged paragraph 2(2) makes clear that when disclosure is authorised by paragraph 2(1), section 56(1) does not prohibit anything being done in relation to proceedings questioning whether the disclosure was authorised. Thus, on its proper construction, paragraph 2 of Schedule 3 supports the admission into evidence of the EncroChat material in the circumstances of the present case.”

[98]The starting point to resolving this issue is to consider what is prohibited by section 56(1)(a). It does not prohibit the disclosure of the content of any intercepted communication, or any secondary data obtained from it in any circumstances. Rather it prohibits disclosure of these things “in circumstances from which its origin in interception-related conduct may be inferred”. Thus, there is no need for any exemption to allow for the disclosure of such things simpliciter. There is only need for a specific exemption in order to allow for disclosure in circumstances otherwise prohibited by the Act. The only sensible way of reading Schedule 3 paragraph 2(1) is that it allows for the disclosure of this material in circumstances in which it would otherwise be prohibited (i.e. in circumstances from which its origin as intercept material could be uncovered). Therefore, the exemption set out in paragraph 2(1) is of itself sufficient to allow not only for the disclosure of the communication and secondary data obtained from it but also the circumstances in which it was obtained.

[99]We further reject the submission that the exemption in paragraph 2(1) is only sufficient to allow for the material to be disclosed in the narrow way argued for by the appellants, namely, only insofar as is necessary to discharge the prosecution’s disclosure duties under the CPIA. The term “disclosure” in Schedule 3, paragraph 2 must be interpreted by reference to section 56(1)(a). It is clear that it refers to, and provides an exemption from, the prohibition in section 56(1) of anything that “discloses” those matters set out in section 56(1)(a). It is not arguable that “discloses” is used in section 56(1)(a) in the narrow sense of disclosure under the CPIA. It is clearly being used in its ordinary, plain English sense. This is reinforced by consideration of the use of the term “disclosure” elsewhere in the Act. For example, a further exemption to section 56 is to be found in Schedule 3 paragraph 21(1) which reads:

“21(1) Nothing in section 56(1) prohibits— (a) a disclosure to a person (“P”) conducting a criminal prosecution that is made for the purpose only of enabling P to determine what is required of P by P's duty to secure the fairness of the prosecution, or (b) a disclosure to a relevant judge in a case in which the judge has ordered the disclosure to be made to the judge alone.” (a) a disclosure to a person (“P”) conducting a criminal prosecution that is made for the purpose only of enabling P to determine what is required of P by P's duty to secure the fairness of the prosecution, or (b) a disclosure to a relevant judge in a case in which the judge has ordered the disclosure to be made to the judge alone.”

[100]In these circumstances, disclosure cannot mean disclosure pursuant to a duty under the CPIA. The regime in the CPIA does not involve material being provided to a judge and not a defendant. Disclosure in the context of this statute does not have the limited meaning contended for by Mr Csoka. It has its common or garden English meaning of telling someone about the material. This covers telling a jury about it in the course of a criminal trial which otherwise would be unlawful or reference to it in open court during the course of submissions or legal argument.

[101]We find that for the reasons he gave, as considered above, Dove J was correct to rule as he did and find that the material was properly admissible at trial. Mr Csoka’s interpretation of paragraph 2 of Schedule 3 is unduly narrow and inconsistent with the purpose of the exception it provides, having regard to the statutory scheme as a whole. The exception is sufficient to render admissible not only any evidence presented at trial about these communications and their origins but also to permit comment on this aspect of the case in closing submissions and summing up and any future legal arguments concerning this material (such as an abuse of process application or a section 78 application to exclude it).

[102]We accept that our interpretation of the statute will result in material obtained from storage pursuant to a targeted equipment interference warrant and that obtained while in the course of transmission under a targeted interception warrant being treated differently by the courts. We see no difficulty with that result. The statute specifically creates two separate regimes for dealing with this material: material covered by a targeted interception warrant is dealt with in part 2 of the Act and that covered by a targeted equipment interference warrant, by part 5. Each regime needs to be considered on its own terms.

[103]Further, we are not persuaded that we should look to what the law was before the Act to deduce whether this material is admissible now that the Act is in force. The IPA changed the landscape for interception in various ways. The establishment of a separate warrant and a separate regulatory regime to deal with equipment interference must mean that the two regimes should be considered separately. That is consistent with the conclusion of this court in R v A, B, D & C at [62].

[104]Unlike material accessed in the course of transmission, communications stored on a telephone can in certain circumstances lawfully be accessed and then used in evidence without recourse to a warrant under the Act. For example, there are powers that the police can use to interrogate the mobile telephone of a suspect under PACE or Schedule 7 of the Terrorism Act 2000. It is logical that the product of a valid interception from the storage of a handset should be treated in a similar way to the product of a physical search of a handset after arrest. That is in our judgment the way in which this legislation is to be interpreted.

[105]We are fortified in our view from a number of sources. First, our decision is in line with that reached by a different constitution of this court in R v A, B, C & D. Although this was not the primary issue argued before the court in that case, the central question being addressed there was as to the admissibility in evidence at a criminal trial of material such as that with which we are concerned. It is of significance that Lord Burnett CJ in that case considered the interaction of the section of the Act and the paragraph of the Schedule with which we are concerned and at [69] arrived at the same conclusion as we have done, namely, that: “on its proper construction, paragraph 2 of Schedule 3 supports the admission into evidence of the EncroChat material in the circumstances of the present case”.

[106]Second, the Equipment Interference Code of Practice issued by the Home Office pursuant to section 7 of the Act in March 2018 contemplates this material being admissible in evidence. Paragraph 3.13 reads as follows: “The material obtained under an equipment interference warrant may be used evidentially (emphasis added) or as intelligence. In the case of an equipment interference warrant authorising testing, training, maintenance or development, the material so obtained may only be used for this purpose. Further detail on handling and retention of material acquired by equipment interference is provided at Chapter 9 of this code”.

[107]Chapter 9 of the Code sets out how this material should be retained and handled and, in particular, at paragraph 9.15, the legal framework against which its admission into evidence should be considered by the courts:

“Subject to the provisions in this chapter of the code, material obtained through equipment interference may be used as evidence in criminal proceedings. The admissibility of evidence is governed primarily by the common law, the Criminal Procedure and Investigations Act 1996, the Criminal Procedure Rules, section 78 of the Police and Criminal Evidence Act 198421 and the Human Rights Act 1998.”

[108]We are mindful of the fact that the Code does not have the force of legislation. Nevertheless, it is issued under powers granted to the Home Office by statute and is of significant persuasive force, tending to indicate this material is admissible in evidence.

[109]Mr Csoka argues that the provisions of the Code should not be assumed to apply to communications obtained under a targeted equipment interference warrant. He suggests that there were different types of material which could be obtained using such a warrant (e.g. images or articles downloaded from the internet which were not at any stage transmitted through the telecommunications system) and that the Code should be taken to relate solely to non-communication material. We reject that submission. Neither the Code nor the Act distinguishes between different types of material which might be obtained as the result of such a warrant. There is no reason to assume that it was intended that the Code should be read in this limited way. Rather, once it is established that material was lawfully obtained as the result of a valid warrant, the Code serves as a reminder that there are other potential barriers to its admissibility outside of the Act such as section 78 PACE.

[110]Third, our interpretation is consistent with the Explanatory Notes issued with the Act. In particular with note 153 which sets out the intention behind the drafting of Schedule 3, paragraph 2:

“153. Paragraph 2 provides that the contents of a communication and secondary data may be disclosed if the communication is obtained under certain statutory powers exercised to obtain information, documents or property or a court order allowing the same. Material may be disclosed if obtained under an equipment interference warrants [sic] (whether targeted or bulk) or through any of the other forms of lawful interception in sections 44 to 52 (interceptions in prisons, for example).”

[111]Mr Csoka submits that the words “so much of any proceedings as relates to the question whether that disclosure is or was so authorised” at the end of Schedule 3, paragraph 2 are intended to limit the application of the exception to a preparatory or other pre-trial hearing where the question of whether the exception in Schedule 3, paragraph 2 applies is considered. He relies on the absence of similar wording in other provisions of Schedule 3.

[112]We accept that paragraph 2(2) is not drafted as clearly as it could be. Mr Csoka’s interpretation is, however, unduly restrictive. It cannot be squared with the conclusion of this court in R v A, B, D & C nor with the relevant provisions of the Code and the Explanatory Notes as discussed above. The term “disclosure” in paragraph 2(2) is clearly used in its ordinary, broad sense and includes both “discloses” for purposes of section 56(1)(a) and “tends to suggest” for purposes of section 56(1)(b). A purposive interpretation of the statute supports the conclusion of this court in R v A, B, D & C. If Parliament had intended that the prohibition in section 56(1)(b) should continue to apply to communications lawfully intercepted under section 6(1)(c) of the Act notwithstanding the application of the exception to the prohibition in section 56(1)(a), it could have done so much more simply and directly.

[113]We reject this ground of appeal. The TEI warrantry was unlawful because the obtaining of the EncroChat messages amounted to bulk interference which could only lawfully occur pursuant to a warrant under Part 6 of the IPA. Thus, the purported authorisation obtained by the NCA did not render the actions of the French authorities lawful.

[114]Mr Csoka argues that in order to obtain access to such wide-ranging material from mobile handsets, the respondents should have obtained a bulk warrant under part 6 of the IPA and not a targeted equipment interference warrant under part 5. Therefore, material gathered under this warrant remains inadmissible even if, contrary to their primary submissions, it was gathered from storage on the handsets and material gathered in that way under a targeted examination warrant is generally admissible. The respondents’ case is that the criminal court has no power to enquire into the lawfulness of the warrant: if the material was in fact gathered in purported reliance on a warrant, it must be presumed that the warrant was valid. In any event, they argue, a bulk warrant was not required in this case. This was material properly gathered under a thematic targeted examination warrant. Had this court the power to consider the validity of this warrant, it would be driven to conclude that the correct warrant was applied for and granted.

[115]Section 99 of the IPA deals with the lawfulness of warrants: “(1) There are two kinds of warrants which may be issued under this Part—(a) targeted equipment interference warrants (see subsection (2));

(b) targeted examination warrants (see subsection (9)). (2) A targeted equipment interference warrant is a warrant which authorises or requires the person to whom it is addressed to secure interference with any equipment for the purpose of obtaining— (a) communications (see section 135); (b) equipment data (see section 100);

(c) any other information. … (11) Any conduct which is carried out in accordance with a warrant under this Part is lawful for all purposes”.

[116]Section 101 deals with the subject matter of warrants:

“Subject-matter of warrants (1) A targeted equipment interference warrant may relate to any one or more of the following matters— (a) equipment belonging to, used by or in the possession of a particular person or organisation; (b) equipment belonging to, used by or in the possession of a group of persons who share a common purpose or who carry on, or may carry on, a particular activity; (c) equipment belonging to, used by or in the possession of more than one person or organisation, where the interference is for the purpose of a single investigation or operation; (d) equipment in a particular location; (e) equipment in more than one location, where the interference is for the purpose of a single investigation or operation; (f) equipment which is being, or may be, used for the purposes of a particular activity or activities of a particular description; (g) equipment which is being, or may be, used to test, maintain or develop capabilities relating to interference with equipment for the purpose of obtaining communications, equipment data or other information; (h) equipment which is being, or may be, used for the training of persons who carry out, or are likely to carry out, such interference with equipment. (2) A targeted examination warrant may relate to any one or more of the following matters— (a) a particular person or organisation; (b) a group of persons who share a common purpose or who carry on, or may carry on, a particular activity; (c) more than one person or organisation, where the conduct authorised by the warrant is for the purpose of a single investigation or operation; (d) the testing, maintenance or development of capabilities relating to the selection of protected material for examination; (e) the training of persons who carry out, or are likely to carry out, the selection of such material for examination.”

[117]Mr Csoka argues that this was not a targeted exercise. It involved an attempt to obtain material from all of those using the EncroChat system. There was no one single investigation but a multiplicity of investigations grouped together for the sole purpose of obtaining this material. The people from whom information would be obtained were not said to be part of the same OCG, did not all operate in the same geographical area and were later investigated by a number of separate law enforcement agencies spread across Europe for a variety of different crimes. In these circumstances he argues that the criteria in section 101 for the obtaining of a targeted equipment interference warrant were not met. If that is so, he argues that, notwithstanding the terms of section 99(11), the criminal courts must have jurisdiction to investigate whether the material was obtained under the terms of an appropriate warrant.

[118]The respondents argue that this was a single investigation at the time of the interception. There was reason to believe that the EncroChat system was being used by OCGs. It was a small private communication system rather than a large public network of devices. There was likely to be little non-criminal use made of the handsets. This was targeted interference and not an indiscriminate trawl to find evidence of wrongdoing. That is not changed by the fact that once the material was obtained it was divided up between the law enforcement agencies who were best placed to utilise it. In any event, it is argued, a warrant was issued, material covered by the warrant was obtained and section 99(11) ousts the criminal court’s jurisdiction to investigate its validity.

[119]Dove J’s ruling on this submission is at [158] of his judgment: “Again, in my view the answer to the defendants’ submissions in relation to this ground are straightforward. The statutory ouster contained in section 99(11) of the 2016 [Act] provides a clear and unequivocal prohibition on this court taking any other course than accepting the legality and validity of the TEI warrants that were obtained and proceeding to rule on that basis. Alternative remedies are available for the defendants to take up in relation to any questions pertaining to the validity of the TEI warrants in this case. In any event, it is clear to me both from the terms of the statute and the contents of the Code of Practice, which is admissible in evidence and has a particular role in assisting in the construction of the 2016 Act, that the use of a thematic warrant in these circumstances was justifiable. Operation Venetic was a single investigation in relation to a telephone system used on the evidence almost exclusively by OCGs, and as such this single investigation or operation was properly assisted by the obtaining of a thematic TEI warrant in relation to the telephone system”.

[120]In our judgement the prosecution are correct in their assertion that it was appropriate to apply for a targeted equipment interference warrant. The material to be obtained was from a single source (viz. the EncroChat devices). This was likely to yield information about a large but defined group of people – i.e. the users of that system. It is wrong to categorise this operation as a number of operations joined under one banner to allow for this exercise to be undertaken. This was an investigation into those who used EncroChat which system was thought to be a conduit for messages being passed between criminals. It was properly characterised as a thematic warrant. The fact that once the material was obtained and analysed it was conveniently divided up so that different aspects of the illegal behaviour could be prosecuted does not diminish from the nature of the overarching investigation into the misuse of this particular system.

[121]Notwithstanding our views as to the propriety of obtaining the type of warrant obtained, we have concluded that it is not open to a criminal court to investigate that issue as part of the trial process. Section 99(11) is clear in its terms. It declares lawful any conduct carried out in pursuance of the warrant. The process of obtaining the warrant has its own safeguards. The application for the warrant must be approved and the warrant granted by a commissioner. The commissioner charged with considering the application has a duty to ensure that the appropriate warrant has been applied for before granting it. There is an appeal process to the Investigatory Powers Commissioner if it is thought that the commissioner granting the warrant erred. Furthermore, the issuing of a warrant can be challenged in the Investigatory Powers Tribunal.

[122]Section 99(11) would not preclude the defence from arguing at trial that the material which the prosecution seek to put before the jury was not covered by the warrant, for example, because it was collected from devices which were not part of the EncroChat system or, as argued in this case, that it was collected not from storage but from communications in transit through the system. It merely ensures that once a warrant is in place, the material obtained from it is lawful.

[123]For these reasons, we reject this ground of appeal.

[124]It follows that this appeal against Dove J’s ruling is dismissed in its entirety.