Philip James O’Brien & Ors v The Crown Prosecution Service & Ors [2025] EWHC 3387 (Admin)

[2025] EWHC 3387 (Admin)

Case No AC-2025-LON-001045

Case No AC-2024-LON-002696

Case No AC-2024-LON-003258

IN THE HIGH COURT OF JUSTICE

KING'S BENCH DIVISION

ADMINISTRATIVE COURT

Venue Royal Courts of Justice, Strand, London, WC2A 2LL

Date 22/12/2025

Before

LORD JUSTICE DOVE

Between

(1) PHILIP JAMES O’BRIENClaimants

(2) CONNOR PALMERClaimant

(3) UBAID SHAIKHClaimant

(1) THE CROWN PROSECUTION SERVICEDefendants

(2) NATIONAL CRIME AGENCYDefendant

(3) THE CHIEF CONSTABLE OF WEST MIDLANDS POLICEDefendant

Oliver Cook KC (instructed by Berkeley Square Solicitors) for First Claimant

Simon McKay (instructed by Opus Law) for Second Claimant

Rupert Bowers KC and Oliver Cook KC (instructed by Berkeley Square Solicitors) for Third Claimant

Jonathan Kinnear KC and Alex Langhorn (instructed by Crown Prosecution Service) for First to Third Defendants

Hearing Hearing date: 17 October 2025

Approved Judgment

This judgment was handed down remotely at 2.00pm on 22 December 2025 by circulation to the parties or their representatives by e-mail and by release to the National Archives.

.............................

LORD JUSTICE DOVE

Introduction

[1]This judgment deals with three claims for judicial review which all relate to overlapping challenges to the obtaining of data from the EncroChat messaging system and its provision to the authorities in the United Kingdom. The issue which is before the court is whether permission to apply for judicial review should be granted to any of the claimants. Given the commonality of the issues raised, and the benefit which was to be obtained from oral argument, the cases were listed for an oral hearing in respect of permission.

[2]The position in relation to the second claimant is that he was charged with counts of conspiracy to murder arising out of events which are described in more detail below and in which the first claimant was identified. The trial commenced in November 2021 and following a preparatory hearing in relation to admissibility and further rulings regarding admissibility of the EncroChat evidence, the second claimant was convicted by the jury on 2 May 2023. He appealed against conviction and on 27 January 2025 the Court of Appeal (Criminal Division) dismissed his appeal. The first claimant commenced these proceedings on 7 April 2025; the second claimant commenced these proceedings on 8 August 2024.

[3]The third claimant was charged on 25 August 2023 with offences under the Proceeds of Crime Act 2002 related to allegations that he conspired to facilitate laundering of around £3.6 million. He is charged with others and the case, which is based upon evidence derived from the EncroChat data, is listed for trial in November 2026.

[4]Procedural objections to these applications for permission to apply for judicial review are raised by the defendants as follows. Firstly, it is contended that these proceedings have been brought out of time and in the circumstances there is no justification to extend time for them to proceed. Secondly, it is contended that this court is bound by the decision in the Court of Appeal (Criminal Division) in respect of the second claimant’s appeal against conviction in which the points which are argued on the merits in this case were presented to the Court of Appeal and dismissed.

[5]These procedural issues are resisted by the claimants. In terms of the merits of the application, ground one is the contention that the European Investigation Order (“the EIO”) was issued in breach of the provisions of the EU Directive 2014/41/EU (“the Directive”) which is the EU instrument creating the power to issue an EIO. Ground two relates to EncroChat data connected to an EncroChat handset which was in Dubai and which featured in the prosecution of the second claimant and again the contention is that this was in breach of the Directive as well as being beyond the jurisdiction of those who obtained the data. This is said to amount to a breach of international law rendering it unlawful. Ground three relates to material disclosed in the second claimant’s case and which was deployed in interview circumstances which are described below. It is contended that there was no provision to enable the transfer of this material to the third defendant so as to enable them to use it in interviewing the first claimant. Ground four is the submission that if the EIO was invalid then it was not permissible to rely upon section 10 of the Investigatory Powers Act 2016 which requires that there is a lawful EU instrument in play for this evidence to be admitted. The claimants raise a fifth ground which is that at the time the EIO was issued it was known that the detailed mechanism which had been used to capture the EncroChat data would not be disclosed in detail and there was no assessment of proportionality as required by article 6 of the Directive rendering the EIO unlawful. These grounds are resisted by the defendants who contend that they are unarguable and permission should be refused.

The EncroChat Data

[6]In the various authorities addressing the admissibility of EncroChat data as evidence there are numerous descriptions of both the nature of the system and also explanations as to how it was exploited and its security breached. What follows is a brief description which focuses on those elements of the narrative that are of particular interest in these applications: reference to those other authorities (which are well known to the court) should be made for the full background to the EncroChat system and the harvesting of its data by law enforcement authorities.

[7]In short, EncroChat was a system of encrypted messaging used mainly if not exclusively by individuals and groups to orchestrate serious crime, and in particular dealing in drugs and firearms and the laundering of the proceeds of crime. On 5 December 2019 the second defendant submitted a proposal which was ratified on 16 January 2020 for the purpose of mitigating the serious organised crime threat posed by the use of the EncroChat system. In particular, the purpose of this project, named Project Venetic, was to develop a capability to collect intelligence and evidence about the EncroChat system, as well as identify its vulnerabilities so that it could be targeted. Additionally in late 2019 the French authorities had established that the EncroChat servers were housed at Roubaix in France, and they had instigated investigations in connection with those servers and the EncroChat system at the Lille Regional Court. As a result of these investigations, they were able to obtain images of the EncroChat servers in France which they were able to analyse.

[8]On 22 January 2020 representatives of the second defendant were briefed by French and Dutch prosecutors that they were about to form a Joint Investigation Team (“the JIT”) to investigate the EncroChat communication system. On 23 January 2020 an officer at the second defendant, Mr Riaz Jakhura, sent an email to his colleagues recording notes of the meeting which he and other colleagues had attended at Eurojust in which they had been briefed by their French and Dutch colleagues in relation to the proposed JIT arrangement which France and the Netherlands were to enter into, but which the UK could not join as a result of the imminence of Brexit. The note of the meeting recorded a good deal of detail in relation to the potential activities of the proposed JIT and in particular the following under the heading of “Discussion of Co-operation”:

“1. Legality of JIT – reason why UK cannot join a JIT with France and Netherlands 59 Convention accepted by France but not willing to do a separate Jits on different basis ut Netherlands will not be used by Netherlands. For this reason bilateral JIT france and Netherlands with communication with other countries based on other legal instruments such as EIO and MLAT Netherlands Position with UK is that have renewed on 59 protocol. Not in a position to decide if multilateral can use that as sole basis. Consideration is taking place. UK cannot work with 2000 convention. Waiting for decision to be taken by Dutch JIT expert. Start bilaterial Jit with France and should the confirmation be made that sole basis if possible can be given in future. KT from Uk explains reason for only 59 protocol as basis for a JIT by UK. One basis and non eu instrument. France drafted on basis of previous case. Both countries want to finalise. Netherlands will look at document and respond after consulting Higher level in Holland. One issue complicated which is can only share information between jit partners in JIT and not outside of the JIT agreement with other countries – need permission on that topic. UK going forward information sharing: EIO to be utilised with France, Netherlands Europol work and sharing of expertise between countries. Data sharing JIT will allow use of data unlimited basis. Precise draft which may say: Data could jeopardise investigations so it must not mention the origins of information until restrictions are lifted and server taken down. JIT will have timely conversation on what to share and when. Europol on board to deal with National packages. Will deal with threats to life eg CT and murders in intelligence phase of intercept. Netherlands – will share all information of JIT and work with UK and other EU partners. Easiest way is through Europol, can share data NCA. France concurs can envisage technical co-operation on filters for idea and tools. 2 month period finalise of infection application. Europol can assist with design of filters ad hoc dedicated meeting at Europol. Passing of intelligence between countries with correct handling comes. Working group.”

Netherlands UK going forward information sharing: EIO to be utilised with France, Netherlands Data sharing Passing of intelligence between countries with correct handling comes. Working group.”

Data sharing

[9]It appears that the members of the proposed JIT invited representatives from the UK (and in particular the second defendant) to attend a meeting at Europol where they explained that they had developed a capability to obtain data from EncroChat devices which they expected to deploy commencing on 10 March 2020. They explained that this activity was going to commence, and would include handsets in the UK, regardless of whether or not the UK gave permission for that activity. The means of exploiting the EncroChat devices was by way of an implant which would be installed on each one of the devices, leading to a first phase of gathering all data stored on the device and thereafter a second phase when messages would be gathered on an ongoing basis.

[10]The detailed mechanism is described in the judgment of the Court of Appeal in R v A, B, D and C

[2021] EWCA Crim 128

. Ms Emma Sweeting, an officer of the NCA who attended the meeting at Europol, obtained an explanation from the lead French investigator Monsieur Jeremy Decou which she noted down at the meeting of 21 February 2020 and which he confirmed to her was accurate. In the light of this explanation, the second defendant concluded that the exploitation was an activity which required a Targeted Equipment Interference warrant (“the TEI warrant"), and an application for such a warrant was made and approved by a Judicial Commissioner at the Office of the Investigatory Powers Commissioner on 4 March 2020. In the meantime, on 3 March 2020 a request to draft an EIO was raised by the first defendant emailing a template for a request for such an order to Ms Sweeting. The template was completed and received by the first defendant on 5 March 2020. The first defendant drafted the EIO and it was authorised for transmission to the French Authorities on 11 March 2020.

[11]The EIO specified in Section C the investigative measures which were required to be carried out and set out the objective of the EIO in the following terms:

“SECTION C: Investigative measure(s) to be carried out 1. Describe the assistance/investigative measure(s) required AND indicate, if applicable, if it is one of the following investigative measures: We request access to data obtained by the French Authorities in respect of all EncroChat devices identified as located in the UK. We anticipate the data will be disseminated by Europol systems set up specifically for this purpose. In addition, we ask the French Prosecutor to confirm: • A list of any handling conditions for the EncroChat data. • Confirmation that the data can be shared with other law enforcement agencies within the United Kingdom by the National Crime Agency (NCA) including with Police Scotland and the Police Service of Northern Ireland. • Confirmation that UK authorities will be informed once the data handling conditions are lifted and the data may thereafter be used as evidence in criminal proceedings if appropriate. (ii) Once the data handling conditions are lifted, we request a statement from an officer of the Gendarmerie describing the actions taken and methods employed by the French authorities to obtain the material referred to.  Obtaining information or evidence which is already in the possession of the executing authority”

. In addition, we ask the French Prosecutor to confirm:  Obtaining information or evidence which is already in the possession of the executing authority”.

In addition, we ask the French Prosecutor to confirm:

[12]Within Section G of the EIO the grounds for issuing it were set out and identified the use to which the EncroChat devices were being put in order to facilitate serious criminality in the UK. It was contended that the majority if not all users of the EncroChat platform were from the criminal world and therefore the objectives of the investigation were to develop the intelligence picture and fill intelligence gaps that remained in relation to EncroChat’s use by individuals and organised groups engaged in serious crime. A number of offences in relation to drugs, firearms and money laundering were specified as being the subject matter of the investigation. The EIO did not include a notification pursuant to Article 31 of the Directive that the investigative measure included the interception of telecommunications authorised by one member state with the communication address of the subject of the interception being in the territory of another member state using the prescribed form set out in Annex C of the Directive.

[13]On 27 March 2020 a Europol Siena Information Exchange Message (“the Siena message”) was received by Mr Matt Horne, an officer of the second defendant. The message was in the following terms:

“Dear colleagues, Operational Task Force (OTF) EMMA provides the cooperation environment between the forthcoming JIT JR (Op. Emma)/ NL (Op. 26LEMONT) and non-JIT countries engaged in similar cases. The OTF includes the establishment of a Joint Operational Centre (JOC) at Europol, which will have the key objective of contributing to the identification of potential threats to life and limb affecting the participating countries. The competent authorities of each country that are willing to participate have to provide the JIT a written consent including that: - They have been briefed about the methods that are being used to generate data from devices in their jurisdiction, - They would like to receive the data as intelligence under the following conditions: ◦ If a situation occurs when the data reveal that an imminent threat to life or serious injury for a person (or persons). When that happens the joint investigation partners will decide ad hoc, in cooperation with Europol, about the way the competent authority will be briefed about this data and how this data may be used to combat the serious threat (handling code H0). ◦ Data can be supplied on intelligence basis. Europol will make an intel package for each participating country. France will try to supply Europol with packages already split up by countries. These packages can be distributed to countries not part of the joint investigation team after permission granted by the joint investigation parties. The receiving country will have to guarantee that the data will be analyzed by a small group of police officers and will be held strictly confidential. In no case this data may be used in an ongoing investigation, unless permission is granted by the joint investigation parties (handling code H1). The reason for this is to protect the operation. So there will be possibilities to use the information as intelligence in ongoing investigations in other countries, but only if the interests of the operation of the JIT can be protected. Furthermore the countries that will use this intelligence based information express that they understand the legal basis for the deployment of this investigative method in France. - They understand that the data can only be used in judicial procedures after following the applicable EIO or MLAT procedures. Kind regards, Netherlands J-CAT” ◦ If a situation occurs when the data reveal that an imminent threat to life or serious injury for a person (or persons). When that happens the joint investigation partners will decide ad hoc, in cooperation with Europol, about the way the competent authority will be briefed about this data and how this data may be used to combat the serious threat (handling code H0). ◦ Data can be supplied on intelligence basis. Europol will make an intel package for each participating country. France will try to supply Europol with packages already split up by countries. These packages can be distributed to countries not part of the joint investigation team after permission granted by the joint investigation parties. The receiving country will have to guarantee that the data will be analyzed by a small group of police officers and will be held strictly confidential. In no case this data may be used in an ongoing investigation, unless permission is granted by the joint investigation parties (handling code H1). The reason for this is to protect the operation. So there will be possibilities to use the information as intelligence in ongoing investigations in other countries, but only if the interests of the operation of the JIT can be protected. Furthermore the countries that will use this intelligence based information express that they understand the legal basis for the deployment of this investigative method in France. Netherlands J-CAT”

[14]Mr Horne responded to the Siena message with a message of his own which was in the following terms:

“On behalf of the UK Law Enforcement community, in my capacity as the Gold Commander for NCA Operation Venetic, which coordinates the UK response, I can confirm my agreement on behalf of the NCA and our UK Law Enforcement partners, to receiving the data in respect of Encrochat devices as described in the Siena message as follows: In particular; I have been briefed about the methods that are being used to generate data from devices in their jurisdiction, I would like to receive the data as intelligence under the following conditions: ◦ If a situation occurs when the data reveal an imminent threat to life or serious injury for a person (or persons). When that happens the joint investigation partners will decide ad hoc, in cooperation with Europol, about the way the competent authority will be briefed about this data and how this data may be used to combat the serious threat (handling code H0). In the UK data can either be relied upon on an intelligence basis which means that it will not be revealed in criminal proceedings (including overt investigations) or judicial procedures or it can be used on an evidential basis and therefore can be revealed in criminal proceedings (including overt investigations) or judicial procedures. If data is treated as intelligence only it can be relied upon the develop ongoing investigations without being disclosed to any party at this stage. As a result, the NCA confirms that this data will be relied upon on an intelligence basis but will be used to inform investigations and it will not be revealed in any judicial procedures at this stage to protect the interests of the operation of the JIT. There is a positive legal duty on UK law enforcement to take reasonable steps to minimise the risk of death or serious injury where the UK law enforcement is aware, or ought to be aware, of a real and immediate threat to life. In the event of intelligence being disseminated that relates to a threat to life it is recognised that the source of the intelligence should not be disclosed by UK law enforcement. However in order to manage the threat and protect life it may be necessary for UK law enforcement to take action quickly and this may involve contacting the victim or aggressor As a result, the UK requests the agreement of the JIT to respond to any potential threat to life as is necessary, justified and proportionate in the circumstances whilst recognising that the source of the intelligence should not be disclosed. In order to protect and prevent serious crime and to fulfil its functions under the Crime and Courts Act 2013 the NCA will limit the number of individuals who will have sight of this data to the minimum possible and will ensure that it is held in strictest confidence unless otherwise directed by the JIT. I understand that the data can only be used in judicial procedures after following the applicable EIO and MLAT procedures. I have asked my team to load this message onto Siena and to forward it to the competent authorities responsible for Operation Emma in order to formally confirm in writing the UK’s participation in this operation on the basis of the terms and conditions detailed above. I also confirm that the UK has supplied a European Investigation Order in respect of this activity and the UK has a legal authorisation in terms of an Investigatory Powers Act Thematic Targeted Equipment Interference Warrant in existence, which renders the activity proposed lawful in the UK. Kind regards, Matt Horne Deputy Director Investigations” ◦ If a situation occurs when the data reveal an imminent threat to life or serious injury for a person (or persons). When that happens the joint investigation partners will decide ad hoc, in cooperation with Europol, about the way the competent authority will be briefed about this data and how this data may be used to combat the serious threat (handling code H0). In the UK data can either be relied upon on an intelligence basis which means that it will not be revealed in criminal proceedings (including overt investigations) or judicial procedures or it can be used on an evidential basis and therefore can be revealed in criminal proceedings (including overt investigations) or judicial procedures. If data is treated as intelligence only it can be relied upon the develop ongoing investigations without being disclosed to any party at this stage. As a result, the NCA confirms that this data will be relied upon on an intelligence basis but will be used to inform investigations and it will not be revealed in any judicial procedures at this stage to protect the interests of the operation of the JIT. There is a positive legal duty on UK law enforcement to take reasonable steps to minimise the risk of death or serious injury where the UK law enforcement is aware, or ought to be aware, of a real and immediate threat to life. In the event of intelligence being disseminated that relates to a threat to life it is recognised that the source of the intelligence should not be disclosed by UK law enforcement. However in order to manage the threat and protect life it may be necessary for UK law enforcement to take action quickly and this may involve contacting the victim or aggressor As a result, the UK requests the agreement of the JIT to respond to any potential threat to life as is necessary, justified and proportionate in the circumstances whilst recognising that the source of the intelligence should not be disclosed. In order to protect and prevent serious crime and to fulfil its functions under the Crime and Courts Act 2013 the NCA will limit the number of individuals who will have sight of this data to the minimum possible and will ensure that it is held in strictest confidence unless otherwise directed by the JIT. I understand that the data can only be used in judicial procedures after following the applicable EIO and MLAT procedures. I have asked my team to load this message onto Siena and to forward it to the competent authorities responsible for Operation Emma in order to formally confirm in writing the UK’s participation in this operation on the basis of the terms and conditions detailed above. I also confirm that the UK has supplied a European Investigation Order in respect of this activity and the UK has a legal authorisation in terms of an Investigatory Powers Act Thematic Targeted Equipment Interference Warrant in existence, which renders the activity proposed lawful in the UK. Kind regards, Matt Horne Deputy Director Investigations”

[15]On 30 March 2020 the Joint Investigation Team Agreement was signed and endorsed by the members of the Joint Investigation Team (“the JIT”). At section 9.1 of the JIT Agreement provisions were made for agreements in relation to the sharing and use of the digital data which had been obtained from the EncroChat system. In particular, in relation to parties who were not participants in the JIT, the agreement made the following arrangements: “Information Sharing with Countries Not Participating in the JIT During the analysis of the digital data from the JIT investigation, Europol will be responsible for dividing the data by country according to where the Encrochat communication devices could be located (see above). Europol will prepare national intelligence packages for the identified countries for later transmission to those countries after approval by all JIT parties. In principle, no data or analyses from the joint investigation will be shared with countries other than the JIT parties (i.e., countries not participating in the JIT) until the suspects in the JIT investigation have been informed/arrested. The only exception to this rule is the procedure described above in the case of an imminent threat. [redacted] Contrary to the above principle of sharing information after intervention in the JIT countries, 'national intelligence packages' may already be shared during the JIT investigation with countries not participating in the JIT, provided that all JIT parties agree. A crucial condition for this is that these countries offer guarantees that the provided data will be strictly confidentially analysed by a limited group of national police officers and that this data will not be used in ongoing investigations until permission is granted by all JIT parties (to avoid jeopardising the ongoing JIT investigation). When the digital data and analyses indicate that Encrochat communication devices located in multiple JIT countries and/or countries not party to the JIT were connected – i.e., that users from different JIT countries or countries not participating in the JIT were likely involved in the same or related criminal activities – the relevant JIT parties, and if desired, countries not part of the JIT and Europol, will consult as soon as possible. The involved JIT party/parties will decide by mutual agreement who will take further action on this group of users and how it will be conducted. This data and information exchange will take place, depending on the case, in accordance with the rules for international police cooperation or international mutual legal assistance in criminal matters.”

[redacted]

[16]The compromising of the EncroChat system was commissioned by the JIT on 1 April 2020. It proceeded, as had been anticipated, with an initial phase of downloading all the messages held on the devices at the time of the operation commencing and a secondary phase of harvesting the data from the EncroChat system devices on an ongoing basis. The data which was obtained from the EncroChat system was passed to Europol and specific packages for individual jurisdictions were created, including packages of data which were passed via Europol to the second defendant. The gathering of the data from the EncroChat system continued until around 12 and 13 June 2020 when it became clear that the administrators of the EncroChat system had been alerted to the fact that their system had been compromised and they issued a warning to all users advising the owners to “power off and physically dispose of your device immediately”.

[17]It is necessary at this stage to interpolate into the chronology some further material in relation to the cases of the first and second claimants. It appears that in April 2020 messages were exchanged on the EncroChat system involving the second claimant and using the EncroChat handles “amazon-world” and “whitestuff”. These messages were ultimately evidence in the charge that the second claimant faced of conspiracy to murder, in particular conspiring to murder a Mr Reiss Larvin who was shot by a masked gunman in his own home on the night of 29 May 2020. In the event Mr Larvin survived. The prosecution case was that the shooting had been commissioned by the first claimant who was based in Dubai but running a drug dealing operation in Birmingham and that, having been introduced to the first claimant, the second claimant was then involved in subcontracting the shooting to a further individual whose identity has never been established. On 11 June 2020, the Operation Venetic Threat To Life team received a Siena message from Europol in respect of messages exchanged between the “whitestuff” and “amazon-world” EncroChat devices. On 15 June 2020 the second claimant was arrested for conspiracy to murder and having obtained the permission of the French authorities to use the messages between “whitestuff” and “amazon-world” as evidence, these messages were put to the second claimant in his police interview. The second claimant exercised his right to silence and answered no comment to all of those questions. The following day, 17 June 2020, the second claimant was interviewed again on several occasions about the EncroChat messages and again provided no comment in answer.

[18]On 1 September 2020 the first defendant sent a further EIO to the French authorities (“the bespoke EIO”). The information sought was the EncroChat data related to the first and second claimants (and their other potential co-defendants) in respect of the allegation of conspiracy to murder involved in the hiring of a contract killer to shoot Mr Larvin. The data was sought in the context of two of the individuals having been charged, including the charging of the second claimant. Within the text of the EIO it was specified that some of the information from the EncroChat messaging was believed to have originated in Dubai.

[19]As set out above, the EncroChat data was central to the prosecution of the second claimant (in respect of the conspiracy charge which involved the first claimant as a named conspirator). The second claimant and two co-defendants were convicted after a trial in the Birmingham Crown Court on 2 May 2023. The second claimant was sentenced to life imprisonment with a minimum term of 23 years less the 1,054 days he had already spent on remand.

[20]The second claimant made an application for leave to appeal against conviction which was refused by the single judge and renewed to the full court; similar applications were made by his two co-defendants. The renewed application was heard on 13 November 2024 and judgment handed down by the Court of Appeal (Criminal Division) (Holroyde VP, Morris J and HHJ Leonard KC) on 27 January 2025. In the proceedings before the Court of Appeal the second claimant sought permission to amend his grounds and indicated in the application to amend that this application for permission to apply for judicial review had been launched and that it dealt with “amongst other things, the EU and international law points”. In the application to amend the second claimant noted that the summary grounds of resistance in this judicial review identified that the second claimant had an alternative remedy in the form of an appeal before the Court of Appeal. It was noted that the second claimant accepted “that, if this Court granted permission and examined the issue, this must be right”.

[21]At paragraph 93 of their judgment, the Court of Appeal granted permission to the second claimant and his co-accused to amend their grounds to include these points. At paragraph 94 of their judgment, the Court of Appeal rejected the submission that the actions of the second defendant’s officers in connection with the TTL system were self-evidently not the monitoring of communications in the course of transmission by means of a telecommunications system. The court further rejected the submission that there was any breach of section 9 of the Investigatory Powers Act 2016. The court went on to reach conclusions in relation to the submissions made by the appellants in respect of the EIOs and the obtaining of data from Dubai in the following paragraphs of their judgment:

“96. We further accept the submissions of the respondent that none of the EIOs relevant to this case was defective, and that there was no breach of s10 of IPA 2016. We reject the submissions of the applicants to the effect that the relevant EU Directive (Directive 2014/41/EO of the European Parliament and of the Council of 3 April 2014 regarding the European Investigation Order in Criminal Matters) excluded the use of EIOs in circumstances where a JIT had been formed. In any event, messages between the AmazonWorld and WhiteStuff devices which were contained in the material from the French TTL system were also contained in the material provided in response to the EIO issued in September 2020. That EIO was a lawful request for assistance in connection with the interception of communications stored in a telecommunication system, made in the exercise of a statutory power. The Dubai data provided in response to it, and relied on by the prosecution at trial, was not obtained by monitoring the French TTL system; so even if the monitoring of that system had been unlawful (which we do not accept), the evidence at trial did not disclose anything relating to that system and did not breach s56 of the Act. 97. We note moreover that in relation to the AmazonWorld device, the French TTL system contained no data which could be accessed by the NCA officers: the first information about a threat to life revealed by that device was sent in a different way, way, on a “police-to-police” basis, several days after the device had ceased to be used. 98. The applicants’ arguments are not in our view assisted by reference to MN. In the circumstances of this case, the CPS were competent to issue an EIO requesting data which had already been intercepted; and the defence plainly were able to challenge and comment on the evidence effectively. The fact that the jury were nonetheless sure of guilt does not mean that no effective challenge to the evidence was possible. Moreover, it must be remembered that one part of the relevant messages was sent or received by a UK-based device attributed to an applicant, the user of which would have a full knowledge of it, and that each of the applicants in any event denied making or receiving any of the relevant messages. 99. We are not persuaded that the assertion of a breach of the sovereignty of the UAE is correct; but even if it were, it would do no more than provide an alternative basis on which the applicants might have sought to exclude the Dubai data pursuant to s78 of PACE. It would not have rendered the evidence inadmissible, and we reject the submission that it would have provided a basis for taking the exceptional step of staying the proceedings as an abuse of the process.”

[22]The court continued at paragraphs 100-102 to reject the arguments in relation to the admissibility of the Dubai data on the basis that the judge had properly identified that evidence as hearsay and conducted an appropriate assessment of its admissibility in accordance with section 117 of the Criminal Justice Act 2003. Whilst other grounds were also raised in the context of the appeal, they were unsuccessful and leave to appeal against conviction was refused in the second claimant’s case.

The Directive and MN (C-670/22 30April 2024)

[23]The recitals to the Directive make clear that its objective is to advance the maintenance and development of the EU as an area of freedom, security and justice. The recitals draw upon the various instruments and authorities which pre-existed the Directive in relation to the enforcement of law and order. In particular at recital 5 the Directive noted that since the adoption of Framework Decisions 2003/577/JHA and 2008/978/JHA it had become clear “that the existing framework for the gathering of evidence is too fragmented and complicated”. A new approach was therefore required. The deliberations of the European Council had concluded that a new approach was needed to pursue the aim of a comprehensive system for obtaining evidence in cases with a cross-border dimension which would be based on the principle of mutual recognition. Of particular importance to the claimants’ case are recitals (7) and (8) which provide as follows:

“(7) This new approach is based on a single instrument called the European Investigation Order (EIO). An EIO is to be issued for the purpose of having one or several specific investigative measure(s) carried out in the State executing the EIO (‘the executing State’) with a view to gathering evidence. This includes the obtaining of evidence that is already in the possession of the executing authority. (8) The EIO should have a horizontal scope and therefore should apply to all investigative measures aimed at gathering evidence. However, the setting up of a joint investigation team and the gathering of evidence within such a team require specific rules which are better dealt with separately. Without prejudice to the application of this Directive, existing instruments should therefore continue to apply to this type of investigative measure.”

[24]Article 1 of the Directive explains that an EIO is a judicial decision issued or validated by a judicial authority of a member state to have one or several specific investigative measures carried out in another member state to obtain evidence in accordance with the Directive. Article 1 goes on to explain that an EIO “may also be issued for obtaining evidence that is already in the possession of the competent authorities of the executing state”. Particular reliance is placed by the claimants upon article 3 of the Directive which provides as follows:

“The EIO shall cover any investigative measure with the exception of the setting up of a joint investigation team and the gathering of evidence within such a team as provided in Article 13 of the Convention on Mutual Assistance in Criminal Matters between the Member States of the European Union (‘the Convention’) and in Council Framework Decision 2002/465/JHA, other than for the purposes of applying, respectively, Article 13(8) of the Convention and Article 1(8) of the Framework Decision.”

[25]The provisions of the Directive were transposed into domestic law in the provisions of the Criminal Judgment (European Investigation Order) Regulations 2017. The effect of these provisions in relation to this EIO were considered by the Divisional Court in R (on the application of C) v DPP and Others

[2020] EWHC 2967 (Admin)

. The challenge considered and rejected by the Divisional Court was based upon two grounds. The first ground was the contention that the statutory criteria for issuing or validating the EIO had not been satisfied since there needed to be a particular offence related to a specified set of facts which had already been committed in order for the EIO to be issued. Ground two was that the EIO did not request that the French authorities conduct the interference with UK-based handsets on behalf of the UK authorities and therefore there was no lawful authority for the extraterritorial interference with the UK-located handsets. The Divisional Court concluded that ground two added nothing of substance to the contentions under ground one. The Divisional Court proceeded to reject ground one on the basis that it was plain that the 2017 Regulations implementing the Directive clearly covered investigations as well as proceedings in circumstances where it may ultimately turn out that no offence had been committed. Further, it was not necessary at the investigation stage to identify any particular person suspected of having committed an offence. The purpose of the Directive was to enable mutual cooperation to assist investigations of possible criminal conduct and therefore a broad interpretation of it was appropriate. The Divisional Court noted that the EIO properly specified the nature of the offences which it was reasonably suspected had been committed. Ground one was therefore rejected. The Divisional Court also reached the view that there was an adequate alternative remedy to judicial review in any event in the form of an application under section 78 of the Police and Criminal Evidence Act 1984 to exclude the evidence.

[26]The CJEU considered the provisions of the Directive in relation to EIOs in the context of EncroChat messages in the case of MN (C-670/22 30 April 2024). The governments of France and the Netherlands took part in the proceedings and made submissions. The case directly concerned proceedings in Germany based upon EncroChat messages which had been obtained pursuant to a similar procedure under an EIO. Following agreement with the authorities who had obtained the data, prosecutions were brought in reliance upon the contents of the messages. Questions were raised by the German court about the use of an EIO in these circumstances, including the question of whether or not concrete evidence of a serious offence committed by specified persons were required to found the EIO request or whether indications of offences committed by yet unidentified persons might suffice. It was further asked whether the principle of proportionality precluded an EIO being issued where the integrity of the data being gathered by the interception method could not be verified because of the confidentiality of the technology which had been deployed, which might prevent an accused person commenting effectively on the data in any subsequent criminal proceedings. The court’s answer to these questions was as follows:

“88 Article 6(1)(a) of Directive 2014/41 thus requires a review of the necessity and proportionality of the issuing of the EIO by reference to the purpose of the proceedings referred to in Article 4 of that directive. The latter article, which determines the types of proceedings for which an EIO can be issued, provides, in point (a), that an EIO may be issued ‘with respect to criminal proceedings that are brought by, or that may be brought before, a judicial authority in respect of a criminal offence under the national law of the issuing State’. Since that provision refers to the national law of the issuing State, the necessity and proportionality of the issuing of an EIO must be assessed only in the light of that law. 89 In that regard, in view of the referring court’s queries as set out in paragraphs 82 and 83 of the present judgment, it should be made clear that, first, Article 6(1)(a) of Directive 2014/41 does not require that the issuing of an EIO for the transmission of evidence already in the possession of the competent authorities of the executing State is necessarily subject to the existence, at the time when that EIO is issued, of a suspicion, based on specific facts, of a serious offence in respect of each person concerned, if no such requirement arises under the national law of the issuing State.”

The Grounds, Submissions and Conclusions

[27]As set out above, ground one is the contention, presented in a variety of different ways, that the EIO was in breach of the Directive and inconsistent with the power that was used to issue it. The first submission made on behalf of the second claimant is that the EIO served in March 2020 was defective because the UK was not requesting that the French authorities, pursuant to the EIO, undertake any investigative measures. The request made by the EIO was for the provision of evidence, and there is no provision within the Directive for an anticipatory request in relation to the provision of evidence which has yet to be obtained. Article 13 of the Directive addresses the transfer of evidence indicating that there must be a link between the investigative measures and the transfer of the data. The second claimant further submits that it cannot be possible to have an EIO provision of evidence by way of an anticipatory request because this would undermine the ability of any person affected to exercise their rights in relation to, for instance, the protection of personal data. As a consequence, the EIO is invalid.

[28]I am unable to accept that it is properly arguable that an EIO issued in circumstances such as the present case is not authorised or inconsistent with the Directive. The submission the second claimant advances has the flavour of submissions which were rejected in the case of C. In particular, as noted in C, given the breadth of the purpose of the Directive it should be made the subject of a broad and purposeful interpretation. Furthermore, at paragraph 60 of C the Divisional Court, in rejecting ground two, made clear that the correct understanding of the EIO was that it was requesting evidence which the French authorities would have in their possession. There is nothing within the terms of the Directive which suggests, in circumstances where it is known that evidence of a particular kind is going to be gathered bearing upon criminal activity which is suspected, that an EIO seeking that evidence cannot be issued. Indeed, the consequence of the second claimant’s submission would lead to the kind of technicality and procedural complexity which the Directive was specifically designed to overcome. In other words, there is nothing in the Directive which suggests that the UK could not issue a valid EIO for the EncroChat data until after the authorities in France had it in their possession. The form of this EIO was perfectly legitimate, and the second claimant’s submissions in relation to anticipatory requests undermining other potential rights does not assist him since the type of EIO which was issued in this case entirely reflects the regime created by the Directive and which will have been accounted for in its enactment.

[29]The second strand of submissions is that the EIOs, presumably including the bespoke EIO, were excluded in the current circumstances because the evidence from the EncroChat system was being obtained by means of the French/Dutch JIT.

[30]On behalf of the first claimant it was submitted that the exchange of Siena messages on 27 March 2020 supported the illegitimacy of the EIO. At the meeting on 21 January 2020 the Dutch authorities had said that they required permission to share information outside the members of the JIT and the language of the message indicated that the data in relation to threats to life could not be shared without permission. It was submitted that the whole of the Siena message sent on 27 March 2020 was related to threats to life and specified that permission from the JIT participants would be required to share any information. Thus, the EIO was not the correct method for this evidence to be provided to the UK authorities but rather an alternative MLAT procedure was required.

[31]The first claimant submitted additionally that the terms of the JIT agreement also reflected this understanding of the earlier messages. The JIT agreement makes clear that the agreement of all of the JIT parties would be required before any data could be shared. There was no mention at all of any EIO elsewhere in the JIT agreement. This approach was further reinforced by a document called the fifth JIT Evaluation published by Eurojust in June 2025 which provides as follows:

“It is important to reach agreements before the operational phase on the sharing of data and electronic evidence with non-JIT countries. Very often, JIT countries will not share such data during a live phase in order not to compromise the case. Moreover, countries outside the JIT that want to receive data will need to know to which JIT party they have to address an EIO or MLA request.”

[32]On behalf of the third claimant it was submitted that a JIT has an obvious impact on the sovereignty of the individual parties joining it and the construction of article 3 excluding an EIO in these circumstances is supported by the fact that the JIT is a bilateral agreement whereas the EIO process is purely unilateral. On this basis EIOs in this situation are excluded. Even were it possible for the JIT to have provided for the French authorities to respond to EIOs this did not occur in the present case.

[33]Having considered these submissions I have reached the conclusion that they are unsustainable. I do not consider that article 3 of the Directive is capable of bearing the meaning ascribed to it by the claimants. The purpose of article 3 is clearly to preserve the possibility of setting up a JIT for the gathering of evidence in appropriate circumstances alongside the reorganisation and consolidation of the legal arrangements in this area undertaken by the Directive. The clear intention and purpose of article 3 is, in my judgment, made plain by the terms of recital 8, which clearly contemplates that the new regime of EIOs established by the Directive should not preclude the setting up of JITs where appropriate as a type of investigative measure. These provisions do not exclude the opportunity for an EIO to be applied for in respect of a member state who is a participant in a JIT, and there is nothing in the Directive to suggest that it is not possible for an EIO to be used to request evidence which has been gathered by an executing state whilst participating in a JIT.

[34]Furthermore, I accept submissions made on behalf of the defendants that the contentions advanced by the claimants on the facts are equally unsustainable. Mr Jakhura’s email of 23 January 2020 made clear that in relation to information sharing with the UK “EIO to be utilised with France, Netherlands”. It further identified that the Netherlands would share all information obtained by the JIT and work with the UK and other EU partners through Europol. I am unable to accept the submission that the Siena message from the Dutch authorities on 27 March 2020 was solely limited to the threats to life material. It is clearly written, and the conditions are clearly specified, on a far wider basis and in relation to the data obtained from the EncroChat system as a whole. Furthermore, the Siena message made clear that the data could be used in judicial procedures but only after “the applicable EIO or MLAT procedures” (emphasis added). What is described in this Siena message is indeed what occurred without apparently any objection being raised by either the French or Dutch authorities. Ground one therefore fails on the evidence.

[35]These conclusions are further reinforced by the factual circumstances of the case of MN which reflect that the provision of the EncroChat data in Germany followed a similar procedure to what which was followed in the UK. Whilst both the French and Dutch authorities participated in that litigation they apparently made no suggestion that using the EIO procedure to access data held by the JIT was in any way illegitimate or contrary to the provisions of the Directive. In fact, the conclusions of MN reinforce the findings that were made by the Divisional Court in C in respect of this material. The submissions made in relation to a JIT sharing sovereignty and being bilateral as opposed to an EIO being unilateral adds nothing in my judgment to the argument which must start from the correct approach to the construction of article 3 of the Directive. For the reasons which have been set out above, the claimant’s contentions are not arguable.

[36]Before leaving ground one it should be noted that on behalf of the second claimant it was argued that an element of the illegality of the EIO was the failure to use Annex C on the basis that what was sought involved the interception of telecommunications. Whilst this argument was presented in the written material, at the hearing it was fairly acknowledged on behalf of the second claimant that since this omission did not affect the rights of the claimants it was a submission to which section 31(2)(c) of the Senior Courts Act 1981 applied on the basis that any error of law would not give rise to any substantially different outcome for the claimants. There is therefore nothing further to be said in respect of this argument.

[37]Turning to ground two, these submissions relate to the EncroChat data which was obtained from handsets present in Dubai and the bespoke EIO which was obtained for the purposes of the proceedings against the second claimant (and in which the first claimant is interested). It is submitted that this material fell outside the scope of any possible agreement between the JIT and the UK authorities and was, further, beyond the jurisdiction of the JIT because the Directive was constrained by the territorial limits of the EU. The limitation of the Directive to EU territories is a matter which is reinforced by guidance on JITs and thus the obtaining of this data exceeded the powers of both the EU and the JIT.

[38]Allied to these submissions reliance is placed by the second claimant on the provisions of section 107 of the Investigatory Powers Act 2016 which precludes a class of law enforcement chief specified in section 107(2) from issuing a targeted equipment interference warrant unless there is a British Isles connection. It is submitted that on the basis this data was outside the terms agreed between the JIT and the UK for data sharing, it also fell outside the scope of the targeted equipment interference warrant which had been obtained. The beneficiary of the data was West Midlands Police not the NCA and the warrant had not been sought by the Chief Constable nor had the Chief Constable collaborated with the NCA in obtaining it. Furthermore, it is contended that it was in breach of the Directive in that the obtaining of this data failed to respect international law and the sovereignty of the United Arab Emirates. This is because it was beyond the territorial scope of the Directive and was a breach of international law.

[39]In my judgment the defendant’s submissions in connection with this ground are entirely sound and the ground is misconceived. It is clear that the bespoke EIO was a request to the French authorities to transmit to the UK data which they already had in their possession: none of this data had been obtained either at the request of the UK or pursuant to any targeted equipment interference warrant. Further, during the course of the defendant’s oral submissions, attention was drawn to section 7 of the Crime and Courts Act 2013 which provides the power for the second defendant to receive information which is disclosed to it and then, pursuant to section 7(4), disclose information which has been obtained by the second defendant to other parties in the exercise of the NCA’s statutory functions. In short, it provides a power to receive and then disclose on a “police-to-police” basis information such as that which was received from the French authorities pursuant to the execution of the EIO. In short, there is no substance in any suggestion that what occurred in relation to the Dubai data was unlawful and ground two is not arguable.

[40]In relation to the points raised about breaches of the sovereignty of Dubai and contravention of international law, in my view the defendants are correct when they observe that those issues, if they were issues at all, were matters which the second defendant and the UK authorities were entitled to assume were resolved by the French authorities as part and parcel of them obtaining the evidence. The EIO requested the specified material which came into the possession of the French authorities and that is what was provided.

[41]Ground three relates to the use of material obtained from the Dubai handset in the interviews which occurred with the second claimant around 16 June 2020. It is submitted by the second claimant that this material was not covered by the EIO and could only have been received on the basis of a threat to life. As such, it was necessary for an instrument to be put in place for this material to be received and therefore its use as evidence in the investigation against the second claimant was unlawful.

[42]In my judgment there are a number of complete answers to this submission. Firstly, the disclosure of this material on the basis that it contained what was legitimately regarded as a threat to life, followed up with the permission of provision to use it, rendered its deployment in the interviews of the second claimant entirely legitimate. This was an appropriate procedure which reflected the arrangements which had been agreed between the parties and was reflected in the Siena messages exchanged on 27 March 2020. In my view the defendants are entitled to draw attention to what was noted by the Divisional Court in the case of R v Knaggs

[2018] EWCA Crim 1863

, when at paragraph 168 of the judgment the Divisional Court observed in the context of formal procedures then contemplated under the provisions of RIPA that the existence of these provisions “does not prevent less formal liaison between police and prosecutors in this country and police and prosecutors abroad, including the provision of information by one to the other”. The admissibility of any intercept evidence which was obtained after such a liaison on a “police-to-police” basis would depend upon the particular facts of the case and the consideration of the discretion to exclude such evidence pursuant to section 78 of the 1984 Act. I have therefore reached the conclusion that ground three is not arguable.

[43]In my view ground four adds nothing to the substance of the claimant’s case. The second claimant points out that section 10 of the 2016 Act requires an EU instrument to be in play if material is to be legitimately introduced into proceedings. The observation that section 10 could not be relied upon if the EIOs were invalid begs the question as to whether or not the EIOs were in fact unlawful. For the reasons which I have set out already the EIO was lawful and therefore ground four simply does not arise.

[44]Turning finally to the further submission made on behalf of the claimants, namely that proportionality ought to have precluded the issuing of the EIO on the basis that the detailed mechanism whereby the data had been captured was unknown, I am not satisfied that this point is properly arguable. It is clear from the Directive that proportionality is required to be considered by the issuing authority when determining whether or not to issue an EIO. Article 6(1)(a) makes plain that the issuing of the EIO must be considered to be necessary and proportionate for the purposes of the proceedings which are in contemplation pursuant to article 4. In my view it is clear from the terms in which the EIOs were expressed that the second defendants had the necessity and proportionality of the measures which were being sought clearly in mind at the time when the EIOs were prepared. As the text of the EIO explained, the purpose of seeking the information from the EncroChat system was founded on the contention that it was principally used by organised criminal operations for communications in relation to facilitating serious crime. Obtaining access to that data in circumstances where it was the only potential means of investigating this extensive criminal activity was clearly a matter to which significant weight should attach. The absence of legitimate use of the system was a further material feature. In the circumstances I am unable to detect any arguable flaw in the EIO based on the consideration of proportionality in the case.

[45]For all of the reasons which have been rehearsed above, I am not satisfied that any of these applications for judicial review are properly arguable and permission should therefore be refused on the merits.

Procedural Issues

[46]As set out above, a number of procedural objections were raised in respect of these applications. In the light of the views which I have reached on the merits of the applications, it is not necessary to deal with those objections in any particular detail, but for the following brief reasons I am satisfied that they all represent a good reason why permission ought not to be granted in the present case.

[47]The first objection raised is in relation to time limits. Whilst it is contended by the claimants that the complaint is some form of continuing breach I am unable to accept that argument. The reality is that the focus of this challenge is the decision to issue the EIO and that is a challenge which should have been brought at the same time as the challenge in C. There is no coherent reason why the arguments which are now made in these applications could not have been made many years ago and the challenges have been brought far too long out of time for it to be legitimate to allow them to proceed. As I have indicated, this is not a case of a continuing breach in the form of the application of a policy, but rather a challenge which is focused upon a discrete decision to issue an EIO which was now taken well over five years ago. These claims are therefore, in my judgment, time barred.

[48]The arguments in relation to alternative remedy are clear and, in my judgment, coherent. They reflect the conclusions which were reached by the Divisional Court in the case of C. There was for the second claimant an appropriate alternative remedy to this application in the form of submissions pursuant to section 78 of the 1984 Act in the Crown Court trial that this evidence should not be admitted and the judge should exercise the court’s discretion to exclude it. That is an alternative remedy which is still available so far as the first and third claimants are concerned. This is a further good reason for refusing permission to apply in relation to these applications.

[49]The third objection relates to the decision reached by the Court of Appeal in the appeal against conviction by the second claimant. It is clear from the judgment of the Court of Appeal that many of these arguments were considered and rejected in the course of the court’s decision. Insofar as there may have been points which were not aired in the Court of Appeal’s decision and which may have required consideration, they have now been addressed in the assessment of the merits set out above. It is clear that I have reached the conclusion that whether or not the decision of the Court of Appeal is binding upon me it was nevertheless an entirely appropriate decision.

Conclusions

[50]For the reasons which have been set out above I am satisfied that these applications for leave to apply for judicial review must be refused. Given the extent of the argument which was presented to the court and the potential wider interest in these issues I give permission for this judgment to be cited, notwithstanding that it is solely a decision on permission to apply for judicial review.