Officer Denies NCA ‘Suppressed’ Evidence About EncroChat Phone Investigation

Hundreds of UK criminal prosecutions depend on outcome of tribunal

Campaigners against the National Crime Agency's use of data hacked from EncroChat by French police protest outside the Old Bailey in London on May 27, 2022. Chris Summers/The Epoch Times

A National Crime Agency (NCA) officer has denied key facts were deliberately “suppressed” about what discussions took place with French law enforcement in the run-up to the hacking of EncroChat—an encrypted phone network allegedly used by thousands of criminals across Europe—in March 2020.

On Friday, Wayne Johns was cross examined by Stephen Kamlish, KC at an Investigatory Powers Tribunal which is hearing legal challenges by 10 individuals on the use of encrypted conversations by the NCA from EncroChat, which resulted from a hack conducted by French law enforcement.

At the heart of the case are Targeted Equipment Interference (TEI) warrants, which the NCA obtained on March 25, 2020, in order to access up to 9,000 EncroChat devices in the UK and investigate the alleged owners of those devices.

Kamlish asked Johns about discussions between his colleague Emma Sweeting and Jeremy Decou, the senior investigating officer (SIO) in the French police, in January 2020.

French Offered to Explain How ‘Rogue App’ Worked

In one email Decou offered to put technical experts at the NCA in touch with French technicians who could explain how “our rogue app” worked.

Kamlish asked, “The main question is whether the material was selected from the database or stored on a server ... that was the big question wasn’t it?”

Johns, who was given an OBE in the Queen’s birthday honours in June for his work on EncroChat, replied: “Yes. It was the crux of knowing how we would be able to use the material.”

Under English law evidence which is intercepted live, such as from phone tapping, is not permissible for use in a criminal trial, whereas emails, phone texts, and other messages are allowed. When it comes to EncroChat the key question is whether the hacked material was obtained by live interception.

Kamlish suggested the NCA had requested the information from the French, “got the answer they didn’t want,” and then “suppressed” it.

An undated handout photo issued by the Police Service of Northern Ireland of police during a raid in Operation Venetic, an investigation into EncroChat, an encrypted phone network. Police Service of Northern Ireland/PA Media

At one time 50,000 people—more than 9,000 of them in Britain—were using EncroChat to send and receive secure messages.

But in March 2020 French police, using malware in the form of a software update, managed to hack into EncroChat’s network which was hosted on a server in the town of Roubaix in northern France, and infiltrated tens of thousands of encrypted messages.

The messages were shared with the NCA in Britain, which launched Operation Venetic and claimed to have identified hundreds of criminals who were dealing in drugs and guns and plotting murders.

In May this year Paul Fontaine, 36, from Hackney, east London, and Frankie Sinclair, 34, from Cardiff, Wales, were jailed for life for conspiracy to murder on the basis of EncroChat evidence.

Earlier this week Luke Shrimpton, a senior technical expert who has since resigned from the NCA, told the tribunal the NCA had purchased some EncroChat devices in 2017 and 2018 which he was trying to use to reverse-engineer the technology and break the encryption, before they discovered the French were already well advanced with their own hack.

NCA Officer ‘Dumped Phone in a Bin’

Kamlish asked Johns, “Did you know that Luke Shrimpton had dumped his phone in a bin?”

“I knew he had got a new phone,” Johns replied.

Kamlish asked if there had not been an internal inquiry at the NCA to find out how Shrimpton’s phone, which could have contained crucial messages, had been lost.

Johns replied, “He has provided a witness statement and been cross examined at a number of trials.”

Kamlish then asked a series of questions about the legal advice Johns and his team had received from the NCA’s own legal department before they contacted the Crown Prosecution Service for permission for the TEI warrant.

Kamlish said: “So 26 minutes after the warrant was granted you were asked by the CPS about NCA legal’s own advice and you said ’the actual legal advice document is privileged.' That is a lie isn’t it?”

The National Crime Agency building in Westminster, London, on Oct. 7, 2013. Dan Kitwood/Getty Images

Johns denied it and said he could not remember why he had said the document was covered by legal privilege.

Earlier Abbas Lakha, KC challenged Johns about the NCA’s assertion that EncroChat was used exclusively by criminals.

Lakha asked Johns about the NCA’s assessment that only 294 of the 7,407 EncroChat devices which were accessed in the UK “had not demonstrated a clear link to criminality.”

Lakha pointed out that on one phone, which was not counted as one of those 294, there were 360 images of houses, cooking, and children, and 4,501 messages of a “general, domestic, and non-criminal” nature, as well as 708 deleted messages, all of which were non-criminal.

Johns said that there was not “sufficient data” for that device to be analysed and confirmed as having “not demonstrated a clear link to criminality.”

Later Johns added, “The assessment is that the network was used exclusively for criminal use.”

Lakha suggested the NCA had failed in its “duty of candour” when it came to disclosure.

A four-day hearing began on Tuesday, but on Thursday Lord Justice Edis announced he was suspending the Cloud Video Platform link, which had allowed around 30 journalists and lawyers to watch the proceedings, after it was allegedly recorded and a link put on Twitter.

The tribunal is due to conclude the evidence-taking part of the hearing in December and may not make a final ruling until early in 2023.

If it decides the NCA breached the Investigatory Powers Act it could mean hundreds of EncroChat convictions being quashed.