A National Crime Agency (NCA) officer has denied deleting a key document related to Operation Venetic, the agency’s investigation into criminals using EncroChat encrypted devices, and has told a tribunal the failure to disclose another document was a “complete error.”
Emma Sweeting was giving evidence at an Investigatory Powers Tribunal, which is hearing legal challenges by 10 individuals on the use of encrypted conversations by the NCA from EncroChat, which resulted from a hack conducted by French law enforcement.
At the heart of the case are Targeted Equipment Interference (TEI) warrants, which the NCA obtained on March 25, 2020, in order to access up to 9,000 EncroChat devices in the UK and investigate the alleged owners of those devices.
Lawyers for the 10 say the NCA knew EncroChat was a live intercept—something the NCA deny—and that they should have requested a Targeted Interception (TI) warrant but that would not have allowed the evidence from the encrypted devices to be used in an English or Welsh court.
A hearing in September heard Sweeting discussed EncroChat with Jeremy Decou, the senior investigating officer (SIO) in the French police, in January 2020.
Then, between Feb. 19 and Feb. 21, 2020, Sweeting and other officers visited Europol and were given a full briefing about EncroChat.
On Wednesday, Sweeting was called back to be cross examined by barristers representing the 10 EncroChat individuals.
The tribunal has heard that Sweeting took notes during the February 2020 briefing, drawing up conclusions and then emailing her gold commander, Matt Horne, two days later.
‘It Was a Complete Error on My Part’
Simon Csoka, KC, asked her, “Did you think you had deleted it?”Sweeting said: “When I was asked to provide documentation of the Feb. 19—21 meeting I did the disclosure exercise but I found my rolling note only recently. It was a complete error on my part.”
She said the notes she took had been drawn up in a document on Feb. 21 after discussing with the NCA what conclusions they had drawn from the Europol briefing.
“I checked it for spelling and grammar and sent it to the gold commander on the 23rd. My recollection is that on the Friday at the conclusion of the meeting I went through the conclusions to make sure it was true and accurate,” Sweeting said.
But Csoka pointed out that the word count in the blue-black note was considerably different from the rolling note.
“I provided the material to the disclosure team. I can see there is a difference but I can’t account for that,” Sweeting replied.
She was then asked by Csoka why two of the 18 conclusions were missing from the document which was sent to Horne, upon which he based his request for a TEI warrant.
Sweeting replied: “I wish I could recall. The conclusions aren’t in this version but my recollection was that I put them in.”
Csoka asked, “Where are they?”
“I’m sorry but I can’t find another version. I would not have deleted anything. When I found it I disclosed it. Then I gave them my laptop. I’ve not deleted anything,” Sweeting said.
Csoka asked, “If you haven’t deleted it, how could it have disappeared from your laptop?”
“I can’t explain,” Sweeting replied.
Csoka asked, “It would still be there if you are telling the truth, wouldn’t it?”
“I am telling the truth,” Sweeting replied.
Csoka asked: “There’s no burn time on NCA documents is there?”
“I don’t believe so,” Sweeting replied.
Csoka asked, “So it must have been manually deleted?”
Barrister Claims Witness Was ‘Deliberately Misleading’
After Sweeting completed her evidence, another barrister for the EncroChat defendants, Matthew Ryder, KC, said he would be making a submission that Sweeting had been “deliberately misleading” in a statement she gave in November 2022.EncroChat evidence has been used to prosecute thousands of people across Europe and hundreds in Britain and a number of trials have heard that the software had a “burn time” facility which allowed criminals to send each other incriminating messages which would then self-destruct and delete themselves after a certain amount of time.
At one time 50,000 people—more than 9,000 of them in Britain—were using EncroChat to send and receive secure messages.
But in March 2020 French police, using malware in the form of a software update, managed to hack into EncroChat’s network which was hosted on a server in the town of Roubaix in northern France, and infiltrated tens of thousands of encrypted messages.
The messages were shared with the NCA in Britain, which launched Operation Venetic and claimed to have identified hundreds of criminals who were dealing in drugs and guns and plotting murders.
In May this year Paul Fontaine, 36, from Hackney, east London, and Frankie Sinclair, 34, from Cardiff, Wales, were jailed for life for conspiracy to murder on the basis of EncroChat evidence.
Earlier this year Luke Shrimpton, a senior technical expert who has since resigned from the NCA, told the tribunal the NCA had purchased some EncroChat devices in 2017 and 2018 which he was trying to use to reverse-engineer the technology and break the encryption, before they discovered the French were already well advanced with their own hack.
A three-day hearing, chaired by Lord Justice Edis, is due to finish on Friday and the judges are not expected to make a final ruling until 2023.
If it decides the NCA breached the Investigatory Powers Act it could mean hundreds of EncroChat convictions being quashed.
