French court docket ruling could result in authorized challenges over state Sky ECC and EncroChat cellphone hack
The French supreme court docket has turned to the European Courtroom of Justice to resolve whether or not EU residents have the suitable to problem the legality of proof obtained by French regulation enforcement by hacking the Sky ECC cryptophone community.
The Cour de Cassation has requested the European Courtroom of Justice to rule whether or not French regulation is in keeping with European regulation. It comes after the French courts refused the suitable of a German citizen to attraction in opposition to the lawfulness of the French hacking operation within the French courts.
The choice may have “vital penalties” for authorized proceedings within the European Union in opposition to people who’re charged with felony offences primarily based on proof obtained by French police from hacking the Sky ECC and EncroChat encrypted cellphone networks.
French, Belgian and Dutch police infiltrated servers belonging to Sky ECC, the world’s largest cryptophone community, and decrypted hundreds of thousands of messages between June 2019 and March 2021, resulting in the arrest of drug gangs throughout Europe.
French and Dutch police additionally harvested messages from tens of 1000’s of EncroChat cryptophone customers after police infiltrated the community’s servers in a novel hacking operation in 2020. A 3-year investigation led to six,500 arrests of organised crime and drug teams worldwide and the seizure of practically €900m in money and belongings.
France ‘breached European regulation’
A coalition of defence legal professionals, often called the Joint Defence Staff, are difficult the legality of the French hacking operation. They argue that France breached European regulation by acquiring hundreds of thousands of encrypted messages from Sky ECC and EncroChat with out grounds for suspicion in opposition to the people focused.
Additionally they argue that the French didn’t notify different EU states prematurely about after they intercepted messages from telephones exterior of French territory, denying different EU member states the suitable to object to the operation.
The defence legal professionals say that their argument gained additional weight after the French supreme court docket ruling in June 2025. The court docket acknowledged that EU states engaged in cross-border digital investigations should formally notify different EU states when intercepting information of their jurisdiction – an obligation defence legal professionals say has been ignored within the Sky ECC operation.
No authorized recourse
People going through prosecution have been denied the suitable to problem the lawfulness of the French hacking operations earlier than judges in their very own nation, as a result of the “mutual recognition” precept requires EU member states to simply accept proof offered by different member states beneath European Investigation Orders (EIOs).
On the identical time, individuals have been denied the suitable to problem proof within the French courts, leaving individuals charged with offences primarily based on intercepted Sky ECC or EncroChat messages with out authorized recourse to attraction.
German lawyer Christian Lödden and French lawyer Guillaume Martine filed an attraction on behalf of a person accused of crimes primarily based partly on proof from Sky ECC intercepts in Germany, within the Paris Courtroom of Attraction in June 2024, searching for to problem the lawfulness of the Sky ECC information. The court docket dominated that the person was not entitled to be heard by the French Courtroom.
Lödden, working with a community of European defence legal professionals, appealed the choice in the French supreme court docket in February final 12 months.
Choice may have ‘vital penalties’
The supreme court docket discovered that beneath French regulation, it was not attainable for individuals accused of crimes in different nations to deliver an attraction in France to problem the lawfulness of the proof, when it had been shared with one other nation beneath an EIO.
However the court docket additionally recognised the suitable of defendants to hunt authorized redress, and in a ruling on 16 September, the French supreme court docket requested the Courtroom of Justice of the European Union to find out if there’s a battle between French and European regulation.
“The interpretation requested is prone to have vital penalties…in proceedings at present underway in numerous member states of the EU, the place prosecutions depend on proof just like that contested right here, all originating from the Sky ECC process,” the court docket stated in its ruling.
‘Fishing with dynamite’
Lödden instructed Laptop Weekly that the French operation to hack Sky ECC, amounted to a mass surveillance operation in opposition to 170,000 units internationally, with out concrete grounds for suspicion in opposition to particular person cellphone customers required beneath European regulation. “It was like fishing with dynamite,” he stated.
Beneath present regulation, it was not attainable to have a court docket overview the lawfulness of the interception operations in opposition to Sky ECC and EncroChat, he stated, including: “That’s totalitarianism, not the rule of regulation.”
Justus Reisinger, a Dutch defence lawyer, stated that the French supreme court docket choice “created a risk of getting an actual efficient treatment” in opposition to Sky ECC.
No decide has thus far selected the lawfulness of proof obtained by French police by hacking encrypted telephones in different nations with out notifying these nations prematurely and giving them an opportunity to object, he stated.
“The Courtroom of Justice of the European Union and the French Cour de Cassation agree that interception is illegal if there isn’t a notification, and there was no notification. If this case is discovered admissible, then the result is nearly actually they’ll declare [the Sky ECC evidence] illegal,” he added.
France, which carried out the Sky ECC hacking operation, obtained the info on the premise that it might deliver prosecutions in opposition to people concerned in operating the Sky ECC community, together with its founder Jean-Francois Eap and distributor Thomas Herdman.
French police went additional and gathered information from Sky ECC telephones worldwide, which it offered to regulation enforcement businesses in different nations investigating organised crime teams who have been utilizing the encrypted telephones.
The Courtroom of Justice of the European Union is predicted to take as much as a 12 months and a half to answer the French supreme court docket.
