A & Ors, R. v

Factual and Procedural Background

This appeal concerns the admissibility of evidence obtained from an encrypted mobile phone system known as EncroChat, which was marketed as secure. The evidence was obtained by a Joint Investigation Team (JIT) of French and Dutch authorities who implanted malware onto EncroChat devices, causing the devices to transmit stored data to French law enforcement. This data was subsequently shared with United Kingdom authorities and used in criminal proceedings against appellants.

The procedural history includes a preparatory hearing under section 29 of the Criminal Procedure and Investigations Act 1996, conducted by Judge Dove J, who ruled that the EncroChat material was admissible evidence. The appellants appealed only the legal issue of admissibility, not the other rulings rejecting exclusion under section 78 of the Police and Criminal Evidence Act 1984 or abuse of process arguments.

The preparatory hearing lasted 15 days with extensive oral and expert evidence, and the judge delivered a detailed 129-page reserved ruling. The appeal focuses on whether the intercepted communications were obtained while being transmitted or from stored data, which determines admissibility under the Investigatory Powers Act 2016 ("the 2016 Act").

Legal Issues Presented

1. Whether the EncroChat communications were intercepted while "being transmitted" (section 4(4)(a) of the 2016 Act) or while "stored in or by the system" (section 4(4)(b)), affecting admissibility under section 56 of the Act.
2. Whether, if intercepted while being transmitted, the interception was carried out by conduct within the United Kingdom as required by section 4(8) and thus subject to exclusion under section 56(2)(a).
3. Whether the United Kingdom authorities unlawfully requested assistance from overseas authorities contrary to sections 9 and 10 of the 2016 Act, potentially engaging exclusion under sections 56(2)(b) and (c).
4. Whether the Targeted Equipment Interference warrants obtained were lawful and appropriate for the interception conducted, or whether a Targeted Interception warrant was required.

Arguments of the Parties

Appellants' Arguments

• The malware intercepted communications while they were "being transmitted," meaning the evidence is inadmissible under section 56 of the 2016 Act.
• The judge erred by treating data extracted from RAM as "stored" rather than "being transmitted," and failed to define when transmission begins and ends.
• The interception was effected by malware implanted on phones in the United Kingdom communicating entirely within the UK, so the interception was within UK jurisdiction.
• The National Crime Agency unlawfully requested the French authorities to conduct the interception, engaging sections 9 and 10 of the 2016 Act, and no appropriate Part 2 warrant was obtained.
• Previous case law and European Directives support a broader definition of "transmission" that includes data in RAM during extraction.

Prosecution's Arguments

• The EncroChat material was intercepted while stored in or by the system, not while being transmitted, thus admissible under the exception in Schedule 3 paragraph 2 of the 2016 Act.
• The exclusionary provisions of section 56 do not apply to material obtained under Part 5 Targeted Equipment Interference warrants, which differ from Part 2 interception warrants.
• The National Crime Agency did not perpetrate or encourage any interception-related conduct within the UK, as the relevant acts occurred in France.
• Sections 9 and 10 of the 2016 Act do not apply to the circumstances here; section 9 applies only to Part 2 warrants, and section 10’s mutual assistance provisions were complied with due to the European Investigation Order being a statutory power under the 2017 Regulations.
• The judge correctly interpreted the statutory scheme, the definitions of interception, and the warrant requirements.

Table of Precedents Cited

Court's Reasoning and Analysis

The court’s central task was to interpret section 4(4) of the Investigatory Powers Act 2016, which defines interception to include communications either "being transmitted" or "stored in or by the system." The parties agreed these are mutually exclusive categories.

The court analyzed the technical operation of the EncroChat system and the implant used by French authorities. It found that the implant extracted data from the devices’ memory (both Realm and RAM), not while communications were actively being transmitted through the network. The messages were unencrypted on the device at the time of extraction, indicating interception occurred from stored data.

The court rejected the appellants’ argument that data in RAM should be treated as "being transmitted," emphasizing that the statutory language uses ordinary English and does not require technical definitions. The court held that the communications were stored when intercepted and thus fell within section 4(4)(b).

The court noted that the 2016 Act establishes separate regulatory regimes and warrant requirements for interception of communications in transmission (Part 2 warrants) and for equipment interference (Part 5 warrants). The evidence was obtained under valid Targeted Equipment Interference warrants issued under Part 5.

The court further held that the National Crime Agency did not carry out interception-related conduct within the United Kingdom, as the modifying acts to the system occurred in France. Therefore, no offence under section 3(1) was committed in the UK.

The court considered the appellants’ arguments under sections 9 and 10 concerning requests for assistance and concluded that section 9 applies only to Part 2 warrants and is not engaged here. Section 10’s mutual assistance provisions were satisfied by the European Investigation Order, which was a statutory power under the 2017 Regulations, removing the need for a Part 2 mutual assistance warrant.

Consequently, the exclusionary provisions of section 56 do not apply to the EncroChat material obtained under lawful Part 5 warrants. The evidence is therefore admissible.

Holding and Implications

The court DISMISSED the appeal.

The holding confirms that communications extracted from devices while stored in or by the telecommunications system, even if obtained via equipment interference warrants, are admissible evidence under the 2016 Act. The decision clarifies the interpretation of "interception" as including stored communications and delineates the distinct regulatory regimes for interception of transmissions versus equipment interference.

The ruling has significant implications for cases involving encrypted communications and equipment interference, providing legal certainty that evidence obtained via lawful Part 5 warrants is admissible, even if obtained abroad and shared with UK authorities. No new precedent was set beyond the statutory interpretation and application to the facts of this case.