Court finds EncroChat hacked messages admissible as former footballer is jailed | Computer Weekly

© François LAFITE / OVHcloud

A former Liverpool youth footballer has been jailed for supplying drugs after a judge ruled that messages and data harvested by police from the EncroChat encrypted phone network can be lawfully used as evidence in the case.

The case, known as Embossed II, was the “lead case” in a long-running legal argument over whether evidence obtained by French police from the EncroChat encrypted phone network is legally admissible in the UK courts. Jamie Cassidy, 46, was jailed for 13 years and three months for taking part in a large drugs conspiracy, after his activities were exposed by messages intercepted from the EncroChat encrypted phone network.

He was sentenced with his brother Jonathan Cassidy, 50, from Crosby in Merseyside, and Nasar Ahmed, 51, from Bury, at Manchester Crown Court on 21 March, over their involvement in a large international drugs operation. They pleaded guilty after Judge Nicholas Dean, the recorder of Manchester, found that messages obtained from the EncroChat encrypted phone network could be lawfully used as evidence in the case.

Dean also cleared the National Crime Agency and Crown prosecutors of “abuse of process” and dismissed arguments from defence lawyers that the agency had deliberately failed to disclose technical evidence needed by expert witnesses hired by the defendants.

The three men were arrested in 2020 after French police hacked into the EncroChat encrypted phone network and passed on messages to the National Crime Agency, which led to their identification as participants in an operation to import and distribute cocaine in the UK. It was part of a wider operation that led to French police obtaining 115 million messages from an estimated 60,000 users of EncroChat phones worldwide.

Police forces and law enforcement agencies in the UK have made more than 3,100 arrests, convicted 1,500 offenders, recovered over nine tonnes of Class A drugs, and seized 3,500 rounds of ammunition and £84m in cash, according to figures from Greater Manchester Police.

In a written ruling on 18 March that can now be reported, Judge Dean said there was no doubt that a vast amount of data was retrieved, and that the material, if admissible, implicates those proved to have used the handsets to send and receive messages in serious crime. “Whatever else, this is not a case of flawed or corrupted software giving the appearance of individuals being involved in criminal activity,” he said.

The case is the latest to address the question of whether EncroChat evidence can be lawfully used as evidence in courts.

Under UK law, phone calls or data intercepted during the course of transmission are prohibited from being used as evidence, and cannot be referred to during a court hearing to protect the methods used by intelligence agencies and law enforcement.

The restriction, however, does not apply if the same data is obtained from storage in an electronic device through a hacking – also known as equipment interference – operation.

Prosecutors argued that French police infected EncroChat phones with a software implant that obtained the supposedly secure encrypted messages from electronic storage in phone handsets, and were therefore admissible under UK law.

Lawyers representing the defendants, however, argued there was evidence that EncroChat messages were intercepted during the course of transmission, and instructed expert witnesses to reverse-engineer EncroChat phones to discover how the interception process worked.

The defence arguments were dismissed by Dean in a ruling dated 18 March that found EncroChat messages were intercepted at a time they were “stored in or by the (telecommunications system)”, rather than during the course of transmission.

He said the issue had been litigated at least twice, including during two preparatory hearings that were scrutinised by the Court of Appeal.

According to submissions made by the French government to the European Court of Human Rights in April 2020, the French police used a “special investigative technique” to bypass EncroChat encryption that was capable of recording key strokes, capturing screen shots, and accessing and collecting data contained in a “digital terminal”.

The judge said an analogy used in the French submission, which compared the hacking operation to a search of a building containing illegal items such as drugs or fire arms, is consistent only with the French government regarding all the data as having been collected from storage in handsets.

The French implant collected data in two stages. During stage 1, both sides agreed the implant retrieved historic data, such as undeleted messages, from storage in a database on the EncroChat handsets.

Stage 2 was more controversial. Defence lawyers argued that evidence showed messages were captured live or in real time, during the course of transmission, while prosecutors argued the messages were obtained from storage in the phone handsets.

The judge concluded that references to “live” or “real-time” interception in evidence presented during the case referred to data captured and collected from storage before it was transmitted to the French authorities. Any “storage” before the implant collected the data would be “very brief”, but “very brief storage is still storage”.

Defence lawyers argued that the defendants did not have the opportunity to present expert evidence on how the EncroChat evidence was obtained. They said the Crown had deliberately limited the disclosure of technical evidence, and delayed or concealed disclosure of evidence to prevent the defendants discovering how EncroChat data was intercepted.

The judge said there were elements of the Crown’s approach to disclosure that were less than optimal, and that “some criticism” of its conduct is not misplaced, but that there was “no misconduct”.

Between March 2022 and March 2023, defence lawyers asked the NCA to disclose technical information and infected EncroChat phones to assist an expert witness, Ross Anderson, professor of security engineering at Cambridge University, and later, Czeck company Invasys, to reverse-engineer the implant.

The process exposed “disclosure problems” and revealed a “sometimes sub-optimal approach by the Crown”, but the judge found that failures in disclosure were a consequence of the scale of the EncroChat cases in the UK and the early distribution of EncroChat data to disparate police forces.

Dean issued an order requiring the NCA and prosecutors to disclose two EncroChat phones and the technique used by the NCA to extract EncroChat APK files from the phone to defence experts to aid their understanding of how the phones worked, on 13 March 2020.

Prosecutors applied for Public Interest Immunity (PII) on 13 April, and on 17 May, the judge issued an order to prevent the disclosure of the APK technique and the infected handsets. The PII ruling also prevented the disclosure of new information that, according to prosecutors, “definitively establishes that the EncroChat material was … intercepted, at a time when it was stored on the relevant EncroChat handsets”.

Dean wrote in his ruling on 18 March: “Although I agree that there is always something unsatisfactory about any trial process in which relevant evidence cannot be deployed, unsatisfactory is not unfair. ”

Simon Csoka KC, defending, had told the court the NCA and CPS had championed an at-best obstructive and at-worst dishonest approach to disclosure. The judge acknowledged that Csoka did not make these assertions gratuitously, but had pointed to evidence he described as a CPS strategy of dishonesty and obfuscation.

The judge found that the evidence was not consistent with a “malign and unlawful strategy”, but rather with a prosecution team discussing and sometimes struggling with the complexities of the EncroChat investigation and prosecution, and with the “sheer scale of their task”.

Judge Dean rejected calls from defence lawyers to hear oral evidence during the trial from Emma Sweeting, the intelligence operations manager at the NCA, Luke Shrimpton, a former NCA senior technical expert, and Jeremy Decou, an officer at the French Gendarmerie.

The judge found that Emma Sweeting and Jeremy Decou were largely reporting things they had been told by others in written evidence about the French hacking operation, but rejected claims by defence lawyers that they amounted to “multiple hearsay” and should not be admitted.

The judge also found that any technical evidence Shrimpton had given in previous cases was no longer helpful in determining the facts relevant to storage versus transmission, and decided not to consider it.

The judge also rejected defence arguments that a letter of request by CPS to the French asking for clarification of how the implant worked told the French what the CPS wanted to hear, and signposted the catastrophic consequences of giving an answer that did not support the Crown’s case that EncroChat messages had been taken from storage.

Defence lawyers also argued that the French reply deliberately answered a different question in order to avoid telling an outright lie. The judge said that the argument was “fanciful”.

Jamie Cassidy had been a leading scorer for Liverpool Football Club’s under-16s, and was described as a prodigy before his career was cut short with injuries.

The court heard that Jamie Cassidy had been drawn into a conspiracy to import large quantities of drugs by his brother, Jonathan Cassidy.

The three men used anonymous handles on EncroChat. Jonathan Cassidy used “whiskywasp”, Amed used “dottetdaw” and Cassidy used “nucleardog”.

The court heard that Jonathan Cassidy had joked that he shared the same birthday as El Chapo, a drugs kingpin featured in an episode of Narcos.

Nasar Ahmed admitted acting as a money transfer agent for deals arranged by Jonathan Cassidy to import cocaine to the UK from the Netherlands.

The court heard that in April 2020, Ahmed switched from an EncroChat phone to another encrypted phone, Sky ECC, amid concerns EncroChat may have been compromised. He was arrested at his home on 15 June 2020, two days after the administrators of EncroChat put out a warning that the network had been infiltrated and was no longer secure.

Jonathan Cassidy flew to Dubai after learning about Ahmed’s arrest, where he considered buying a villa with a budget of £2. 3m, which he intended to furnish with at £22,000 bed. He was arrested at Manchester Airport when he returned to England in October 2020.

Detectives estimated that Jonathan Cassidy and Nasar Ahmed were involved in importing close to £26m of drugs to the UK.

Sentencing, Dean said that although EncroChat phones were used by organised crime groups, there were relatively loose ties between Ahmed and Jonathan Cassidy. “It would not be accurate to say that Jonathon Cassidy and Nasar Ahmed were part of an organised crime group,” he added. “They were operating independently, but to their joint mutual benefit. ”

The judge said Jamie Cassidy had a more limited involvement in the drug conspiracy. The court heard that he worked as a prison listener with the Samaritans.

Wayne Johns, the NCA’s Operation Venetic senior investigating officer, said: “The Cassidy brothers and Ahmed pleaded guilty in this case after years of tenaciously challenging the legality of the case against them. The NCA and Crown Prosecution Service worked with GMP to robustly defend the challenge, and we now see the trio where they belong.

Detective Constable Marc Walby from the Greater Manchester Police Serious Organised Crime Group said the three men were from the upper echelons of organised criminals that operate in Greater Manchester.

“Jonathan Cassidy and his colleagues got far too comfortable with their encrypted phones and began bragging about their personal lives, but this just confirmed what we already knew about them,” he said. “Ironically, it was this bravado and these messages which have landed them in jail for a long time.

“This has been a long-running and complex case, and I would like to thank the NCA and CPS for their pursuit in defending the legal challenges associated with this case. Without, these convictions may not have been possible. ”

Jonathan Cassidy of Whitewood Park, Liverpool, was jailed for 21 years and nine months for conspiracy to import cocaine, conspiracy to supply cocaine, and conspiracy to conceal, transfer and disguise criminal proceeds. Nasar Ahmed of Moreton Drive, Bury, was jailed for 21 years and nine months for conspiracy to import cocaine, conspiracy to supply cocaine, and conspiracy to conceal, transfer and disguise criminal proceeds. Jamie Cassidy of Knowsley Lane, Knowsley, was jailed for 13 years and three months for conspiracy to supply cocaine, and conspiracy to conceal, transfer and disguise criminal proceeds.

A manhunt is underway for another suspect, Joshua Avis, who absconded during pre-trial hearings.

March 2023: Judge Dean, record of Manchester, orders the Crown to disclose technical material required by expert witnesses for the defence to reverse-engineer the EncroChat implant.

May 2023: The judge orders that material ordered to be disclosed to defence lawyers in March 2023 was protected by public interest immunity and should not be disclosed. Defence lawyers said the failure to disclose the material would mean that defence experts Ross Anderson and Invasys would not be able to continue their work. The French authorities answer questions about EncroChat interception after receiving a European Investigation Order and Letter of Request from UK prosecutors.

August 2023: A pre-trial hearing was scheduled to start, but did not take place after it emerged that Invasys, a Czechia-based company acting as an expert witness in the case, was continuing with its work on reverse-engineering the EncroChat implant. Invasys indicated it would complete its work in January or early February 2024.

November 2023: The French authorities answer a further question about EncroChat interception after receiving a European Investigation Order and Letter of Request from UK prosecutors.

22 January 2024: Embossed II hearing starts at Manchester Crown Court.

29 January 2024 – 6 February 2022: Manchester Crown Court begins hearing arguments over whether EncroChat messages were obtained by equipment interference (hacking) from phone storage or were intercepted during the course of transmission, and arguments over alleged “abuse of process” by prosecutors. Invasys reports its work would not be complete until mid-March 2024. The judge declined to delay the trial.

21 March 2024: Jonathan Cassidy, Nasar Ahmed and Jamie Cassidy are jailed for over 51 years after making guilty pleas.

A source: www.computerweekly.com/news/366575017/Court-finds-EncroChat-hacked-messages-admissible-as-former-footballer-is-jailed