'Wot no questions & missing file found 32 months on' - NCA officers grilled during EncroChat case

NATIONAL Crime Agency (NCA) officers were accused of pre-ordaining the type of warrant needed to access hacked EncroChat messages before they knew how it was carried out, a tense hearing of the Investigatory Powers Tribunal (IPT) heard today.

Ten people charged under Operation Venetic - the NCA investigation into the use of the supposedly encrypted EncroChat phone system by organised criminals - lodged a complaint with the IPT that the targeted equipment interference (TEI) warrant that the NCA applied for to access historic phone date of British users was unlawful.

They argue that because some of the messages received from French police, who carried out the EncroChat infiltration in March 2020, were sent in real-time, they were a live intercept and therefore a targeted intercept (TI) warrant was required and the evidence, which is being used in several crown court cases, should be inadmissible in the UK.

As the IPT hearing rumbled on inside the High Court today, there was a protest outside, including with a van decked out with EncroChat information.

There were also banner waving protests outside crown courts at Edinburgh, Glasgow, Newcastle, Manchester, Leeds, Sheffield and Liverpool.

Campaigners also fitted EncroChat signs to railings at roadsides and on dual carriageway bridges.

Inside the IPT hearing, Barrister Simon Csoka, acting for some of the defendants, said today: "I suggest it was pre-ordained by the NCA to be a TEI."

It was during the cross examination of NCA officer Wayne Johns, an NCA senior investigating officer awarded in June this year an OBE for his work on EncroChat, who replied: "I do not accept that."

Mr Csoka pointed to an NCA memo sent two weeks before officers met with Europol, to learn more about how the hack was carried out, which said that "the technique that will be used will be TEI not TI."

Mr Johns said: "I can see that."

Mr Csoka said: "At that stage there had been no technical explanation from the Joint Investigation Team (JIT). Did anyone question this?"

Mr Johns said: "I can't answer for others. I didn't."

He could not recall who, within the NCA, had determined a TEI was appropriate ahead of the European talks.

Mr Csoka asked him if there had been a policy within the NCA not to ask questions surrounding the warrant type and he replied "absolutely not."

Mr Johns was also asked about an earlier statement he made in which he said the NCA did not have any EncroChat devices that had been infected by the infiltration that were not part of those seized during investigations.

It later transpired that the NCA had purchased three that were infected.

Mr Csoka said: "Are you saying when you made the statement that the NCA did not know it had (three) infected devices?"

Mr Johns said the position had not been clear when he wrote it, but it subsequently came to light, but he was not clear had authorised their purchase.

Emma Sweeting, an NCA intelligence officer, who in January 2021 was also awarded an OBE for her work on Operation Venetic, was asked about a report of a Europol meeting from February 19 to 21 that she had forgotten existed and said she found on her work laptop in October this year.

The newly disclosed report differed in its content to the report of the meeting that she had sent to NCA superiors and other officers on February 23.

She had said in earlier statements and evidence to the IPT hearing in September that the February 23 report, known as the "blue-black" note, had been the only report of the meeting.

In the blue-black note she had said she was confident that a TEI warrant was required to access the EncroChat data.

However, the newly found earlier "rolling note" had left this ambiguous.

Mr Csoka said: "it (rolling note) said TI/TEI so no answer to whether it was TI or TEI. Not on this version, but on the February 23 version you appear to have established that it was a TEI."

Asked about the newly discovered older version, she said: "I admit it was an error on my behalf.

"This older version was only found very recently. It was an oversight on my part and not a case that I knew all along... I apologise to the court that the disclosure is so late."

She said she believed everything had been disclosed during the earlier proceedings, but she was asked to do a disclosure review in October when she discovered what she called the "rolling note" on her NCA laptop.

She denied any files had been deleted.

Asked about the difference between the two notes in terms of warrants needed, she said: "The rolling note was quite unclear in some cases.

"That bit I wish I could explain more about, but I am unable to I'm afraid.

"I have given over the document and I have given as much information as I can recall around them.

"I really wish I could assist more."

Mr Csoka pointed out that the word count of the blue-black note was considerably different from the rolling note and two of the 18 conclusions from the earlier note were not on the one eventually sent.

She said: “I provided the material to the disclosure team. I can see there is a difference but I can’t account for that.”

Matthew Ryder, barrister for some other defendants on the case, said: "Her submission that she forgot about the rolling note is untenable. I will be submitting that she was deliberately misleading or willfully blind."

Both NCA officers vehemently denied being misleading at all.

French and Dutch cyber experts infiltrated the system, used by 60,000 people worldwide and 9,000 in the UK, in April 2020.

They obtained historic images and messages sent but also monitored new ones sent in real time until June that year after the owners realised the compromise and shut down the platform, said to have been used exclusively by criminals.

The NCA was offered access by European counterparts to messages of UK based users if they could obtain a lawful warrant to access the information due to different laws in the UK about the use of intercepted data.

Judge Leveson authorised the warrant and the NCA was provided with access to infiltrated data.

The tribunal heard that if the data was extracted directly from the EncroChat server it was a live intercept, but if it had been stored on the devices first it was classed as "targeted equipment interference," from which evidence can be used in British courts.

However, the tribunal heard the NCA claims the French have refused to reveal exactly how they carried out the hack for security purposes.

Lawyers for complainants argued the NCA therefore can't know if the data was stored on devices or came live from the server.

At an earlier IPT hearing in September, Stephen Kamlish KC, for one of the complainants, said Luke Shrimpton, a former NCA technical officer, had told bosses he had wiped his phone that contained messages about the discussions and thrown it in a bin after he got a new one, after he was asked by bosses to disclose its contents.

He suggested to Mr Johns, that they had actually received details from the French of how the hack worked but it had been "suppressed" because it showed it was live data.

Mr Johns replied: "No it wasn't."

The hearing continues.