Was the EncroChat Hack Legal? If not, is there a legal mechanism which could allow the evidence to be used? Disclaimer: I am aware there are a lot nuances within law, particularly within each country, as such this question only concerns the wider EU law and UK law as these are the courts I am interested in specifically. However, if you have a generic answer around illegally or potentially legally obtained evidence, please feel free to answer. Summary: If you're unaware of the backstory, here's a quick summary. EncroChat was a crypto-phone provider. Their service was created in 2016 and sold via their website. Their &quot;unique&quot; selling point was guaranteed anonymity &amp; security via their own hardware units &amp; mobile network. While the platform was not designed for criminals or even exclusively used by criminals, it was thought to be used somewhat heavily by criminals. This led to the platform being hacked in a joint effort by: Dutch, Belgian, French and British police &amp; intelligence operators The ultimate result of this hack was a lot of data &amp; evidence of criminal activity. Was the Hack Legal? My first instinct is no, it was not legal to infiltrate this platform. There's a lot of misinformation &amp; confusion online about whether or not the hack itself was legal in the first place. The intelligence community claims that the hack was legal because the platform was riddled with criminal activity. But is that an accurate &amp; legal justification for such an action? Again, my first instinct is no. As an example, Signal is a secure messaging service, it was founded in 2014 and it was designed entirely with privacy &amp; security in mind. This means that Signal is used both by ordinary every day citizens as well as criminals. It is also used by journalists, politicians, dissidents and many more groups of people which may or may not need such levels of privacy &amp; security. Whether or not these people need privacy is neither here nor there they are entitled to it and Signal provides that platform. This leads me into my next point. Signal itself is a privacy platform, and like EncroChat, it is also used by criminals however, as far as we know, no hacking attempts have been made by intelligence agencies. I am unable to come up with a valid reasoning as to why this might be the case. It could be the case that intelligence agencies have tried to hack it &amp; failed and so, nothing has been published. But there is one key difference between Signal &amp; EncroChat, Signal is open-source. This leads me to believe that intelligence agencies have shied away from hacking attempts not because they don't want to destroy the privacy of its users but because they know more eyes are on it. EncroChat however was a closed source platform, perhaps this might be a reason why intelligence agencies targeted it, who knows? Irrespective of all of that, it still begs the question whether hacking a platform is legal at all? Everyone has a right to privacy, over 150 national constitutions recognise a right to privacy. So I have to wonder how it could possibly be legal for an intelligence agency to hack any platform which is perpetuating that right either via hardware, software, etc. If so many countries recognise a right to privacy, how is it that leading intelligence agencies can pick a target (in this case EncroChat) and perform border-line cyber terrorism against it all because some users are using it for malicious or criminal activity. It would be as if SSL/TLS was banned, outlawed, back-doored or hacked because some terrorists used it on their systems. What are the legal specifics within the EU around governments performing hacking against companies? What evidence do governments need in order to prove that these type of activities are in-fact necessary and legal? If the Hack was Not Legal Can the Evidence be Used? If so, how? If the attack on the platform was not legal (which I don't think it was) then how could the evidence still be used? Or could it be used at all? The reason I ask is because on the news today, I saw the first UK criminal to be convicted and all of the evidence used against him was cited from the evidence gathered during the EncroChat attack. This lead me to believing A. he has a terrible lawyer. B. perhaps the attack was ruled legal? C. the evidence isn't admissible and this is corruption at the highest degree. This also led me to wondering, say the evidence is ruled as being legally obtained, what would the legal process be for this gentleman? Would this go to the appeals court or would it have to go much higher than that? Finally, has either the EU or the UK made an official ruling on the data collected from the hack or is that still under investigation?
It's just been answered by the Court of Appeal: BBC News, Encrochat: Secret network messages can be used in court, judges rule (5 February 2021) A, B, D &amp; C v Regina [2021] EWCA Crim 128 (5 February 2021) The rationale for the decision is: Interception of messages renders them unable to be used as evidence. But the Encrochat system used end to end encryption, and the captured messages were in plain text and not decrypted by authorities. Therefore the captured evidence data could not have arisen from &quot;interception&quot; of messages. They were not intercepted messages, but on-device captures of the phones memory/RAM prior to encryption and sending. Corroborating this, the court observed that the captures also apparently included device data that was not part of any transmitted message,showing again, they were not &quot;intercepted&quot; data. It appears it was captured by some kind of software introduced onto the phones by French authorities, perhaps with UK involvement its not clear to me.
This question, along with a number of articles on the Internet, misconstrues what the rule change is about. The rule change does not say that you can get a search warrant, that is to enter premises with/without machineguns etc, solely on the basis that someone is running Tor on that premises. The rule changes actually has nothing to do with search warrants. The rule change is about "remote access" warrants and, specifically, the question of which magistrate you need to get the warrant from. The background is that statute grants the FBI the power to hack into a computer (that is, obtain "remote access") to search for and retrieve evidence in a criminal investigation. One of the preconditions for doing so is that they identify which district the computer is in, and apply to a magistrate in that district. (By way of further background, under the American way of distributing power, it is seen as a bad thing for (for example) a magistrate in California to be able to issue a warrant to an FBI agent to conduct a search in North Carolina.) When the target computer is desired to be hacked because it is running a hidden Tor service, then how does anyone know what district it is in? Where does the poor FBI agent apply for his or her warrant? This rule change resolves this practical problem by saying that, where the use of Tor or a similar system precludes any knowledge of the physical location of the target computer, then the FBI can apply for a warrant with any magistrate. See further http://www.fed-soc.org/blog/detail/amendments-to-federal-criminal-rule-41-address-venue-not-hacking-powers
Under United States law, it is not illegal to simply make an account on a forum where criminal activity takes place. The closest thing I can think of would be misprision of felony (AKA failure to report a crime), which requires active concealment (see United States v. Johnson, 546 F.2d 1225 (5th Cir. 1977)). Simply observing evidence of criminal activity and not reporting it would not qualify. However, if that forum also contains material that is illegal to posses (such as child sexual abuse material), downloading that (even by simply viewing it using your browser) could be a crime. I would note that I am specifically not advising you whether or not doing any of the other things, like making and publishing tutorial videos on how to access such sites, is likely to get you into trouble with the law. If you want that sort of legal advice, you should contact a lawyer, as the advice is going to be very specific to the exact details.
Maybe, but probably not The geographic location of the organisation is immaterial: under Article 3.2: This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: ... (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. Posts anyone (not just EU citizens) make to Reddit (or anywhere else) while they are physically located in the EU or UK engage the GDPR. Pushift.io is therefore captured by the GDPR and any denial of that is just plain wrong. Given the denial, it is likely right out of the gate that they are non-complient. For example, they are unlikely to provided the required information under Article 14. More importantly, it seems that they have not determined the lawful basis for processing the data under Article 6 - they can possibly rely on the public interest basis (preserving deleted publication is arguably a public interest) or a legitimate interest but that requires a balancing of their interest against the data subject's. That said, the right to be forgotten is not absolute, the reasons that might be applicable here are: The data is being used to exercise the right of freedom of expression and information. The data is being used to perform a task that is being carried out in the public interest or when exercising an organization’s official authority. The data represents important information that serves the public interest, scientific research, historical research, or statistical purposes and where erasure of the data would likely to impair or halt progress towards the achievement that was the goal of the processing.
From a German perspective, it would be absolutely normal and expected that you're providing identity &amp; contact information publicly. Per §5 TMG (Impressumspflicht / Anbieterkennzeichnung) this is required for German tele-media offerings, such as websites or email providers, even if non-commercial. Whereas for you as an upstanding and diligent email provider an abuse@... address should be enough, the German context expects a street address where you could be served with a lawsuit… There absolutely are privacy and free speech issues with this compelled self-doxxing. But by running an email service, you're not just acting as a private person. Your privacy interests and the transparency and security interests of other people have to be balanced. Now since you are not in Germany, the TMG does not apply to you. You have no legal obligation to provide this information. However, the ISP also has no legal obligation to to deliver your email. The ISP does have an obligation to apply appropriate organizational and technical safety measures. It seems that one organizational measure they have found appropriate is that they will only deliver emails from providers that provide public contact information, as would be the norm in Germany. I am not entirely sure how the GDPR applies here. The GDPR doesn't really allow or prohibit disclosures of personal data, it just requires that every purpose of processing for personal data has a legal bases per GDPR Art 6. One such legal basis is a legitimate interest, which boils down to a balancing test between your rights and freedoms and other people's interests. I'm also not sure if the contact information should be classified as personal data in this context, because the contact info primarily relates to your role as an email provider. I'm also not sure if the ISP is processing your personal data in the sense of the GDPR when they merely require you to publish it on your own site. They would be processing it as soon as they scrape, store, or otherwise use this info.
I have not read the news report so cannot comment on the alleged offences and police conduct, but what I can say is that the information to given on arrest may be found at section 28 Police and Criminal Evidence Act 1984 (PACE): (1) Subject to subsection (5) below, where a person is arrested, otherwise than by being informed that he is under arrest, the arrest is not lawful unless the person arrested is informed that he is under arrest as soon as is practicable after his arrest. (2) Where a person is arrested by a constable, subsection (1) above applies regardless of whether the fact of the arrest is obvious. (3) Subject to subsection (5) below, no arrest is lawful unless the person arrested is informed of the ground for the arrest at the time of, or as soon as is practicable after, the arrest. (4) Where a person is arrested by a constable, subsection (3) above applies regardless of whether the ground for the arrest is obvious. (5) Nothing in this section is to be taken to require a person to be informed— (a) that he is under arrest; or (b) of the ground for the arrest,if it was not reasonably practicable for him to be so informed by reason of his having escaped from arrest before the information could be given. Note the provisions at subsection (3) do not require anyone else to be told the grounds (reasons) at the time of arrest - including members of the public, protesters, bloggers or the press. Kerb-side debates can seriously or significantly distract the officer from ensuring e.g. public safety or preventing e.g. an escape from custody. Also, depending on what else is going on e.g. say in a dynamic and volatile crowd control or public order situation, the person under arrest does not need to told immediately if it would be impractical to do so. The operative phrase being as soon as is practicable, which is not defined by statute as each case needs to be considered individually according to its own set of circumstances. The relevant case law is DPP v Hawkins [1988] 1 WLR 1166, but the only detailed commentary I can find online is behind the PNLD paywall1. Succinctly, the magistrates initially dismissed the case against Hawkins for assaulting four police officers who kept him under arrest without giving the grounds as required by s.28(3) PACE. The DPP appealed, and the Court of Appeal sent the case back to the magistrates saying, inter alia, although there is an obligation under s.28(3) to tell a prisoner of the reason for his arrest as soon as possible (sic) after his arrest, a constable was also under an obligation to maintain that arrest until it was practicable to do so. 1Or free to law enforcement officers
Since you don't say which country you're in, it's likely that you're interested in United States law. You are probably in the clear here, though you're getting close enough to the edge of breaking the law that I wouldn't be confident about not being prosecuted and/or convicted. The relevant laws in this case appear to be 18 USC 471, 18 USC 472, and perhaps 18 USC 514. All three of them begin "Whoever, with the intent to defraud...". It's questionable whether creating counterfeit money as a burglar decoy counts as defrauding the burglar.
I am just a foreign patent attorney who is studying common law to pass the California Bar Exam, but I will present my personal view. (I cannot guarantee the validity of my theory) There is an equitable theory called Constructive Trust. If it is established, the victim is entitled to benefit of any increase in value of defendant's (thief) property, meaning in this example victim (plaintiff) can recover $100 million. In order to assert CT, the following must be met: Wrongful appropriation; Here, D stole lottery ticket. Met. D has title; Here, D has title to $100 million. Met. P can trace his property to D's property; P can trace from P's $1 lottery ticket to its possession by D and collection by D of $100 million. Met. Unjust enrichment by D; D was enriched by stealing P's property (the lottery ticket). Met. Thus, it is highly possible that a court will order D to hold the property ($100 million) in constructive trust for P. This means, in plain language, that P will recover $100 million.