This article is more than 1 year old
EncroChat hack case: RAM, bam... what? Data in transit is data at rest, rules UK Court of Appeal
That's the Snoopers' Charter in action for you
British prosecutors can make use of evidence gathered by the French and Dutch police from encrypted messaging service EncroChat’s servers thanks to a legal interpretation of whether RAM counts as data storage, the Court of Appeal has ruled.
The judgment, handed down on the afternoon of 5 February, has far-reaching repercussions for criminal defendants identified and arrested on suspicion of serious crimes – with their identification being possible thanks to police reading the contents of their messages.
In addition, the judgment also sheds more light on Britain’s Byzantine and occasionally opaque surveillance laws, which regulate how police can lawfully spy on people.
Police and other law enforcement agencies are banned from outsourcing unlawful methods of evidence collection to foreign countries’ agencies – and the EncroChat defendants in this case lost their argument that that was what British police did in mid-2020 under the codename Operation Venetic.
Had they succeeded, a number of criminal trials – including some test cases in Liverpool – would potentially have collapsed.
“We have concluded that the only substantial question which the judge was required to answer was whether the EncroChat material was stored by or in the telecommunications system when it was intercepted. Like him, we consider that these communications were not being transmitted but stored at that time,” said the Lord Chief Justice, Lord Burnett of Maldon.
Multiple reporting restriction orders are in force on most EncroChat cases currently before the criminal courts – though those restrictions are not being applied to police forces and the National Crime Agency, both of which have been boasting since last year about EncroChat-linked arrests and convictions, and even the contents of EncroChat messages.
Thanks to the reporting restriction orders we cannot lawfully link to any of the police press releases.
Data in transit and at rest
The main law in play during this appeal was the infamous Snoopers’ Charter, the Investigatory Powers Act 2016. Broadly speaking, intercepting communications over a “telecommunications system” is illegal unless there’s a proper warrant in place, as set out in section 4 of the act.
Different types of warrant apply depending on whether the intercepted message was being transmitted or was in storage somewhere on the system. If it’s at rest, police need to apply for a Targeted Equipment Interference (TEI) warrant; if it’s in transmission, they need a Targeted Interception (TI) warrant. The NCA obtained a TEI warrant, as previously reported, arguing that the data harvested from EncroChat was being stored at the time that European police forces accessed it.
The Court of Appeal explained that in a previous judgment about EncroChat evidence, a Crown court had held that messages in a device’s RAM were to be treated as being stored for legal purposes. That ruling also described how EncroChat worked when a user wanted to send a message, or so it summarised:
Upon launch, the app's program and some of its data would be drawn from Realm [local storage] into RAM for use by the CPU in order to send and receive messages. The owner would compose a message on the device for an identified contact and this would be held in RAM for the purposes of the app, and when instructed to send the message the app ensured its encryption, following which it would be sent to the radio chip and antenna for it to be transmitted out of the device to the EncroChat server.
When an EncroChat phone received a message, a similar process occurred:
Having passed through the EncroChat server, via the receiver's message queue, the message would arrive on the receiving device when it was switched on and was running the EncroChat app. The message would be decrypted and then held in RAM, and married with other information on the receiving device which was relevant to the app, including for instance the receiving device owner's nickname for the sender. The message would then be held in RAM for the purposes, for instance of being displayed on the screen of the device, or being forwarded to other contacts.
Matthew Ryder QC argued that based on this, prosecutors’ claims that sent messages were being stored was wrong. As described, he said, holding EncroChat messages in RAM constituted part of “transmission” as defined in law. Both prosecution and defence agreed that messages couldn’t be “stored” and “transmitted” at the same time.
Matters were complicated by nobody from the police testifying exactly how their malware worked. When the French and Dutch police hacked EncroChat they remotely deployed a man-in-the-middle technique onto its network which took snapshots of each end-user device (a smartphone running a “clean” version of Android alongside EncroChat’s own OS) and beamed their contents back to police. These included messages described in a previous High Court ruling as “ongoing… as they were stored in handsets after transmission”.
The Court of Appeal said: “It is not known when or how the malware extracted the messages. There was no evidence about this. No one who gave evidence knew exactly how the malware works, and the French authorities were concerned that this should continue to be the case.”
Despite all this the Lord Chief Justice, Lord Justice Edis and Mrs Justice Whipple sided firmly with prosecutors, saying: “We do not accept that this issue requires a minute examination of the inner workings of every system in every case,” stating:
The communication is that which is transmitted. What remains on the device is not what has been transmitted, but a copy of it or what, in older forms of messaging, might be described as a "draft". That is so however quickly after transmission the obtaining of the copy takes place, or even if the copy is extracted while the original encrypted communication is being transmitted. The fact that what was obtained was an unencrypted message, means that what was on the phone, and what was intercepted, was not the same as what had been transmitted because what had been transmitted was encrypted. It cannot therefore have been "being transmitted" when it was intercepted: it can only have been "being stored".
What this means
Even when a message is being transmitted, as far as the law is concerned it’s still being stored somewhere and was therefore fair game for the NCA, the Court of Appeal appeared to have ruled.
Tech lawyer Neil Brown of decoded.legal blogged about this, writing: “I think this means that, if a communication is available by virtue of access to a device, then it is inherently a ‘stored’ communication, irrespective of whether a copy of it is also in the course of transmission. I'd need to give that some further thought, and I note that the Court itself recognises that this is not a universally held position.”
The judges also criticised defence expert witnesses, saying: “The experts have an important role in explaining how a system works, but no role whatever in construing an Act of Parliament. They appear to have assumed that because a communication appears in the RAM as an essential part of the process which results in the transmission it did so while ‘being transmitted’. That is an obvious error of language and analysis.”
It appears that the Court of Appeal has just rendered useless a large part of the protections in the Snoopers’ Charter. Why would a British police force need to bother with TI warrants in future when even messages in the act of being transmitted are, legally, “in storage” and can therefore be hacked from abroad by foreign police or intelligence agencies with impunity provided UK police get a TEI warrant?
Legal protections against unlawful interception, in section 3 of the Snoopers’ Charter, don’t apply to data in storage targeted by police hackers under a TEI warrant. This part of the Court of Appeal’s ruling is likely to have big implications. ®
Biting the hand that feeds IT
