Sky ECC Hack: Landmark EU Court Ruling Couldinvalidate Evidence in Major Criminal Cases
The legality of evidence obtained from the massive hack of encrypted dialog platform Sky ECC is facing a critical challenge,potentially impacting criminal prosecutions across Europe. A recent referral to the Court of Justice of the European Union (CJEU) by the French supreme Court (Cour de Cassation) could determine whether the widespread interception of Sky ECC data violated essential European law.
The Core of the Dispute: Mass Surveillance and Due Process
For years, law enforcement agencies have relied heavily on data gleaned from Sky ECC – a platform popular with organized crime groups – to build cases. In 2020, French authorities infiltrated the Sky ECC network, gaining access to an astonishing volume of communications from approximately 170,000 devices globally. This operation, and a similar one targeting EncroChat, has led to numerous arrests and convictions.
However, the legality of this mass surveillance has been consistently questioned by defense lawyers. The central argument revolves around whether the French operation adhered to European legal standards requiring concrete suspicion of individual wrongdoing before intercepting communications. Critics argue the Sky ECC hack was akin to “fishing with dynamite,” as described by Dutch lawyer Leon Lödden, a leading figure in challenging the evidence.
French Courts Initially Reject Challenge, Sparking EU Appeal
Initial attempts to challenge the Sky ECC data in French courts proved unsuccessful. In june 2024, the Paris Court of Appeal dismissed an appeal filed by French lawyer Guillaume Martine on behalf of a man accused of crimes based on Sky ECC intercepts in Germany, stating the French court lacked jurisdiction to rule on evidence used in another country.
This decision prompted an appeal to the French supreme Court, spearheaded by Lödden and a network of European defense lawyers. The Supreme Court acknowledged the right to legal redress but found French law prevented challenges to evidence shared with other countries via a European Investigation Order (EIO). Crucially, the court didn’t dismiss the concerns outright.
A Pivotal Referral to the CJEU: Conflict of Laws at Stake
Recognizing a potential conflict between French national law and European Union law, the French Supreme Court took a landmark step on September 16th, referring the case to the CJEU.The court specifically asked the CJEU to determine if individuals accused of crimes in other countries have the right to challenge the legality of evidence obtained through methods like the Sky ECC hack, even when that evidence is shared under an EIO.
The french Supreme Court emphasized the potential ”significant consequences” of its decision, noting it could impact ongoing prosecutions across the EU reliant on Sky ECC data. This referral signals a serious consideration of fundamental rights and the boundaries of cross-border law enforcement cooperation.
Why This Matters: The Principle of Notification and the Rule of Law
The core legal principle at stake is notification. Under European law, intercepting communications in one country and using that evidence in another requires notifying the affected country, giving them an opportunity to object. French authorities did not notify other nations before sharing the Sky ECC data.
“The Court of Justice of the European Union and the French Cour de Cassation agree that interception is unlawful if there is no notification, and there has been no notification,” explains dutch defense lawyer Justus Reisinger. “If this case is found admissible, then the outcome is almost certainly they will declare [the Sky ECC evidence] unlawful.”
This lack of notification strikes at the heart of the rule of law. As Lödden argues, preventing judicial review of such large-scale interception operations is “totalitarianism, not the rule of law.”
France’s Justification and the Scope of the Hack
France justified the Sky ECC operation by stating its initial goal was to prosecute those involved in running the Sky ECC network itself, including founder Jean-francois Eap and distributor Thomas Herdman. However, the scope quickly expanded. French police gathered data from Sky ECC phones worldwide and proactively shared it with law enforcement agencies in other countries investigating organized crime.
What’s Next? A Wait for Justice
The CJEU is expected to take up to 18 months to deliver its ruling. the outcome will have far-reaching implications. A decision in favor of the defendants could invalidate evidence in countless cases, potentially leading to the release of convicted individuals and a significant disruption to ongoing investigations.
This case represents a crucial test of the balance between law enforcement’s need for tools to combat serious crime and the fundamental rights of individuals to privacy and due process within the European legal framework. The world is watching to see if the pursuit of justice will be tempered
