An Italian criminal prosecution that relied on intercepted messages from an encrypted phone network, Sky ECC, which was infiltrated by French police, collapsed after a judge concluded the data should not be used as evidence in the case.
The trial in Catanzaro, involving more than 50 alleged members of a notorious Ndrangheta crime group in Southern Italy, led to acquittals for a majority of the defendants after a judge found that there was no evidence against them.
The case has raised questions about the admissibility of intercepted phone messages from encrypted phone networks used by criminals and whether defendants should be entitled to access raw data to prepare their defence.
Although the ruling has not set a legal precedent, defence lawyers argue that judges are likely to exclude evidence from Sky ECC in similar cases where defendants are unable to access the raw data used as evidence against them.
The judge excluded evidence from Sky ECC after finding that defendants did not have the ability to challenge the authenticity and reliability of the electronic evidence used against them, and that there was an absence of other evidence.
Man in the middle
The court found in a 170-page verdict published this week that the charges against the defendants were based almost entirely on evidence obtained by French police by hacking the Sky ECC encrypted phone network in 2020.
French police, working with Dutch and Belgium police, attached a “man-in-the-middle” server to the Sky ECC infrastructure at the OVH Datacentre in Roubaix, France, to intercept messages and encryption keys.
Police in Italy issued three European Investigation Orders (EIOs) to obtain intercepted data from the French attributed to Sky ECC users in Italy, leading to arrests of suspected drug dealers and organised crime groups.
Defence lawyers questioned the integrity of the data supplied to Italy, which was delivered in the form of spreadsheets with missing metadata and missing messages, and did not meet forensic evidence standards.
In January, defence lawyers asked the court to issue an EIO requiring France to preserve evidence so that defendants could challenge the evidence against them in France. The French ignored the request.
Defendants had no legal remedy
The judgment found that the defendants had no legal remedy either in France or Italy to challenge the evidence used against them. It decided that the evidence should be disregarded where the defendants had no opportunity to comment on it or challenge it.
The court also found that there had been a lack of proper communication between France and Italy, and that France had handed over Sky ECC evidence to Italy without following the formal EIO route required by law. It acquitted 34 of the 50 defendants.
Commenting on the case, Dutch defence lawyer Justus Reisinger said: “In my opinion, the verdict is the only logical reasoning when confronted with cross-border intercepted evidence of which it is impossible to challenge in the country of origin.”
Defence lawyer Yehudi Moszkowicz said that the court had given the prosecution every opportunity “to be transparent about how the Sky ECC data was obtained, so that the defence could actually test it”.
He added: “That transparency never came – France refused, and the defendants were left with no forum anywhere to challenge the French collection. The judge drew the only lawful conclusion: evidence that cannot be tested cannot be used to convict.”
Moszkowicz stated that the ruling should serve as a “blueprint” for courts across Europe in other Sky ECC cases.
The European Court of Justice is expected to make a preliminary decision next week in a separate Sky ECC case following questions by the French supreme court over the circumstances in which EU states can accept evidence from another EU state.
The court will decide whether an EU country should be allowed to act on evidence supplied by another EU country if there is no mechanism in place to allow defendants to challenge the veracity of that evidence in the state that provided it.
