France says “defense secrecy” in police surveillance operations is constitutional
France’s Constitutional Court has rejected arguments that using “defense secrecy” to withhold from lawyers information about a police hacking operation into an encrypted phone network used by organized crime groups violates the accused’s right to a fair trial.
The Conseil-Constitutionnel today found that provisions in the Criminal Code that allow investigators to use defense secrecy to cover up surveillance operations do not violate the accused’s right to an effective remedy.
The decision follows a legal challenge by lawyers supported by civil rights group La Quadrature du Net questioning the legality of a French police hacking operation against the encrypted mobile network EncroChat, which is widely used by organized criminals.
Robin Binsard, co-founder of Binsard Martine, who brought the case, said that while the council found that defense secrecy was constitutional, it also identified legal requirements to disclose information about the hacking operation, which in the EncroChat case was not were complied with.
“We are now awaiting a Supreme Court decision to know exactly what evidence should be disclosed,” he said.
“We are now awaiting a Supreme Court decision to know exactly what evidence should be disclosed”
Robin Binsard, Attorney at Law
Secrecy necessary to protect intelligence techniques
The Constitutional Court ruled today that defense secrecy provisions used in police surveillance operations are necessary to protect the techniques used by French intelligence services and “to safeguard the nation’s fundamental interests”.
The law, the court said, strikes a balance between defendants’ constitutional rights to an effective remedy and the right to privacy, as well as constitutional requirements to identify criminals and protect national security.
The contested legislation “does not violate the right to an effective judicial remedy, the right to privacy, freedom of expression or any other constitutionally guaranteed right or freedom” and should therefore be declared constitutional, the court said in its decision.
France’s Constitutional Council, which includes former Prime Ministers Laurent Fabius and Alain Juppé, heard arguments on March 29 over whether the EncroChat and Sky ECC hacking operations complied with the right to a fair trial and the French-guaranteed right to privacy be constitution.
At issue is a clause in the Criminal Code that allows prosecutors or judges to invoke “defense secrecy” to prevent disclosure of information about police surveillance operations, which defense attorneys say is necessary to ensure a fair trial for the accused obtain.
French investigators used Article 707-102-1 of the Penal Code – described as a “legal bridge” between French police and the secret services – to ask French security agency DGSI to stop surveillance operations on two encrypted phone systems, EncroChat and Sky ECC.
Patrice Spinosi, an attorney at the Council of State and Supreme Court representing the Association of Criminal Lawyers and the League of Human Rights, said the intelligence agencies’ hacking operation had found a goldmine of information.
But the work also resulted in violations of fundamental freedoms, the rights of the accused, respect for adversarial procedures in court and the right of the accused to appeal.
There are many unanswered questions about how data was obtained from EncroChat, how it was processed, retained and used, and how the surveillance operation was conducted, he said.
Defense attorney Robin Binsard argued that the secrecy of the operation was akin to charging suspects based on evidence found in a police search without knowing where the search took place, when it was conducted and without who the police were method used to know investigators.
“At a time when we are increasingly demanding transparency, this law allows judges and prosecutors to cover themselves in utter opacity,” he said.
Alexis Fitzjean O. Cobhthaigh, representative of the French NGO La Quadrature du Net, told the Constitutional Court that under the Penal Code, national defense secrecy can be invoked without particular necessity or without being deemed necessary for an investigation.
A judge can authorize the use of a “special investigative technique” to obtain data from an automated data processing system, he said. A prosecutor or an investigating magistrate can then invoke defense secrecy without requiring a judge’s consent.
“This election is not subject to any criteria, it is entirely arbitrary and not subject to appeal,” said Fitzjean O. Cobhthaigh.
Antoine Pavageau, deputy for French Prime Minister Jean Castix, said defendants must be allowed to challenge the conditions under which evidence against them was collected.
However, this does not mean that all information about the origin, process and conditions of collection must be made available.
In the case of EncroChat, the protected information “pertains solely to the technical processes of data collection or decryption, the disclosure of which is likely to cause harm or lead to the discovery of a national defense-protected secret,” Pavageau said.
The aim of the secrecy is not to prevent the defense from acting, but only to protect the techniques used by the secret services, which serve to obtain information in addition to judicial investigations, he said.
“Challenging those protections would mean significantly weakening the work of these services in favor of protecting fundamental interests of the nation, without granting specific protections to the data subject,” Pavageau said.
The court stated in its written decision that it was the task of the legislature to balance the defendants’ rights to contest the evidence on the one hand with the need for the identification of the perpetrator on the other hand and the need to protect the fundamental interests of the accused on the one hand and the nation on the other.
Article 707-102-1 of the Code of Criminal Procedure allows prosecutors or investigating judges to invoke national “defense secrecy” in hacking and wiretapping operations. This had the effect of shielding information about the data extraction from an “adversarial debate” in a courtroom.
The legislator wanted to allow investigators to benefit from technical measures for data collection and processing without weakening the intelligence services by disclosing the techniques they used.
The court found that defense secrecy can only be invoked for a special investigative technique authorized by an investigating judge when justified by the needs of an investigation of serious and complex crimes.
The judge must provide a written and reasoned order authorizing the use of a data collection device, which remains on file.
The order should contain details of the offence, the exact location or a detailed description of the target of the automated data processing system and the duration of the hacking attack.
In addition, an acceptance report must be submitted, accompanied by a certificate of authenticity signed by the person responsible for the entity performing the data extraction, certifying the authenticity of the data obtained, the court ruled.
“The court may request the release and transfer of information subject to national defense secrecy,” it said.
It follows, according to the Constitutional Council, that the controversial code strikes a balance between the constitutional rights of the accused and the requirements to protect the state.
The contested law does not violate “the right to an effective judicial remedy, the right to respect for private life, freedom of expression or any other right or freedom guaranteed by the constitution” and “must therefore be declared constitutional,” it said.
Binsard said that while the court can request that information about a hacking operation be released, that option is not open to defense attorneys.
Binsard and Martine will present arguments before France’s Supreme Court in July, challenging the French gendarmerie’s refusal to provide information about the hacking operation to the accused following the Constitutional Court’s decision.
They claim that French police should explain how they obtained evidence of EncroChat phone tapping so the accused have a fair trial and provide a certificate to authenticate the intercepted data and messages.
The lawyers also allege that French cybercrime specialists went beyond the legal powers granted them by judges in a Lille court.
The controversial court orders include one requiring French cloud computing service provider OVH, which hosted the servers used by EncroChat at its Roubaix data center, to modify its network to allow wiretapping
Gendarmes from C3N’s Pointoise digital crime unit, with the help of Dutch investigators, were able to secretly take copies of the servers and upload a “software implant” that could extract plain text messages from EncroChat phones in April 2020.
Investigators collected more than 120 million allegedly encrypted text messages, notes and photos from EncroChat phones in 120 countries.
The operation caused widespread disruption to criminal groups and drug gangs in Europe. In the UK, as of December 2021, more than 2,600 people have been arrested, 1,380 charged and 260 convicted as part of Operation Venetic, the National Crime Agency’s response to EncroChat.
French police were also instrumental in hacking Sky ECC, one of the world’s largest cryptophone networks, which had 120,000 users worldwide as of 2021.
Experts from the French Gendarmerie were able to intercept and decrypt hundreds of millions of messages after gaining access to the Sky servers, also hosted by OVH, the cloud service provider in Roubaix.
Police in Belgium, France and the Netherlands launched raids in March 2021 against suspected organized crime groups and drug dealers identified by intercepted Sky ECC messages.
Forensic scientists in the UK have argued that the French gendarmerie’s refusal to release information about the hacking has created an “evidence black hole” in violation of accepted principles that evidence should be properly collected and secured before being used in legal cases be used.