Encryption has become an essential component for safeguarding fundamental rights, digital sovereignty and innovation. However, criminal organisations are increasingly using encrypted communication tools and continue to find methods to leverage the latest technologies to evade investigations. Judicial authorities and law enforcement increasingly depend on digital data to proceed with these investigations. Such data are often encrypted and difficult to access legally.

To help practitioners deal with these challenges, in July 2021 Eurojust and Europol jointly published the Third report of the observatory function on encryption. The report shares insights on encryption in the context of cross-border cases, with two key focuses: cases in which decryption of the tool used by criminals is the main focus of the investigation, and ‘spin-off cases’ where the focus is on other aspects but where decrypted communications among criminals are required as evidence. The report also explores the need to find legal means to decrypt electronic communications, the admissibility of evidence obtained from decrypted devices and the sharing of such data with other law enforcement agencies in the context of cross-border cases.

 This third joint Report reflects the complexity that results from a constantly evolving digital landscape and a fragmented legal framework. It also shows how the global COVID-19 pandemic forced the EU’s judiciary to develop innovative approaches and adapt existing processes. We clearly see, as well, that our success in the fight against organised crime depends on the strength of our mutual partnerships. As long as we work together, we can strike the right balance between obtaining access to electronic evidence and upholding the fundamental rights and liberties of our citizens.

A recent example of Eurojust’s operational work in this area is the support it has provided to investigators and prosecutors in the SKY ECC case. Investigators monitored the criminal use of the Sky ECC communication service tool, generating invaluable insights into hundreds of millions of messages exchanged between criminals. This has resulted in the collection of crucial information on more than a hundred planned large-scale criminal operations, preventing potential life-threatening situations and possible victims.

The operation is an essential part of the continuous efforts of judiciary and law enforcement in the EU and third countries to disrupt the illegal use of encrypted communications, following the successful decryption of the EncroChat communication platform in 2020. After EncroChat was unveiled, many users changed over to the popular Sky ECC platform.

Criminal networks’ encrypted communications blocked

Crime: Exchanging around three million messages daily, approximately 170 000 criminals use the Sky ECC tool, which operates from the United States and Canada using computer servers based in Europe.

Action: As of mid-February 2021, authorities were able to monitor the information flow of approximately 70 000 Sky ECC users. During an action day on 9 March 2021, a large number of arrests were made, as well as numerous house searches and seizures in France, Belgium and the Netherlands.

Result: Further use of encrypted communications by large-scale OCGs was blocked with the support of Europol and Eurojust. Thanks to the successful unlocking of Sky ECC’s encryption, the information acquired has provided insights into planned criminal activities in various EU Member States and beyond, while also helping to expand investigations and solve cross-border organised crime.

Eurojust's Role: Eurojust organised and supported various coordination meetings between the relevant authorities and will continue to provide advice and support regarding cross-border judicial cooperation in any ‘spin-off’ cases.