The first and last challenge to the EIO?

On 26 October 2020, the High Court heard a claim for judicial review[1] brought by a defendant facing trial on indictment before Liverpool Crown Court on counts of conspiracy to supply class A drugs and conspiracy to murder. The claimant was one of 746 individuals who had been arrested in July 2020 as part of the NCA’s Operation Venetic, an investigation that boasted of dismantling ‘entire organised crime groups’, resulting in the seizure of £54m in ‘criminal’ cash, 77 firearms and over two tonnes of drugs[2].

The judicial review sought to challenge a European Investigation Order (“EIO”) that had been issued by the NCA and sent to the French authorities. The EIO requested data from the EncroChat system – an encrypted communication network, run from servers in France, that the NCA claimed was ‘used exclusively by criminals engaged in serious organised crime[3]’. The claimant denies that he was a user of the EncroChat system.

The EIO was established by the EU Directive 2014/41/EU and can be issued ‘for the purpose of having one or several specific investigative measure(s) carried out in the State executing the EIO (“the executing State”) with a view to gathering evidence…’ including ‘the obtaining of evidence that is already in the possession of the executing authority’.  This Directive was transposed into UK law by the Criminal Judgment (European Investigation Order) Regulations 2017 (“2017 Regulations”). Designed to speed up mutual legal assistance between Member States, the EIO is one investigative tool that the UK will lose the ability to use come 1 January 2021 when the UK-EU transition period ends. It is a loss that the SFO has said will adversely affect its ability to investigate and prosecute serious fraud.

Despite being in force since 31 July 2017, this was the first High Court decision to consider the 2017 Regulations. Given the UK only has another two months to utilise the EIO, it may also be the last time they are considered.

Turning to the facts of the case, as a result of the discovery of EncroChat servers in France, the French and Dutch prosecutors formed a Joint Investigation Team (“JIT”), which is a creature of EU law.[4] The UK were unable to join the JIT as a result of (at the time in January 2020) the UK’s imminent departure from the EU on 31 January 2020. (The JIT, which was deployed by the UK and French prosecutors in the Airbus global settlement, is another investigative measure that the UK will lose the ability to use come 1 January 2021). As a result, the JIT stated that in order to receive the data on the French servers, the NCA would need to make a formal written request contained within an EIO.

The EIO issued by the NCA and executed by the French-Dutch JIT concerned images of EncroChat servers in France that were said to contain data from handsets in the UK. Since 2016, the NCA had been working with international law enforcement agencies to target EncroChat (and other encrypted platforms) and had been monitoring the communications of EncroChat users. The result of this surveillance, leading to the transfer of data to the NCA under the EIO, was the widely publicised July 2020 arrests of hundreds of individuals some of whom have since pleaded guilty and have been sentenced whilst others are awaiting trial. In the words of the NCA, this data was of such evidential importance that it was “the essence of the prosecution case”.

Whilst permission to bring judicial review was refused, the court gave permission for the case to be cited as it ‘addressed a number of issues of principle’. The main challenge was that the statutory criteria for the issuance of the EIO were not satisfied, in particular the criteria in Regulation 7(1)(a) and (b) when read in accordance with Regulation 7(3) of the 2017 Regulations.

Regulation 7(1) empowers a designated public prosecutor to make or validate an EIO:

7.—(1) If it appears to a designated public prosecutor—

(a) that an offence has been committed or that there are reasonable grounds for suspecting that an offence has been committed, and

(b) proceedings have been instituted in respect of the offence in question or it is being investigated,

the prosecutor may make an order under this regulation.

Regulation 7(3) states that ‘An order under this regulation is an order specifying one or more investigative measures to be carried out in a participating State (“the executing State”) for the purpose of obtaining evidence for use either in the investigation or the proceedings in question or both’.

The claimant argued, unsuccessfully, that an EIO cannot be used to request a foreign authority to conduct a ‘speculative intelligence gathering exercise’ and that (i) ‘there can be no proceedings for a criminal offence unless there is a known specified actus reus in mind at the time it is issued, and ii) there can be no investigation into an offence that is unknown to the investigating authority or that has not been committed.’

The High Court disagreed with both propositions. In relation to the first proposition, Regulation 7(3) was clear that the EIO covered investigations into criminal offences, and there can be an investigation into an offence even if it turns out that no offence has in fact been committed. In relation to the second proposition, the court held that there was no need to establish that an offence is already known to the investigating authority at the time an EIO is issued. Furthermore, in order to comply with Regulation 7, the EIO does not need to identify any particular person who is suspected of having committed an offence. The court concluded that the underlying purpose of the Directive was to enable mutual cooperation to assist investigations of possible criminal conduct.

In response to the claimant’s argument that this conclusion would mean that EIOs could be issued as part of a ‘fishing expedition’, the court replied that this goes to questions of necessity and proportionality (which are to be considered by the issuing authority (see Regulation 7(4)(a)) and no such challenge was made on those grounds in this case. The court declined to indicate whether such a challenge would succeed. It may be that no court will decide this issue given that 1 January 2021 is just around the corner.

Standing back from the court’s analysis of the scope and purpose of EIOs, this case highlights the loss that investigative tools such as the EIO will represent for criminal law enforcement in the UK; the rapid arrests of those accused of serious organised crime in the UK may have not been possible without the use of the EIO. The EIO was able to deliver to the NCA data (and subsequently evidence) that provided reasonable suspicion to effect numerous arrests and launch subsequent prosecutions. The loss of such an investigative tool will, as the SFO predicted, adversely impact the ability of UK law enforcement agencies to carry out effective cross-border investigations. Whilst the NCA were able to boast of the success of Operation Venetic, such dramatic headlines may be few and far between once the transition period ends, and with it the UK’s ability to rely on the EIO – as well as a host of other EU criminal justice measures. The beneficiary of such a loss will undoubtedly be organised crime groups.

Edward Grange

10 November 2020

[1] R (on the application of C) v DPP & NCA [2020] EWHC 2967 (Admin)

[2] https://www.nationalcrimeagency.gov.uk/news/operation-venetic

[3] It was accepted that the ‘possession and sale of EncroChat devices in the UK is not an offence and that there are a few valid reasons for which an individual not involved in crime would have use for highly expensive and complex methods of communication’.

[4] EC Framework Decision of 13 June 2002 on joint investigation teams.