The Dutch Public Prosecution Service in the Netherlands sends less information to courts about EncroChat and Sky ECC messages made readable by the police than is available. This is evident from foreign documents that Crimesite has seen. This concerns so-called “metadata”, data that judges can use to identify the people who have sent certain messages.
By @Wim van de Pol
“Bro, that bullet went right through his head. Twice.’
Sometimes the chats from EncroChat and Sky ECC servers hacked by the police leave little doubt. The sentence above seems clearly written by someone who was involved in a murder, in this case that of Peter R. de Vries.
But, for a judge, this is not enough. Everything revolves around the question of who exactly was the person who wrote and sent this message. Was it the suspect?
This piece in half a minute:
Europol, the National Police and the Public Prosecution Service have access to all hundreds of millions of cracked chat messages from Sky ECC and EncroChat through a system called Chat-X. In addition to the messages themselves, that system also contains related data such as location data.
Dutch courts do not receive all this data, it now appears. But in Slovakia that information is apparently added to the court file.
Because the Dutch courts do not see this information, judges are less able to determine whether or not suspects have sent very incriminating messages. Courts sometimes have to correct incorrect assumptions made by investigators about this. The cracked messages are often the only real evidence in a criminal case. That is why the absence of the so-called metadata is of great legal importance, because suspects must be able to defend themselves properly in a fair trial. Especially if they even risk life sentences.
‘This is where I live’
In court, the Public Prosecution Service and lawyers invariably have a discussion about the identification of users of Encro or Sky. If someone mentions an address and then writes in the message: ‘this is where I live’, this can be a strong argument. If a suspect says he has an alibi, a court will check this based on the location of the telephone he allegedly used.
For example, the contact list from a telephone that sent the message can also be an argument in correctly identifying a suspect.
But that information is usually missing from the criminal file that the Public Prosecution Service sends to the court.
Usernames and messages
In a typical criminal case, courts receive thick stacks of files, sometimes containing tens of thousands of chat messages. The detective writes which usernames belong to which suspect and lists the incriminating messages from those suspects.
How do these messages end up in the court file?
The police obtained the messages from EncroChat and Sky ECC through a hacking operation on servers in France in 2020 and 2021 respectively. All data first went to Europol in The Hague and then to the Dutch police, and to police services in other countries.
At Europol, a selection of the messages took place so that the countries could receive the messages relevant to them in “data packages”.
Chat-X
Crimesite publications this year (and last year) have already shown that Europol and the various police services have access to hundreds of millions of messages through an easy-to-use interface, a system called Chat-X. It has been specially developed for this purpose. There is a Chat-X for EncroChat and also for Sky ECC.
Detectives can use it to browse through the messages if they are looking for a person, or if they want to obtain information about a specific murder or, for example, a cocaine network.
The detectives then sift out what they consider to be important information.
Excel sheet
There are two operations. It is not clear exactly how this happens. First, a bundle of messages from Chat-X is sent to a specific police team that is conducting a specific investigation. That bundle ends up in an Excel sheet. Detectives then copy-pasted the messages from that Excel sheet into a court file. There are hundreds and sometimes thousands per file, it is done “by hand”.
That is the file that the court and the lawyers read. In some cases, the court instructs the Public Prosecution Service to also submit the Excel sheets.
But the Excel sheets and court files usually only contain date and time codes, bare messages and user names. In addition to this information, the detective then writes down why they think the usernames can be linked to the suspect.
More data
Lawyer Yehudi Moszkowicz was repeatedly told in criminal cases that the Public Prosecution Service does not have any other data available. Only the messages and usernames were available, prosecutors emphasized to the court again and again.
Last year it emerged that this was not entirely the truth.
Moszkowicz discovered by chance that in a case involving certain Sky ECC messages, the police actually had more data available.
Moszkowicz discovered the existence of Chat-X, where this information came from. The Public Prosecution Service has described the process in documents that Crimesite has seen and also named and confirmed the existence of Chat-X.
Slovakia
Now lawyer Moszkowicz has information from a criminal file from Slovakia. Data ended up in that file that was apparently taken from Chat-X by the local police. These are chats from EncroChat.
Moszkowicz: ‘Apparently the Slovak Public Prosecution Service is more transparent than that in the Netherlands’.
The following metadata is available:
Crucial data
These are not just any data, but data that can be crucial in evidence in a criminal case or for the defense of a suspect. A telephone device can be identified with an IMEI number. An IMSI number can be linked to a specific telephone number. Based on a contact list, a judge can determine who apparently knows someone. And location data can show whether or not a user was near a crime scene.
If this information exists, and has also been passed on to Slovakia, why is it not in Dutch criminal files?
Moszkowicz:
It is unacceptable that the Dutch Public Prosecution Service gives less information to a suspect’s lawyer about his accounts than the Public Prosecution Service gives to foreign authorities about the same account. The Dutch Public Prosecution Service is the initiator of the Sky and Encrohacks, and also the technical implementer of this progressive operation. It cannot be the case that the Public Prosecution Service withholds that relevant information.
Cousin
In a major criminal case involving suspicions about drug and weapons trafficking against a cousin of Ridouan Taghi, who has been sentenced to life, Moszkowicz asked the court how exactly the criminal investigation department receives the data and whether they also have access to the data known in Slovakia.
Quote Moszkowicz: ‘It is difficult to understand why there is no insight into what equipment is being used and what its effects are on the data. The reliability of the evidence is always the basis of the criminal trial. It seems to me that judges are also interested in that.’
Fingerprints
In recent years, the Netherlands has seen a stream of major criminal cases involving liquidations, large-scale cocaine trafficking and the production of synthetic drugs, in which cracked chat messages provide virtually the only evidence.
Moszkowicz:
We know the use of suspect fingerprints, analysis of DNA material or the analysis and seizure of drugs. These procedures are covered from start to finish in Dutch legislation. From securing material, through storage, transport, research, re-storage and ultimately destruction.
At each step it must be ensured which person was involved, which actions were carried out, how a matter was transferred to the next step, and so on. There can never be a time when evidence is not anyone’s responsibility. We are not told anything about the collection and processing of evidence from EncroChat and Sky ECC. I believe that the courts should raise the alarm with the Public Prosecution Service about this.
In the case about Ridouan Taghi’s cousin, Moszkowicz has asked the court to interrogate a data expert. It is not yet known when the court will decide on this and other questions.
