About EncroChat
EncroChat was an encrypted messaging service which was hacked by the French authorities in 2020. While the
hack was publicised as targeting organised crime, it affected other users of the EncroChat network, including
lawyers, journalists and political dissidents.
Thousands of people have been prosecuted in the UK on the basis of messages obtained from the hack. In most
cases, the only evidence linking them to these messages was their attribution to a pseudonymous EncroChat
‘handle’.
The French authorities have refused to reveal how the hack was performed, how the evidence obtained was
processed and what, if any, safeguards were put in place to ensure that the data was not modified or otherwise
contaminated. Defendants have been convicted on evidence of unknown provenance, accuracy and reliability – in
many cases, the prosecution have relied on nothing more than an Excel spreadsheet of messages, without any
independent evidence to corroborate the allegations.
This has caused grave concerns amongst lawyers, journalists and privacy campaigners. Core principles of fair
trial rights, open justice and accountability have been bypassed, with chilling implications for the rights of
citizens in the digital age.
The legality of the hack and the reliability of the evidence obtained are subject to ongoing challenge in the
domestic and European courts. This litigation has led to some deeply troubling revelations, including the
following:
the hack may have been illegal under UK law, meaning that no prosecutions should have been brought
a sorting error may have affected the entire dataset, meaning that defendants have been convicted on the basis
of messages sent by others
up to 90% of the data is missing, meaning that the attribution evidence relied on in courts has been
decontextualised and evidence which could prove that a defendant was not the sender of the messages has been
lost forever.
Admissible ≠ infallible — datasets still need to be proven accurate, complete, and correctly attributed.
Why the Evidence is Contested
How much is missing?
According to contemporaneous reporting from the Old Bailey (3 June 2025), defence counsel said former NCA
technical officer Luke Shrimpton had told the jury that about 80–90% of
overall EncroChat messages were missing from the datasets. Earlier reporting (7 May 2025) quotes Mr
Shrimpton acknowledging that Venetic data was often “incomplete.”
These figures come from court reporting, not an official transcript. See Sources below.
Technical failures & data loss
Independent reporting on earlier EncroChat trials recorded joint expert evidence that the French implant and
processing system were “not reliable,” frequently failing and requiring restarts; data was “frequently lost
or missing for significant periods.”
Verification & standards (ACPO/FSR)
Defence experts argue the datasets cannot be fully verified against UK digital evidence principles (e.g.,
ACPO/FSR) because the capture process is secret and hashing/continuity artefacts were not provided by the
French. Contemporary analysis also raised that key reliability guidelines were not followed.
Foreign secrecy & disclosure gaps
French national security laws block disclosure of how the implant captured and sorted data. UK courts
therefore rely on another country’s undisclosed process—limiting the defence’s ability to test reliability.
