The French supreme court has turned to the European Court of Justice to decide whether EU citizens have the right to challenge the legality of evidence obtained by French law enforcement by hacking the Sky ECC cryptophone network.
The Cour de Cassation has asked the European Court of Justice to rule whether French law is in line with European law. It comes after the French courts refused the right of a German citizen to appeal against the lawfulness of the French hacking operation in the French courts.
The decision will have “significant consequences” for legal proceedings in the European Union against individuals who are charged with criminal offences based on evidence obtained by French police from hacking the Sky ECC and EncroChat encrypted phone networks.
French, Belgian and Dutch police infiltrated servers belonging to Sky ECC, the world’s largest cryptophone network, and decrypted millions of messages between June 2019 and March 2021, leading to the arrest of drug gangs across Europe.
French and Dutch police also harvested messages from tens of thousands of EncroChat cryptophone users after police infiltrated the network’s servers in a novel hacking operation in 2020. A three-year investigation led to 6,500 arrests of organised crime and drug groups worldwide and the seizure of nearly €900m in cash and assets.
France ‘breached European law’
A coalition of defence lawyers, known as the Joint Defence Team, are challenging the legality of the French hacking operation. They argue that France breached European law by obtaining millions of encrypted messages from Sky ECC and EncroChat without grounds for suspicion against the individuals targeted.
They also argue that the French failed to notify other EU states in advance about when they intercepted messages from phones outside of French territory, denying other EU member states the right to object to the operation.
The defence lawyers say that their argument gained extra weight after the French supreme court ruling in June 2025. The court stated that EU states engaged in cross-border digital investigations must formally notify other EU states when intercepting data in their jurisdiction – an obligation defence lawyers say has been ignored in the Sky ECC operation.
No legal recourse
Individuals facing prosecution have been denied the right to challenge the lawfulness of the French hacking operations before judges in their own country, because the “mutual recognition” principle requires EU member states to accept evidence provided by other member states under European Investigation Orders (EIOs).
At the same time, people have been denied the right to challenge evidence in the French courts, leaving people charged with offences based on intercepted Sky ECC or EncroChat messages without legal recourse to appeal.
German lawyer Christian Lödden and French lawyer Guillaume Martine filed an appeal on behalf of a man accused of crimes based partly on evidence from Sky ECC intercepts in Germany, in the Paris Court of Appeal in June 2024, seeking to challenge the lawfulness of the Sky ECC data. The court ruled that the man was not entitled to be heard by the French Court.
Lödden, working with a network of European defence lawyers, appealed the decision in the French supreme court in February last year.
Decision will have ‘significant consequences’
The supreme court found that under French law, it was not possible for people accused of crimes in other countries to bring an appeal in France to challenge the lawfulness of the evidence, when it had been shared with another country under an EIO.
But the court also recognised the right of defendants to seek legal redress, and in a ruling on 16 September, the French supreme court asked the Court of Justice of the European Union to determine if there is a conflict between French and European law.
“The interpretation requested is likely to have significant consequences…in proceedings currently underway in various member states of the EU, where prosecutions rely on evidence similar to that contested here, all originating from the Sky ECC procedure,” the court said in its ruling.
‘Fishing with dynamite’
Lödden told Computer Weekly that the French operation to hack Sky ECC, amounted to a mass surveillance operation against 170,000 devices across the world, without concrete grounds for suspicion against individual phone users required under European law. “It was like fishing with dynamite,” he said.
Under current law, it was not possible to have a court review the lawfulness of the interception operations against Sky ECC and EncroChat, he said, adding: “That is totalitarianism, not the rule of law.”
Justus Reisinger, a Dutch defence lawyer, said that the French supreme court decision “created a possibility of having a real effective remedy” against Sky ECC.
No judge has so far decided on the lawfulness of evidence obtained by French police by hacking encrypted phones in other countries without notifying those countries in advance and giving them a chance to object, he said.
“The Court of Justice of the European Union and the French Cour de Cassation agree that interception is unlawful if there is no notification, and there has been no notification. If this case is found admissible, then the outcome is almost certainly they will declare [the Sky ECC evidence] unlawful,” he added.
France, which carried out the Sky ECC hacking operation, obtained the data on the premise that it would bring prosecutions against individuals involved in running the Sky ECC network, including its founder Jean-Francois Eap and distributor Thomas Herdman.
French police went further and gathered data from Sky ECC phones worldwide, which it provided to law enforcement agencies in other countries investigating organised crime groups who were using the encrypted phones.
The Court of Justice of the European Union is expected to take up to a year and a half to respond to the French supreme court.
