Addressing the challenges of encryption

While encryption is essential to ensure cybersecurity and the protection of personal data, it is also used by criminals to avoid detection. A recent example is EncroChat, an encrypted phone network widely used by criminal networks to exchange millions of messages planning serious crimes. The abuse of encryption by criminal organisations is likely to continue and requires a common knowledge of best practice and efficient international judicial cooperation.

In January 2020, Eurojust, in cooperation with Europol, published the Second report of the observatory function on encryption. The observatory function on encryption, supported by EC3 (Europol, Eurojust and the European Judicial Cybercrime Network (EJCN)), was proposed by the European Commission in 2017 to achieve an effective and genuine ‘Security Union’.

After the first report from early 2019, the 2020 report provides an update of technological challenges and developments, as well as the existing legal landscape to address encryption in criminal investigations.

The 9th Plenary Meeting of the EJCN examined the topic ‘Goodware’ and lawful access to digital evidence. The focus of the discussion was the use of encryption technology by international criminal organisations and technical solutions needed by competent authorities to obtain the encrypted data concerning those criminal activities, as seen in the EncroChat case.

Improving access to electronic evidence through the SIRIUS project

More than half of all criminal investigations today include a cross-border request to access electronic evidence (e-evidence) such as texts, emails or messaging apps. As one response to the increasing need for transnational access to e-evidence, the SIRIUS project was launched in late 2017. Funded by the European Commission’s Service for Foreign Policy Instruments, it aims to foster the co-development of practical and innovative tools and solutions for EU law enforcement and judicial authorities in the area of cross-border data acquisition from US-based service providers.

Eurojust has been making a significant contribution to the SIRIUS project since early 2018 by developing the judicial component of the project. For example, co-developing the second annual edition of the SIRIUS EU Digital Evidence Situation Report with Europol, which was published in December 2020.

In late 2020, FPI, Eurojust and Europol signed an agreement formalising Eurojust’s involvement in the project and further expanding inter-Agency partnership in supporting the law enforcement and judicial authorities with cross-border access to electronic evidence. This new agreement extends the duration of the project until June 2024 and reinforces the financial support.

Under this new agreement, Eurojust becomes a full partner and beneficiary of the funding in the SIRIUS project. The practical measures outlined in the new agreement aim to:

• exchange experiences aimed at strengthening and speeding up direct cooperation between law enforcement authorities and online service providers with a view to accessing e-evidence;

• allow for the exchange of best practice and training for the practitioners of EU Member States on applicable rules in the United States related to the mutual legal agreement procedures;

• expand the geographical focus of SIRIUS beyond the cooperation with the United States to develop collaboration on existing initiatives and projects with selected third countries based on the interests of EU Member States.

Cybercrime Judicial Monitor

The 5th CJM, focusing on virtual currencies, was published in December 2019. Published once a year, the CJM is based on input from the EJCN and distributed to judicial and law enforcement authorities active in fighting cybercrime and cyber-enabled crime. In addition to the updates on legislative developments and case law on cybercrime, cyber-enabled crime and e-evidence in 2019, the focus of this issue of the CJM was the ‘handling of virtual currencies in criminal investigations and proceedings’.

The report looks at the legal framework and policies in different countries, and the challenges and obstacles encountered when seizing and possibly converting virtual currencies at different stages of an investigation.