EU coordination falls short of control in case of encrypted app drug busts

(CN) — An attempt to pin the fallout of an encrypted phone crackdown on EU crime-fighting agencies fizzled Wednesday, as Europe’s General Court made clear that coordinating a drug probe is not the same as owning its consequences.

In twin rulings, the court drew a firm boundary between EU agencies and national police forces. Europol, the bloc’s law enforcement coordination agency, and Eurojust, its judicial cooperation body, may assist and analyze cross-border investigations, but responsibility for arrests, seizures and prosecutions remains with member states.

“The judge of the European Union is not competent to verify the validity or the proportionality of operations carried out by the police or other law enforcement services in a member state,” the court said.

The two applicants claimed the EU agencies mishandled their data when they were separately swept up in Dutch drug probes after authorities infiltrated Sky ECC, an encrypted network widely used by criminal groups to coordinate cocaine shipments across Europe. Following requests from Belgium and the Netherlands in 2018, French investigators began intercepting Sky ECC traffic. By late 2019, the three countries had formalized their cooperation through a joint investigation team.

When authorities later gained full access to the network’s servers in 2020 and 2021, they pulled down millions of messages. Prosecutors say traffickers used the encrypted phones to line up cocaine shipments, tip off port insiders and route drugs through gateways like Rotterdam in the Netherlands. The chats quickly moved from intelligence to courtroom evidence, forming the backbone of arrests and pretrial detention orders across Europe.

The applicants argued Europol and Eurojust were no mere bystanders and should answer for how the data was handled and shared. They sought compensation for detention, reputational harm and legal costs.

According to those caught in the busts, the agency received the raw Sky ECC data intercepted by French authorities, stored it in its own systems, analyzed it, ran cross-checks and produced intelligence reports before sending the results back to Belgian, French and Dutch investigators. In BW’s case, the complaint also focused on a Jun. 24, 2022, transfer in which Eurojust passed along a secure download link to Serbian prosecutors containing messages tied to him.

The court was unmoved. The joint investigation team was created by Belgium, France and the Netherlands, not by an EU institution, and its agreement was not an EU act subject to annulment, judges said in a ruling available in French.

Under EU law, shared responsibility arises only in narrow circumstances, for example if Europol itself unlawfully processes personal data. It does not turn Europol or Eurojust into guarantors of national criminal investigations.

Maria Tzanou, senior lecturer in law at the University of Sheffield, said the judgment largely followed established EU case law: “It comes as no surprise that the General Court found no sufficiently serious breach of an EU rule of law intended to confer rights upon an individual,” she said.

She added that judicial review for damages remains crucial, “even if the particular case was unsuccessful—rightly so in my view,” as it ensures EU institutions are held accountable within the fundamental rights framework.

Nissim Picard, public law researcher at Maastricht University, noted a nuance the court highlighted: “Eurojust can only be held accountable for its own acts, while Europol could be held liable in narrow cases if national authorities act unlawfully.”

He added the court found the applicants’ claims lacked enough proof, underscoring the complexity of verifying evidence shared behind closed doors between national and EU authorities.

Criminal law scholars say that framework made the outcome difficult to avoid.

Richard Gerding, senior lecturer in criminal law and criminal procedure at the University of Amsterdam, said the applicants “have not substantiated their accusation that these agencies were predominantly involved in the investigation,” stressing that the Sky ECC operation “was carried out by the team itself.”

He added that the verdict reflects the “limited role of Europol and Eurojust in the investigation,” and that the agencies’ handling of information was not found to be unlawful.

The broader debate over encrypted chat evidence continues. Some national courts, including a Spanish court in Valencia, have begun scrutinizing whether defendants had adequate access to raw data, an issue the EU judges did not address.

Both EU agencies welcomed the rulings.

In a statement to Courthouse News, Eurojust spokesperson Jacobien Breukink said the court confirmed Eurojust’s support to national authorities in investigations linked to encrypted communication platforms, including Sky ECC, “is in accordance with its mandate and competence under the Eurojust Regulation.” She added the court found Eurojust “has complied with its legal obligations as to the processing of personal data,” with any handling “done in a completely lawful manner.”

Europol struck a similar tone. Claire Georges, head of media relations and deputy spokesperson, said the agency was “pleased to learn” the court had dismissed the actions. She described the rulings as part of “a line of dismissals” in related cases and said they concerned “legitimate activities carried out by Europol in support of the member states' investigations.”

The applicants’ side saw the outcome differently.

Justus Reisinger, lawyer for both applicants, said the court did more than simply shut the door on the claims.

“The court didn’t state the claims were inadmissible and the actions of Europol or Eurojust can’t be reviewed,” he said. Instead, the judges addressed the substance and dismissed the claims on the merits, a move he said keeps the door open for appeal.

“Of course, in substance, we tend to disagree with the decision, but now it will be possible to challenge this in substance in appeal at the Court of Justice, without being bothered too much with procedural grounds,” he said, adding that the case “is definitely going to be continued.”

The applicants now have two months and 10 days from notification of the judgments to appeal to the Court of Justice of the European Union. Any appeal would be limited to points of law. Until then, the damages claims are dismissed, and the national drug prosecutions continue on their own track.

Courthouse News reporter Eunseo Hong is based in the Netherlands.