The future of data-driven investigations in light of the Sky ECC operation

Published date01 December 2023
DOIhttp://doi.org/10.1177/20322844231212661
AuthorJan-Jaap Oerlemans,Sofie Royer
Date01 December 2023
Special Issue Article
New Journal of European Criminal Law
2023, Vol. 14(4) 434458
© The Author(s) 2023
Article reuse guidelines:
sagepub.com/journals-permissions
DOI: 10.1177/20322844231212661
journals.sagepub.com/home/nje
The future of data-driven
investigations in light of the Sky
ECC operation
Jan-Jaap Oerlemans
Utrecht University, The Netherlands
Sof‌ie Royer
KU Leuven, Belgium
Abstract
The Sky elliptic-curve cryptography (Sky ECC) operation is a prime example of a data-driven
investigation. The collection of approximately 1 billion messages from 70,000 phones paved the way
for hundreds of criminal investigations, resulting in numerous convictions in the Netherlands and
Belgium alone. This article addresses how the Sky ECC operation interferes with the right to privacy
and the right to a fair trial. We examine whether or not, and on what terms, there is a future for
data-driven criminal investigations. Our main research question is therefore how data- driven
criminal investigations can be (better) regulated in order to be in line with case law of the European
Court of Human Rights. To answer the research question, the main characteristics and legal criteria
for data-driven investigation are identif‌ied. These criteria derived from the right to privacy and the
right to a fair trial. Finally, we examine the impact of a violation of these criteria for the use of
evidence in criminal proceedings. The research uncovers a disconnection between dat a protection
regulations and criminal procedural law. It highlights that practitioners concentrate primarily on the
collection phase, governed by criminal procedural law, whereas the most urgent questions relate to
the respect of data protection law and the right to a fair trial. This f‌inding suggests an ongoing
discourse relating to the transparency of data-driven criminal operations like Sky ECC and the need
to address concerns regarding the reliability of evidence.
Keywords
data-driven criminal investigation, Sky ECC, fair trial, right to privacy, grey infrastruc ture, reliability,
exclustion of evidence
Corresponding author:
Jan-Jaap Oerlemans, Utrecht University, Newtonlaan 231, Utrecht 3584 CS, The Netherlands.
Email: j.j.oerlemans@uu.nl
Introduction
Sky ECC was a subscription-based messaging application that ran on modif‌ied Nokia, Google,
Apple, and BlackBerry phones. The phones were supplied by Sky Global, the company behind Sky
ECC.
1,2
Like other cryptophones, Sky ECCs primary purpose was to facilitate secure commu-
nication between subscribers by use of applications that utilise strong encryption. The cameras,
microphones, and GPS were disabled, making it impossible to make regular phone calls with a Sk y
ECC phone.
Worldwide, approximately 170,000 individuals used the tool, which had its own infrastructure
and applications and was operated from the United States and Canada, using computer servers based
in France. On a global scale, around three million messages were exchanged each day via Sky ECC.
Over 20 percent of the users were based in Belgium and the Netherlands.
3
In mid-February 2021, law enforcement authorities were able to monitor the information f‌low of
approximately 70,000 users of Sky ECC. On 9 March 2021, the service was shut down after a joint
operation by French, Belgian, and Dutch law enforcement authorities, known as Operation Argus.
The operation led to the interception of approximately 1 billion messages, which were later used as
evidence in criminal investigations and for intelligence purposes.
4
While the operation received much media attention, it was not the f‌irst operation targeting
cryptophone companies and their users. Other examples are the investigations into Ennetcom, PGP
Safe, IronChat, EncroChat, and ANOM cryptophones.
5
We refer to these operations as data-driven
criminal investigations. A data-driven criminal investigation involves the processing of data that
has been collected by law enforcement authorities in an earlier phase, which is then enriched, and
linked with other data for future investigations.
6
In other words, the Sky ECC operation was not the f‌irst data-driven criminal investigation and it
will most certainly not be the last one. We expect similar operations to be carried out in the future,
1. Prof. dr. Jan-Jaap Oerlemans is an endowed professor of Intelligence and Law,aff‌iliated to the Willem Pompe Institute for
Criminal Law and Criminology,Utrecht University, The Netherlands. He is also a senior researcher at the Dutch Review
Committee for Intelligence and Security Services (CTIVD).
2. Dr. Sof‌ie Royer is a research expert at the Centre for IT and IP Law, aff‌iliated to the Institute of Criminal Law, both KU
Leuven, and a guest professor at UAntwerpen and ULiège.
3. Europol, New major interventions to block encrypted communications of criminal networks(Europol, 10 March 2021),
<www.europol.europa.eu> accessed 1 October 2023.
4. This number is mentioned by Belgian law enforcement off‌icials. See, e.g., Leon van Poppel, Waarom criminelen een
berichtendienst gebruiken zoals Sky ECC(RTL Nieuws, 10 March 2021) < https://www.rt lnie uws. nl/n ieuw s/
nederland/artikel/5219062/sky-ecc-berichten-criminelen-encryptie>accessed 1 October 2023; H Lyons,Cracking
of encrypted messaging service dealt major blow to organised crime(The Brussels Times, 9 March 2021) < https://www.
brusselstimes.com/159039/cracking-of-encrypted-text-messaging-service-sky-ecc-app-dealt-major-blow-to-organised-
crime> accessed 1 October 2023; S Drommen and D Hiroux, Politie na grootste actie ooitin ons land: Tonnen
coca¨
ıne, corruptie tot in alle lagen van de maatschappij”’ (vrt nws, 9 March 2021) < https://www.vrt.be/vrtnws/nl/2021/
03/09/huiszoekingen-200-1500-agenten/> accessed 1 October 2023.
5. See, for an overview of these operations in which Dutch law enforcement authorities were involved: J J Oerlemans,
Overzicht cryptophone-operaties(jjoerlemans.com, 14 November 2022) <https://jjoerlemans.com/2022/11/14/
overzicht-cryptophone-operaties/> accessed 1 October 2023.
6. We derive this concept from the following paper: E van de Sandt, A van Bunningen, J van Lenthe, and J Fokker,Towards
Data Scientif‌ic Investigations: A Comprehensive Data Science Framework and Case Study for Investigating Organized
Crime and Serving the Public Interest(Third INTERPOL-UNICRI Global Meeting on AI for Law Enforcement,
, 25 November 2020). See also M F H Hirsch Ballin and J J Oerlemans, Datagedreven opsporing verzet de
bakens in het toezicht op strafvorderlijk optreden(2003) DD 18-38.
Oerlemans and Royer 435

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT