David Silva Ramalho analyses the Sky ECC case and the limits of digital evidence in Portugal

David Silva Ramalho, managing associate in the criminal, regulatory offences and compliance practice at Morais Leitão, analysed, in an interview with CNN Portugal, the international investigation into the encrypted communications network Sky ECC, an unprecedented operation in the fight against organised crime. The investigation, led by the authorities of Belgium, France and the Netherlands, enabled access to around one billion messages and resulted in the transmission of more than 500 communications to Portugal.

Sky ECC operated as a private electronic communications infrastructure, developed by a Canadian company, based on mobile devices configured for exclusive use and on a proprietary message transmission system.

“It worked with BlackBerry software that was installed on top of the iOS system. It was entirely configured with software to avoid detection and was highly confidential.”

The devices used SIM cards exclusively for data and a private APN (Access Point Name), which made traditional interception of communications impossible.

“They had a private APN and, therefore, it was not possible to carry out wiretaps.”

Scale of the network and initial suspicions

In 2020, there were an estimated 67,000 active users worldwide, with a particular concentration in Belgium and the Netherlands. The high cost of the service was one of the main factors underpinning the authorities’ view that the network was used predominantly for criminal purposes.

“The price of the phone was high, and on top of that there was a fee ranging between €1,400 and €2,500 for six months of use.”

Evidence gathering and international cooperation

At an early stage of the investigation, and in the absence of access to the content of communications, the authorities relied on the analysis of traffic metadata, through the construction of heat maps, to identify spatial and temporal patterns of use.

“Even without being able to carry out wiretaps, the authorities managed to do what are known as heat maps.”

At a later stage, a technical infiltration of the devices is believed to have taken place, allowing access to communications directly on the equipment.

“It is known that there was an infiltration of the devices so that evidence could be collected.”

Over several months, around one billion messages were collected, subsequently decrypted, analysed and subject to filtering, with the relevant information being shared with other States within the framework of international judicial cooperation.

“There were around 500 notifications” sent to Portugal.

Admissibility of evidence and the legal framework in Portugal

According to David Silva Ramalho, despite the objections raised in several cases, the prevailing trend in European case law has been to admit this type of evidence. In Portugal, however, a significant structural issue remains.

“In Portugal this would not have happened.”

The lawyer highlights the absence of a clear and express legal basis allowing so-called source interception, that is, the collection of communications directly on the device before or after encryption.

“We do not have an express legal basis to do this.”

This situation raises doubts as to the assessment, in national proceedings, of evidence obtained abroad through methods that are not expressly provided for under Portuguese law.

“If I do not know exactly how the evidence was collected, then I cannot guarantee that the evidence was properly obtained.”

The reading that David Silva Ramalho offers of this case shows how the Sky ECC investigation confronts the justice system with new problems, for which Portuguese law still does not provide clear answers, in a context where crime has long ceased to recognise borders.

Read the full interview here.