France's Secret EncroChat Implant Was Copied From GitHub

Six years of European criminal trials have turned on evidence almost nobody outside the French Gendarmerie was allowed to examine. Defendants in the UK, the Netherlands, Germany and France were convicted on messages lifted off EncroChat phones by a tool France classified as a defence secret, and the classification was total enough that defence experts could not test how those messages were captured. A company in Brno has now taken the tool apart.

Key Takeaways

• Computer Weekly and the Sussex Centre for Law and Technology published the first technical account of the 2020 EncroChat hack, attributing it to France's Gendarmerie cyber crime unit C3N and the Service Technique National de Captation Judiciaire.
• Invasys, a security firm in Brno, Czechia, reverse engineered the implant and reported it was built largely from public code, including the open source Frida toolkit and the Realm database library.
• The implant escalated privileges using Bad Binder, CVE-2019-2215, a use after free flaw in Android's binder driver that NIST rates 7.8 High and Google Project Zero analysed publicly in November 2019.
• Eurojust recorded 6,558 arrests and close to €900 million seized or frozen after the EncroChat takedown.
• The Court of Justice of the European Union held in Case C-670/22 that EncroChat material is admissible only where the defence can comment effectively on it.

What Did the Czech Teardown Actually Find?

Invasys found the French implant was assembled substantially from freely available software rather than bespoke classified tooling. According to Computer Weekly's investigation, it shipped as an Android package containing six native hooks named Exploit_c through Exploit_h, with message capture exposed as Java_com_android_device_Exploit_h.

The components are the point. Computer Weekly reports the implant used Frida, an open source instrumentation toolkit any researcher can install in one command, and Realm, an ordinary Android database library. Neither is exotic. Both are maintained in public.

Its behaviour was blunt once the code had root. On boot it kept the handset awake, disabled logging and switched off SELinux enforcement. Frida hooks captured the unlock password as the user typed it, and each message was copied out as it was written, reaching police screens within seconds. Invasys also tested and rejected the rival theory that the encryption had been weakened.

These internals come from Computer Weekly's report and the Invasys examination behind it, led by Kyrre Sletsjøe, which produced an expert report in February 2025. British barristers told the publication Invasys was paid £2 million for the work.

What Is Bad Binder, and Why Did It Still Work in 2020?

Bad Binder is CVE-2019-2215, a use after free bug in Android's binder driver that lets an ordinary app escalate to Linux kernel privileges. NIST's National Vulnerability Database describes it as "a use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel" and scores it 7.8 High.

It still worked in 2020 because of a patching failure, not a research failure. Google Project Zero's analysis records that syzbot found the bug in November 2017 and it was fixed upstream in February 2018, but the fix never went into an Android monthly security bulletin, leaving shipped devices including the Pixel and Pixel 2 exposed for close to two years. Project Zero went public in November 2019 after learning NSO Group had an Android zero day in a chain that installed Pegasus.

Line the dates up. A complete public write up existed in November 2019; Computer Weekly dates the EncroChat injection to 1 April 2020. Roughly four months separate a published exploit analysis from a police force using the same bug against tens of thousands of handsets — and within one twelve month window, that vulnerability served both a commercial spyware vendor and a national police agency.

Why Does It Matter That the Code Was Public?

Because the whole justification for keeping the method from defence lawyers was that disclosure would burn a sensitive national capability. Courts across Europe accepted a French classification that made the collection method unexaminable, and every conviction built on EncroChat material inherited that gap.

If the load bearing pieces were an open source testing toolkit, a mainstream database library and a proof of concept for a bug Google had already documented in full, what was protected was integration work rather than a secret capability. That is a far weaker claim, and one a court can now weigh against evidence instead of taking on trust.

Most coverage treats EncroChat as a drugs story. The precedent is the bigger part: an evidentiary method was withheld from adversarial scrutiny on a security assertion nobody outside the state making it could test. That pattern recurs wherever government demands meet technology providers, which is why companies willing to contest secrecy around law enforcement data demands matter beyond any single case.

Interception or Stored Data? Why the Distinction Decides Cases

Whether the implant captured messages in transit or read them from storage determines which legal authority governed the operation, and in the UK it has been argued to decide admissibility outright. That question has been litigated for years on a factual record nobody could inspect.

A technical account describing hooks that copy each message as it is created goes straight to that argument. Computer Weekly reports the disclosure is expected to restart a UK Investigatory Powers Tribunal case adjourned for more than two years awaiting exactly this kind of finding. Matthew Ryder KC, a lead lawyer in UK EncroChat litigation, told the publication the findings are bound to have consequences for the legal argument.

The European position sharpens it. In Case C-670/22, decided 21 March 2024, the CJEU held EncroChat material can be admitted but conditioned that on defendants being able to engage with it. An analysis in the European Journal of Risk Regulation notes the court's finding that a fair trial breach occurs where a defendant cannot comment effectively on evidence weighing heavily in the outcome. The stakes are large: Eurojust recorded 6,558 arrests and close to €900 million seized or frozen, drawn from more than 115 million intercepted conversations among an estimated 60,000 users.

What This Means for Your Inbox

The encryption did not fail here. The endpoint did. EncroChat sold end to end encrypted messaging on a hardened handset, and by the Invasys account the cryptography held. What defeated it was code running with kernel privileges, reading messages after they had already been decrypted for display.

That applies to your email identically. PGP, S/MIME and provider level encrypted mail protect a message while it moves between endpoints; none protects an endpoint that has been implanted. If a reporter's phone is compromised, mail is read in plaintext the moment it appears on screen, the provider sees nothing unusual, and transport security is irrelevant. The SilkParasite campaign sat inside government ministries for close to a year doing exactly that.

EncroChat also shows the shape of platform risk: one closed device, one vendor controlled update channel, and no way to verify what the handset runs. When that platform falls, every user falls at once. Anyone whose work makes them a plausible target should enrol in the warning systems built for this population — Apple's threat notifications have reached targets in 110 countries, and Google runs an equivalent programme.

What Should High Threat Users Actually Do?

Assume the endpoint is the target, and shrink what a compromised endpoint can give away. Bad Binder had an upstream fix two years before it was used at scale; the people who suffered ran devices whose vendor never shipped it.

• Turn on automatic security updates and retire handsets past their support window. A device outside that window is not slightly worse, it is permanently vulnerable.
• Prefer widely audited mainstream platforms over bespoke secure phones. A boutique device attracts a fraction of the adversarial research iOS and Android receive, and its update channel is a single point of failure.
• Enable the hardened modes vendors ship. Apple's Lockdown Mode is built for people facing state grade targeting.
• Minimise on device retention. Disappearing messages and short mail sync windows mean a seized phone yields weeks of history, not years.
• Audit linked devices and companion sessions monthly. Web sessions and forwarding rules are the quietest way to lose a mailbox.
• Compartmentalise. Keep sensitive correspondence on a separate device and identity that never touches personal accounts.

What Happens Next?

The findings are moving into two forums. Computer Weekly reports they were discussed at Crypto 2026, the 46th Annual International Cryptology Conference in Santa Barbara, by a US and UK team led by Martin Albrecht of King's College London, whose framing is that the secrecy itself caused problems in the later legal proceedings.

The other is the Investigatory Powers Tribunal. If that case restarts, it will be the first time the technical basis of the interception is argued in a setting designed to test it. Whatever it concludes, the durable outcome is what this teardown already established: a classification that survived six years of litigation was protecting an assembly of public parts.

Sources: Computer Weekly on the EncroChat implant; Google Project Zero on Bad Binder; NIST NVD entry for CVE-2019-2215; Eurojust on the EncroChat takedown results; European Journal of Risk Regulation on CJEU Case C-670/22. Implant internals, timeline dates and the £2 million figure are as reported by Computer Weekly and the Invasys examination.