If EncroChat messages are the central evidence in the case in front of you, the question everyone asks is the same: are they valid as evidence, or can the judge be persuaded to exclude them? The honest answer is neither a flat yes nor a flat no. It depends on how that data reached Spain, what authorisations there were, and how the whole process was documented. And in those details, there are sometimes cracks that change the outcome.
What is EncroChat and why did it end up in the Spanish courts?
EncroChat was an encrypted communications network operating from servers in France. In 2020, the French and Dutch authorities intervened those servers, obtained millions of messages and shared them with security services in other EU countries, including Spain, through joint investigation teams (JITs). From there, the data reached Spanish courts and were used in dozens of cases for drug trafficking, organised crime and money laundering.
The platform sold modified phones with no GPS, no camera and no microphone, which could only send encrypted messages within the network. The service was geared towards interception-proof private communications. The investigations revealed that the network was used extensively by criminal organisations across Europe.
What makes the Spanish case peculiar is that the data were not captured by the Policía Nacional or the Guardia Civil: they were captured by France. And they were transferred to Spain through European judicial cooperation mechanisms. That raises European criminal law questions that do not arise in an ordinary interception, and they are exactly the questions that matter for the defence.
How valid are EncroChat messages as evidence in Spain?
The Supreme Court has admitted EncroChat messages as valid evidence, but in a single ruling — and that distinction matters for the defence. It has not done so unconditionally: the evidential value depends on the specific circumstances of each case, and that is exactly where real room to work remains.
The Supreme Court’s position: one ruling, not settled case law
The Second Chamber of the Supreme Court, sitting as a full Plenary, set out its position in STS 854/2025, of 16 October — currently the only judgment that has addressed, in a unified and direct way, the validity of EncroChat evidence. That is the starting point for any defence strategy today.
This matters strategically: a single ruling, even from the full Plenary, is not the same as settled and reiterated case law. The criterion exists and carries weight, but the debate is not closed the way it would be after a consistent line of judgments. The Court itself acknowledged this by stressing that no general patterns can be established: the evidential value of the messages will depend on the circumstances of each specific case and on the effective opportunities the defence had to contest them.
What STS 854/2025 established:
- When a European Investigation Order (EIO) serves to transmit evidence already obtained by France (not to order its collection), Spain does not need to scrutinise how France obtained it — only whether the transfer would be admissible in an equivalent domestic case.
- That EIO can be issued by the Public Prosecutor, without requiring a prior Spanish judicial order authorising access to the data.
- The presumption that France respected EU law and fundamental rights is rebuttable — that is the key foothold for the defence.
What the CJEU has said about EncroChat data
The Grand Chamber of the CJEU ruled on 30 April 2024, in case C-670/22 (M.N.), following a reference from a German court. It held that when an EIO is used to transmit evidence already held by the executing state, the issuing state need not scrutinise how that evidence was collected — and that the order can be issued by a prosecutor if national law so permits.
But the same ruling introduced safeguards that remain live for the defence: the presumption that fundamental rights were respected is rebuttable, the issuing state must verify the transfer was not designed to circumvent its own procedural guarantees, and the court evaluating the evidence must ensure the right of defence and fairness of the proceedings are safeguarded (Article 14 of the Directive). It is also worth noting that the CJEU responded to questions posed by a German court, calibrated to German criminal procedure — its direct projection onto Spanish criminal procedure is not fully settled, which is itself an argument the defence can develop.
Article 588 ter of the Criminal Procedure Act governs the interception of telematic communications in Spain. But when the data come from another EU state, the legal basis is more complex: instruments of mutual recognition and the Framework Decisions on joint investigation teams come into play.
When can EncroChat evidence be challenged?
The challenge is not automatic: it has to be built with specific arguments and raised at the right procedural moment. A defence that waits until the oral trial to challenge the evidence for the first time is already at a disadvantage.
Defence arguments that have worked
The most effective in the Spanish courts have been:
- Absence of a reasoned judicial authorisation in Spain: the order authorising access to the data did not examine the proportionality of the measure. It is not enough for a judge to sign the authorisation; they have to reason why the intrusion into privacy is justified in that specific case.
- Gaps in the chain of custody: if it cannot be fully established how the data travelled from EncroChat’s servers to the Spanish case, the evidence is called into question.
- Irregularities in the JIT: if Spain did not really participate in the joint investigation team, or if the participation was nominal, the legal basis of the transfer is weakened.
- Questioning the authenticity of the messages: the data were processed by French authorities before reaching Spain. The defence can question whether there were modifications or whether the metadata are reliable and allow the authenticity of each specific message to be established.
What the defence needs to request exclusion
Requesting the nullity of the evidence is not enough: it has to be argued with documentation. That requires accessing the investigation file and analysing the authorisation order, the content of the JIT, the police reports on the chain of custody and, if available, the documentation on how France obtained the data from the server.
The ideal is to raise the nullity during the investigation phase, through a specific submission before the court. If it is dismissed, it can be appealed. Once at the oral trial, the challenge can be reiterated, but the room for manoeuvre is smaller.
If your case involves EncroChat evidence, the first thing to do is to speak with a lawyer specialising in cases with intercepted digital evidence. The defence strategy over the evidence is defined during the investigation, not at the trial.
Is there a difference between EncroChat, SkyECC and other encrypted apps?
The technology was different, but the legal debate is very similar.
SkyECC was intervened by Belgian authorities in 2021, following a scheme similar to EncroChat. The data were also shared through European judicial cooperation mechanisms. ANOM was directly an undercover operation by the FBI with the Australian Federal Police, which adds an extra layer of complexity regarding the admissibility of that data in Spain.
In all cases, the question to ask is the same: how was the evidence obtained, who transferred it, with what authorisation, and how did it reach the Spanish file? The answer may be different for each platform and for each specific case.
What is true is that the case law on EncroChat is more developed in Spain than that on SkyECC or ANOM, because it reached the courts earlier. In SkyECC cases, there are fewer Supreme Court judgments, which means more uncertainty, but also more room for the defence to open lines of argument that the Supreme Court has not yet closed.
This article is for informational purposes and does not constitute legal advice. Every case has specific circumstances that can completely change the analysis. If you need concrete guidance on your situation, consult a criminal defence lawyer.
