EncroChat, SkyECC and ANOM

By Dr. Julius Hagen, Attorney at Law

Encrypted phone data is not the same as proof of a drug offence

In EncroChat, SkyECC or ANOM cases, the file can look overwhelming. Chat logs, usernames, contacts, photos, locations and police analysis reports may appear to settle the case. But that does not yet show what the data really proves. The first questions are often whether an account can actually be linked to a person, whether a message describes a specific offence and whether the alleged quantity is reliable.

How data becomes a prosecution narrative

A person often learns about an EncroChat, SkyECC or ANOM investigation through a search, arrest or seizure of phones, cash, vehicles and storage devices. What later carries weight in the file is often not a current seizure, but communication data that has already been analysed. The file may include chat logs, translations, attribution notes, photographs, location references, contact lists and police analysis reports.

From that material, the allegation is built step by step. A username is linked to a person. A message is read as referring to a drug transaction. A quantity is connected to specific substances. Individual passages are used to describe a role within a supply or distribution structure. Each step can move the case in a different direction.

Account attribution: who used the chat?

Many cases depend on the assumption that a specific EncroChat, SkyECC or ANOM account can be attributed to the accused. Investigators may rely on nicknames, photographs, contacts, location data, delivery points, seized devices, language patterns, vehicles or residential addresses.

A nickname, a location or a contact does not by itself prove who actually used an account. This matters especially where apartments were shared, devices changed hands, several people had access or attribution is indirect. Technical traces, investigative inferences and reliable proof of identity are not the same thing.

Chat content: what was actually agreed?

The German concept of drug trafficking is broad. A completed sale is not required. Preparatory, coordinating or intermediary conduct may be treated as trafficking if it is directed at a profit-making drug transaction.

This makes encrypted chats vulnerable to far-reaching interpretation. Prices, delivery instructions, quality complaints, handover times or courier coordination may be read as trafficking. The context may also point in another direction: an attempted arrangement, someone else’s communication, a failed discussion or a role that is more limited than the prosecution assumes.

Series of offences, quantities and sentencing range

Short chat sequences are often used to allege several individual transactions or larger drug quantities. This can significantly affect the sentencing range. Whether a conversation refers to one delivery, several independent transactions or only a non-binding discussion may influence conviction, sentencing and pre-trial detention.

The issue of a “significant quantity” is particularly sensitive under German narcotics law. It depends on active substance quantity, attribution and reliable evidence – not simply on the gross weight mentioned in a chat or on the impression created by the communication. If no drugs were seized, the defence question becomes sharper: can drug type, quality and active substance content really be proven from the data?

Admissibility and mutual legal assistance

The admissibility of EncroChat, SkyECC and ANOM data remains a separate issue. EncroChat and SkyECC cases typically involve data obtained abroad and later transferred to Germany. ANOM adds another layer because the platform itself was introduced as a law enforcement operation and the data reached German proceedings through international mutual legal assistance.

For the accused, it matters whether the file contains only finished police analysis reports or whether the origin, transfer and selection of the data are properly documented. If documents on the original data collection are missing, translations remain unclear or only excerpts from larger data sets are available, the issue is no longer just admissibility in the abstract. The specific analysis itself must then hold up. That applies to account attribution, the content of the messages, the alleged quantity and the charge built from them.