Sky ECC chats excluded in an Italian trial: why the way evidence was collected matters

What happened to the Sky ECC chats in the Ostro trial, according to the press

The Sky ECC chats in the Ostro trial were set aside because the defense could not examine how they had been gathered, according to the Calabria Inchieste report of November 10, 2026 on the reasons filed four days earlier. TrueScreen took no part in gathering the Sky ECC chats; for evidence that private parties collect themselves, it records how each item is captured at the moment of capture, so the question of method has an answer from the start. The ruling is first-instance, not final, and applies to that proceeding only.

As the report describes it, the case turned on access to the collection method: the defense could not see how the chats had been obtained, so it could not contest that phase. The chats had been collected by the French authorities and obtained in Italy through European Investigation Orders. France denied access to the records the defense had asked for, and the whole Sky ECC material was treated as if it did not exist, tamquam non esset.

The report says the judge relied on a principle of the EU Court of Justice, without citing a case number: evidence obtained through an EIO that weighs decisively on the decision, and that the accused cannot examine, may have to be excluded. It is a principle that the EU Court of Justice has affirmed, in particular, in judgment C-670/22; that link is ours, not the judge’s.

What held up and what did not without that material

Without that material, some charges did not hold up, according to the source, while the parts of the case built on ordinary phone wiretaps, surveillance and police checks were assessed on that evidence. The source ties the charges that did not hold up to the excluded material, and the convictions that remained to ordinary evidence.

Why this is not a general exclusion of Sky ECC chats

Calabria Inchieste itself stresses that this is not a general exclusion of Sky ECC chats: acquisition, access to the records and the role of each piece of evidence are assessed case by case.

In another proceeding before the same court, the outcome was different. According to Metis 2.0, on October 28, 2026 another preliminary hearing judge rejected the defense objections and the request for raw data and technical documentation on Sky ECC, and the chats remained usable. National courts apply the principle case by case, and the facts of each case decide the outcome.

Sky ECC, EncroChat and the European Investigation Order: how encrypted chats reach the courtroom

Encrypted chats usually reach a trial in one country after authorities in another country have collected them, and the European Investigation Order is the channel they travel through.

What Sky ECC and EncroChat were

EncroChat sold encrypted phones with a promise of anonymity; according to Europol, the interception of the network stopped on June 13, 2020. By June 2023, Eurojust counted more than 60,000 users, 115 million conversations and 6,558 arrests.

Sky ECC, another network of cryptophones, was hit on March 9, 2021 by an operation in Belgium and the Netherlands, and Eurojust reported about 70,000 users being monitored, out of roughly 170,000 worldwide, exchanging around 3 million messages a day.

The EIO and the problem of access to the records

A European Investigation Order (EIO), created by Directive 2014/41/EU of April 3, 2014, lets a judicial authority in one Member State obtain evidence from another, including evidence that State already holds. In the EncroChat case, data gathered in France reached Germany this way.

The EIO moves the data, but the collection stays where it happened, under another authority’s control. Article 14(7) of the Directive speaks to that gap: “Without prejudice to national procedural rules Member States shall ensure that in criminal proceedings in the issuing State the rights of the defence and the fairness of the proceedings are respected when assessing evidence obtained through the EIO.” When the records of the collection are out of reach, the defense has the chats in hand and nothing to test them against.

The EU Court of Justice principle: when evidence the defense cannot comment on may have to be disregarded

In its EncroChat judgment (C-670/22, April 30, 2024), the EU Court of Justice held that national criminal courts may have to disregard evidence when two conditions are met together: the person concerned is not in a position to comment on it, and it is likely to have a preponderant influence on the findings of fact. A certified package can be checked by whoever receives it, independently, using standard tools. The judgment concerned EncroChat, not Sky ECC, and otherwise leaves the use of such evidence to national law.

The Court tied exclusion to two conditions together and left the wider question of using such evidence to national law.

The Court’s press release No 77/24 sets out when that duty arises: “when the person concerned is not in a position to comment on that evidence and the said evidence is likely to have a preponderant influence on the findings of fact.” The case came from the Regional Court of Berlin and concerned EncroChat, not Sky ECC.

A further reference from the French Cour de cassation, case C-625/25, is pending.

Content and method: digital evidence also counts for how it was collected

Digital evidence is verifiable when the party challenging it can check for itself how, when and from which source it was acquired, and whether it has changed since. TrueScreen makes that check possible for the chats and web pages acquired with it, because the record of the acquisition travels with the content and the other side does not have to take anyone’s word for it.

A chat in court is two things: what it says, and the trail that shows where it came from.

Encryption does not supply that trail. A WhatsApp chat is end-to-end encrypted in transit, yet the version a party submits is whatever appears on a screen or in an export, and the questions start there: who captured it, on which device, when, and was anything cut? A digital evidence chain of custody answers those questions only if it starts at the moment of collection, because a gap at the start cannot be filled in later. Lawyers running defense investigations face the same challenge on the material they gather themselves.

Outside criminal trials: not a rule, but the same question

The principle comes from criminal proceedings and concerns evidence gathered by authorities. The question it raises, how was this collected and can I check it, is one any opposing party can ask, whether the dispute is about a contract, a dismissal or a defamatory post. It is not a rule of civil procedure: it is a question.

There is one useful difference. In the Ostro case, as reported, access to the method was denied; if you produce the evidence, you can do the opposite and open the method up.

Feature

Verify a TrueScreen certification

With the TrueScreen public verifier, whoever receives the package checks seal, timestamp and hashes without having to trust anyone.

Discover more →

How can a private party make digital evidence verifiable?

TrueScreen makes evidence collected by a private party verifiable by acquiring it at the source: the conversation is recorded while it scrolls on the screen, in a controlled environment where alteration is prevented during the acquisition, and the time, device and network of the session stay attached to the content. The result is a certification package that anyone who receives it can check with standard tools, without TrueScreen and without relying on whoever hands it over.

The result is certified evidence that can be submitted in court, whose weight the judge assesses; what certification adds is a method the other side can check.

Chats on a phone are certified with the TrueScreen App, which records the screen while the user scrolls through the conversation; its report covers environment, device and network, plus the session log when the template includes it. Chats open as a web service on a computer, such as WhatsApp Web, and web pages go through the Forensic Browser, the first choice for acquisitions that may be contested, with a hash chain, clock check, page source, TLS certificates and, when it ran, network traffic. Every file comes with its SHA-256 hash.

TrueScreen guarantees the how, not the what. It certifies how a conversation was acquired, not that its content is true or complete; what the messages mean is for the judge and the experts to weigh. Any evidence can be challenged, and certification does not change that.

Some things sit outside what TrueScreen does. It cannot certify after the fact how a third party collected its data, so material already gathered by others, such as wiretaps or chats held by authorities, is outside what a TrueScreen certification attests. It does not perform forensic extraction of devices, and it does not replace the forensic expert: the expert evaluates, TrueScreen guarantees the acquisition.

Take a plausible scenario: in an employment dispute, a company has to produce the chat in which a former employee passed price lists to a competitor. Screenshots invite the obvious objection about where they come from and whether they are complete. If the chat was acquired with TrueScreen as it scrolled on the company phone, the opposing consultant receives the package, recalculates the hashes and checks the certification alone, without having to believe the company.

1. 1

   Acquire at the source in a controlled environment

   Acquisition at the source means capturing the content where it lives, at the moment it is shown, before anyone exports or copies it. Open the chat on the phone that holds it, or the page in the browser, and acquire it there. A file that already exists, such as an exported chat or an earlier screenshot, is certified from that moment on, not as an acquisition at the source.

2. 2

   Keep the certification package intact

   A certification package is the set of files, hashes and reports that documents one acquisition, and it works only as a whole. The data are verified, a technical report records each stage of the session, and the package is sealed with a qualified electronic seal and a qualified timestamp. Only the complete sequence preserves the chain of custody: a seal or a timestamp on its own is not enough. After certification any alteration becomes detectable, so store and share the package exactly as delivered.

3. 3

   Let the other side verify

   Verification by the other side turns a claim about evidence into something checkable, so hand over the package itself, not a printout. The opposing party, a court-appointed expert or anyone else can open the free public verifier, which runs in the browser, checks seal and timestamp and recalculates the SHA-256 hashes. That kind of independent verification does not depend on whoever holds the file, and where a certification is challenged, TrueScreen source code and activity logs can be examined in a forensic review under a non-disclosure agreement.

Conclusion