In most drug supply prosecutions in England and Wales, the drugs themselves are no longer the main battleground. The phone is.
A small quantity of cocaine in a pocket, on its own, is a simple possession charge. Add a handset with hundreds of outgoing “menu” messages, a contacts list of first names and street nicknames, and photographs of scales and cash, and the Crown Prosecution Service will almost always charge the far more serious offence of possession with intent to supply under section 5(3) of the Misuse of Drugs Act 1971.
This guide explains how mobile phone evidence in possession with intent to supply cases is gathered, attributed and used in court, what the police are legally entitled to demand from you, and where these cases can be challenged. It reflects the law and forensic standards as they stand in 2026, including the statutory Forensic Science Regulator Code that now governs how digital evidence is extracted.
If your phone has already been seized, speak to our drug offences solicitors before your police interview, not after it.
Section 5(3) of the Misuse of Drugs Act 1971 breaks down into four elements. The Crown must prove all of them.
Possession. You knowingly had the drugs in your custody or under your control. Ownership is irrelevant minding a package for someone else is still possession. So is leaving drugs at your home address while you are elsewhere. Two or more people can be in “joint possession” of the same package if they all exercise control over it. Crucially, possession requires knowledge: if you borrow a coat and have no idea there is a wrap in the lining, you are not in possession of it.
Intent. No supply needs to have happened. A settled intention to pass the drugs on at some future point is enough, and it does not have to involve a named customer, a fixed price or a particular date.
Supply. Handing drugs to another person. Money is not required a free transfer is still supply. Even returning drugs to the person who asked you to hold them counts, which is why the “I was only looking after it” account so often fails.
A controlled drug. Controlled drugs are listed in Schedule 2 to the 1971 Act and split into Classes A, B and C, with Class A carrying the heaviest penalties.
Once a handset is downloaded, specialist officers usually a force’s drug expert or a dedicated digital media investigator go through the report looking for a recognisable pattern. The main categories are:
| Category of evidence | What it looks like in practice |
|---|---|
| Advertising or “menu” messages | Bulk broadcasts to dozens or hundreds of contacts advertising availability, quality or price |
| Incoming customer messages | Short requests asking whether you are “on”, “about”, “sorted” or “still doing food” |
| Coded and slang terminology | “White”, “B”, “dark”, “brown”, “louie”, “half a bar”, emoji substitutes such as ❄️ or 🍫 |
| Money movements | Bank transfer confirmations, payment app screenshots, tick lists and running debt tallies |
| Images and video | Photographs of cash, scales, deal bags, kilo blocks, or drugs laid out on a surface |
| Contacts and call patterns | Large numbers of one-word or nickname contacts, high volumes of very short calls |
| Location and movement | GPS history, geotagged photos, map searches and travel patterns consistent with delivery runs |
| Group and app activity | Snapchat, Telegram, Signal and WhatsApp group membership, disappearing-message settings |
| Second devices | References to a separate “graft” or “deal” line, which supports a county lines allegation |
Officers will also look for evidence of association in multi-handed cases: whether the seized phones have been in contact with each other, whether the same numbers appear across several handsets, and whether the pattern fits a hierarchy.
It is worth being clear about what this evidence is not. A phone containing customer style messages does not prove that the drugs found on a particular day were held for supply. It is circumstantial, and there is often a legitimate competing explanation historic personal use, social supply among friends, someone else using the handset, or messages arriving unsolicited. Those explanations have to be developed properly and early, and usually with expert assistance.
Attribution is the first hurdle for the Crown. If nobody admits ownership of a handset, or it was found in a communal area, a vehicle or a shared address, the prosecution must build attribution from circumstantial material:
Attribution is frequently the weakest link in a prosecution case, particularly with unregistered pay as you go “burner” handsets, shared addresses, phones passed between users, or lines that have been sold on. A defence that concentrates on attribution can succeed even where the content of the phone looks damaging on its face. Several of our notable drug offence cases turned on exactly this point.
As a starting point, no. There is no general duty to help the police with their investigation, and that includes handing over a PIN, passcode, pattern or password.
There is one important exception: section 49 of the Regulation of Investigatory Powers Act 2000 (RIPA). A section 49 notice compels the recipient to provide the “key” to “protected information” the police lawfully hold in practice, the passcode to a seized device.
A valid section 49 notice requires all of the following:
If a valid notice is served and you fail to comply, you commit an offence under section 53 RIPA. The maximum sentence is two years’ imprisonment, rising to five years in national security cases and cases involving indecent images of children. Sentences in ordinary criminal investigations have typically fallen in the range of roughly eight to eighteen months.
That is a common and understandable position most people’s phones contain intimate photographs, medical information, financial detail and messages about other people. Refusal is lawful where no valid section 49 notice exists, but you should understand the three practical consequences:
The right answer depends entirely on the facts of your case and what is actually on the device. This is a decision to take with a solicitor present in the police station free of charge, at any hour not alone in a cell.
Sometimes. The picture has shifted since these questions were first being asked.
Brute force. Forensic tools can cycle through passcode combinations. Success depends heavily on the state the device was seized in. A phone seized while unlocked or recently unlocked (“after first unlock”) is far more vulnerable than one seized powered down or rebooted (“before first unlock”). Modern handsets throttle attempts, so a strong passcode is a genuine obstacle. Short numeric PINs, repeated digits and dates of birth are not — investigators routinely try personally significant dates first.
Commercial exploit tools. Vendors such as Cellebrite and Magnet/GrayKey sell tools to law enforcement that exploit vulnerabilities in phone operating systems. These work against some devices and firmware versions and not others, Apple and Google patch them, and they are expensive. Availability varies significantly between forces and units.
The cloud route. This is the most significant change in recent years. Even where a handset stays locked, investigators may obtain authentication tokens or seek data directly from iCloud, Google or a messaging platform under a production order or international request. Backups, synced messages, photo libraries and location history frequently exist outside the handset.
Biometrics. Officers may attempt to unlock a device using a face or fingerprint, which does not require a section 49 notice in the way a passcode does. Devices can be put into a state where a passcode is required.
The practical reality: for a locally investigated street level supply case, most forces will not deploy their most expensive capability, but they will try the standard triage tools and the cloud. Assume that anything backed up may be recoverable.
A SIM card holds the number itself and identifies the network. From that, police can go to the provider for two things:
Subscriber details. If you are on contract, or you registered a pay as you go SIM, this reveals your name, address and account information. An unregistered PAYG SIM will usually return nothing.
Communications data. Call and message records and cell site connection data, held under the Investigatory Powers Act 2016 retention regime for up to 12 months. Depending on handset settings, a SIM may also store contacts, texts or call history directly.
Cell site analysis shows which mast a handset connected to, and when. It cannot pinpoint a phone to a doorstep. What it can do is place the device within a mast’s coverage area, show patterns of movement, and support or undermine attribution for example, where a “deal line” consistently rests overnight in the same area as a defendant’s personal handset. Cell site analysis for geolocation is now a regulated forensic activity under the Forensic Science Regulator’s statutory Code, which matters when the quality of the analysis is in dispute.
Two sets of rules apply.
General exhibit handling continuity. The seizing officer must exhibit the handset with a unique exhibit reference (usually their initials plus a number) and record the seizure in a statement. Every subsequent person who handles the device must be documented. A break in that chain, if serious enough to cast doubt on whether the item examined is the item seized, can render the resulting evidence inadmissible.
Digital specific standards. The four ACPO principles for digital evidence now carried forward through College of Policing guidance still form the backbone:
It depends on the seriousness of the failure. A minor gap in paperwork rarely leads anywhere. But a break in continuity that leaves genuine doubt about the identity of the device, an examination that alters or destroys original data so the defence cannot check it, or an extraction carried out by a unit without proper accreditation, can all support an application to exclude the evidence under section 78 of the Police and Criminal Evidence Act 1984.
Because so much of the extraction process is automated, large errors are uncommon but they are not unheard of, and they are only ever found by a defence team that asks for the underlying material rather than accepting the summary report.
Usually not, but it repays careful analysis.
The hearsay rules only bite on statements of fact or opinion. Photographs, call logs, cell site records, contacts and metadata contain no such statement and are not hearsay.
Messages are the real question, and the leading guidance is R v Twist [2011] EWCA Crim 1143. Two points follow:
Section 22 of the Police and Criminal Evidence Act 1984 allows retention for as long as necessary, including for use as evidence and for forensic examination. There is no fixed statutory time limit.
In practice:
If retention has become unreasonable for example, the extraction was completed long ago and no charge has followed a solicitor can press for return, and ultimately apply to the magistrates’ court under the Police (Property) Act 1897.
Phone downloads look overwhelming when they arrive as a 4,000 page report. They rarely are. The most productive lines of challenge include:
Cases built on mobile phone evidence in possession with intent to supply prosecutions are won and lost on detail: who the user was, what the messages really show, whether the extraction was done properly, and what the unused material contains. That work has to start early.
Stuart Miller Solicitors have defended more than 50,000 cases across 40 years of criminal practice, including complex county lines, conspiracy and Class A supply prosecutions built almost entirely on digital evidence. We are available 24 hours a day, 7 days a week, we work with Legal Aid, and the first consultation is free and without obligation.
Call us on 07980 000 076, or get in touch here for a confidential, no obligation discussion of your case.
Not unless a valid notice under section 49 of RIPA 2000 has been served, which requires judicial permission and authorisation at Superintendent level. Without one, you cannot be compelled although refusal can be commented on at trial and may mean your phone is never returned. Note that officers may lawfully attempt to unlock a device using your face or fingerprint.
If no section 49 notice exists, refusal is not itself a crime. If a valid notice has been served and you do not comply, you commit an offence under section 53 RIPA carrying up to two years’ imprisonment. Recent sentences in criminal investigations have generally fallen between eight and eighteen months.
Yes, in the sense that messages are frequently the core of the prosecution case, and convictions do follow from message evidence combined with cash, scales or packaging. But messages are circumstantial. Their weight depends on attribution, volume, dates and context all of which can be challenged.
There is no legal maximum. Section 22 PACE 1984 permits retention while the device is needed for examination or as evidence. Because of digital forensic backlogs, six to twelve months is common, and if you are charged the handset will usually be retained until the case ends. On conviction it may be forfeited under section 27 of the Misuse of Drugs Act 1971.
Often, yes. Deleted data may remain recoverable from the handset, and messages frequently survive in cloud backups, on the other party’s device, or in synced accounts. Recovery depends on the device, the app, how much time has passed and how much the phone has been used since. Never assume deletion has removed anything.
No. Cell site analysis shows which mast a device connected to and therefore places it within a coverage area, not at a precise location. It is most useful for showing patterns of movement and for supporting attribution, and its limits should be tested including whether the analysis complies with the Forensic Science Regulator’s Code.
Say so through your solicitor and give a clear, accurate account of whose it was and how it came to be there. Then the focus shifts to attribution: subscriber details, contacts, photographs, linked accounts and cell site patterns. This is a defence that succeeds regularly, but it needs to be advanced consistently from the first interview.
Yes. Released under investigation is not the end of the case it usually means your phone is queued for examination. The months before a charging decision are the best opportunity to make representations to the police and CPS, to challenge attribution early, and in some cases to prevent charges being brought at all.
Author: Michael Goold – Garden Court Chambers
Responsive
A legal expert will consult you within 24 hours of making an enquiry.
Empathetic
We will always treat you with trust, understanding and respect.
Specialised
Your case will be handled by an expert who specialises in your type of offence.
Proactive
We will take early action to end proceedings as soon as it is practically and legally possible to do so.
Engaged
You will be kept updated on your case at all times. We will provide a named contact available to answer your questions.
Caring
We understand this is a difficult and stressful time for you and your family. Our team will support you every step of the way.
Tenacious
We will never give up on your case. We fight tirelessly to get you the best possible outcome.