Concept and objectives

This is the final and overall objective of the development of a Common European Framework for the application of new technologies in the collection and use of evidence. In response to this final goal, EVIDENCE proposes the production of a Road Map tracing the route to be followed (legislation, recommendations, guidelines, technical standards and a research agenda) for realizing a Common European Framework for the application of new technologies in the collection, use and exchange of evidence. This will allow the identification of core actions to be undertaken for the introduction of a new technical standard on the legal, political, technical, ethical and social perspectives level. The lines traced in the Road Map will aim to go beyond the current and close period trying to foresee future actions and plans to be undertaken by future policies, programs and plans. The possible application, re-use and adaptation of the EVIDENCE Road Map to other legal domains different from the criminal one (civil justice, administrative justice, etc) will be considered as well.

At the same time it will be possible that these actions will be distinguished between what should be taken at an European level and what at a national level. The former will include, if found necessary, the drafting of a common legal & technical framework regulation (based on the appropriate legal basis in the EU Treaties); the drafting of briefing papers and information packages for increasing awareness of the issues involved for Members of the European Parliament and other stakeholders; draft a step by step implementation plan for the introduction of the common framework for the application of new technologies in the collection, use and exchange of evidence. Whilst the latter, will produce an overall 28 MS action plan noting gaps, challenges and actions to reach the goal of a common European for the application of new technologies in the collection, use and exchange of evidence.

One of the problems that falls within EVIDENCE scope is the uncertainty on admissibility of electronic evidence due to the lack of clear criteria. As a preliminary matter and a prerequisite for further activities and before assessing the scenario going on as to national regulation, implemented standards, stakeholder perceptions and data protection and procedural safeguards issues it is fundamental to develop a common and share understating of what electronic evidence is in general and how this must be interpreted with respect to our specific domain of interest. Working definitions of electronic evidence, based upon existing literature and research projects, will be analysed.

The Project Team will then create a detailed taxonomy to envisage future forms of electronic evidence and validates this with stakeholders. This dual approach produces a strong categorisation capable of being used as a basis of the all project activities addressed to the elaboration of the EVIDENCE Road Map proposed by this project and will be a good tool for policy makers in order to harmonize their legal jargon when dealing with electronic evidence avoiding the creation of a misaligning terminology.

The EVIDENCE project activities respond to:

• the need to carry on a comparative analysis of existing legal provisions which apply in the electronic evidence case and to identify and define those legislative changes that should be promoted both at European and national level; and
• the need to define open standards assuring not only the international transfer of the evidence but also the chain-of- custody requirements and protection of the means of proof.

EVIDENCE will analyse whether and how electronic evidence is perceived and eventually regulated in the EU framework. Through a wide collection of relevant documentation and available information the legal framework will be identified and discussed in order to highlight criteria and rules to be applied for guaranteeing an uniform regulation of electronic evidence.

Activities will focus not only on the domestic regulation but also on specific criteria implemented in each MS for transnational exchange of electronic evidence. A Status quo analysis will be delivered providing a thorough comparative overview of legislation and practises existing in the EU member states considering the Collection of electronic evidence, the Preservation of electronic evidence and finally the Exchange of electronic evidence. Furthermore a set of criteria will comply with among others the following requirements: efficiency of investigations and judicial procedures.

The existence of adequate safeguards aiming at the protection of relevant fundamental human rights and the respect for clear standard of conduct will be duly identified. Ethical and privacy aspect will be specifically faced by all activities dedicated to Data Protection with the aim to investigate how to balance efficient investigation and sufficient protection of each individual’s privacy faces different challenges than those raised by conventional investigation.

EVIDENCE deals with the need to define open standards assuring not only the international transfer of the evidence but also the chain of custody requirements and protection of the means of proof. In response to this need EVIDENCE will analysewhether and how electronic evidence is treated from technological point of view bydefining an open standards, assuring not only the international transfer of evidence but also the chain-of custody requirements and the protection of the means of proof. Therefore in realizing this objective activities will be addressed to identify and review the practices currently in use by policing agencies computer forensic investigators and to determine the measurable criteria and desired outcomes required of software tools by policing agencies.

A status quo analysis of tools, procedures and methods not readily be available tothe public and therefore not be readily understood and accepted will be provided. This activity will provide an overview of practices and procedures for digital evidence gathering, concerning tools that are thoroughly tested and generally accepted in the computer forensics field in the 28 MS.

The definition of an evidence ad hoc standard for electronic evidence will be built upand tested. Furthermore functional specifications for exchanging digital evidence will be proposed by comprising the elaboration of a digital unique identifier and of an open standard for forensic data. This standard should be independent of the forensic tool that discovered the evidence, in this way starting from the description and the raw image file; evidence can be reproduced by other tools with the same functionality.

In order to realise this objective the EVIDENCE Team is going to provide an overview and a status quo assessment of the collection, preservation and exchange of evidence obtained using new technologies (‘electronic evidence’) from the standpoint of law enforcement and a set of guidelines that could be integrated into a Common European Framework governing this field are going to be proposed. The assessment of the status quo governing the collection, preservation and exchange of electronic evidence will be developed taking in due consideration the efficiency of police investigations conducted within national jurisdictions as well as thorough regional or international collaboration; the existence of adequate safeguards aiming at the protection of relevant fundamental human rights, such as the right to privacy and data protection principles and the respect for ethical standards of conduct. The various systems will therefore be assessed on their ability to strike a proper balance between the above interests.

The analysis of the systems within the European Union and other pertinent systems worldwide shall aim at exploring the challenges encountered and the shortcomings of the existing mechanisms. Through that analysis, best practices and potential guidelines pertaining to the collection and handling of electronic evidence by law enforcement agencies shall be identified.

In order to realise this objective the EVIDENCE will validate the results arising from the analysis of legal and standard issues by translating functional specifications into technical specifications examining the gathering and exchanging technologies and standards of digital evidence and computer forensics. This will enable security, access control and capability delegation on evidence exchange systems according to the functional specifications. It will consider both the traditional environment setup but also a cloud computing setup. Best practices will be identified and guidelines will be drafted for developing services and applications in this domain. Specific guidelines for users and how they should use the available applications to exchange such information will be also realized.

These guidelines, specifications and protocols will be put together into a technical specification document for exchanging digital evidence. The proof of concept will include a prototype of a service for exchanging evidence and the design and prototype of user-friendly application for mobile devices such as tablets but also for command centre systems.

In order to validate the proposed technical specifications and guidelines and test the developed proof of concept application, specific events targeting audience from end user organisations will be organised where the results to specific related to the legal and cybercrime/computer forensic events will be disseminated.

In response to the need for an evaluation of the market targeted by the technological development the project will establish the size of the European market for the EVIDENCE technical solution, taking into deep account the inertia forces, time lags for changes, actors behaviours (‘supporting’ and ‘hindering’ actors), driving forces and assessing obstacles and facilitating factors in the transition process towards an (also) ICT based evidence in courts.

Determining the market size for any technical solution is an important information source for policy makers when deciding on how to promote a common harmonized European approach to evidence collection. The WP dealing with this issue follows a three-step methodology to determine the market size, taking into account all the societal dynamics related to the introduction/consolidation of electronic evidence in courts (for incorporating standardized solutions on how to regulate and harmonize the treatment and exchange of electronic evidence): 1) identification and classification of target users determining who are the ‘consumers’ for the EVIDENCE technical standards in Europe (law enforcement agencies, prosecuting judges, Offices of the Prosecutor etc.) or, in other words the stakeholders involved in the introduction/consolidation of electronic evidence in courts; 2) determining the stakeholders orientation/obstacles and facilitating factors in the transition process towards an (also) ICT based evidence in courts.

Building on the results of previous activities, the next EVIDENCE task will carry out an analysis on stakeholders perceptions of digital evidence, level of acceptance, use and difficulties in using digital evidence, level of integration with traditional evidence practices, challenges and issues related privacy and data protection aspects, exchange and preservation of information, etc.