Work Packages

Activities of this WP will be addressed to carry out a classification of relevant concepts of electronic evidence domain and related fields (criminal law, criminal procedure). This will lead to assess and produce a common and shared understanding of digital evidence gathering and exchanging.

• Task 2.1 (M1 – M5): Identifying and Classifying Relevant Concepts

Activities of this WP will be mainly devoted to understand whether and how electronic evidence is perceived and eventually regulated in the EU framework. The legal framework will be identified through a wide collection of relevant documentation and available information and will be discussed thus highlighting the criteria and rules to be applied for guaranteeing a uniform regulation of electronic evidence. Activities of this WP will focus not only on the domestic regulation but also on specific criteria implemented in each MS for trans-national exchange of electronic evidence.

• Task 3.1 (M3 – M14): Status Quo Analysis
• Task 3.2 (M15 – M17): Requirements for Uniform Regulation of Electronic Evidence (Including Trans-national Exchange)

Activities of this WP will be devoted to identify the definition of open standards, assuring not only the chain-of-custody requirements and the protection of the means of proof, but also the international transfer of electronic evidence.

• Task 4.1 (M3 – M11): Status Quo Analysis
• Task 4.2 (M12 – M14): Defining Standard for Digital Evidence
• Task 4.3 (M15 – M17): Defining Functional Specifications for Exchanging Digital Evidence

This WP will review preservation, and examination of digital evidence and it will also look at security issues for transmitting digital evidence. The activity will also consider the Computer Forensics in the age of cloud computing, for example, which legislations apply when cloud providers are based in and outside Europe and have their serves located throughout the world. Consequently the objectives of WP5 have two sides:

1. Technological Issues in the “Traditional Setup”. In this setup data is mostly stored on organisation’s servers or users’ machines.
   • Study technological issues encountered in various European countries regarding digital legal evidence collection, preservation, and exchange.
   • Determine what may block harmonisation of national and regional regulations at European level.
   • Identify potential directions to address the blocking issues
2. Technological Issues in the Cloud Computing Era
   • Study what new issues may arise for computer forensics in cloud computing environment.
   • Recommend what should be harmonisation at the European level (before it even becomes national legislations).
   • Identify the scope of issues that must remain national or regional prerogatives.

The realization of the two objective above will be implemented by completing several tasks:

• Task 5.1 (M14 – M19): From Functional Specifications into Technical Specifications
• Task 5.2 (M19 – M26): Evidence Exchange Prototype Application
• Task 4.3 (M15 – M17): Validation of the Proposed Technical Specifications and Guidelines

The laws and procedures regulating the collection, preservation and exchange of electronic evidence by law enforcement agencies are crucial as they determine the admissibility of that evidence in court and its probative value, thus fundamentally affecting the outcome of criminal proceedings. While WP3 intends to identify the legal framework governing the collection and use of electronic evidence, WP6 aims at providing a thorough study of the implementation of the existing legislations carried out by law enforcement agencies within the European Union and beyond. With 190 member countries and direct daily work with specialized law enforcement agencies around the globe, INTERPOL will coordinate this Work Package and shall deliver a comparative approach from the field. The various systems shall then be assessed in order to identify their shortcomings and with a view to propose best practices and guidelines that can be integrated into a comprehensive European Framework.

• Task 6.1 (M3 – M11): Overview of the Status Quo Governing the Collection, Preservation and Exchange of Electronic Data
• Task 6.2 (M12 – M17): Status Quo Assessment and Identification of Best Practices and Guidelines

Determining the market size for any technical solution is an important information source for policy makers when deciding on how to promote a common harmonized European approach to evidence collection. This WP follows a three-step methodology to determine the market size, considering societal dynamics related to the introduction/consolidation of electronic evidence in courts (for incorporating standardized solutions on how to regulate and harmonize the treatment and exchange of electronic evidence):

• Task 7.1 (M3 – M12): Identification and Classification of Target Users
• Task 7.2 (M13 – M19): Determining the Stakeholders Orientation / the Obstacles and Facilitating Factors in the Transition Process Towards an (also) ICT Based Evidence in Courts
• Task 7.3 (M20 – M22): Validation Workshop

Gathering evidence in a ‘virtual environment’ – as opposed to the ‘physical environment’ in which we are living, and hence the gathering of electronically stored or transmitted information, is an action of a different nature from the traditional ways of collecting evidence. It is also quite new, meaning those procedures and safeguards for dealing with digital evidence and the associated hazards are lacking compared with those that have developed out of our experience over some hundreds of years with analogue and embodied media.

While for example collection of evidence on a crime-scene usually requires both accessing the particular respective location physically and assigning human resources (which are regularly very limited as these are usually specially trained experts of a particular department), these kinds of limitations do not exist when collecting digital information. Not only can this be carried out remotely e.g. via networks, but any need for human resources is significantly reduced as well, as many processes can be executed by automated means. Similarly, whereas accessing a crime-scene is a rather overt process, collecting digital evidence can be achieved by means which are hardly detectable and often will leave no traces at all. All these particularities will need to be addressed by WP8 when evaluating particular data protection safeguards, which both guarantee high privacy standards as well as efficient investigation by law enforcement authorities.

Consequently, the need to balance efficient investigation and sufficient protection of each individual’s privacy faces different challenges than those raised by conventional investigation. Not only do different technical environments and possibilities require different technical safeguards, but the different degree of exposure to surveillance systems need to be taken into account. Thus the greater intrusion is likely to be caused by modern, highly efficient means of digital evidence collection, treatment and distribution, requires precise and efficient legal safeguards – both of a procedural and of a substantive nature. Given the fact, that digital collection and distribution of evidence does not face the traditional limits of space and time, but (at least technically) allows making available digital evidence virtually anywhere without any significant delay – including multiple lossless copies of the original piece of evidence – it becomes apparent that particularly cross-border distribution of evidence between different authorities will need focused legal safeguards. These need to be designed in such a manner that they do not unnecessarily hinder transnational investigation between the member states, while simultaneously preventing any infringement of the principle of proportionality.

WP8 will use the input of the preceding WPs to deliver conclusions on data protection issues which will need to be addressed. Activities carried out for WP8 can roughly be divided into two major tasks:

• Task 8.1 (M3 – M13): Data Protection in Gathering and Using Electronic Evidence
• Task 8.2 (M14 – M17): Data Protection in Sharing and Exchanging Electronic Evidence

This WP aims at producing a feasibility study tracing the route to be followed (legislation, recommendations, guidelines, technical standards etc) for realising a Common European Framework for the application of new technologies in the collection, use and exchange of evidence. Included in this aim is to prepare a research agenda to reach areas that are seen in this project as needed more attention and examination in future.

• Task 9.1 (M22 – M25): Identifying What Actions Need to Be Taken
• Task 9.2 (M26 – M27): Determining European-level Action
• Task 9.3 (M28 – M29): Determining National-level Action
• Task 9.2 (M30): Final Conference

The aim of the WP is to develop and implement an evaluation plan and to coordinate the evaluation of the major results of the project.

• Task 10.1 (M1 – M4): Develop an Evaluation Plan and Evaluation Criteria
• Task 10.2 (M1 – M30): Carry Out Evaluation

Prof. George Dimitrov
Alexandra Tsvetkova

The aim of the WP is to develop and implement an evaluation plan and to coordinate the evaluation of the major results of the project.

• Task 11.1 (M1 – M30): EVIDENCE Website/Forum
• Task 11.2 (M4 – M6, M15 – M18): Workshops
• Task 11.3 (M4 – M6, M15 – M18, M23 – M30): Ad Hoc Briefings, Seminars and Meetings for Policy Makers and Specialists
• Task 11.4 (M23 – M30): Final Conference