Overview of the Existing Mechanisms and Procedures for the Collection, Preservation and Exchange of Electronic Evidence by Law Enforcement Agencies within the European Union and Beyond

Deliverable D6.1 ‘Overview of the Existing Mechanisms and Procedures for the Collection, Preservation and Exchange of Electronic Evidence by Law Enforcement Agencies within the European Union and Beyond’ presents the current state of affairs concerning the use of electronic evidence by law enforcement agencies, both in Europe and at a global level. It will provide the basis for the two following reports on law enforcement challenges related to electronic evidence and the identification of best practices.

To this intent, the report commences with a categorization of electronic evidence which presents delineation between the categories of born-digital evidence, digitized evidence and non-digital electronic evidence as well as the main types of evidence that law enforcement is confronted with for each type of category. Based upon on preliminary findings, it was deemed more suitable to further delimit the research to digital evidence, covering both born-digital and digitized evidence.

This is followed by a concise overview of the legal framework of digital evidence covering both the general legal bases for the use of digital evidence as well as the specific legal bases for each phase of the digital evidence process, namely the collection, preservation, analysis, use before court and transfer of digital evidence.

Subsequently, the deliverable addresses the implementation of the legal framework in practice starting with the investigative measures for the identification; acquisition and collection of evidence which covers the types of investigative measures law enforcement agencies are permitted to take as well as the legal bases for each of those measures. In addition, the preservation of digital evidence is touched upon as well as the forensic analyses of digital evidence which deals with the type of digital forensics performed by law enforcement agencies, the tools used, the guidelines and best practices followed as well as the profiles of personnel handling digital evidence. Next, the presentation of digital evidence before court is covered and, lastly, the transfer of digital evidence within a country, to a requesting country and from a requesting country.

Linked to the implementation of the legal framework, the collaboration between the agencies responsible for the implementation of that framework are also dealt with. Therefore, the responsible agencies are first identified as well as the legal basis for the collaboration between these agencies. The modalities of the collaboration are then presented regarding both the acquisition and analysis of digital evidence. Furthermore, the reason for collaborating are also touched upon.

After presenting an overview of the collaboration between national agencies, the channels of international cooperation in the field of digital evidence are discussed, making distinction between the use of informal cooperation channels, such as police to police contact, 24/7 networks and direct contact with foreign service providers, and the use of formal cooperation channels, in particular mutual legal assistance.

The challenges LEAs are confronted with regarding each of these topics are briefly introduced in the report at the end of each chapter and will be further discussed in the next reports under WP6 on law enforcement challenges related to digital evidence.