Matching Evidence into eCodex CNR eCodex core team

Matching Evidence into e-Codex CNR / e-Codex core team MSs experts meeting on the e-Evidence Exchange System Fabrizio Turchi - CNR-ITTIG

Legal activities ¡Description and Updating EVIDENCE 2 e-Codex project Experts Group meeting | Brussels October 12 nd 2

Legal activities: updating on Questionnaire Country Number of Questionnaires Bulgaria 2 Germany 1 Greece 1 Italy 1 Portugal 1 Austria 3 Croatia 3 Lithuania 1 Czech Republic 1 Luxembourg 1 EVIDENCE 2 e-Codex project ¡ 16 responses ¡At least other 5 are expecting Missing Countries France Malta Netherlands UK Spain Experts Group meeting | Brussels October 12 nd 3

Legal activities: some statistics on Questionnaire EVIDENCE 2 e-Codex project Experts Group meeting | Brussels October 12 nd 4

Legal activities: other tasks ¡Questionnaire ¡ongoing Analysis of the answers received so far ¡requests for further details for some Ministries of Justice ¡Meeting the Legal community (EJTN seminar Florence 27 -28 Sept. ) ¡Selected set of Questions to 25 Public prosecutors all over Europe ¡Some statistics on a selected set of questions of the Questionnaires (Evidence Package) and how to manage that package EVIDENCE 2 e-Codex project Experts Group meeting | Brussels October 12 nd 5

¡ Q 1: Do you know what an electronic evidence is? ¡ Q 2: Do you know what the digital evidence life cycle means? (evidence life cycle) ¡ Q 3: Are you familiar with the digital forensic jargon? (forensics acquisition, forensic copies, forensic analysis, forensic tools). ¡ Q 4: Are you dealing with digital evidences during your daily activities? EVIDENCE 2 e-Codex December 2016 6

Technical activities ¡Description and Updating EVIDENCE 2 e-Codex project Experts Group meeting | Brussels October 12 nd 7

Evidence Exchange within EIO: common terms § Competent authority (EIO – Article 2. c Issuing Authorities) § § a Judge, a Court, an Investigating Judge or a Public Prosecutor competent in the case concerned any other competent authority as defined by the issuing State, for instance LEA/Police Authorities ¡Digital Evidence ¡A Digital Evidence is any information of probative value that is either stored or transmitted in a digital form ¡Forensic Science ¡The application of scientific methods and techniques to extract, during an investigation, relevant information to a case to be presented before a court of law. EVIDENCE 2 e-Codex project Experts Group meeting | Brussels October 12 nd 8

Evidence Exchange within the EIO and through the e-Evidence Exchange System ¡Starting point: in the e-Evidence system presentation we have seen that the system is able to exchange evidence using an attachment to a message travelling through e-CODEX. ¡Next point: to describe the content of that attachment (Evidence Package) and how to manage that package ¡Why would you be interested in this subject? : because is strictly connected with the integrity, the authenticity and the admissibility of the evidence. All things that matter to judicial authorities. Moreover In this modern age, it is hard to imagine a crime that does not have a digital dimension EVIDENCE 2 e-Codex project Experts Group meeting | Brussels October 12 nd 9

Evidence Exchange within EIO: questions ¡Why do we need to exchange an evidence by an electronic mean? ¡When may the exchange happen? ¡How can the exchange be dealt with? EVIDENCE 2 e-Codex project Experts Group meeting | Brussels October 12 nd 10

Evidence Exchange: why and when? § Why is it necessary to exchange a digital evidence, by a digital mean? § § To expedite the judicial cooperation inside and outside Europe To better fight the crime ¡When does the Evidence Exchange come to play? ¡In dealing with an EIO, the Executing State will have to exchange a digital evidence with the Issuing State. ¡For instance after the data acquisition from a smartphone of a suspect EVIDENCE 2 e-Codex project Experts Group meeting | Brussels October 12 nd 11

EIO – Timeline in the Evidence Exchange Context EVIDENCE 2 e-Codex project Experts Group meeting | Brussels October 12 nd 12

Evidence Exchange: how? ¡the Evidence Package (EP): it is a package that contains data related to an evidence. It aims at representing that data in a suitable/standard way representation, popular in the community (Europol, U. S. Department of Defense Cyber Crime Center - DC 3, Cellebrite) ¡the Evidence Exchange Standard Application (EESP) being able to to manage, import/export and prepare EP. The EESP will be flexible and adaptable to the different national information systems in place ¡The e-Evidence Exchange System being able to transfer the EP to the Competent Authority (CA) using the Reference Implementation EVIDENCE 2 e-Codex project Experts Group meeting | Brussels October 12 nd 13

14

Evidence Exchange: scenario ¡A real scenario where the Evidence Exchange may take place involves the following actors: § § § Competent Authorities (CAs) Law Enforcement Agencies (LEAs) Forensic Laboratories (FLs) ¡and the following elements: § § § EVIDENCE 2 e-Codex project Evidence Package Evidence Exchange Standard Package Reference Implementation (e-Evidence) Experts Group meeting | Brussels October 12 nd 15

EVIDENCE 2 e-Codex project Experts Group meeting | Brussels October 12 nd 16

Attachment EVIDENCE 2 e-Codex project Experts Group meeting | Brussels October 12 nd 17

Evidence Exchange: points of discussion ¡Check integrity and Verifying the EP content: EESP will be in charge for these tasks ¡Verifying the EP content: read-only ¡EESP should be at CA disposal: how the CAs would like to be served by the EESP application? ¡The EESP will communicate with the Reference Implementation, but in case a Member State uses its national solution, the EESP will guarantee its compatibility with the national systems. EVIDENCE 2 e-Codex project Experts Group meeting | Brussels October 12 nd 18

Evidence Exchange: different scenarios ¡Scenario 1 ¡EP containing meta data and data (small-sized file of evidence < 2 GB), The meta data includes a reference (path name) to the physical files. ¡Scenario 2 ¡EP containing meta data and data (large-sized file of evidence 2 GB < SIZE < 32 GB). The file is stored on a Storage Area under MS/CA responsibility, the meta data includes a web reference to the physical file. EVIDENCE 2 e-Codex project Experts Group meeting | Brussels October 12 nd 19

Exchange Large File of Evidence EVIDENCE 2 e-Codex project Experts Group meeting | Brussels October 12 nd 20

Thanks for your attention Questions? EVIDENCE 2 e-Codex project Experts Group meeting | Brussels October 12 nd 21