Matching Evidence into e-Codex CNR / e-Codex core team 4/4/2019 Matching Evidence into e-Codex CNR / e-Codex core team MSs experts meeting on the e-Evidence Exchange System Fabrizio Turchi - CNR-ITTIG

Description and Updating Legal activities Description and Updating EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

Legal activities: updating on Questionnaire 16 responses At least other 5 are expecting Country Number of Questionnaires Bulgaria 2 Germany 1 Greece Italy Portugal Austria 3 Croatia Lithuania Czech Republic Luxembourg Missing Countries France Malta Netherlands UK Spain EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

Legal activities: some statistics on Questionnaire EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

Legal activities: other tasks Questionnaire ongoing Analysis of the answers received so far requests for further details for some Ministries of Justice Meeting the Legal community (EJTN seminar Florence 27-28 Sept.) Selected set of Questions to 25 Public prosecutors all over Europe Some statistics on a selected set of questions of the Questionnaires (Evidence Package) and how to manage that package EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

Q1:Do you know what an electronic evidence is? Q2: Do you know what the digital evidence life cycle means? (evidence life cycle) Q3: Are you familiar with the digital forensic jargon? (forensics acquisition, forensic copies, forensic analysis, forensic tools). Q4: Are you dealing with digital evidences during your daily activities? EVIDENCE2e-Codex December 2016

Description and Updating Technical activities Description and Updating EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

Evidence Exchange within EIO: common terms Competent authority (EIO – Article 2.c Issuing Authorities) a Judge, a Court, an Investigating Judge or a Public Prosecutor competent in the case concerned any other competent authority as defined by the issuing State, for instance LEA/Police Authorities Digital Evidence A Digital Evidence is any information of probative value that is either stored or transmitted in a digital form Forensic Science The application of scientific methods and techniques to extract, during an investigation, relevant information to a case to be presented before a court of law. EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

Evidence Exchange within the EIO and through the e-Evidence Exchange System Starting point: in the e-Evidence system presentation we have seen that the system is able to exchange evidence using an attachment to a message travelling through e- CODEX. Next point: to describe the content of that attachment (Evidence Package) and how to manage that package Why would you be interested in this subject?: because is strictly connected with the integrity, the authenticity and the admissibility of the evidence. All things that matter to judicial authorities. Moreover In this modern age, it is hard to imagine a crime that does not have a digital dimension EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

Evidence Exchange within EIO: questions Why do we need to exchange an evidence by an electronic mean? When may the exchange happen? How can the exchange be dealt with? EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

Evidence Exchange: why and when? Why is it necessary to exchange a digital evidence, by a digital mean? To expedite the judicial cooperation inside and outside Europe To better fight the crime When does the Evidence Exchange come to play? In dealing with an EIO, the Executing State will have to exchange a digital evidence with the Issuing State. For instance after the data acquisition from a smartphone of a suspect EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

EIO – Timeline in the Evidence Exchange Context EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd 12

Evidence Exchange: how? the Evidence Package (EP): it is a package that contains data related to an evidence. It aims at representing that data in a suitable/standard way representation, popular in the community (Europol, U.S. Department of Defense Cyber Crime Center - DC3, Cellebrite) the Evidence Exchange Standard Application (EESP) being able to to manage, import/export and prepare EP. The EESP will be flexible and adaptable to the different national information systems in place The e-Evidence Exchange System being able to transfer the EP to the Competent Authority (CA) using the Reference Implementation EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

14

Evidence Exchange: scenario A real scenario where the Evidence Exchange may take place involves the following actors: Competent Authorities (CAs) Law Enforcement Agencies (LEAs) Forensic Laboratories (FLs) and the following elements: Evidence Package Evidence Exchange Standard Package Reference Implementation (e-Evidence) EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd 16

Attachment EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd 17

Evidence Exchange: points of discussion Check integrity and Verifying the EP content: EESP will be in charge for these tasks Verifying the EP content: read-only EESP should be at CA disposal: how the CAs would like to be served by the EESP application? The EESP will communicate with the Reference Implementation, but in case a Member State uses its national solution, the EESP will guarantee its compatibility with the national systems. EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

Evidence Exchange: different scenarios EP containing meta data and data (small-sized file of evidence < 2 GB), The meta data includes a reference (path name) to the physical files. Scenario 2 EP containing meta data and data (large-sized file of evidence 2 GB < SIZE < 32 GB). The file is stored on a Storage Area under MS/CA responsibility, the meta data includes a web reference to the physical file. EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

Exchange Large File of Evidence EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

Thanks for your attention Questions? EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd