1. Matching Evidence into e-Codex CNR / e-Codex core team
4/4/2019
Matching Evidence into e-Codex CNR / e-Codex core team
MSs experts meeting on the
e-Evidence Exchange System
Fabrizio Turchi - CNR-ITTIG

2. Description and Updating
Legal activities
Description and Updating
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

3. Legal activities: updating on Questionnaire
16 responses
At least other 5 are expecting
Country
Number of
Questionnaires
Bulgaria 2
Germany 1
Greece
Italy
Portugal
Austria 3
Croatia
Lithuania
Czech Republic
Luxembourg
Missing Countries
France
Malta
Netherlands UK
Spain
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

4. Legal activities: some statistics on Questionnaire
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

5. Legal activities: other tasks
Questionnaire
ongoing Analysis of the answers received so far
requests for further details for some Ministries of Justice
Meeting the Legal community (EJTN seminar Florence Sept.)
Selected set of Questions to 25 Public prosecutors all over Europe
Some statistics on a selected set of questions of the Questionnaires (Evidence Package) and how to manage that package
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

6. Q1:Do you know what an electronic evidence is?
Q2: Do you know what the digital evidence life cycle means? (evidence life cycle)
Q3: Are you familiar with the digital forensic jargon? (forensics acquisition, forensic copies, forensic analysis, forensic tools).
Q4: Are you dealing with digital evidences during your daily activities?
EVIDENCE2e-Codex December 2016

7. Description and Updating
Technical activities
Description and Updating
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

8. Evidence Exchange within EIO: common terms
Competent authority (EIO – Article 2.c Issuing Authorities)
a Judge, a Court, an Investigating Judge or a Public Prosecutor competent in the case concerned
any other competent authority as defined by the issuing State, for instance LEA/Police Authorities
Digital Evidence
A Digital Evidence is any information of probative value that is either stored or transmitted in a digital form
Forensic Science
The application of scientific methods and techniques to extract, during an investigation, relevant information to a case to be presented before a court of law.
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

9. Evidence Exchange within the EIO and through the e-Evidence Exchange System
Starting point: in the e-Evidence system presentation we have seen that the system is able to exchange evidence using an attachment to a message travelling through e- CODEX.
Next point: to describe the content of that attachment (Evidence Package) and how to manage that package
Why would you be interested in this subject?: because is strictly connected with the integrity, the authenticity and the admissibility of the evidence. All things that matter to judicial authorities. Moreover In this modern age, it is hard to imagine a crime that does not have a digital dimension
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

10. Evidence Exchange within EIO: questions
Why do we need to exchange an evidence by an electronic mean?
When may the exchange happen?
How can the exchange be dealt with?
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

11. Evidence Exchange: why and when?
Why is it necessary to exchange a digital evidence, by a digital mean?
To expedite the judicial cooperation inside and outside Europe
To better fight the crime
When does the Evidence Exchange come to play?
In dealing with an EIO, the Executing State will have to exchange a digital evidence with the Issuing State.
For instance after the data acquisition from a smartphone of a suspect
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

12. EIO – Timeline in the Evidence Exchange Context
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd 12

13. Evidence Exchange: how?
the Evidence Package (EP): it is a package that contains data related to an evidence. It aims at representing that data in a suitable/standard way representation, popular in the community (Europol, U.S. Department of Defense Cyber Crime Center - DC3, Cellebrite)
the Evidence Exchange Standard Application (EESP) being able to to manage, import/export and prepare EP. The EESP will be flexible and adaptable to the different national information systems in place
The e-Evidence Exchange System being able to transfer the EP to the Competent Authority (CA) using the Reference Implementation
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

14. 14

15. Evidence Exchange: scenario
A real scenario where the Evidence Exchange may take place involves the following actors:
Competent Authorities (CAs)
Law Enforcement Agencies (LEAs)
Forensic Laboratories (FLs)
and the following elements:
Evidence Package
Evidence Exchange Standard Package
Reference Implementation (e-Evidence)
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

16. EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd16

17. Attachment
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd 17

18. Evidence Exchange: points of discussion
Check integrity and Verifying the EP content: EESP will be in charge for these tasks
Verifying the EP content: read-only
EESP should be at CA disposal: how the CAs would like to be served by the EESP application?
The EESP will communicate with the Reference Implementation, but in case a Member State uses its national solution, the EESP will guarantee its compatibility with the national systems.
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

19. Evidence Exchange: different scenarios
EP containing meta data and data (small-sized file of evidence < 2 GB), The meta data includes a reference (path name) to the physical files.
Scenario 2
EP containing meta data and data (large-sized file of evidence 2 GB < SIZE < 32 GB). The file is stored on a Storage Area under MS/CA responsibility, the meta data includes a web reference to the physical file.
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

20. Exchange Large File of Evidence
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd

21. Thanks for your attention Questions?
EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd