210 likes | 227 Views
Matching Evidence into e-Codex CNR / e-Codex core team. MSs experts meeting on the e-Evidence Exchange System Fabrizio Turchi - CNR-ITTIG. Legal activities. Description and Updating. Legal activities: updating on Questionnaire. 16 responses At least other 5 are expecting.
E N D
Matching Evidence into e-CodexCNR / e-Codex core team MSs experts meeting on the e-Evidence Exchange System Fabrizio Turchi - CNR-ITTIG
Legal activities EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd Description and Updating
Legal activities: updating on Questionnaire EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd 16 responses At least other 5 are expecting
Legal activities: some statistics on Questionnaire EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd
Legal activities: other tasks • Meeting the Legal community (EJTN seminar Florence 27-28 Sept.) • Selected set of Questions to 25 Public prosecutors all over Europe • Some statistics on a selected set of questions of the Questionnaires (Evidence Package) and how to manage that package EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd • Questionnaire • ongoing Analysis of the answers received so far • requests for further details for some Ministries of Justice
EVIDENCE2e-Codex December 2016 Q1:Do you know what an electronic evidence is? Q2: Do you know what the digital evidence life cycle means? (evidence life cycle) Q3: Are you familiar with the digital forensic jargon? (forensics acquisition, forensic copies, forensic analysis, forensic tools). Q4: Are you dealing with digital evidences during your daily activities?
Technical activities EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd Description and Updating
Evidence Exchange within EIO: common terms • Competent authority (EIO – Article 2.c Issuing Authorities) • a Judge, a Court, an Investigating Judge or a Public Prosecutor competent in the case concerned • any other competent authority as defined by the issuing State, for instance LEA/Police Authorities • Forensic Science • The application of scientific methods and techniques to extract, during an investigation, relevant information to a case to be presented before a court of law. EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd • Digital Evidence • A Digital Evidence is any information of probative value that is either stored or transmitted in a digital form
Evidence Exchange within the EIO and through the e-Evidence Exchange System • Next point: to describe the content of that attachment (Evidence Package) and how to manage that package • Why would you be interested in this subject?: because is strictly connected with the integrity, the authenticity and the admissibility of the evidence. All things that matter to judicial authorities. Moreover In this modern age, it is hard to imagine a crime that does not have a digital dimension EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd Starting point: in the e-Evidence system presentation we have seen that the system is able to exchange evidence using an attachment to a message travelling through e-CODEX.
Evidence Exchange within EIO: questions EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd Why do we need to exchange an evidence by an electronic mean? When may the exchange happen? How can the exchange be dealt with?
Evidence Exchange: why and when? • Why is it necessary to exchange a digital evidence, by a digital mean? • To expedite the judicial cooperation inside and outside Europe • To better fight the crime EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd • When does the Evidence Exchange come to play? • In dealing with an EIO, the Executing State will have to exchange a digital evidence with the Issuing State. • For instance after the data acquisition from a smartphone of a suspect
EIO – Timeline in the Evidence Exchange Context 12 EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd
Evidence Exchange: how? EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd the Evidence Package (EP): it is a package that contains data related to an evidence. It aims at representing that data in a suitable/standard way representation, popular in the community (Europol, U.S. Department of Defense Cyber Crime Center - DC3, Cellebrite) the Evidence Exchange Standard Application (EESP) being able to to manage, import/export and prepare EP. The EESPwill be flexible and adaptable to the different national information systems in place The e-Evidence Exchange System being able to transfer the EP to the Competent Authority (CA) using the Reference Implementation
Evidence Exchange: scenario • Competent Authorities (CAs) • Law Enforcement Agencies (LEAs) • Forensic Laboratories (FLs) • and the following elements: • Evidence Package • Evidence Exchange Standard Package • Reference Implementation (e-Evidence) EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd A real scenario where the Evidence Exchange may take place involves the following actors:
16 EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd
Attachment 17 EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd
Evidence Exchange: points of discussion EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd Check integrity andVerifying the EP content: EESP will be in charge for these tasks Verifying the EP content: read-only EESP should be at CA disposal: how the CAs would like to be served by the EESP application? The EESP will communicate with the Reference Implementation, but in case a Member State uses its national solution, the EESP will guarantee its compatibility with the national systems.
Evidence Exchange: different scenarios EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd • Scenario 1 • EP containing meta data and data (small-sized file of evidence < 2 GB), The meta data includes a reference (path name) to the physical files. • Scenario 2 • EP containing meta data and data (large-sized file of evidence 2 GB < SIZE < 32 GB). The file is stored on a Storage Area under MS/CA responsibility, the meta data includes a web reference to the physical file.
Exchange Large File of Evidence EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd
Thanks for yourattentionQuestions? EVIDENCE2e-Codex project Experts Group meeting | Brussels October 12nd