Skip to main content
Top

2018 | OriginalPaper | Chapter

6. Electronic Evidence: Challenges and Opportunities for Law Enforcement

Authors : Sabine Berghs, Geoffrey Stewart Morrison, Caroline Goemans-Dorny

Published in: Handling and Exchanging Electronic Evidence Across Europe

Publisher: Springer International Publishing

Activate our intelligent search to find suitable subject content or patents.

search-config
loading …

Abstract

This chapter presents a cross-section of law enforcement issues addressed as part of the research conducted by INTERPOL in the framework of the European Informatics Data Exchange Framework for Courts and Evidence (EVIDENCE) project. The aim of the research was to formulate recommendations and best practice based on the status quo and challenges identified regarding the handling of electronic evidence by law enforcement agencies (LEAs).
First, the status quo on the handling of digital evidence by LEAs and the main trends identified for each phase of the electronic evidence lifecycle are set out. Subsequently, the main challenges hampering law enforcement investigations and forensic analyses involving digital evidence are presented. These challenges can be categorised under two main headers, namely challenges caused by technical measures such as encryption and anonymisation tools and those caused by legal lacunae.
Then, building further upon these findings, a set of recommendations are presented to strengthen law enforcement action in the field of digital evidence. This can, first, be done by working towards the professionalisation of digital forensics, as suggested by digital forensics practitioners themselves. Furthermore, as LEAs are not the only actors within the electronic evidence domain, it is also essential to continue enhancing the collaboration between LEAs and other actors, such as the judiciary and policymakers. Lastly, mutual legal assistance (MLA) procedures are no longer considered fit-for-purpose and LEAs continue to increasingly call for initiatives to expedite these often lengthy procedures.

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Footnotes
1
INTERPOL was in charge of the work package on law enforcement issues in the EVIDENCE project. However, the views of the authors in no form or manner represent the views or policies of the Organization.
 
2
While legal and data protection issues are also paramount to the handling of electronic evidence by law enforcement, these topics are more comprehensively addressed in the research conducted by the University of Groningen (RUG) and the Leibniz University of Hannover (LUH) within the framework of the EVIDENCE project.
 
3
The questionnaire was conceived in such a way that it would also contribute to the fact-finding activities of several consortium partners. To this end, the partners of the University of Groningen (RUG) in The Netherlands, the Institute of Legal Information Theory and Techniques of the National Research Council (CNR-ITTIG) in Florence, Italy, and the Centre of Excellence in Information and Communication Technologies (CETIC) in Liège, Belgium, contributed to the drafting of the questionnaire, particularly the legal and digital forensics sections. The widest possible dissemination of the questionnaires was ensured by making it available in INTERPOL’s four working languages: Arabic, English, French, and Spanish.
 
5
Questionnaire, Law enforcement section, Question 2.
 
6
Questionnaire, Law enforcement section, Question 11.
 
7
Based on the Electronic Evidence Expert Group Meeting held on 2 and 3 December 2014 at the INTERPOL General Secretariat (IPSG), in Lyon, France.
 
8
Questionnaire, Law enforcement section, Question 8.
 
9
Questionnaire, Law enforcement section, Question 7d.
 
10
Questionnaire, Law enforcement section, Question 7d and based on the Electronic Evidence Expert Group Meeting held on 2 and 3 December 2014 at the INTERPOL General Secretariat (IPSG), in Lyon, France.
 
11
Questionnaire, Law enforcement section, Question 5.
 
12
Questionnaire, Law enforcement section, Question 5 and Questionnaire, Digital forensics section, Question 1.
 
13
Questionnaire, Law enforcement section, Question 4.
 
14
Questionnaire, Digital forensics section, Question 2.
 
15
Questionnaire, Law enforcement section, Question 6.
 
16
Questionnaire, Law enforcement section, Question 7e.
 
17
Questionnaire, Legal section, Question 4.
 
18
Questionnaire, Legal section, Question 5 and 6.
 
19
Questionnaire, Legal section, Question 10.
 
20
Questionnaire, Law enforcement section, Question 3a and 3b.
 
21
Ibidem.
 
22
Questionnaire, Law enforcement section, Question 3.
 
23
Questionnaire, Law enforcement section, Question 3c.
 
24
Ibidem.
 
25
Questionnaire, Law enforcement section, Question 12.
 
26
Ibidem.
 
27
As presented during the 2nd Eurasian Working Group Meeting on Cybercrime for Heads of Units, organised by the INTERPOL Global Complex for Innovation (IGCI) and hosted in Istanbul, Turkey, on 28–30 May 2014 and as confirmed by semi-structured telephone interviews conducted in August 2015.
 
28
Based on semi-structured telephone interviews conducted in August 2015.
 
29
Questionnaire, Law enforcement section, Question 7a and semi-structured telephone interviews conducted in August 2015.
 
30
Joint communication of the French and German Ministers of Interior to the EU, 20 February 2017, available at http://​www.​politico.​eu/​wp-content/​uploads/​2017/​02/​2017-02-17-Declaration-FR-DE-II_​Officielle.​pdf. See also Computer and Communications Industry Association, Is Europe about to weaken encryption, 24 February 2017, available at: https://​www.​ccianet.​org/​2017/​02/​is-europe-about-weaken-encryption.
 
31
Tech Crunch, Encryption under fire in Europe as France and Germany call for decrypt law, 24 August 2016, available at https://​techcrunch.​com/​2016/​08/​24/​encryption-under-fire-in-europe-as-france-and-germany-call-for-decrypt-law.
 
32
Joint communication of the French and German Ministers of Interior to the EU, 20 February 2017, available at http://​www.​politico.​eu/​wp-content/​uploads/​2017/​02/​2017-02-17-Declaration-FR-DE-II_​Officielle.​pdf. See also Computer and Communications Industry Association, Is Europe about to weaken encryption, 24 February 2017, available at https://​www.​ccianet.​org/​2017/​02/​is-europe-about-weaken-encryption.
 
33
Questionnaire, Law enforcement section, Question 7a and based on semi-structured telephone interviews conducted in August 2015.
 
35
Questionnaire, Law enforcement section, Question 11.
 
37
Judgment of the Court (Grand Chamber) of April 2014, High Court of Ireland, Verfassungsgerichtshof v. Ireland, Austria (joined cases C-293/12 and C-594/12), Available from: http://​curia.​europa.​eu/​juris/​document/​document.​jsf?​text=​&​docid=​150642&​pageIndex=​0&​doclang=​EN&​mode=​req&​dir=​&​occ=​first&​part=​1&​cid=​332880.
 
38
Questionnaire, Law enforcement section, Question 10.
 
39
Judgment of the Court (Grand Chamber) of 21 December 2016, Tele2 Sverige AB v Post- och telestyrelsen and Secretary of State for the Home Department v Tom Watson and Others (joined cases C-203/15 and C-698/15), available at: http://​eur-lex.​europa.​eu/​legal-content/​EN/​TXT/​PDF/​?​uri=​CELEX:​62015CJ0203&​from=​EN.
 
40
Ivi par. 134.
 
41
Ivi par. 110.
 
42
Ivi par. 103.
 
43
Ivi par. 111.
 
44
Ivi par. 134.
 
45
Questionnaire, Legal section, Question 7.
 
46
In 2007 a Belgian public prosecutor asked Yahoo to release information regarding a subscriber, Yahoo refused to do so and it was the beginning of an ongoing judicial saga, see http://​www.​stibbe.​com/​en/​news/​2016/​january/​court-of-cassation-definitively-confirms-yahoos-obligation-to-cooperate-with-law-enforcement-agenci Harvard law review (2014) [Online], In re Warrant to Search a Certain Email Account Controlled & Maintained by Microsoft Corp, available at http://​harvardlawreview​.​org/​2015/​01/​in-re-warrant-to-search-a-certain-email-account-controlled-maintained-by-microsoft-corp.
 
47
Judgment of the European Court of Justice, 6 October 2015, Case C-362/14, Maximilian Schrems V. Data Protection Commissioner and Digital Rights Ireland Ltd.
 
48
Based on the Electronic Evidence Expert Group Meeting held on 2 and 3 December 2014 at the INTERPOL General Secretariat (IPSG), in Lyon, France.
 
49
As presented by Y. Vandermeer and further discussed at the EVIDENCE Status Quo Workshop in Sofia, Bulgaria.
 
50
As presented by Y. Vandermeer and further discussed at the EVIDENCE Status Quo Workshop in Sofia, Bulgaria and confirmed during the semi-structured telephone interviews conducted in August 2015.
 
51
As presented by Y. Vandermeer and further discussed at the EVIDENCE Status Quo Workshop in Sofia, Bulgaria.
 
52
Ibidem.
 
53
On method validation, see Forensic Science Regulator, Guidance: Validation, November 2014, available at https://​www.​gov.​uk/​government/​publications/​forensic-science-providers-validation and Forensic Science Regulator, Draft Guidance: Digital Forensics Method Validation, August 2014, available at https://​www.​gov.​uk/​government/​uploads/​system/​uploads/​attachment_​data/​file/​355996/​2014.​08.​28_​FSR_​Digital_​validation_​Draft.​pdf.
 
54
Ibidem.
 
55
Comments were not specifically about digital forensics.
 
56
For instance, concerning the potential adoption of a data retention law in Norway, a public hearing was organised for which the National Criminal Investigation Service (NCIS) analysed how various types of electronic evidence are acquired and used by the police in Norway. Therefore, NCIS circulated a survey among the police districts in Norway. Also, for an example of a US survey regarding the impact of digital evidence on LEAs, see Emerson (2014).
 
57
Based on semi-structured telephone interviews conducted in August 2015.
 
58
Ibidem.
 
59
Based on semi-structured telephone interviews conducted in August 2015.
 
60
Ibidem.
 
61
Based on semi-structured telephone interviews conducted in August 2015.
 
62
As presented by D. Szumilas at the Final Conference of the SMART Project, 4–5 March 2014, in Brussels, Belgium.
 
63
Based on semi-structured telephone interviews conducted in August 2015.
 
64
Intervention by P. Curry, Director British Business Federation Authority—BBFA Ltd, at the Internet Governance Forum (IGF) 2015, 9–13 November 2015, Workshop WS141, Law Enforcement in a world where encryption is ubiquitous.
 
65
As discussed during the EVIDENCE Workshop hosted by Eurojust in The Hague, the Netherlands.
 
66
Based on semi-structured telephone interviews conducted in August 2015; the Electronic Evidence Expert Group Meeting held on 2 and 3 December 2014 at the INTERPOL General Secretariat (IPSG), in Lyon, France; Questionnaire, Law enforcement section, Question 7b; and also see Emerson (2014).
 
67
Based on semi-structured telephone interviews conducted in August 2015.
 
68
Global Action on Cybercrime (GLACY), EU/CoE, Law Enforcement Training Strategy: Project area specific strategies, Draft version 17 April 2014, pp. 8–15, available at https://​rm.​coe.​int/​CoERMPublicCommo​nSearchServices/​DisplayDCTMConte​nt?​documentId=​090000168030287b​.
 
69
Questionnaire, Law enforcement section, Question 7e.
 
70
Based on semi-structured telephone interviews conducted in August 2015.
 
71
Ibidem.
 
72
Ibidem.
 
73
Ibidem.
 
74
Questionnaire, Law enforcement section, Question 7e.
 
75
UNODC, Cybercrime Repository, available at https://​www.​unodc.​org/​cld/​v3/​cybrepo.
 
76
Questionnaire, Law enforcement section, Question 7e.
 
77
As mentioned during the 2nd Eurasian Working Group Meeting on Cybercrime for Heads of Units, organised by the INTERPOL Global Complex for Innovation (IGCI) and hosted in Istanbul, Turkey, on 28–30 May 2014.
 
78
On formal MLA, see UNODC, Manual on Mutual Legal Assistance and Extradition (United Nations, New York, 2012), pp. 19–23.
 
79
On informal MLA, see UNODC, Manual on Mutual Legal Assistance and Extradition (United Nations, New York, 2012), pp. 66–68.
 
80
Communication from the Commission of the European Communities, Mutual Recognition of Final Decisions in Criminal Matters, COM(2000) 495 final, Brussels 26 July 2000, p. 4.
 
81
Council Framework Decision 2008/978/JHA of 18 December 2008 on the European evidence warrant for the purpose of obtaining objects, documents and data for use in proceedings in criminal matters [2008] OJ L 350/72, [hereinafter: EEW Decision] Recitals Nr. 2, 3, 6.
 
82
EEW Decision, Article 14(2).
 
83
Directive 2014/41/EU of the European Parliament and of the Council of 3 April 2014 regarding the European Investigation Order in criminal matters, available at http://​eur-lex.​europa.​eu/​legal-content/​EN/​TXT/​?​uri=​celex%3A32014L0041.
 
84
EIO Directive, Recital Nr. 6. See also Ruggeri (2014), p. 9.
 
85
Based on semi-structured telephone interviews conducted in August 2015.
 
86
Questionnaire, Law enforcement section, Question 7c.
 
87
Ibidem.
 
89
As discussed during the 2nd Eurasian Working Group Meeting on Cybercrime for Heads of Units, organised by the INTERPOL Global Complex for Innovation (IGCI) and hosted in Istanbul, Turkey, on 28–30 May 2014.
 
90
See Council of the European Union (2011), p. 2.
 
91
As discussed during the 2nd Eurasian Working Group Meeting on Cybercrime for Heads of Units, organised by the INTERPOL Global Complex for Innovation (IGCI) and hosted in Istanbul, Turkey, on 28–30 May 2014.
 
92
Council resolution of 26 February 2010 on a Model Agreement for setting up a Joint Investigation Team (JIT), C 70/01.
 
93
As discussed during the 2nd Eurasian Working Group Meeting on Cybercrime for Heads of Units, organised by the INTERPOL Global Complex for Innovation (IGCI) and hosted in Istanbul, Turkey, on 28–30 May 2014.
 
94
Council of Europe, Convention no. 185 on Cybercrime signed in Budapest the 23 November 2001, Article 18.1. “Each Party shall adopt such legislative and other measures as may be necessary to empower its competent authorities to order [...] a service provider offering its services in the territory of the Party to submit subscriber information relating to such services in that service provider’s possession or control”.
 
95
In 2007 a Belgian public prosecutor asked Yahoo to release information regarding a subscriber, Yahoo refused to do so and it was the beginning of a judicial saga. See http://​www.​stibbe.​com/​en/​news/​2016/​january/​court-of-cassation-definitively-confirms-yahoos-obligation-to-cooperate-with-law-enforcement-agenci.
 
96
Expression used by the British parliament in the Draft Communications Data Bill Joint Committee, Jurisdictional issues, available at http://​www.​publications.​parliament.​uk/​pa/​jt201213/​jtselect/​jtdraftcomuni/​79/​7909.​htm.
 
100
Scalable Measures for Automated Recognition Technologies, http://​www.​smartsurveillanc​e.​eu/​ and Rules, Expectations & Security through Privacy-Enhanced Convenient Technologies, http://​respectproject.​eu.
 
101
Mapping Alternatives for Privacy, Property and Internet Governance, https://​mappingtheintern​et.​eu.
 
Literature
go back to reference Ashouri A, Bowers C, Warden C (2014) The 2013 Salzburg workshop on cyber investigations: an overview of the use of digital evidence in international criminal courts. Digital Evid Electron Signature Law Rev 11:116 Ashouri A, Bowers C, Warden C (2014) The 2013 Salzburg workshop on cyber investigations: an overview of the use of digital evidence in international criminal courts. Digital Evid Electron Signature Law Rev 11:116
go back to reference Association of Chief Police Officers (ACPO) (2011) Manager’s Guide: Good Practice and Advice Guide for Managers of e-Crime Investigations. http://www.4matdata.co.uk/LiteratureRetrieve.aspx?ID=116738&usg=AFQjCNEoltGErOeWVZZiMHf8RqRmalS2RA Association of Chief Police Officers (ACPO) (2011) Manager’s Guide: Good Practice and Advice Guide for Managers of e-Crime Investigations. http://​www.​4matdata.​co.​uk/​LiteratureRetrie​ve.​aspx?​ID=​116738&​usg=​AFQjCNEoltGErOeW​VZZiMHf8RqRmalS2​RA
go back to reference Choo A (2015) Evidence, (In)efficiency, and freedom of proof: a perspective from England and Wales. Ala Law Rev 66(3):493–505 Choo A (2015) Evidence, (In)efficiency, and freedom of proof: a perspective from England and Wales. Ala Law Rev 66(3):493–505
go back to reference Council of Europe (2014) Transborder access to data and jurisdiction: options for further action by the T-CY, 2–3 December 2014 Council of Europe (2014) Transborder access to data and jurisdiction: options for further action by the T-CY, 2–3 December 2014
go back to reference Council of Europe (2016) Cybercrime Convention Committee (T-CY), Criminal justice access to electronic evidence in the cloud: recommendations for consideration by the T-CY – Final report of the T-CY Cloud Evidence Group, 16 September 2016, pp 40–46. http://rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent?documentId=09000016806a495e Council of Europe (2016) Cybercrime Convention Committee (T-CY), Criminal justice access to electronic evidence in the cloud: recommendations for consideration by the T-CY – Final report of the T-CY Cloud Evidence Group, 16 September 2016, pp 40–46. http://​rm.​coe.​int/​CoERMPublicCommo​nSearchServices/​DisplayDCTMConte​nt?​documentId=​09000016806a495e​
go back to reference Council of the European Union (2011) Joint investigation teams manual, 4 November 2011 Council of the European Union (2011) Joint investigation teams manual, 4 November 2011
go back to reference Mason S (2012) Electronic evidence, 3rd edn, p 75. LexisNexis Buttersworth, London Mason S (2012) Electronic evidence, 3rd edn, p 75. LexisNexis Buttersworth, London
go back to reference Ruggeri S (2014) Introduction to the proposal of a European investigation order: due process concerns and open issues. In Ruggeri S (ed) Transnational evidence and multicultural inquiries in Europe. Springer, Cham Ruggeri S (2014) Introduction to the proposal of a European investigation order: due process concerns and open issues. In Ruggeri S (ed) Transnational evidence and multicultural inquiries in Europe. Springer, Cham
go back to reference Ruggeri S (2014) Transnational investigations and prosecution of cross-border cases in Europe: guidelines for a model of fair multicultural criminal justice. In Ruggeri S (ed) Transnational evidence and multicultural inquiries in Europe. Springer, Cham Ruggeri S (2014) Transnational investigations and prosecution of cross-border cases in Europe: guidelines for a model of fair multicultural criminal justice. In Ruggeri S (ed) Transnational evidence and multicultural inquiries in Europe. Springer, Cham
go back to reference Tan J (2001) Forensic readiness, 17 July 2001. http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.480.6094&rep=rep1&type=pdf Tan J (2001) Forensic readiness, 17 July 2001. http://​citeseerx.​ist.​psu.​edu/​viewdoc/​download?​doi=​10.​1.​1.​480.​6094&​rep=​rep1&​type=​pdf
go back to reference Ward M (2012) What sequestration means to state, local, and tribal law enforcement Police Chief Mag (2012). http://www.policechiefmagazine.org/magazine/index.cfm?fuseaction=display_arch&article_id=2819&issue_id=122012 Ward M (2012) What sequestration means to state, local, and tribal law enforcement Police Chief Mag (2012). http://​www.​policechiefmagaz​ine.​org/​magazine/​index.​cfm?​fuseaction=​display_​arch&​article_​id=​2819&​issue_​id=​122012
Metadata
Title
Electronic Evidence: Challenges and Opportunities for Law Enforcement
Authors
Sabine Berghs
Geoffrey Stewart Morrison
Caroline Goemans-Dorny
Copyright Year
2018
DOI
https://doi.org/10.1007/978-3-319-74872-6_6