Skip to main content

Programme Category


Article available in the folowing languages:

Forensics topic 4: Internet Forensics to combat organized crime

Specific challenge:

The Internet is nowadays at the core of any business activity. All large and distributed organisations rely on the Internet for the exchange of data, information, and knowledge, both internally and externally, so as to organise and run their activities. Organized crime is no exception. The Internet has become an important tool for criminal organisations to carry out illegal activities. Research under this topic should refer to Internet Forensics as the set of investigation techniques concerned with Internet as a media used by organised crime in general - mainly to communicate and exchange data and information. A further and specific challenge is represented by the camouflage of the real nature of the concerned data and information. Due to the borderless nature of the Internet, specific trans-border aspects should be considered when dealing with Internet Forensics. Therefore, aside from the relevant technological aspects, legal and organisational issues like the co-ordination of different Law Enforcement Authorities (LEA) and the harmonisation of the different legal frameworks have to be addressed.


Proposals should focus on how to extract, compare, correlate, filter, reason over and/or interpret suspect information, data, communications stored and/or transferred on the Internet including on the deepweb, darknet and other less easily accessible parts of networks, obtained under a lawful warrant, in order to discover facts and evidence to support forensic investigations (including e.g. resolving identities in social networks, authorship identification on webfora, shared media, etc.). Software and, if necessary, hardware tools, methods and guidelines should be proposed. They should tackle all the layers of analysis, from the data-packet level to the data mining, to language interpretation, semantic analysis, and information retrieval, including the multi-lingual aspects, and video and picture analysis. Investigative techniques on any kind of crime using the Internet to some extent (to communicate, transfer data, etc.) should be concerned. The proposed solutions should enable accelerated searches of the huge amount of data-transfer that occurs on the Internet, and to discover and make clear (interpret) out of it the relevant data and information. At the same time, limited, or at least controlled, pervasiveness of the proposed solutions must be guaranteed, in order guarantee the privacy of all the internet users. Ethical issues have to be clearly addressed. Appropriate solutions to fulfil the legitimate request of privacy by the citizens should be embedded in the very core of the proposed solutions. Also, all the developed tools, methods and guidelines should be supported by training support and curricula.

Where necessary new technologies should be developed for sampling, analysing, evaluating, interpreting and recording forensic evidence with a view to achieve solid and court-proof forensic evidence that can be used during legal prosecution.

The development of a base line system for current and future end users should also be envisaged and the solution should follow Open Source concepts.

Proposals will have to deal with the management of personal data, and related ethical and legal issues. Therefore considerable attention will have to be given to privacy and data protection, and to the adherence to European regulations. For each proposed solution, potential issues vis-à-vis these rights and regulations will have to be analysed, and recommendations on the best solutions to these issues must be proposed.

The Commission considers that proposals requesting a contribution from the EU of between  €3m and €5m would allow this specific challenge to be addressed appropriately. Nonetheless, this does not preclude submission and selection of proposals requesting other amounts.

Expected impact:

- improved LEA capabilities to conduct investigations by using information travelling and stored on the Internet obtained under a lawful warrant ;

- improved training of LEA staff able to perform these investigations. increased crime prosecution capabilities;

- shorter court cases due to the availability of more solid court proof forensic evidence;

- increased privacy and data protection during forensic investigations;

- for industry better understanding of modern operational LEA requirements, thus increasing their competitiveness.

The outcome of the proposal is expected to lead to development from Technology Readiness Levels (TRL) 6 or above; please see part G of the General Annexes.

Type of action: Innovation Actions