Periodic Reporting for period 2 - LOCARD (Lawful evidence collecting and continuity platform development)
Reporting period: 2020-05-01 to 2022-07-31
Cybercrime is a risk for society as it weakens confidence in Information and Communication Technologies and threatens international peace and stability. In fact, cybercrime and cyber-assisted crime result in billions in losses for organisations worldwide. Cyber attacks are behind several military conflicts and political disagreements, and millions of attacks on computer systems and security incidents take place every day.
In its fight against cybercrime, one of the most difficult challenges for the European Union is to homogenise the jurisdictions of the Member States. The procedure needed to obtain digital evidence, as well as its recognition in a court of justice, should follow a standardised procedure accepted by most countries within the Union. This procedure should guarantee the origin of the evidence and the integrity of the chain of custody.
Based on the above, LOCARD addresses this need by providing a unique platform for managing and exchanging digital evidence. The common repository, identity management and secure storage, auditing and trust through blockchain technology provide the backbone to realise these goals.
This project, funded through the European Commission’s Horizon 2020 program, automates the collection of digital evidence in any electronic format and medium. It provides a comprehensive management approach to handle digital evidence to be presented in a court of law, alleviating many issues of current art and practice. LOCARD increases trust in the handling and processing of digital evidence and the management of the chain of custody by providing transparency and using an immutable chain of custody stored with blockchain technology by also modelling the interactions among different stakeholders via smart contracts
In its fight against cybercrime, one of the most difficult challenges for the European Union is to homogenise the jurisdictions of the Member States. The procedure needed to obtain digital evidence, as well as its recognition in a court of justice, should follow a standardised procedure accepted by most countries within the Union. This procedure should guarantee the origin of the evidence and the integrity of the chain of custody.
Based on the above, LOCARD addresses this need by providing a unique platform for managing and exchanging digital evidence. The common repository, identity management and secure storage, auditing and trust through blockchain technology provide the backbone to realise these goals.
This project, funded through the European Commission’s Horizon 2020 program, automates the collection of digital evidence in any electronic format and medium. It provides a comprehensive management approach to handle digital evidence to be presented in a court of law, alleviating many issues of current art and practice. LOCARD increases trust in the handling and processing of digital evidence and the management of the chain of custody by providing transparency and using an immutable chain of custody stored with blockchain technology by also modelling the interactions among different stakeholders via smart contracts
The success of the project mainly depends on the use that the agents involved in the forensic field give to the platform and the degree of recognition that the courts of law grant to the presented evidence. Both the standard and the developed platform consider the real needs of stakeholders.
The core of the project is a comprehensive chain of custody platform based on blockchain with smart contracts to allow the seamless interaction of all stakeholders and the recording of all digital evidence and action on it. This allows for the creation of an immutable yet flexible and transparent storage for digital evidence which enables all the involved entities from the private sector, LEAs, prosecutors, etc. to manage the digital evidence but also exchanges them in a cross-jurisdiction case. Moreover, it allows the identification of correlations, e.g. a piece of evidence is found in two different cases. Finally, a set of dedicated tools have been created to provide investigators with advanced capabilities for streaming, mobile, and network forensics.
With the aim to ensure high-quality results and maximise the project’s impact, the consortium built a network from an interdisciplinary community of stakeholders, encompassing technology providers, public bodies, consumers and concerned citizens from the private, public, research and third sectors across Europe, interested in the results of the project, as well as in the use of the platform developed by the LOCARD project. The stakeholders were requested to get involved (always voluntarily and without any obligation on their part) in the following activities: Follow the evolution of the project by reading the materials and deliverables; provide feedback, based on their expertise, on the development of the platform; contribute to the dissemination of LOCARD’s results and; participate in the public activities organised by LOCARD.
From a dissemination perspective, to make the findings of the LOCARD project known as widely as feasible, especially among researchers, stakeholders and the general public, the project has been presented in several events such as workshops and symposiums, besides several webinars to keep the community informed. All the information is available on the Project website: https://locard.eu/news-events/events. Moreover, scientific publications (in prestigious conferences and journals) have been published and are available in the LOCARD’s website section: https://locard.eu/outcomes/project-publications. In fact, the research outcomes have been published in more than 90 venues, most of which Q1 and Q2 journals, receiving more than 1200 citations at the time of writing. The research contributions cover topics such as mobile forensics, cloud forensics, trusted computing environments, streaming services forensics, identity access management, blockchain systems, and deviant behaviour in social networks, to name a few. Moreover, most developed tools are open source and have been integrated into the LOCARD’s toolkit.
Dissemination materials such as brochures, posters and presentations are also available in the Project website: https://locard.eu/outcomes/communication-tools.
The core of the project is a comprehensive chain of custody platform based on blockchain with smart contracts to allow the seamless interaction of all stakeholders and the recording of all digital evidence and action on it. This allows for the creation of an immutable yet flexible and transparent storage for digital evidence which enables all the involved entities from the private sector, LEAs, prosecutors, etc. to manage the digital evidence but also exchanges them in a cross-jurisdiction case. Moreover, it allows the identification of correlations, e.g. a piece of evidence is found in two different cases. Finally, a set of dedicated tools have been created to provide investigators with advanced capabilities for streaming, mobile, and network forensics.
With the aim to ensure high-quality results and maximise the project’s impact, the consortium built a network from an interdisciplinary community of stakeholders, encompassing technology providers, public bodies, consumers and concerned citizens from the private, public, research and third sectors across Europe, interested in the results of the project, as well as in the use of the platform developed by the LOCARD project. The stakeholders were requested to get involved (always voluntarily and without any obligation on their part) in the following activities: Follow the evolution of the project by reading the materials and deliverables; provide feedback, based on their expertise, on the development of the platform; contribute to the dissemination of LOCARD’s results and; participate in the public activities organised by LOCARD.
From a dissemination perspective, to make the findings of the LOCARD project known as widely as feasible, especially among researchers, stakeholders and the general public, the project has been presented in several events such as workshops and symposiums, besides several webinars to keep the community informed. All the information is available on the Project website: https://locard.eu/news-events/events. Moreover, scientific publications (in prestigious conferences and journals) have been published and are available in the LOCARD’s website section: https://locard.eu/outcomes/project-publications. In fact, the research outcomes have been published in more than 90 venues, most of which Q1 and Q2 journals, receiving more than 1200 citations at the time of writing. The research contributions cover topics such as mobile forensics, cloud forensics, trusted computing environments, streaming services forensics, identity access management, blockchain systems, and deviant behaviour in social networks, to name a few. Moreover, most developed tools are open source and have been integrated into the LOCARD’s toolkit.
Dissemination materials such as brochures, posters and presentations are also available in the Project website: https://locard.eu/outcomes/communication-tools.
The development of a trusted, cross-jurisdiction platform guaranteeing the integrity of the chain of custody of digital evidence greatly facilitates and boosts investigations involving transnational criminal (cyber and cyber-assisted) activities. Moreover, LOCARD delivered a set of tools for:
• Collecting digital evidence from the cloud.
• Detecting mobile device hijacking (Android).
• Unlocking Android devices.
• An Intelligent Crawler for detecting:
• child exploitation streams, victims and perpetrators.
• streams of copyrighted content.
Benefits for Citizens: LOCARD’s research and toolbox contribute to elevating the level of security across Europe by providing the different actors involved in judicial proceedings with comprehensive tools to assure timely collection and the integrity of digital evidence. LOCARD’s identity management and blockchain elements also support accountability of justice, and so citizens’ trust. Moreover, the crowdsourcing platform puts citizens in the loop, allowing them to timely report incidents and know that their input is evaluated.
Benefits for LEAs: LOCARD provides Law Enforcement agencies with an innovative platform to manage digital evidence continuity easily, as well as a way to support cooperation and exchange of information across different jurisdictions. This can significantly speed up and facilitate criminal investigations as well as assure evidence integrity for presentation in a court of law.
Benefits for Organisations: LOCARD will greatly benefit private organisations, especially those engaged in the provision of digital services. The platform’s modules support forensic readiness processes, as well as compliance with GDPR provisions such as data breach notifications.
Benefits for Information Security and Cybersecurity Consulting Companies: LOCARD adds an innovative set of services to any portfolio and allows security providers to easily integrate digital forensics into their offer.
Moreover, LOCARD has participated in one CWA for forensic investigations in mobile devices https://www.cencenelec.eu/news-and-events/news/2022/eninthespotlight/2022-04-12-for-mobile/ and it is in the process of creating a new ISO standard for the exchange of digital evidence.
• Collecting digital evidence from the cloud.
• Detecting mobile device hijacking (Android).
• Unlocking Android devices.
• An Intelligent Crawler for detecting:
• child exploitation streams, victims and perpetrators.
• streams of copyrighted content.
Benefits for Citizens: LOCARD’s research and toolbox contribute to elevating the level of security across Europe by providing the different actors involved in judicial proceedings with comprehensive tools to assure timely collection and the integrity of digital evidence. LOCARD’s identity management and blockchain elements also support accountability of justice, and so citizens’ trust. Moreover, the crowdsourcing platform puts citizens in the loop, allowing them to timely report incidents and know that their input is evaluated.
Benefits for LEAs: LOCARD provides Law Enforcement agencies with an innovative platform to manage digital evidence continuity easily, as well as a way to support cooperation and exchange of information across different jurisdictions. This can significantly speed up and facilitate criminal investigations as well as assure evidence integrity for presentation in a court of law.
Benefits for Organisations: LOCARD will greatly benefit private organisations, especially those engaged in the provision of digital services. The platform’s modules support forensic readiness processes, as well as compliance with GDPR provisions such as data breach notifications.
Benefits for Information Security and Cybersecurity Consulting Companies: LOCARD adds an innovative set of services to any portfolio and allows security providers to easily integrate digital forensics into their offer.
Moreover, LOCARD has participated in one CWA for forensic investigations in mobile devices https://www.cencenelec.eu/news-and-events/news/2022/eninthespotlight/2022-04-12-for-mobile/ and it is in the process of creating a new ISO standard for the exchange of digital evidence.