More information
Description
The project shall contribute to Outcome 2 ''Improved capacity of law enforcement services to prevent and detect organised crime''.
The main activities in the project shall include:
- Study visits for staff from CFLP to other European countries to learn new methods.
- Training sessions, including advanced analysis of mobile devices by the Norwegian police and involving staff from CFLP and IT labs located within the Voivodship Police Headquarters. The training will take place in Poland.
- Training in malware analysis involving specialists from the Dutch police
- Training in securing volatile data involving specialists from the Norwegian Police University College in Oslo, also training in the decryption of encrypted data, recovery of data from damaged mobile devices and solid-state media forensics.
- Procurement of specialised equipment and software for CFLP and IT labs located within the Voivodship Police Headquarters to enable specialists to apply the above methods.
- Promotion of the project by organising three events and the procurement of some promotional material (pens, booklets, portable storage devices, etc)
Gender equality is relevant in case of this project, because Project Promoter will ensure equal access to trainings for male and female police officers. Indicator related to trainings will be monitored and disaggregated by gender.
Summary of project results
The main challenge identified by the project was ability to keep up with criminals in terms of using the modern equipment and methods. Criminals are up to date with the newest technology, so law enforcement entities have to improve their abilities to secure evidences also in cyber form. Project was focused on cybercrime, specifically collecting and securing evidences by Forensic Laboratories of the Police (highly-specialised state institution which is responsible in Poland for processing evidence). These activities are crucial, since only properly collected and secured evidences can be used in court. The access to specialised training for employees of the CFLP is limited – 95% of IT forensic experts are trained only internally, so the trainings were also identified as a challenge in terms of raising competences of specialists in the cybercrime detection.
First phase of the project were trainings, most of which was the responsibility of the project partner, the Norwegian Police University, which specialises in computer forensics. Twenty-two editions of training courses were held, attended by experts and certified experts from forensic laboratories from all over Poland. They were held in small groups, were very practical in nature and the trainers were specialists from Norway, Spain, Ireland, Estonia, Germany and Belgium. The training sessions were of a very high standard and the Polish participants were very satisfied with them. Some of the participants stayed in informal contact with the trainers, discussing with them the ''more difficult cases'' they face in their work. A total of 104 people were trained in the project. Trainings covered such issues as: advance low level analysis of mobile devices, malware analysis, acquisition of volatility data, decryption of encrypted data carriers, recovery data from damaged mobile devices.
Second phase consisted of the retrofitting of 18 forensic laboratories across the country (i.e. all the Voivodeship Police Headquarters, as well as the Warsaw Metropolitan Police Headquarters and the Central Police Forensic Laboratory) with hardware and software for cryptographic testing on devices (mainly phones). This equipment included:
- Highly specialised workstations used for data decryption work;
- Chip-off stations that allow data to be extracted directly from the memory chips of electronic devices (i.e. extracting data from defective devices);
- Software for data acquisition from mobile devices that are in possession of Laboratories;
- Software to break the cryptographic security of mobile devices that are in possession of Laboratories;
- A suite of tools (software) to analyse the acquired data.
The primary benefit of the project is improved ability of forensic laboratories to acquire, analyse and secure digital material so that it can provide hard-to-evade forensic evidence in computer crime cases. Thanks to the project level of competence of law enforcement units at a regional level improved – they took part in advanced trainings and updated their knowledge to respond to modern challenges in combating crimes. They also received specialised equipment and software, so that the they have tools to put new acquired knowledge into use.
The significant impact on the effectiveness of law enforcement activities in this area achieved thanks to this project is worth emphasising. The systemic approach, covering all forensic laboratories in the country, contributed to levelling the level of competence and equipment nationwide. The key effect has not only been to improve the technical skills of staff, but also to increase the reliability of digital evidence in court proceedings. This, in turn, will translate into higher effectiveness in combating cybercrime in the long term.
Summary of bilateral results
Project were implemented with significant engagement of Norwegian Partner – Norwegian Police University College. Norwegian Partner was responsible for conducting majority of trainings within the project. Before conducting trainings Project Promoter and Norwegian Partner created a survey for attendees to find out are their exact training needs. Attendees of the trainings were very satisfied with the trainings conducted by Norwegian Partner.Besides from conducting trainings, Norwegian Partner organised study visit in Norway for Polish Police officers. During the visit, Polish police officers got acquainted with the structure of the Norwegian criminal police and local forensic laboratories. They looked at their equipment and observed the work of their Norwegian counterparts. They got to know the hardware and software facilities used by the Norwegian Police. Thanks to the study visit Project could be updated – Polish representatives noticed the widespread availability of software to break cryptographic security of mobile devices (being in physical possession of law enforcement entities), and decided to implement those solutions in Polish Forensic Laboratories as well.Cooperation between Polish Police Headquarters and Norwegian Police University College found a continuation in bilateral initiative “Training in the area of computer forensic”. Within this initiative more training concerning network forensic was conducted by Norwegian specialists for Polish Police Forensic Laboratories.