News

FORMOBILE: An end-to-end forensic investigation chain for mobile devices

European Standardisation Agreement Strengthens Confidence in Mobile Forensics

Just because the Police has evidence, the process of collecting it and presenting it in Court is not straightforward.

Published on 25 March 2022

Article Prepared by Karl Grün: Austrian Standards International

Consider that a crime was committed and an investigation has taken place. However, once in the Court, proceedings became challenging for the law enforcement agency (LEA), forensic scientist, and the prosecutor involved. Why? Because the LEA seized a mobile phone as evidence during the case. But at the crime scene, the officer collected the device in a method that altered the evidence. Furthermore, tools used at the forensic laboratory were neither validated nor verified. Moreover, certain steps even intruded on the privacy rights of the suspects because the analyst processed data beyond the purposes of the investigation.

Finally, in the courtroom, the technical expert's oral report was confusing and full of jargon, making it impossible for the judge, defence attorney and even for the prosecutor to follow.

This can be - and has been the scenario - in past cases in the EU.

The Solution

To help avoid such scenarios, FORMOBILE initiated a European Committee for Standardisation through CEN. The work was led by the Austrian Standards International, leaders of Work Package 3. The goal was the creation of a standardisation deliverable called a CEN Workshop Agreement (CWA). After two years of extensive work, and the dedicated involvement of almost 60 representatives from 30 organisations plus others participating in an open commenting phase, the document has been published as CWA 17865:2022, and was publicly available for download from the 22nd of March 2022.

CWA 17865 focuses on the Personnel, Tools, Processes and Legal and Ethical framework specific for mobile forensics. The work includes all elements of the forensics investigation chain, including competencies, device seizure, preservation of evidence, acquisition, examination and analysis of data, documentation. Moreover, it details all investigation steps with guidance and requirements for reporting, evaluation and sharing of information with other Law Enforcement Agencies (LEAs), and the necessary legal and ethical considerations.

In addition to the process-related issues, the document covers requirements for a new curriculum for the appropriate training of LEA officers, security practitioners and criminal prosecution experts to ensure that evidence from mobile devices is court-approved across national borders.

The CWA offers a collection of building blocks covering different aspects of mobile forensics, allowing for adjustments based on national laws and regulations as well as internal rules and codes of conduct. It allows LEAs from different countries to accommodate their available technical solutions - offering a standardised collection of procedures and requirements.

Representatives from numerous LEAs, forensic institutes, tool providers, research organisations and legal and ethical advisors participated on peer-level in drafting the document. Collaboration was fruitful and encouraging, especially as several contributors are organisations often seen as competitors. They worked together for a greater goal and to benefit society; helping to shape the future of the mobile forensics domain.

Following an open commenting phase - where additional organisations, alongside existing participants of the CEN Workshop, provided their feedback on the document, the improved draft of CWA 17865 was subject to validation by FORMOBILE. Activities like WP1’s Ring Trials and WP7’s Train-the-Trainer took place. Results from this validation, plus feedback from FORMOBILE's legal and ethical experts and advisory board, contributed to enhancing the content of the CWA. This covered usability and understandability for the benefit of LEAs, forensic institutes, tool developers, prosecutors, and society.

Now that the CWA 17865 is openly available for implementation, the next step will be to collect feedback from the use of the document in the coming years. With this feedback, it will be decided whether the CWA will be amended, revised, or upgraded as a European Standard.

FORMOBILE has covered the necessary costs to allow the document to be openly used and downloaded by interested parties.

CWA 17865:2022, Requirements and Guidelines for a complete end-to-end mobile forensic investigation chain, is publicly available for download.