Improvement of the process of gathering, analysis and assessment of the evidence in the area of counteracting transnational cybercrime using the network of Polish Police forensic IT laboratories
ended
The project is financed by the "Internal Affairs" Program implemented under the Norwegian Grants for 2014-2021. The program is at the disposal of the Minister of the Interior and Administration. The project is co-financed from the state budget.
Norway Grants
The Norway Grants and the EEA Grants represent Norway’s contribution towards a green, competitive and inclusive Europe. Through the Norway Grants and the EEA Grants, Norway contributes to reducing social and economic disparities and to strengthening bilateral relations with beneficiary countries in Central and Southern Europe and the Baltics. Norway cooperates closely with the EU through the Agreement on the European Economic Area (EEA). Together with the other donors, Norway has provided €3.3 billion through consecutive grant schemes between 1994 and 2014. Norway Grants are financed solely by Norway and are available in the countries that joined the EU after 2003. For the period 2014-2021, the Norway Grants amount to €1.25 billion.
The priorities for this period are:
- Innovation, Research, Education, Competitiveness and Decent Work
- Social Inclusion, Youth Employment and Poverty Reduction
- Environment, Energy, Climate Change and Low Carbon Economy
- Culture, Civil Society, Good Governance and Fundamental Rights
- Justice and Home Affairs
For more information on Norway Grants, please visit: www.norwaygrants.org and www.eog.gov.pl
____________________________________________________________________________
Project information
Title of the Project:
Improvement of the process of gathering, analysis and assessment of the evidence in the area of counteracting transnational cybercrime using the network of Polish Police forensic IT laboratories
Programme:
The Project is implemented under the funds of the Norwegian Financial Mechanism 2014-2021.
Value of the project: 4 424 625 EUR including funding from the Norwegian Financial Mechanism: EUR 3 760 931 co-financing: EUR 663 694.
Financial Agreement: Agreement no 4/NMF/2021 was signed on 16.04.2021
Period of implementation: 01.01. 2021 – 30.04.2024
The aim of the project is to create a modern, long-term and sustainable training system in the field of computer forensics and combating cybercrime for employees of police forensic laboratories, as well as equipping them with specialized equipment. Such trained and equipped staff will be able to make security and then analyse electronic evidence in a way that will make it indisputable in cases related to cross-border computer crime.
The project is implemented by the National Police Headquarters - as a beneficiary in cooperation with Central Forensic Laboratory of the Police - as the originator of the project and the unit responsible for substantive and organizational supervision over activities under the project. The Partner of the Project is Norwegian Police University College - Politihøgskolen.
The project is nationwide - specialized training and purchase of equipment are planned for all Police forensic laboratories.
Activities:
- Study visits to learn about IT forensic solutions used by the Dutch, Norwegian, French and German police
- Specialized training in the field of IT forensics, also in partnership with the Norwegian Police University
- Purchase of specialist hardware and software for 18 units, including: CFLP/forensic laboratory of the Provincial Police Headquarters and Metropolitan Police Headquarters
- Organization of 3 events promoting the project
News:
In April 2022 (25-29.04.2022) Representatives of Polish police forensic laboratories had the opportunity to visit four institutions:
- Bundeskanzleramt - Office of the Chancellor of Germany
- Landeskriminalamt Eberswalde (LKA Brandenburg) - State Criminal Office of the Land of Brandenburg
- Landeskriminalamt Berlin (LKA Berlin) - National Criminal Office of the Land of Berlin
- Bundespolizei Berlin (BPOL Berlin) - Federal Police Berlin.
During the visit, Polish police officers got acquainted with the structure of the German Criminal Police and local forensic laboratories. They looked at their equipment and observed the work of their German counterparts. They learned about the organizational structure of the German forensic laboratory, which is characterized by a narrow division of specialties. The hardware and software facilities used by the German Police were familiarized. Particular attention of Polish representatives was focused on the software owned by German police institutions for acquiring data from digital devices.
In 2022, survey questionnaires were developed together with the Norwegian Partner to identify training needs among employees of the regional and CFLP forensic laboratories for which they will be intended. The completed questionnaires were provided to the Norwegian Partner in order to analyse and develop a detailed training program based on their results. A detailed program of the above-mentioned trainings is being prepared and preparations for their implementation are underway.
In August 2022, a study visit to the Kingdom of Norway took place representatives of Polish police forensic laboratories had the opportunity to visit three institutions:
- the National Cybercrime Centre (NC3) A specialised cybercrime unit of the Norwegian Police, operating within the National Criminal Investigation Service (NCIS) organisation.
- Oslo Police District, the equivalent of the Oslo Police Department with 3 police stations under it in the Norwegian capital.
- Police University College - Politihøgskolen, Oslo Police University
During the visit, Polish policemen became acquainted with the structure of the Norwegian Criminal Police and its forensic laboratories. They looked at their equipment and observed the work of their Norwegian counterparts. They learned about the hardware and software facilities used by the Norwegian Police.
In January 2023, a series of specialized training courses was launched in cooperation with the Project Partner, the Norwegian Police University College, which lasted until November 24, 2023. A total of 22 editions of training courses were implemented with the participation of the Norwegian Partner, in which 300 training places were provided for experts and certified experts from CFLP and forensic laboratories of Provincial Police Headquarters and Metropolitan Police Headquarters.
In accordance with the schedule, training projects devoted to acquiring theoretical and practical knowledge and skills for investigating network intrusion techniques by collecting traces and gathering relevant digital evidence, entitled "Network forensics intermediate course," and acquiring skills for revealing and correctly identifying traces left by malware in the memory of evidentiary devices, entitled "Malware analisys," have been completed.
Also completed was a training course that allows participants to acquire skills to correctly identify cryptographic security currently used by users, select the appropriate tools, and then attempt to break such security, titled "Decryption of encrypted data carriers," and a training course that allows participants to acquire skills to correctly secure on-site volatile data contained in the memory of IT devices, titled "Volatile Data Acquisition (Live Data Forensics)."
Training courses on low-level analysis of mobile devices running Android and iOS operating systems "Advance low-level analysis of mobile devices" were also fully implemented.
The trainings were very popular. Trainers from Norway, Spain, Ireland, Estonia, Germany and Belgium, among others, not only represented a very high level of technical knowledge, but also conveyed it to the audience in an accessible manner. It should be noted that the training courses are highly specialized. They were implemented in groups of 10 and 20 people and were conducted entirely in English.
The trainings entitled "Malware analisys" and "Network forensics intermediate course" were the most popular among participants. There were more applicants for these trainings than the project anticipated.
In addition, a series of trainings conducted by an external entity on recovering data from damaged media were implemented. The trainings ended on December 8, 2023. In 9 editions of training courses, 36 people were trained.
Due to the fact that the trainings were planned so that experts and experts could attend more than one training (there were about 336 training places), 104 people were trained in all trainings under the project.
Specialized equipment and software were also purchased - test stations - high-performance workstations, stations for recovering data from damaged devices (chip-off), and software for acquiring data from cell phones, breaking cryptographic security, and analyzing the acquired data, which were allocated to the CFLP and the Forensic Laboratories in all Provincial Police Headquarters and Metropolitan Police Headquarters.
The software and hardware will enhance research capabilities within mobile devices.
On February 8-9, an international conference summarizing the implementation of the project was held at the WINDSOR Hotel in Jachranka. The conference was attended by representatives of the Ministry of Internal Affairs and Administration, the Departments of Public Order and European Funds, representatives of the Police, including the Heads of Forensic Laboratories of the Provincial / Metropolitan Police Headquarters, who were the actual beneficiaries of the project. Representatives of the partner, the Norwegian Police University, also actively participated in the conference. During the conference, the great value of the project activities and the usefulness of the knowledge from specialized training, as well as the purchased equipment and software in the work of experts and experts from forensic laboratories were emphasized. Undoubtedly, the added value of the project is the establishment of national and international contacts.
The implementation of the project ended on April 30, 2024, and 100% of the anticipated project results were achieved.
In addition, both the Beneficiary and the Norwegian Police University expressed their willingness to continue fruitful cooperation within the framework of the new bilateral initiative.
