Dirk VAN ERPSHead of Unit Cartels IIForensic IT Project ManagerMadrid, 5 July 2013

Gathering digital evidence by the EU Commission in inspections

Digital Evidence Gathering: Powers

• Reg. 1/2003, Art. 20, 2:"The officials […] are empowered: (b) to examine the books and other records related to the business irrespective of the medium on which they are stored;(c) to take or obtain in any form copies of or extracts from such books or records"

Digital Evidence Gathering: Powers

Means:-We can look at electronic documents-We can make electronic copies of (electronic or paper) documents

(see point 9 of Explanatory Note)

Digital Evidence Gathering: Powers

• DG Comp has started in April 2013 to take systematically electronic copies of electronic documents;

• DG Comp is planning to make electronic copies (scans) of paper documents; one test in June 2013

The revised Explanatory Note

• What for:• - provide transparency to company, kind of

FAQ• - handed over to company representative at

start of inspection• - available on internet• For information only and without prejudice to

formal interpretation of powers of investigation

Clarifications in 18 March 2013 version

• - provides examples on company's IT environment and storage media that can be searched: "laptops, desktops, tablets, mobile phones, CD-Roms, DVDs, USB-key and so on" (point 10)

• - reference to 'obligation to cooperate fully and actively with the inspection' (point 11)

• - more examples stemming from this: -"explaining organisation and IT environment"

Clarifications in 18 March 2013 version

• "temporarily disconnecting running computers from network, removing and re-installing hard drives from computers and providing 'administrator access rights'-support"

• Possibility to use company hardware (that is not wiped at the end by Commission) (pt 11)

• Inspectors can keep storage media until end of inspection but may return earlier after having made forensic copy of data (pt 12)

Clarifications in 18 March 2013 version

• Commission cleanses all Commission data carriers used to transfer data at end of inspection (pt 13)

• Revised Note to coincide with introduction of new workflow

•

Previous Workflow

IT Inspector

FIT Inspector

Company ComputerNo Dedicated Search Tools

DG COMP FIT LaptopForensic Software

New WorkflowIT Inspector

Nuix Operator

Nuix Reviewers

FIT Inspector

Digital review method has not changed

• Possible relevant documents are 'collected' (no systematic 'imaging' of entire content, but still forensic copy from laptops/desktops)

• Possible relevant documents are indexed• Possible relevant documents are reviewed, now on

a 'platform' basis• Commission official decides whether document is

relevant• Company receives list and copy of relevant

documents

Digital review method has not changed

• In principle, review is done on the spot, on the basis of the content of the individual document, by a Commission official (in the presence of company representative)

• Sealed envelope (or 'continued inspection') procedure remains exceptional:• Less than 10% of cases• Often on request of company (as 'Nuix' was not

available on site)

We are not obliged to

• Define the relevance of a document on the basis of a Commission pair of eyes looking at the individual document (but we do)

• Describe our interpretation of our rights (but we do – transparency via Inspection Explanatory Note)

• Describe our workflow and our tools (but we do – article and presentation as this one)

• Cleanse/Sanitise/Wipe our tools at the end of the inspection (but we do)

Legal issues

• Location of server: irrelevant: what is available to company staff is available to Commission official

• LPP: can be excluded from 'search data' and reviewed separately between Team leader and company representative

• Keywords: are not provided as they are only 'intelligence' helping to define possible individual relevant documents (that are provided)

• Chain of custody: company signs 'document list' that identifies individual documents by path file and name and Hash Value for entire collection

Legal issues

• 'Continued inspection' or 'sealed envelope' procedure: Nexans/Prysmian challenge: General Court: measure implementing inspection decision; not separable act

• Personal Data: we process in compliance with Reg. 45/2001 applicable to Commission, but no hindrance to obtain the data

• No procedural harmonisation within ECN but exchange of practices and experience in ECN Forensic IT Working Group

DEMO

• Presentation of the Demo CD that is provided to inspected company at start of inspection to explain procedure

The End

• Thank you• Any further questions?

• Dirk.Van-Erps@ec.europa.eu

• * The views expressed are personal and do not commit the Commission