Short-term expert - International Law Enforcement expert in digital forensics

Background

The promotion and protection of human rights while countering terrorism requires specific actions aiming at generating awareness to the main investigation and prosecution actors while dealing with CT cases. To that end, output 3.1 aims at strengthening the capacities of CT specialised institutions on rights-based criminal investigation and prosecution in Lebanon.

A series of trainings are intended to ensure that counter-terrorism measures during the investigation and prosecution stages are based in law, pursue a legitimate objective, and are proportionate to prevent abuse and human rights violations of persons impacted by such measures, including those suspected or accused of acts of terrorism.

CT specialised institutions must know how to manage digital evidence during judicial process and international expertise will provide know how on the Budapest Convention on Cybercrime with the aim of securing electronic evidence in relation to any crime.

Although Lebanon is not signatory of the Budapest Convention, a new law on e-transactions and data protection was adopted in October 2018 (Law 81), which is inspired and based on this Convention. Representatives of the judiciary requested the ACT project to deliver a training course on both the Budapest Convention and Law 81 (by a local expert), with the aim of improving the knowledge and application of the national regulation which results essential in protecting the rights of the accused while ensuring the protection and compliance of the chain of custody of digital evidence. This training was held on 24-25 November 2023, and based on its conclusions and recommendations, a follow up activity was necessary to enhance the coordination between judges and LEAs in the lawful collection of digital evidence in line with HR standards combined with a table-top exercise in digital forensics investigation and prosecution.

An assessment on the digital forensic investigation capacities within the Law Enforcement Agencies (LEAs), was conducted in October 2021, which highlighted the following points, among others:

• In an ever-evolving digital world, where cybercrime adapts itself every day, Lebanese LEAs need to increase their capacities at the same pace as cybercriminals and terrorists do;
• To avoid duplication of efforts and promote best practices and to share work, Lebanese LEAs shall meet and exchange more information with each other;
• Awareness-raising is necessary for LEAs managers to better understand cybercrime challenges and help them to make decisions in terms of budget, equipment, international cooperation, public-private partnership, as well as for judges/magistrates to better understand new cybercrime methods and raise precise questions on real-case difficulties to identify possible loopholes of the law and initiate a reflection on possible further law update.

To this end, trainings on crypto currencies, e-evidence and dark web have been carried out for the benefit of the LEAs digital forensic units and judges of the General Prosecutor Office and ministry of Justice. An advanced training on crypto currencies is planned from 5 to 9 June 2023.

Regarding cybersecurity and information security, a comprehensive training programme has been performed, since 2021, to the cybersecurity staff of the LEAs, regal ministries (including ministry of Justice), Banque du Liban, telecommunication sector and Lebanese University, in risk assessment, crisis management and SOPs, cyber threat intelligence, cyber incident detection, etc.

Also, a study visit on cyber security and digital forensics topics was deployed in April 2023 to the Carabinieri’s Digital Forensic Units and Labs (Rome, Italy); Europol and Eurojust HQs (The Hague, Netherlands); The International Cybersecurity Forum (Lille, France); The National Digital Forensics Training Center of the French Ministry of the Interior (Lille, France). The Lebanese delegation was composed of officials from the LEAs and of judges from the ministry of Justice.

These capacity building activities have allowed the participants to achieve a level of maturity in cyber security and digital forensics.

Objective

The main objective of this activity is to provide a thorough and exhaustive understanding of Lebanese Law 81, and other related laws, and improve the coordination process between judges and law enforcement agencies in the lawful collection of digital evidence as part of the judicial process (including valid seizure, incorporation into the procedure, expert analysis etc.). All this in line with EU best practices, namely the Budapest Convention and while addressing the difficulties and legal challenges of this process for both the judiciary and LEAs.

To this end, this activity will include one first part dedicated to detailed explanation and presentation of the legal, procedural and administrative current practices of digital forensics among Lebanese LEAs and justice institutions, assessing current challenges. A second part of the activity will address a table-top exercise aiming at enhancing the coordination process between judges and law enforcement agencies, through practical cases related to cybercrime and cyber-terrorism allowing them to better understand their respective capabilities, issues and needs as regards technical investigation and judicial prosecution, and to identify areas for improvement, procedures to be developed, possible further law update.

Local ownership will be the guiding principle of this activity by letting the main Lebanese actors on digital forensics share their legal and administrative procedural practices, especially related to Law 81, and its modus operandi. International experts will accompany the local counterparts, commenting and sharing feedback based on EU standards.

Expected result

Judges and LEAs officials involved in the entire digital forensic process (lawful collection, custody and analysis of digital evidence, etc) will identify the existing coordination gaps while enhancing their coordination process. This activity will grant a better shared understanding of their respective capabilities in digital investigation and prosecution that will open the door for developing standard operating procedures in line with the Lebanese law.

The activity will be carried out in Beirut by a steering group of local and international experts in the framework of a series of trainings led by ACT project. The workshop on the coordination between judges and LEAs in the lawful collection of digital evidence in line with HR standards (component 3) will be combined with a table-top exercise[1] in digital forensics investigation and prosecution (component 2) in a joint activity.

The following expert profiles are required for this activity:

• Coordinator: one local expert;
• EU Judicial Expert (judge): one international expert;
• EU Digital Forensics Expert: three international experts from the Consortium members (one each).

1. Coordinator of the activity

One local expert is required to assume to overall coordination of the activity and present in details the Lebanese Law 81 and related laws. The coordinator shall work closely with the ACT Project Team based in Beirut, and the international experts and local stakeholders in the preparations of the activity, content and implementation of the activity.

Tasks required for the Activity Coordinator, under the supervision of the ACT Project:

• Preparatory meeting with the ACT Institutional Coordinator and the Project Team.
• Review of the activity report of 3.1.10 and its assessment to follow up on the conclusions and recommendations.
• Coordination of the activity and preparation of training materials
• Presentation of Law 81 and related laws.
• Coordination with international experts and local stakeholders
• Coordinate the preparation of case studies and overview of best practices with international experts, local speakers, ACT Facilitator and ACT Project Experts.

Deliverables and outputs of the mission for the Activity Coordinator

• Preparation of material and case studies.
• Activity report (according to the templated provided).

NB: the deliverables are to be drafted in English.

2. International Experts: 4

The international experts are requested to travel to Lebanon to participate in this activity. Prior to the workshop, some preparatory work will be necessary for the finalisation of the table-top exercise in coordination with the rest of the steering group.

The international experts with proven experience in the custody, collection and the use of digital evidence during the investigation and prosecution process, as well as in digital forensics investigation in the fields of organised crime, cybercrime and cyber-terrorism, will provide expertise on the best practices/feedback based on national/EU law and professional experience in comparison with the Lebanese law and investigation and prosecution practices.

Two profiles of international experts are required:

• One judicial expert (judge); from a specialised national court on terrorism
• Three Law Enforcement Agents with technical background on digital evidence and forensics.

B1) Tasks required for the international judicial expert: 1 expert (judge)

• Preparatory meeting with the ACT Institutional Coordinator and the Project Team.
• Review of activity reports of 3.1.10 “Workshop on the Lawful Collection of Digital Evidence in line with human rights standards” and 2.1.11 “Assessment on the digital forensic investigation capacities achieved amongst law enforcement agencies”.
• Coordination and preparatory meetings with other international experts and the coordinator, attending this activity, prior to the arrival to Beirut, under the ACT Project supervision. The outcome of this preparatory meetings will guide and define the specific tasks for each international expert.
• In coordination with other experts, prepare a case scenario for the Table -Top Exercise.
• Based on their national expertise, regulations and best practices, the experts shall comment in an interactive way the interventions of Lebanon´s speakers in the first part of the activity dedicated to the detailed explanation and presentation of the legal, procedural and administrative current practices of digital forensics among Lebanese LEAs and justice institutions, assessing current challenges.
• Drafting of the Activity Report.

Deliverables and outputs of the mission for the international judicial expert

• Share all training curriculum and materials required for this activity.
• Draft Activity Report, according to the template provided, including specific recommendations for Lebanon´s partners.

NB: the deliverables are to be drafted in English.

B2) Tasks required for the international Law Enforcement experts in digital forensics: 3 experts

• Review of activity reports of 3.1.10 “Workshop on the Lawful Collection of Digital Evidence in line with human rights standards” and 2.1.11 “Assessment on the digital forensic investigation capacities achieved amongst law enforcement agencies”.
• Coordination and preparatory meetings with other international experts and the coordinator, attending this activity, prior to the arrival to Beirut, under the ACT Project supervision. The outcome of this preparatory meetings will guide and define the specific tasks for each international expert.
• Based on their national expertise, regulations and best practices, the experts shall comment in an interactive way the interventions of Lebanon´s speakers in the first part of the activity dedicated to the detailed explanation and presentation of the legal, procedural and administrative current practices of digital forensics among Lebanese LEAs and justice institutions, assessing current challenges.
• On second part of the activity, the table-top exercise, under the supervision of the ACT Project Team, experts shall:
  • Design and prepare practical cases (i.e., role-playing scenarios) based on their previous professional experience in digital forensics, cybercrime and cyber terrorism
  • Conduct the table-top exercise for the attendees
  • Feedback and comment on the solutions provided by the attendees for the exercises.

• Drafting the Activity Report.

Deliverables and outputs of the mission for the international experts in digital forensics

• Share all training curriculum and materials required for this activity.
• Draft Activity Report, according to the template provided, including specific recommendations for Lebanon´s partners.

NB: the deliverables are to be drafted in English.

3. National Speakers

Representatives of LEAs and judges with the following profiles:

• Ministry of Justice: judges and prosecutors,
• LEAS: Representatives from ISF, LAF, GS and SS specialised in digital forensics.

4. Attendees

• Representatives of the ACT Inter Ministerial Committee
• Judges/magistrates from the ministry of Justice or General Prosecutor Office;
• Representatives of the LEAs’ digital forensics units & labs;
• Cyber experts from other ministries;
• Representatives of academics (e.g., Faculty of law of the Lebanese University);
• Administrators and Managers from the Presidency of the Council of Ministers.

5. Agenda in Beirut (from Monday to Friday)

• Day 1: Preparation meetings with the ACT Project Team, the local coordinator and the stakeholders.
• Day 2: Final review of the presentations and practical cases of the table-top exercise
• Day 3 to 5: Workshop and Table-top exercise with all participants.
  • Day 3: Workshop. Plenary cross-presentation of participants’ respective procedures/tools on digital forensics investigation and lawful collection of digital evidence as part of the judicial process;
  • Day 4: Table-top exercise. Role-playing practical cases and scenarios in groups under the guidance of the trainers;
  • Day 5: Table-top exercise and conclusive workshop. Debriefing, lessons learned, identification of improvement actions and measures.

A table-top exercise is a facilitated discussion of a plan in an informal, stress-free environment. It is like a problem-solving or brainstorming session where participants share capabilities and solve problems as a group based on their organization's existing plans/procedures and the determined objectives of the exercise. Each practical case or role-playing scenario usually lasts between 1 and 4 hours.

Places of the mission

The mission will be held in Beirut, Lebanon.

Period of the mission

The mission will take place in July 2023 (first week)

Duration of the mission

The duration of the activity is estimated to 8 working days organised as follows: 3 days remote preparations for coordination of experts and preparation of the table-top exercise, prior to the arrival in Lebanon; and 5 working days in Beirut to the execution of the activity.

Financial aspects

The mobilized expert receives fees for each working day.

A working day can be invoiced if the expert spends at least seven working hours, excluding any break. STEs are bound by the rules on hours of work in force in the Lebanese administration.

5 - Required expertise

Qualifications and skills of the international Law Enforcement experts in digital forensics

Digital investigator from law enforcement agencies, specialised in digital forensics investigation and collection of digital evidence in counter terrorism or organised crime, cybercrime and cyber-terrorism.

Mastery of English is a must. Knowledge in other languages in use in Lebanon would be an asset (Arabic or French).

Degree in IT, cyber security, cyber forensics or other related matters, or equivalent expertise in the matter with more than 10 years, would be an asset.

General professional experience

At least 10 years of professional prosecutorial experience in criminal cases or in the fields of organised crime, international crime, cybercrime or cyber-terrorism.

Specific professional experience

At least 5 years of experience in digital forensics investigation, collection of digital evidence, penal procedure and international cooperation.

Proven experience in previous investigation in transnational terrorism or crime cases.

Professional experience in Counter Terrorism Central Units will be an asset.

Collaboration with Europol and Eurojust, will be an asset.

Participation in international projects/forums specialised in terrorism or cybercrime.