CYCLOPES attended the most recent EACTDA – Tools4LEAs – Demonstration & Evaluation Event at EUROPOL’s magnificent centre in a quiet leafy part of the Netherlands’ second capital city, Den Haag, on 24.01.2023.

“An ideal environment for the presentation, demonstration, and evaluation of the tools with the request for proactive and constructive criticism.”
EACTDA’s Business Manager

It was refreshing to hear the open and pragmatic approach presented by EACTDA’s Business Manager, Juan Arraiza Irujo, when kicking off the event.

Continuous improvement with multiple iterations is an effective recipe for success – commercial industry partners prove this repeatedly with their quarterly releases of enhanced functionality, security patches and innovations.

As Juan Arraiza Irujo also stated, ‘constructive criticism is an essential part of our continuous improvement culture’.

What is EACTDA?

The European Anti-Cybercrime Technology Development Association: focusing on the uptake of research and innovation results by EU public entities fighting cybercrime. EACTDA is funded by the European Commission via a Direct Award through the Internal Security Fund for Police. The first grant provided 2M Euro for 2 years and will be followed-up by additional funding to give continuity to their activities.

EACTDA’s aim is to “Deliver fully-tested and operational-ready tools to EU public entities fighting cybercrime with no license cost and with access to the source code”.

The first cycle was mostly spent cementing roots and providing a structure for continued – and stable – growth.

This started with establishing the core team, which EACTDA intends to maintain and not overly inflate in the coming years.

Secretariat > Business Manager / Capability Manager / Office Administrator / Tester-Developers x3

EACTDA also supports the development of your specialists through traineeship programmes with universities. The Deusto University partnership is the first programme established in the 2021-22 academic year and onwards. Another collaboration is planned with Kaunas University of Technology starting in the 2023-24 academic year.

To provide tools that meet the ambitious goals, it is obviously imperative to have a watertight IPR License Scheme, which was also a main focus.

IPR License Scheme

IPR initial version in place; to be updated with Europol’s feedback (details, here)

– IPR compliance > Software Bill of Materials (SBOM) analysis (what’s in the software) of pre-existing tools and of the final result.

-European Union Advisory Board (EUAB): setup and operation > outcome: a prioritised list of needs for new tooling.

Key Points

The team has obviously been working hard to establish firm standing in the EU research arena. EACTDA has initiated contact with circa 100 project coordinators and made links with other key networks and stakeholders, including EuCB, ECTEG, ENLETS, CEPOL, ENFSI, EARTO, EOS, APWG…

Read a Brief Overview of EACTDA’s Journey

The Event

Following a warm reception from EACTDA and EUROPOL, the 30+ practitioners attending from a range of European Law Enforcement Agencies, several of the 8 tools highlighted in the image above were introduced and reviewed.

Tools Presented and reviewed:

FiRST*: A first responder tool, used on live machines, encountered at search sites. FiRST checks the machine for signs of encryption or disk wiping software, cloud/network storage locations, virtualisation etc. – volatile data that may be lost if the machine is powered down and the post-mortem forensics may not be successful.

DeepThought*: Designed to conduct a forensic analysis/examination of many of the artefacts contained on digital media in an automated manner. Deep Thought focuses on the retrieval of images, movies, documents, web history, emails, chat, keyword searching and registry from allocated, deleted and unallocated space on computers and laptops.

VINOME*: Provide automated analysis of videos and images, with the goal of identifying similarities between distinctly different media files. Proving similarity is a much more difficult task than proving that two digital media files are identical.

ConFind: Targeted to investigators who need to know quickly if two entities (person, companies, phone number, bank accounts, IP addresses, etc.) are connected in some way. ConFind can answer this extremely fast, even in large databases. If they are connected, the connecting path, i.e., the sequence of links (relationships) providing the connection is shown.

FREETOOL’s Role

*Along with FiRST, DeepThought and VINOME, several other tools were also introduced by the FREETOOL manager, Michael O’Callaghan of the UCD Centre for Cybersecurity & Cybercrime Investigation (UCD-CCI), coordinator of the FREETOOL initiative that works in close connection with EACTDA and Tools4LEAs.

FREETOOL is an EU-funded project (Grant Agreement no: 821947) that began in 2012. The project’s goal was to address the need for customised cybercrime tools, developed by law enforcement for law enforcement. These tools are then distributed to law enforcement free of charge.

FREETOOL had three iterations of funding, the last of which ended in January 2022. FREETOOL is managed by UCD Centre for Cybersecurity & Cybercrime Investigation (UCD-CCI). Some FREETOOL applications are now being developed as part of the Tools4LEAs project coordinated by EACTDA. The Tools4LEAs project aims at establishing a long-term and sustainable structure that regularly delivers tools ready to be used at an operational level by European public security practitioners.

Currently, there are 6 FREETOOL applications being developed under the Tools4LEAs project: Roast Lamb, Deepthought, FiRST, VINOME, H@X and FoBro. In June 2023, major upgrades to these tools will be tested, evaluated and then released to European public security practitioners. The current version of these tools are available on the FREETOOL Hub.

Thoughts on the Event

Clearly, it is not feasible or practical to fully test and review multiple tools in one day – not forgetting the general progress updates. However, this was never EACTDA’s intention.

The session was a useful opportunity to get critical feedback on key functions that are missing and any serious obstacles with the tools’ graphical interfaces, installation processes, etc. Essentially, the meeting was the perfect chance to whet LEAs’ appetites. In this vein, they were encouraged to volunteer for more in-depth analyses and testing post event.

A Sustainable Model?

Yes. The idea and approach to EACTDA make perfect sense. With limited budgets and issues procuring commercial tooling an ever-present challenge across the EU – particularly with smaller agencies – providing solutions to LEAs on a low-cost, easy-access model is the perfect solution.

However, to allow the system to flourish, it will take the combined effort of LEAs – particularly management teams to encourage and support the concept, providing the necessary energy and resources to allow it to mature and expand.

A Silver Bullet?

We need to keep our feet firmly on the ground. Although EACTDA’s approach provides much potential when we consider the gamut of tools required to counter the considerable spectrum of modern crimes. This model only provides one tactic in a much broader strategy required to empower LEAs to attract and maintain the talent and resources required to tackle tech-savvy modern criminals and complex crimes.

The LEA community requires significant investment in people and processes, and procedural changes are required (particularly legal) to permit LEAs to balance the scales in the fight to reduce crime and its consequences.

Capacity Building: EACTDA Part of the Puzzle