Gathering digital evidence by the EU Commission in inspections Dirk VAN ERPS Head of Unit Cartels II Forensic IT Project Manager Madrid, 5 July 2013

Digital Evidence Gathering: Powers Reg. 1/2003, Art. 20, 2: "The officials […] are empowered: (b) to examine the books and other records related to the business irrespective of the medium on which they are stored; (c) to take or obtain in any form copies of or extracts from such books or records"

Digital Evidence Gathering: Powers Means: We can look at electronic documents We can make electronic copies of (electronic or paper) documents (see point 9 of Explanatory Note)

Digital Evidence Gathering: Powers DG Comp has started in April 2013 to take systematically electronic copies of electronic documents; DG Comp is planning to make electronic copies (scans) of paper documents; one test in June 2013

The revised Explanatory Note What for: - provide transparency to company, kind of FAQ - handed over to company representative at start of inspection - available on internet For information only and without prejudice to formal interpretation of powers of investigation

Clarifications in 18 March 2013 version - provides examples on company's IT environment and storage media that can be searched: "laptops, desktops, tablets, mobile phones, CD-Roms, DVDs, USB-key and so on" (point 10) - reference to 'obligation to cooperate fully and actively with the inspection' (point 11) - more examples stemming from this: -"explaining organisation and IT environment"

Clarifications in 18 March 2013 version "temporarily disconnecting running computers from network, removing and re-installing hard drives from computers and providing 'administrator access rights'-support" Possibility to use company hardware (that is not wiped at the end by Commission) (pt 11) Inspectors can keep storage media until end of inspection but may return earlier after having made forensic copy of data (pt 12)

Clarifications in 18 March 2013 version Commission cleanses all Commission data carriers used to transfer data at end of inspection (pt 13) Revised Note to coincide with introduction of new workflow

Previous Workflow IT Inspector Company Computer No Dedicated Search Tools DG COMP FIT Laptop Forensic Software FIT Inspector 9

New Workflow IT Inspector Nuix Operator FIT Inspector Nuix Reviewers 10

Digital review method has not changed Possible relevant documents are 'collected' (no systematic 'imaging' of entire content, but still forensic copy from laptops/desktops) Possible relevant documents are indexed Possible relevant documents are reviewed, now on a 'platform' basis Commission official decides whether document is relevant Company receives list and copy of relevant documents

Digital review method has not changed In principle, review is done on the spot, on the basis of the content of the individual document, by a Commission official (in the presence of company representative) Sealed envelope (or 'continued inspection') procedure remains exceptional: Less than 10% of cases Often on request of company (as 'Nuix' was not available on site)

We are not obliged to Define the relevance of a document on the basis of a Commission pair of eyes looking at the individual document (but we do) Describe our interpretation of our rights (but we do – transparency via Inspection Explanatory Note) Describe our workflow and our tools (but we do – article and presentation as this one) Cleanse/Sanitise/Wipe our tools at the end of the inspection (but we do)

Legal issues Location of server: irrelevant: what is available to company staff is available to Commission official LPP: can be excluded from 'search data' and reviewed separately between Team leader and company representative Keywords: are not provided as they are only 'intelligence' helping to define possible individual relevant documents (that are provided) Chain of custody: company signs 'document list' that identifies individual documents by path file and name and Hash Value for entire collection

Legal issues 'Continued inspection' or 'sealed envelope' procedure: Nexans/Prysmian challenge: General Court: measure implementing inspection decision; not separable act Personal Data: we process in compliance with Reg. 45/2001 applicable to Commission, but no hindrance to obtain the data No procedural harmonisation within ECN but exchange of practices and experience in ECN Forensic IT Working Group

DEMO Presentation of the Demo CD that is provided to inspected company at start of inspection to explain procedure

The End Thank you Any further questions? Dirk.Van-Erps@ec.europa.eu * The views expressed are personal and do not commit the Commission