1. Gathering digital evidence by the EU Commission in inspections
Dirk VAN ERPS
Head of Unit Cartels II
Forensic IT Project Manager
Madrid, 5 July 2013

2. Digital Evidence Gathering: Powers
Reg. 1/2003, Art. 20, 2:
"The officials […] are empowered:
(b) to examine the books and other records related to the business irrespective of the medium on which they are stored;
(c) to take or obtain in any form copies of or extracts from such books or records"

3. Digital Evidence Gathering: Powers
Means:
We can look at electronic documents
We can make electronic copies of (electronic or paper) documents
(see point 9 of Explanatory Note)

4. Digital Evidence Gathering: Powers
DG Comp has started in April 2013 to take systematically electronic copies of electronic documents;
DG Comp is planning to make electronic copies (scans) of paper documents; one test in June 2013

5. The revised Explanatory Note
What for:
- provide transparency to company, kind of FAQ
- handed over to company representative at start of inspection
- available on internet
For information only and without prejudice to formal interpretation of powers of investigation

6. Clarifications in 18 March 2013 version
- provides examples on company's IT environment and storage media that can be searched: "laptops, desktops, tablets, mobile phones, CD-Roms, DVDs, USB-key and so on" (point 10)
- reference to 'obligation to cooperate fully and actively with the inspection' (point 11)
- more examples stemming from this: -"explaining organisation and IT environment"

7. Clarifications in 18 March 2013 version
"temporarily disconnecting running computers from network, removing and re-installing hard drives from computers and providing 'administrator access rights'-support"
Possibility to use company hardware (that is not wiped at the end by Commission) (pt 11)
Inspectors can keep storage media until end of inspection but may return earlier after having made forensic copy of data (pt 12)

8. Clarifications in 18 March 2013 version
Commission cleanses all Commission data carriers used to transfer data at end of inspection (pt 13)
Revised Note to coincide with introduction of new workflow

9. Previous Workflow IT Inspector
Company Computer No Dedicated Search Tools
DG COMP FIT Laptop Forensic Software
FIT Inspector 9

10. New Workflow IT Inspector Nuix Operator FIT Inspector Nuix Reviewers10

11. Digital review method has not changed
Possible relevant documents are 'collected' (no systematic 'imaging' of entire content, but still forensic copy from laptops/desktops)
Possible relevant documents are indexed
Possible relevant documents are reviewed, now on a 'platform' basis
Commission official decides whether document is relevant
Company receives list and copy of relevant documents

12. Digital review method has not changed
In principle, review is done on the spot, on the basis of the content of the individual document, by a Commission official (in the presence of company representative)
Sealed envelope (or 'continued inspection') procedure remains exceptional:
Less than 10% of cases
Often on request of company (as 'Nuix' was not available on site)

13. We are not obliged to
Define the relevance of a document on the basis of a Commission pair of eyes looking at the individual document (but we do)
Describe our interpretation of our rights (but we do – transparency via Inspection Explanatory Note)
Describe our workflow and our tools (but we do – article and presentation as this one)
Cleanse/Sanitise/Wipe our tools at the end of the inspection (but we do)

14. Legal issues
Location of server: irrelevant: what is available to company staff is available to Commission official
LPP: can be excluded from 'search data' and reviewed separately between Team leader and company representative
Keywords: are not provided as they are only 'intelligence' helping to define possible individual relevant documents (that are provided)
Chain of custody: company signs 'document list' that identifies individual documents by path file and name and Hash Value for entire collection

15. Legal issues
'Continued inspection' or 'sealed envelope' procedure: Nexans/Prysmian challenge: General Court: measure implementing inspection decision; not separable act
Personal Data: we process in compliance with Reg. 45/2001 applicable to Commission, but no hindrance to obtain the data
No procedural harmonisation within ECN but exchange of practices and experience in ECN Forensic IT Working Group

16. DEMO
Presentation of the Demo CD that is provided to inspected company at start of inspection to explain procedure

17. The End Thank you Any further questions? Dirk.Van-Erps@ec.europa.eu
* The views expressed are personal and do not commit the Commission