Short-term expert - International Law Enforcement expert in digital forensics

ppA continuous dialogue between the European Union and Lebanon has been focusing, for several years, on security and counter-terrorism. Aligned with the European Neighborhood Policy and the European Union Global Strategy on Foreign and Security Policy, an agreed roadmap addresses the areas of counter-terrorism, justice and law enforcement, countering terrorism financing and violent extremism, among others. /ppbr/The project “Advance Counter Terrorism for Lebanon security” ) aims at contributing to improved citizens security against terrorism based on rule of law and human rights. /ppbr/Three specific objectives are pursued:br/SO 1: Improved national response against terrorism in line with international standardsbr/SO 2: Improved cyber-security and protection and response against cyber-terrorismbr/SO 3: Improved application of rights-based approach to Counter Terrorism (CT)/ Violent Extremism (VE) cases by law enforcement officials and Courts. /ph3Description of the assignment /h3pbBackground /b /ppThe promotion and protection of human rights while countering terrorism requires specific actions aiming at generating awareness to the main investigation and prosecution actors while dealing with CT cases. To that end, output b3.1 aims at strengthening the capacities of CT specialised institutions on rights-based criminal investigation and prosecution in Lebanon. /b /ppA series of trainings are intended to ensure that counter-terrorism measures during the investigation and prosecution stages are based in law, pursue a legitimate objective, and are proportionate to prevent abuse and human rights violations of persons impacted by such measures, including those suspected or accused of acts of terrorism. /ppCT specialised institutions must know how to manage digital evidence during judicial process and international expertise will provide know how on the Budapest Convention on Cybercrime with the aim of securing electronic evidence in relation to any crime. /ppAlthough Lebanon is not signatory of the Budapest Convention, a new law on e-transactions and data protection was adopted in October 2018 (Law 81), which is inspired and based on this Convention. Representatives of the judiciary requested the ACT project to deliver a training course on both the Budapest Convention and Law 81 (by a local expert), with the aim of improving the knowledge and application of the national regulation which results essential in protecting the rights of the accused while ensuring the protection and compliance of the chain of custody of digital evidence. This training was held on 24-25 November 2023, and based on its conclusions and recommendations, a follow up activity was necessary to enhance the coordination between judges and LEAs in the lawful collection of digital evidence in line with HR standards combined with a table-top exercise in digital forensics investigation and prosecution. /ppbAn assessment on the digital forensic investigation capacities /b within the Law Enforcement Agencies (LEAs), was conducted in October 2021, which highlighted the following points, among others: /pulliIn an ever-evolving digital world, where cybercrime adapts itself every day, Lebanese LEAs need to increase their capacities at the same pace as cybercriminals and terrorists do; /liliTo avoid duplication of efforts and promote best practices and to share work, Lebanese LEAs shall meet and exchange more information with each other; /liliAwareness-raising is necessary for LEAs managers to better understand cybercrime challenges and help them to make decisions in terms of budget, equipment, international cooperation, public-private partnership, as well as for judges/magistrates to better understand new cybercrime methods and raise precise questions on real-case difficulties to identify possible loopholes of the law and initiate a reflection on possible further law update. /li /ulpTo this end, trainings on crypto currencies, e-evidence and dark web have been carried out for the benefit of the LEAs digital forensic units and judges of the General Prosecutor Office and ministry of Justice. An advanced training on crypto currencies is planned from 5 to 9 June 2023. /ppRegarding cybersecurity and information security, a comprehensive training programme has been performed, since 2021, to the cybersecurity staff of the LEAs, regal ministries (including ministry of Justice), Banque du Liban, telecommunication sector and Lebanese University, in risk assessment, crisis management and SOPs, cyber threat intelligence, cyber incident detection, etc. /ppAlso, a study visit on cyber security and digital forensics topics was deployed in April 2023 to the Carabinieri’s Digital Forensic Units and Labs (Rome, Italy); Europol and Eurojust HQs (The Hague, Netherlands); The International Cybersecurity Forum (Lille, France); The National Digital Forensics Training Center of the French Ministry of the Interior (Lille, France). The Lebanese delegation was composed of officials from the LEAs and of judges from the ministry of Justice. /ppThese capacity building activities have allowed the participants to achieve a level of maturity in cyber security and digital forensics. /ppObjective /ppThe main objective of this activity is to provide a thorough and exhaustive understanding of Lebanese Law 81, and other related laws, and improve the coordination process between judges and law enforcement agencies in the lawful collection of digital evidence as part of the judicial process (including valid seizure, incorporation into the procedure, expert analysis etc.). All this in line with EU best practices, namely the Budapest Convention and while addressing the difficulties and legal challenges of this process for both the judiciary and LEAs. /ppTo this end, this activity will include one first part dedicated to detailed explanation and presentation of the legal, procedural and administrative current practices of digital forensics among Lebanese LEAs and justice institutions, assessing current challenges. A second part of the activity will address a table-top exercise aiming at enhancing the coordination process between judges and law enforcement agencies, through practical cases related to cybercrime and cyber-terrorism allowing them to better understand their respective capabilities, issues and needs as regards technical investigation and judicial prosecution, and to identify areas for improvement, procedures to be developed, possible further law update. /ppLocal ownership will be the guiding principle of this activity by letting the main Lebanese actors on digital forensics share their legal and administrative procedural practices, especially related to Law 81, and its modus operandi. International experts will accompany the local counterparts, commenting and sharing feedback based on EU standards. /ppExpected result /ppJ udges and LEAs officials involved in the entire digital forensic process (lawful collection, custody and analysis of digital evidence, etc) will identify the existing coordination gaps while enhancing their coordination process. This activity will grant a better shared understanding of their respective capabilities in digital investigation and prosecution that will open the door for developing standard operating procedures in line with the Lebanese law. /ph3Course of the assignment /h3pThe activity will be carried out in Beirut by a steering group of local and international experts in the framework of a series of trainings led by ACT project . The workshop on the coordination between judges and LEAs in the lawful collection of digital evidence in line with HR standards (component 3) will be combined with a table-top exercise (1) in digital forensics investigation and prosecution (component 2) in a joint activity. /ppThe following expert profiles are required for this activity: /pulliCoordinator: one local expert; /liliEU Judicial Expert (judge): one international expert; /liliEU Digital Forensics Expert: three international experts from the Consortium members (one each). /lilibCoordinator of the activity /b /li /ulpOne local expert is required to assume to overall coordination of the activity and present in details the Lebanese Law 81 and related laws. The coordinator shall work closely with the ACT Project Team based in Beirut, and the international experts and local stakeholders in the preparations of the activity, content and implementation of the activity. /ppTasks required for the Activity Coordinator, under the supervision of the ACT Project: /pulliPreparatory meeting with the ACT Institutional Coordinator and the Project Team. /liliReview of the activity report of 3.1.10 and its assessment to follow up on the conclusions and recommendations. /liliCoordination of the activity and preparation of training materials /liliPresentation of Law 81 and related laws. /liliCoordination with international experts and local stakeholders /liliCoordinate the preparation of case studies and overview of best practices with international experts, local speakers, ACT Facilitator and ACT Project Experts. /li /ulpDeliverables and outputs of the mission for the Activity Coordinator /pulliPreparation of material and case studies. /liliActivity report (according to the templated provided). /li /ulpNB: the deliverables are to be drafted in English. /pullibInternational Experts: 4 /b /li /ulpThe international experts are requested to travel to Lebanon to participate in this activity. Prior to the workshop, some preparatory work will be necessary for the finalisation of the table-top exercise in coordination with the rest of the steering group. /ppThe international experts with proven experience in the custody, collection and the use of digital evidence during the investigation and prosecution process, as well as in digital forensics investigation in the fields of organised crime, cybercrime and cyber-terrorism, will provide expertise on the best practices/feedback based on national/EU law and professional experience in comparison with the Lebanese law and investigation and prosecution practices. /ppTwo profiles of international experts are required: /pulliOne judicial expert (judge); from a specialised national court on terrorism /liliThree Law Enforcement Agents with technical background on digital evidence and forensics. /li /ulpB1) Tasks required for the international judicial expert: 1 expert (judge) /pulliPreparatory meeting with the ACT Institutional Coordinator and the Project Team. /liliReview of activity reports of 3.1.10 “Workshop on the Lawful Collection of Digital Evidence in line with human rights standards” and 2.1.11 “Assessment on the digital forensic investigation capacities achieved amongst law enforcement agencies”. /liliCoordination and preparatory meetings with other international experts and the coordinator, attending this activity, prior to the arrival to Beirut, under the ACT Project supervision. The outcome of this preparatory meetings will guide and define the specific tasks for each international expert. /liliIn coordination with other experts, prepare a case scenario for the Table -Top Exercise. /liliBased on their national expertise, regulations and best practices, the experts shall comment in an interactive way the interventions of Lebanon´s speakers in the first part of the activity dedicated to the detailed explanation and presentation of the legal, procedural and administrative current practices of digital forensics among Lebanese LEAs and justice institutions, assessing current challenges. /liliDrafting of the Activity Report. /li /ulpDeliverables and outputs of the mission for the international judicial expert /pulliShare all training curriculum and materials required for this activity. /liliDraft Activity Report, according to the template provided, including specific recommendations for Lebanon´s partners. /li /ulpNB: the deliverables are to be drafted in English. /ppB2) Tasks required for the international Law Enforcement experts in digital forensics: 3 experts /pulliReview of activity reports of 3.1.10 “Workshop on the Lawful Collection of Digital Evidence in line with human rights standards” and 2.1.11 “Assessment on the digital forensic investigation capacities achieved amongst law enforcement agencies”. /liliCoordination and preparatory meetings with other international experts and the coordinator, attending this activity, prior to the arrival to Beirut, under the ACT Project supervision. The outcome of this preparatory meetings will guide and define the specific tasks for each international expert. /liliBased on their national expertise, regulations and best practices, the experts shall comment in an interactive way the interventions of Lebanon´s speakers in the first part of the activity dedicated to the detailed explanation and presentation of the legal, procedural and administrative current practices of digital forensics among Lebanese LEAs and justice institutions, assessing current challenges. /liliOn second part of the activity, the table-top exercise, under the supervision of the ACT Project Team, experts shall:ulliDesign and prepare practical cases (i.e., role-playing scenarios) based on their previous professional experience in digital forensics, cybercrime and cyber terrorism /liliConduct the table-top exercise for the attendees /liliFeedback and comment on the solutions provided by the attendees for the exercises. /li /ul /liliDrafting the Activity Report. /li /ulpDeliverables and outputs of the mission for the international experts in digital forensics /pulliShare all training curriculum and materials required for this activity. /liliDraft Activity Report, according to the template provided, including specific recommendations for Lebanon´s partners. /li /ulpNB: the deliverables are to be drafted in English. /pullibNational Speakers /b /li /ulpRepresentatives of LEAs and judges with the following profiles: /pulliMinistry of Justice: judges and prosecutors, /liliLEAS: Representatives from ISF, LAF, GS and SS specialised in digital forensics. /liliRepresentatives of the ACT Inter Ministerial Committee /liliJudges/magistrates from the ministry of Justice or General Prosecutor Office; /liliRepresentatives of the LEAs’ digital forensics units labs; /liliCyber experts from other ministries; /liliRepresentatives of academics (e.g., Faculty of law of the Lebanese University); /liliAdministrators and Managers from the Presidency of the Council of Ministers. /lilibAgenda in Beirut (from Monday to Friday) /b /li /ulpDay 1: Preparation meetings with the ACT Project Team, the local coordinator and the stakeholders. /ppDay 2: Final review of the presentations and practical cases of the table-top exercise /ppDay 3 to 5: Workshop and Table-top exercise with all participants. /pulliDay 3: Workshop. Plenary cross-presentation of participants’ respective procedures/tools on digital forensics investigation and lawful collection of digital evidence as part of the judicial process; /liliDay 4: Table-top exercise. Role-playing practical cases and scenarios in groups under the guidance of the trainers; /liliDay 5: Table-top exercise and conclusive workshop. Debriefing, lessons learned, identification of improvement actions and measures. /li /ul pA table-top exercise is a facilitated discussion of a plan in an informal, stress-free environment. It is like a problem-solving or brainstorming session where participants share capabilities and solve problems as a group based on their organization's existing plans/procedures and the determined objectives of the exercise. Each practical case or role-playing scenario usually lasts between 1 and 4 hours. /ph3Location, duration and financing of the assignment /h3pPlaces of the mission /ppThe mission will be held in Beirut, Lebanon. /ppPeriod of the mission /ppThe mission will take place in July 2023 (first week) /ppDuration of the mission /ppThe duration of the activity is estimated to 8 working days organised as follows: 3 days remote preparations for coordination of experts and preparation of the table-top exercise, prior to the arrival in Lebanon; and 5 working days in Beirut to the execution of the activity. /ppThe mobilized expert receives fees for each working day. /p pA working day can be invoiced if the expert spends at least seven working hours, excluding any break. STEs are bound by the rules on hours of work in force in the Lebanese administration. /pp5 - Required expertise /ppbQualifications and skills of the international Law Enforcement experts in digital forensics /b /ppDigital investigator from law enforcement agencies, specialised in digital forensics investigation and collection of digital evidence in counter terrorism or organised crime, cybercrime and cyber-terrorism. /ppMastery of English is a must. Knowledge in other languages in use in Lebanon would be an asset (Arabic or French). /ppDegree in IT, cyber security, cyber forensics or other related matters, or equivalent expertise in the matter with more than 10 years, would be an asset. /ppGeneral professional experience /ppAt least 10 years of professional prosecutorial experience in criminal cases or in the fields of organised crime, international crime, cybercrime or cyber-terrorism. /ppSpecific professional experience /ppAt least 5 years of experience in digital forensics investigation, collection of digital evidence, penal procedure and international cooperation . /ppProven experience in previous investigation in transnational terrorism or crime cases. /ppProfessional experience in Counter Terrorism Central Units will be an asset. /ppCollaboration with Europol and Eurojust, will be an asset. /ppParticipation in international projects/forums specialised in terrorism or cybercrime. /p /p #J-18808-Ljbffr