Forensic Institute provides Hansken viewing method for Dutch lawyers

The Netherlands Forensic Institute (NFI), in cooperation with the police and the Public Prosecution Service, has developed a method that allows lawyers in criminal cases to view crypto communication, such as EncroChat, from their own offices via the digital search engine, Hansken. 

Previously, lawyers had to go to the police station to access digital police files, according to NFI digital forensics researcher Harm van Beek, who co-founded Hansken and was involved in the development of the new viewing method. “Not only was accessing a digital police file time-consuming for lawyers because they had to physically travel for it, but their search terms could also be logged, making it clear what they had searched for,” he said. “That was undesirable.”

In 2018, that situation led to a copy of the dataset being deposited in a remote location at the NFI, where lawyers could access data. “But that still didn’t solve the travel problem,” said Van Beek. “Moreover, we at the NFI are not actually set up to facilitate this. Nor is it our role in criminal cases to offer inspection, but it was clear the need was there for the NFI to join forces with the police and the Public Prosecution Service to look for possible solutions.

“In various court rulings and in the media, there was and still is a discussion about the right of access and what exactly may be viewed,” he said. “For example, it is important that all communications covered by the right to privilege are filtered out.”

This means that communications between a lawyer and his client may not be used in an investigation. “When the police seize a phone, that data may be in there,” said Van Beek. “That’s why we applied that filtering to Hansken as well.”

Early this year, three Dutch law firms tested the method in a pilot. It not only saves the lawyers travel and time, but also offers them more flexibility. The new process is said to provide access to datasets of crypto communications from Ennetcom, PGP Safe, and EncroChat, but will soon be extended to SkyECC.

“Data is stored in different ways and in different locations, which means we have to build separate tooling for each form of crypto communication to convert the data into insightful information that an investigator can actually search,” said Van Beek. “Moreover, we are dealing with increasingly large data sets for which we also need the hardware and computing power to process that data properly.”

Data search 

The Hansken digital platform is now used in over a thousand criminal cases, and that number is growing. “People are collecting more and more digital data,” said Van Beek.

“Not only can phones store more and more data, devices like cars, energy meters and smartwatches do, too. This contains potentially interesting data for criminal cases, but the tricky thing is that it is enormously difficult to find that one relevant email, chat message or text message in that huge amount of data.”

Together with his colleagues, he designed and developed search engine Hansken several years ago. “That is a digital forensic investigation platform in which all the data available in a case can be uploaded,” said Van Beek. “In addition, it is a great search index where you can search by keywords just like in Google. Thus, potentially incriminating but equally exculpatory evidence can be obtained.”

In a news item on the NFI’s website, one of the lawyers who was allowed to test Hansken’s new inspection method in recent months is quoted.

“This marks a major and important step in actually facilitating the inspection capabilities that the defence should have in criminal cases,” said Van Beek. “The access function works easily, provides an overview of the available data, and offers all the options that are also available when visiting the NFI.” 

He understands the convenience the lawyer is referring to. “Lawyers like to have access to Hansken just before a trial, but because they depend on scheduling an appointment to visit the police station or the NFI to do so, in practice, this is often not easy,” said Van Beek. “That was one of the reasons for developing the method so that they can access the data from their own workplace at their convenience.”

Long-term solution 

The lawyers can only view data in Hansken and not save, print, or copy it. “And at the lawyers’ request, no usage data is recorded, so the searches they perform cannot be viewed by the prosecution, police or NFI,” said Van Beek.

The dataset that lawyers can view is a copy of the dataset held by the police. Each investigative body has its own dataset in the Hansken platform. This is not ideal, which is why Van Beek and his colleagues are continuing to build and upgrade the new access method

“This is a temporary solution for this year and next,” he said. “By then, we hope to have devised and implemented a long-term solution. The main improvement is that we will then no longer want multiple copies of datasets.

“In some criminal cases, there is a couple of terabytes of data held by the police or FIOD,” said Van Beek. “To offer access to lawyers, it is necessary to deposit that dataset with the NFI as well. You can imagine that it is a hugely labour-intensive process to copy that, but also that the necessary hardware has to be available for that. That makes it quite an expensive solution and also error-prone. We are working on a way to offer direct access to the dataset from the police or Fiscal Information and Investigation Service that takes into account the wishes and requirements of the lawyers.” 

Artificial intelligence 

That is far from the only thing that is being worked on in Hansken. A team of more than 40 developers works on the system on a daily basis, and Van Beek has been experimenting with a colleague to gauge the possibilities of artificial intelligence.  

“We put a ChatGPT-like application on top of Hansken to see how this technology may help make data insightful,” he said. Although this research is in a very early stage, Van Beek described the results of those experiments promising.

“You can prompt a specific search query, for example, ‘Give me a list of all emails in a certain date range in which the name Jan appears’,” he said. “But what is interesting is that you can also ask the system to provide a summary of all people’s communications and roles in a chat. That can save a lot of time and provide insights that a human might have overlooked.”

The challenge of AI for Hansken lies in reproducibility, traceability and explainability. “AI is beneficial to assist case investigators with finding potential evidence more quickly,” said Van Beek.

“Results of forensic investigations, however, should always be reproducible, traceable and explainable. These are the requirements that apply to evidence in criminal cases and, therefore, also to all information coming out of Hansken.

“Current AI technology is not yet sufficiently explainable; it is not always clear how a system arrives at its findings,” he said. “Moreover, two identical search queries can yield two different results, which makes it not reproducible. For the time being, we are leaning on other techniques for digital forensic reporting, which requires good interpretation of data.”