A continuous dialogue between the European Union and Lebanon has been focusing, for several years, on security and counter-terrorism. Aligned with the European Neighborhood Policy and the European Union Global Strategy on Foreign and Security Policy, an agreed roadmap addresses the areas of counter-terrorism, justice and law enforcement, countering terrorism financing and violent extremism, among others.
The project “Advance Counter Terrorism for Lebanon security” (2020-2023) aims at contributing to improved citizens security against terrorism based on rule of law and human rights.
Three specific objectives are pursued:
SO 1: Improved national response against terrorism in line with international standards
SO 2: Improved cyber-security and protection and response against cyber-terrorism
SO 3: Improved application of rights-based approach to Counter Terrorism (CT)/ Violent Extremism (VE) cases by law enforcement officials and Courts.
Background
The promotion and protection of human rights while countering terrorism requires specific actions aiming at generating awareness to the main investigation and prosecution actors while dealing with CT cases. To that end, output 3.1 aims at strengthening the capacities of CT specialised institutions on rights-based criminal investigation and prosecution in Lebanon.
A series of trainings are intended to ensure that counter-terrorism measures during the investigation and prosecution stages are based in law, pursue a legitimate objective, and are proportionate to prevent abuse and human rights violations of persons impacted by such measures, including those suspected or accused of acts of terrorism.
CT specialised institutions must know how to manage digital evidence during judicial process and international expertise will provide know how on the Budapest Convention on Cybercrime with the aim of securing electronic evidence in relation to any crime.
Although Lebanon is not signatory of the Budapest Convention, a new law on e-transactions and data protection was adopted in October 2018 (Law 81), which is inspired and based on this Convention. Representatives of the judiciary requested the ACT project to deliver a training course on both the Budapest Convention and Law 81 (by a local expert), with the aim of improving the knowledge and application of the national regulation which results essential in protecting the rights of the accused while ensuring the protection and compliance of the chain of custody of digital evidence. This training was held on 24-25 November 2023, and based on its conclusions and recommendations, a follow up activity was necessary to enhance the coordination between judges and LEAs in the lawful collection of digital evidence in line with HR standards combined with a table-top exercise in digital forensics investigation and prosecution.
An assessment on the digital forensic investigation capacities within the Law Enforcement Agencies (LEAs), was conducted in October 2021, which highlighted the following points, among others:
To this end, trainings on crypto currencies, e-evidence and dark web have been carried out for the benefit of the LEAs digital forensic units and judges of the General Prosecutor Office and ministry of Justice. An advanced training on crypto currencies is planned from 5 to 9 June 2023.
Regarding cybersecurity and information security, a comprehensive training programme has been performed, since 2021, to the cybersecurity staff of the LEAs, regal ministries (including ministry of Justice), Banque du Liban, telecommunication sector and Lebanese University, in risk assessment, crisis management and SOPs, cyber threat intelligence, cyber incident detection, etc.
Also, a study visit on cyber security and digital forensics topics was deployed in April 2023 to the Carabinieri’s Digital Forensic Units and Labs (Rome, Italy); Europol and Eurojust HQs (The Hague, Netherlands); The International Cybersecurity Forum (Lille, France); The National Digital Forensics Training Center of the French Ministry of the Interior (Lille, France). The Lebanese delegation was composed of officials from the LEAs and of judges from the ministry of Justice.
These capacity building activities have allowed the participants to achieve a level of maturity in cyber security and digital forensics.
Objective
The main objective of this activity is to provide a thorough and exhaustive understanding of Lebanese Law 81, and other related laws, and improve the coordination process between judges and law enforcement agencies in the lawful collection of digital evidence as part of the judicial process (including valid seizure, incorporation into the procedure, expert analysis etc.). All this in line with EU best practices, namely the Budapest Convention and while addressing the difficulties and legal challenges of this process for both the judiciary and LEAs.
To this end, this activity will include one first part dedicated to detailed explanation and presentation of the legal, procedural and administrative current practices of digital forensics among Lebanese LEAs and justice institutions, assessing current challenges. A second part of the activity will address a table-top exercise aiming at enhancing the coordination process between judges and law enforcement agencies, through practical cases related to cybercrime and cyber-terrorism allowing them to better understand their respective capabilities, issues and needs as regards technical investigation and judicial prosecution, and to identify areas for improvement, procedures to be developed, possible further law update.
Local ownership will be the guiding principle of this activity by letting the main Lebanese actors on digital forensics share their legal and administrative procedural practices, especially related to Law 81, and its modus operandi. International experts will accompany the local counterparts, commenting and sharing feedback based on EU standards.
Expected result
J udges and LEAs officials involved in the entire digital forensic process (lawful collection, custody and analysis of digital evidence, etc) will identify the existing coordination gaps while enhancing their coordination process. This activity will grant a better shared understanding of their respective capabilities in digital investigation and prosecution that will open the door for developing standard operating procedures in line with the Lebanese law.
The activity will be carried out in Beirut by a steering group of local and international experts in the framework of a series of trainings led by ACT project . The workshop on the coordination between judges and LEAs in the lawful collection of digital evidence in line with HR standards (component 3) will be combined with a table-top exercise [1] in digital forensics investigation and prosecution (component 2) in a joint activity.
The following expert profiles are required for this activity:
One local expert is required to assume to overall coordination of the activity and present in details the Lebanese Law 81 and related laws. The coordinator shall work closely with the ACT Project Team based in Beirut, and the international experts and local stakeholders in the preparations of the activity, content and implementation of the activity.
Tasks required for the Activity Coordinator, under the supervision of the ACT Project:
Deliverables and outputs of the mission for the Activity Coordinator
NB: the deliverables are to be drafted in English.
The international experts are requested to travel to Lebanon to participate in this activity. Prior to the workshop, some preparatory work will be necessary for the finalisation of the table-top exercise in coordination with the rest of the steering group.
The international experts with proven experience in the custody, collection and the use of digital evidence during the investigation and prosecution process, as well as in digital forensics investigation in the fields of organised crime, cybercrime and cyber-terrorism, will provide expertise on the best practices/feedback based on national/EU law and professional experience in comparison with the Lebanese law and investigation and prosecution practices.
Two profiles of international experts are required:
B1) Tasks required for the international judicial expert: 1 expert (judge)
Deliverables and outputs of the mission for the international judicial expert
NB: the deliverables are to be drafted in English.
B2) Tasks required for the international Law Enforcement experts in digital forensics: 3 experts
Deliverables and outputs of the mission for the international experts in digital forensics
NB: the deliverables are to be drafted in English.
Representatives of LEAs and judges with the following profiles:
Day 1: Preparation meetings with the ACT Project Team, the local coordinator and the stakeholders.
Day 2: Final review of the presentations and practical cases of the table-top exercise
Day 3 to 5: Workshop and Table-top exercise with all participants.
A table-top exercise is a facilitated discussion of a plan in an informal, stress-free environment. It is like a problem-solving or brainstorming session where participants share capabilities and solve problems as a group based on their organization's existing plans/procedures and the determined objectives of the exercise. Each practical case or role-playing scenario usually lasts between 1 and 4 hours.
Places of the mission
The mission will be held in Beirut, Lebanon.
Period of the mission
The mission will take place in July 2023 (first week)
Duration of the mission
The duration of the activity is estimated to 8 working days organised as follows: 3 days remote preparations for coordination of experts and preparation of the table-top exercise, prior to the arrival in Lebanon; and 5 working days in Beirut to the execution of the activity.
The mobilized expert receives fees for each working day.
A working day can be invoiced if the expert spends at least seven working hours, excluding any break. STEs are bound by the rules on hours of work in force in the Lebanese administration.
5 - Required expertise
Qualifications and skills of the international Law Enforcement experts in digital forensics
Digital investigator from law enforcement agencies, specialised in digital forensics investigation and collection of digital evidence in counter terrorism or organised crime, cybercrime and cyber-terrorism.
Mastery of English is a must. Knowledge in other languages in use in Lebanon would be an asset (Arabic or French).
Degree in IT, cyber security, cyber forensics or other related matters, or equivalent expertise in the matter with more than 10 years, would be an asset.
General professional experience
At least 10 years of professional prosecutorial experience in criminal cases or in the fields of organised crime, international crime, cybercrime or cyber-terrorism.
Specific professional experience
At least 5 years of experience in digital forensics investigation, collection of digital evidence, penal procedure and international cooperation .
Proven experience in previous investigation in transnational terrorism or crime cases.
Professional experience in Counter Terrorism Central Units will be an asset.
Collaboration with Europol and Eurojust, will be an asset.
Participation in international projects/forums specialised in terrorism or cybercrime.