7 December 2019, Entebbe-Uganda - The IGAD Security Sector Program (IGAD SSP), with support from the European Union Trust Fund (EUTF) administered by the Austrian Development Agency (ADA) under the IPPSHAR program conducted a five days regional training on “Cyber/Digital Evidence/Forensics on Counter Terrorism Investigation and Prosecution” held on 3-7 December 2019 in Entebbe, Uganda.
Terrorism with its ever changing and evolving nature is one of the serious Transnationl Security Threats (TSTs) that affects the region. Terrorists and their networks are becoming transnational with cells and members scattered across borders who use various forms of technology to coordinate and communicate their activities. The Internet, various technology and Social Media are used to facilitate terrorist activities, such as recruitment, communications, radicalization, training, financing, incitement, preparation, planning, and collection information through secret chat rooms, encrypted Internet messages boards, fake email accounts, mobile applications, among others. These has called for more comprehensive approach to counterterrorism by understanding the role Information, Communication, and Technology (ICT) plays and utilized by terrorists. Cyber Terrorism is a real threat that may use the available infrastructure through cyber space, in which terrorist could apply directly or indirectly. In this regard, digital forensics is one of the tools to identify the source of these attacks requiring knowledge, expertise, and experience in investigation and prosecution of terrorism cases. Evidence in terrorism cases can sometimes be huge in volume, encrypted or in a foreign language, classified or located in a conflict zone, or technically so complex that it requires forensic or technological experts. Due to the complex and sophisticated nature of terrorism cases, it is important to have dedicated response from relevant officials who are involved in tracking terrorists and bringing them to justice.
It is with this background in mind and as part of its effort to enhance the capacity of IGAD Member States that this training was undertaken. The overall objective of the training was to equip trainees with an advanced knowledge and practical skills on handling and managing digital evidence/forensics through the investigation processes and prosecution of terrorism cases. In addition, it aimed at strengthening the cooperation and coordination among the relevant agencies at various levels.
The guest of honor, Commander Abebe Muluneh - Director of IGAD SSP, in his opening and closing remarks emphasized the importance of having the capability in dealing with digital evidence and the overall cybercrime dynamism. He said that “due to the increasing complexity of terrorism cases, successful prosecution in terrorism cases requires intense coordination during the investigation phase related to the gathering of evidence and on the use of general or specific investigative tools available”. He continued “...considering the transnational and trans regional threat of terrorism, strengthening law enforcement and judicial cooperation between States is crucial”. He further urged IGAD Member States “...to streamline law enforcement and judicial cooperation on the principle of aut derere aut judicare…”. He indicated that “...IGAD Member States have to engage in enabling the use of procedural protective measures, adopting a tailored, flexible, and comprehensive approach to questioning, assisting and protecting witnesses, assisting persons processing sensitive or classified information to testify, establishing witness protection programs, and strengthening the use of expert witness in court”.
A total of 28 practitioners from the relevant institutions of Member States participated in the training bringing together vast experience from their respective expertise, which were believed to highly contribute to the training contents. The participants were drawn from the Police, Ministry of Justice, Judiciary, Information Security Agency, Counter Terrorism Center, Ministry of ICT, Ministry of Interior, Ministry of Defense, Intelligence Units, Ministry of Foreign Affairs, Cyber Crime Unit, Criminal Investigation, among others.
Subject matter experts from and out of the region with extensive work experience shared their experiences and facilitated the sessions through presentations, interactive discussions, group exercise (table top, scenarios, case studies). The experts were Dr. Mehari G. Msgna and Mr. Dessalegn H. Kinane of the Information Network Security Agency of Ethiopia, Dr. Kinfe Yilma- an assistant professor of Law at the Addis Ababa University, Chief Inspector Julius Cheruiyot from Kenya Department of Criminal Investigations. Mr. Fernando P. Mendoza from the United Nations Counter Terrorism Center (UNCCT) Cybersecurity unit has also facilitated and presented on the training. In addition, experts from the US, namely Ms. Jessica Milla Schutzman (Bureau Chief-Financial Crimes for District Attorney’s Office in New York State), and Mr. John Bridge (Director of Financial Crimes Technology at Trust Stamp) who are facilitators through the Attorney General Alliance African Alliance Partnership (AGA-AAP) have contributed to the training.
The topics covered during the five days were the following. These topics have been extensively discussed and it was believed to have contributed to the overall objective.
- Cybercrime and Cyberterrorism - concepts, definitions, terminology, types, threats
- Cyber/digital evidence/forensics - identification, preservation, collection, analysis, classification, comparison/examination, interpretation)
- Information security and current hacking trends
- Protection of key infrastructure from terrorist cyber attacks
- The insider threat - radicalization of cyber security personnel
- Terrorist investigation using the Internet and Social Media, open source intelligence (OSINT)
- Legal instruments at various levels on handling cybercrime, digital evidence, mutual legal assistance
- Investigation of digital evidence - collection and examination - tools, processes, techniques, phases and processes
- Identification, interpretation of digital evidence - authorization, access, understanding, preserving, etc
- Analysis of digital evidence - tools, classification/categorization, examination/evaluation
- Presentation and documentation of digital evidence - converting to understandable versions with explanations without tampering the value and meaning of the evidence
- Digital evidence in effective prosecution - understand, defend and proof.
Participants at the end appreciated the content, methodology and approach of the training whereby they requested IGAD to continue to provide such kind of on-hand training that will help them build their and their institutional capacity. They came up with a way forward with clear recommendations of the training.
At the end of the training program, the Director of IGAD SSP - Commander Abebe, thanked the Government of Uganda for hosting, the EU and ADA for their financial support, the staff of IGAD SSP, and the participants for their respective role in the successful completion of this timely training. Participants received a certificate of completion meant to serve as a recognition of their participation of the training.
