eFirst: First responders e-learning package

Project description

Being the initial actors in contact with potential electronic evidence, Law Enforcement First responders (patrol police officers, detectives, border and tax controllers) are crucial within the forensic process, influencing the efficiency of criminal investigations. This self-paced e-learning package focuses on essential IT forensics and IT crime knowledge for first-line police officers without IT expertise.

The deliverable also solves the ever-challenging “pre-requisite” topics required before residential training, while providing a common sound reference for all Law Enforcement First responders and attendees to advanced-level IT forensics courses.

With an expected audience of over 1.5 million first-line officers in Europe, this course package is available free of cost to all Law Enforcement Agencies (LEA), enabling additional organisation or country-related content to be included.

The training materials are kept up-to-date and maintained by a core group of EU LEA cybercrime experts, allowing to:

• Identify and seize potential electronic evidence, including “live data” forensics.
• Gain awareness on digital forensics, cybercrime, the Internet and its services, the Internet of Things, encryption/decryption, the dark web, cryptocurrencies, and other topics.
• Assist victims of crimes facilitated by the use of new technologies when taking a complaint (asking specific crime-related questions), starting a criminal case, and providing first help and basic advice on these types of crimes.
• Advise on how to use the NOMORERANSOM tools and other non-commercial solutions.
• Facilitate communication, reporting and further investigation, by explaining the types of traces that can be recovered by specialised forensic examiners and how they may contribute to investigative processes.
• Serve as a repository or knowledge base of cyber essentials.

Topics covered

The training addresses key issues encountered on the field, including networks, the Internet of Things, devices and technologies (mobile devices, etc.), e-evidence and first responder guidelines, online child sexual abuse and exploitation, cryptocurrencies, the dark web, Open Source Investigations (OSINT). It includes ‘serious games’ that combine skills and topics to solve online exercises in a gamified environment.

Background and history

An ECTEG flagship initiative, eFirst came to life in 2013 to provide First responders with basic knowledge of digital forensics tools and practices, combining live data forensics with general awareness and understanding of cyber-dependent and cyber-enabled crimes.

This initial version was translated into over 14 EU languages (plus some additional ones via international partners), and localised to match national guidelines and refer to each country’s legal framework. Numerous forces and Units deployed it in the EU and beyond, including CEPOL (via LEED e-learning platform), Brussels Local Police (Belgium), Polícia de Segurança Pública (Portugal), Baden-Wuerttemberg State Police College (Germany), Norwegian Police University College (Norway), Bundeskriminalamt (BKA – Germany), French Customs (France), An Garda in cooperation with University College Dublin (Ireland), Public Prosecutors Office (Netherlands), Latvian Police (Latvia), Polish Police (Poland), Belgian Federal Police (Belgium), Council of Europe (via Glacy+ and iProceeds projects), Thailand (thanks to the cooperation with UNODC).

Development: eFirst 2.0 version and next steps

In 2023, a team of cybercrime experts from Law Enforcement Agencies in the European Union began updating and optimising the product. The eFirst 2.0 version, launched in November 2024, features indispensable content updates, a streamlined training path, up-to-date electronic evidence good practices, improvements in the interface and seizure tips requested by the end-users.

The next steps involve:

• Translation into EU languages and localisation, with regular update cycles.
• Launch of a spin-off product for Magistrates, Judges and Prosecutors, in cooperation with Eurojust and the European Judicial Cybercrime Network (EJCN).
• Translation in other non-EU languages, by international partners, to aid in an inclusive and global fight against cybercrime.

Project partners and contributors

These LEAs have collaborated in the training material development:

• Polícia de Segurança Pública (Portugal)
• Portuguese Judicial Police (Portugal)
• Portuguese National Guard (Portugal)
• Polish Cybercrime Bureau (Poland)
• Politie Academie (Netherlands)
• Swedish Cyber Crime Center (Sweden)
• Swedish Customs (Sweden)
• An Garda Schíochána (Ireland)
• Baden-Wuerttemberg State Police College (Germany)
• Guardia Civil (Spain)
• Polizia di Stato (Italy)
• Servizio Polizia Postale e delle Comunicazioni (Italy)
• Hellenic Police (Greece)
• Danish Police (Denmark)
• Finish Police University College (Finland)
• Universidad Autónoma de Madrid (Spain)
• Romanian Police (Romania)
• Romanian Prosecutor Office (Romania)
• French Gendarmerie (France)
• Cypriot Police (Cyprus)
• Norwegian Police University College (Norway)
• Antwerp Local Police (Belgium)
• Brussels Local Police (Belgium)
• Hessen Police Academy (Germany)

The project’s continuity is also possible thanks to funding from the European Commission and the kind support of University College Dublin, Europol, CEPOL, the Council of Europe, OSCE and UNODC.

Languages

The main version is developed in English. Localised versions in EU and additional languages will be produced after November 2024. The expected languages to be covered are:

These and other translations will be added as they become available.