Component 0: Project Visibility. Activity 0.1 Kick-off meeting. Method

Transcription

1 Component 0: Project Visibility Activity 0.1 Kick-off meeting Kick-off meeting will be held in Zagreb with Croatian, Spanish and Austrian parties involved. The aim of this event is not only to achieve visibility of the project but also to present the main objectives of the project and results to be achieved during the implementation of the project. Moreover, this event is an important opportunity for all the participants to network. The activity will start with the organisation of the event, invitation will be sent to the main actors, stakeholders and press agencies. An Agenda will be drafted and the related speeches and presentations will be prepared. Leaflets will be produced and disseminated. Furthermore, meetings with BC key-experts and institutions involved in the project and with responsible persons of other linked projects will be held. Representatives of the MS and BC shall issue a press release in order to raise public awareness of the project. MS Human : MS Project Leader - 1 working day Junior Project Leader - 1 working day RTA BC Project Leader RTA counterpart Representatives of relevant stakeholders: Ministry of Interior, Forensic Science Centre Ivan Vučetić, Police Academy and other relevant Croatian institutions/organizations. Interpretation and translation by RTA language assistant Activity 0.2 Final event closing conference and media presentation

2 Final event will be held in Zagreb during the last month of the project with Croatian, Spanish and Austrian parties involved. The aim of this event is to present the main results achieved during the implementation of the project to the media and general public. This event is an important opportunity for all the participants to exchange experiences acquired during implementation of the project and discuss the sustainability of the project results. The activity will start with the organisation of the event, invitation will be sent to the main actors, stakeholders and press agencies. An Agenda will be drafted and the related speeches and presentations will be prepared. Leaflets in English and Croatian language containing information about the project and its results will be produced and disseminated. Representatives of the MS and BC shall issue a press release and present the main result of the project. MS Human : MS Project Leader - 1 working day Junior Project Leader - 1 working day RTA BC Project Leader RTA counterpart Representatives of relevant stakeholders: Ministry of Interior, Forensic Science Centre Ivan Vučetić, Police Academy and other relevant Croatian institutions/organizations. Interpretation and translation by RTA language assistant

3 Component I: Strengthening capacities of Forensic Science Centre for forensic investigation of cybercrime Activity Drafting Standard Operating Procedures for forensic investigation of cybercrime which will cover collection, examination, analysis and reporting on electronic evidence according to ISO standard and ENFSI procedures. MS short-term experts will carry out missions and during these missions they will run need and gap" analyses through interviews and consultations with relevant BC experts. These analyses will be carried out by means of: Workshop Interview with BC key experts of the forensic unit Analysis and assessment of the current system Analysis of internal guidelines Assessment of organisational and operational structure and the workflow The experts will have the duty to review and assess any existing documents from the aspect of quality and coherence. The pre-requisites and qualifications necessary for using the Standard Operating Procedures (SOP) will be defined. Such an approach will avoid repetitions in the working processes. Some of the most relevant subjects of analysis can be mentioned: 1.) Equipment for forensic laboratory: Procedures for usage and procedures for maintenance of equipment 2.) Crime scene investigation: Procedures for collecting digital evidence 3) Forensic laboratory investigation: Procedures for digital evidence analysis Inputs, suggestions and comments by the national forensic team members will be analysed and taken into account in the course of preparation of the SOP. Materials freely available through the European Cybercrime Training and Education Group (ECTEG, and other available materials will be used. ECTEG materials have been designed and elaborated by Member States police agencies with the support of the Prevention of and Fight against Crime (ISEC) Programme of DG Home Affairs; in some cases they include open source software. Using available and free of charge material would offer the possibility to train officials of the beneficiary administration on the same tools that would continue to be freely at their disposal after the conclusion of the project. In this activity also a focus will be put on international cooperation for strengthening BC capabilities in this area, in particular with Europol and the European Cybercrime Centre (EC3) in order to facilitate contacts with EC3, especially with the service in charge of the mobile office which is envisaged to deliver on-the-spot assistance.

4 The content of the drafted SOP will be discussed with the national representatives and continuously developed with the purpose to achieve the benchmark of highest quality. MS Human : 4 STEs: Erhard FRIESSNIK, Gottfried STÜTZ, Ursula KNIERIM, Gerhard ROSSKOPF 3 working days, 2 mission each (total 24 working days) 3 representatives from Forensic Science Centre Ivan Vučetić Activity Conducting training needs analysis (TNA) for the forensic science experts regarding forensic cybercrime investigation and preparing corresponding TNA report. MS short-term experts will perform training needs analysis through: Workshop Interview with BC key experts of the forensic unit The professional skills of the national forensic science experts will be assessed and the needed skills and knowledge will be defined in the TNA report. MS Human : 4 STEs: Erhard FRIESSNIK, Gerhard ROSSKOPF, Ursula KNIERIM, Gottfried STÜTZ 4 working days, 1 mission each (total 16 working days) 2 representatives from Forensic Science Centre Ivan Vučetić Activity Designing long-term training programme consisting of training modules on topics regarding forensic cybercrime investigation (e.g. techniques of collection, examination, analysis and reporting on electronic evidence) that will be used in training of future forensic science experts. Designing training of trainers (ToT) programme. Preparing operational plan for implementation of respective trainings.

5 MS short-term experts will implement the activity through: Workshop Interview with BC key experts of the forensic unit Analysis and assessment of the current training system and documentation The experts shall have the duty to review and assess any existing documents from the aspect of quality and coherence. Such an approach shall avoid repetitions in the working processes. Inputs, suggestions and commends by the national forensic team members shall be analysed and taken into account in the course of preparation of the relevant documents. Within this module there shall be made a comparison between the Austrian experience in this field and the needs of the national BC taking into consideration the prepared TNA report. Materials freely available through the European Cybercrime Training and Education Group (ECTEG, and other available materials will also be used. ECTEG materials have been designed and elaborated by Member States police agencies with the support of the Prevention of and Fight against Crime (ISEC) Programme of DG Home Affairs; in some cases they include open source software. Using available and free of charge material would offer the possibility to train officials of the beneficiary administration on the same tools that would continue to be freely at their disposal after the conclusion of the project. The content of the designed long-term training programme shall be discussed with the national representatives and continuously developed/adapted based on their inputs. The four modules for this training programme are: Computer & Network system forensic: Recovery of information (e.g. recovery of deleted and hidden files, evidence of ownership), sequence of the events occurred within the computer software (determining timeframe of the actions) etc. Mobile devices forensics: Recovery of information, analysis of date from telecommunication network systems etc. Video & Audio forensics (e.g. enhancement of digital video for identification purposes) Advanced forensics (e.g. cryptography, malware analysis) Direct output of the activity shall be long-term training programme, training of trainers (ToT) programme and operational plan (with detailed schedule, participants, topics) for implementation of trainings. MS Human : 4 STEs: Klaus MITS, Robert MAIERHOFER, Ursula KNIERIM, Horst REISNER 5 working days, 1 mission each (total 20 working days) 3 representatives from Forensic Science Centre Ivan Vučetić

6 Activity Preparing training manual which will be used by future trainers for implementing the developed long-term training programme. Preparing training materials for training of trainers envisaged to be implemented through Activity MS short-term experts shall implement the activity through: Workshop Interview BC key experts of the forensic unit Documentation produced under the project (TNA, long-term training programme, ToT programme) shall be fully taken into account while performing this activity. Some of the training materials freely available through the European Cybercrime Training and Education Group (ECTEG, and other available materials will also be used. ECTEG materials have been designed and elaborated by Member States police agencies with the support of the Prevention of and Fight against Crime (ISEC) Programme of DG Home Affairs; in some cases they include open source software. Using available and free of charge material would offer the possibility to train officials of the beneficiary administration on the same tools that would continue to be freely at their disposal after the conclusion of the project. Moreover, the needs and important topics of the training manual shall be developed on the bases of the Austrian expertise and under consideration of international experiences. Inputs, suggestions and comments by the national forensic team members shall be analysed and taken into account in the course of preparation of the training manual and training materials. The training materials shall be based on practical exercises. The content of the designed training manual and materials shall be discussed with the national representatives and continuously developed/adapted based on their inputs. MS Human : 4 STEs: Klaus MITS, Gottfried STÜTZ, Ursula KNIERIM, Robert MAIERHOFER 4 working days, 2 missions each (total 32 working days) 2 representatives from Forensic Science Centre Ivan Vučetić

7 Activity Organising and conducting internship on forensic cybercrime investigation for 2 forensic science experts in the MS forensic science centre (one internship in duration of 10 weeks for each expert). An internship for 2 BC forensic science experts for 10 weeks is planned for the project months 5-7 in Austria. 2 BC experts shall be trained by working together with the Austrian teams in the Cybercrime Competence Centre for IT forensics and mobile forensics. BC experts shall learn in the real work environment and gain experience while watching MS colleagues dealing with the tasks and challenges of a normal working day and by participating in everyday activities. The internship shall be organized as on-the-job training and organizationally it shall be divided in two parts, one focusing on IT forensics and the other on mobile forensics. It is planned that each expert shall focus alternately on one specific topic for 5 weeks: for the first part of the internship one expert focuses on IT forensics, while the other one shall focus on mobile forensics; for the second part of the internship they shall switch and focus on the other topic. IT forensics training shall cover: Handling of electronic evidences, especially storage-devices like hard- and dumpdrives Seizing electronic evidences and storage-devices Forensic analysis of evidence-files of IT-storage-devices Mobile forensics training shall cover: Handling of seized mobile-devices: mobile-phones, tablets or navigation-devices Seizing mobile-devices Forensic analysis of evidence-files from mobile-devices Goal of the activity is for BC experts to gain experience in Austrian best practices in forensic cybercrime investigation and specifically to learn from Austrian experience on how electronic evidences need to be handled to keep validity during legal procedures (chain of custody). Throughout the internship, emphasis will be put on international cooperation, in particular with Europol and the European Cybercrime Centre (EC3) in order to facilitate contacts with EC3, in particular with the service in charge of the mobile office which is envisaged to deliver on-the-spot assistance. MS Human : Involvement of MS institutions staff 2 representatives from Forensic Science Centre Ivan Vučetić Local travel

8 No interpretation is needed because the experts from Cyber crime units have advanced language skills in English Activity Conducting on-the-job training in the BC for 2 forensic science experts through practical implementation of learned techniques for forensic cybercrime investigation under supervision of MS expert/s. MS short-term experts shall stay for one week in the forensic laboratory of the BC and conduct an on-the-job training. During the on-the-job training the MS experts shall take care of the content of the preceding trainings and manuals, which have been created, shall be implemented in daily work in a correct way. Deviations shall be recognized and adjusted by interfering of the MS experts. Especially, the chain of custody should be checked and any discrepancy from standard procedures should be prevented to keep validity during legal procedures. Inputs, suggestions and comments by the national forensic team members shall be analysed and taken into account in the course of training. The on-the-job training shall be direct follow-up of internship and shall focus on the following topics: Handling, seizing and analysing IT-storage-devices Handling, seizing and analysing mobile devices Throughout the on-the-job training, emphasis will be put on international cooperation, in particular with Europol and the European Cybercrime Centre (EC3) in order to facilitate contacts with EC3, in particular with the service in charge of the mobile office which is envisaged to deliver on-the-spot assistance MS Human : 2 STEs: Robert MAIERHOFER, Gerhard ROSSKOPF 5 working days, 1 mission each (total 10 working days) 2 representatives from Forensic Science Centre Ivan Vučetić Interpretation by RTA Language Assistant Activity Conducting training of trainers (ToT) courses for 2 forensic science experts (future trainers) on forensic cybercrime investigations.

9 MS short-term experts shall implement the activity through: Workshop Round Table discussions Trainings shall be implemented in 2 modules, each module in duration of 3 working days and shall be based on the developed training programme and materials. During the first mission the STE shall develop and conduct the ToT with the 2 BC experts and on the basis of this result, to ensure sustainability, a table desk exercise /planning scenario shall be conducted in the second mission. Inputs, suggestions and comments by the national forensic team members shall be analysed and taken into account in order to implement trainings in high quality manner and address the needs of the BC experts who need to become capable to train other experts in the field. MS Human : 4 STEs: Klaus MITS, Erhard FRIESSNIK, Ursula KNIERIM, Robert MAIERHOFER 3 working days, 2 missions each (total 24 working days) 2 representatives from Forensic Science Centre Ivan Vučetić Interpretation by RTA Language Assistant Component II: Strengthening capacities of the Criminal Police Directorate for fighting cybercrime at the national, regional, European and international level Activity Conducting analysis of the existing legislation related to cybercrime and preparing analysis report. The analysis should include primary legislation (e.g. Criminal Code and Criminal Procedure Act), related secondary legislation (e.g. regulations, directives, ordinances) and other legislation which is directly or indirectly connected to fight against cybercrime. The analysis should also include relevant commitments of the Republic of Croatia assumed by international conventions and multilateral or bilateral agreements. MS short-term experts in cooperation with MS cybercrime prosecution office missions shall be conducted on the legal framework and admissibility of digital evidences (when collected, for example, by undercover agents) and other legal features directly related to cybercrime legal procedures and investigations. Analysis shall comprise the existing legal framework concerning cybercrime at that time, specifically of primary legislation (Criminal Code and Criminal Procedure Act), related

10 secondary legislation (regulations, directives, ordinances) and any other legislation which is directly or indirectly connected to cybercrime. The legislation picture obtained shall be completed with information gathered from a practitioners daily work in this specific field. A questionnaire shall be developed to be used on interviews with different stakeholders which will be determined in cooperation between MS and BC experts (e.g. lawyers, judges, prosecutors, police officers) to provide the MS experts with all the information related with the practice concerning the admissibility of electronic evidences and problems faced by the practitioners in order to get a broad overview about the implementation of the legislation related to cybercrime. Discussions shall also encompass possible improvement of the existing legislation. The results shall be shown in an analysis report. MS Human : 3 STEs; Elvira TEJADA DE LA FUENTE, Ana Maria MARTIN DE LA ESCALERA, Roberto FERNANDEZ ALONSO 5 working days, 1 mission each (total 15 working days) 4 representatives from Ministry of Interior Activity Conducting analysis of relevant procedures and practices of criminal police officers regarding criminal investigation of cybercrime and preparing analysis report. MS short-term experts shall conduct the analysis of the current situation of police procedures and practices concerning cybercrime investigations. In order to carry out the assessment different research forms/questionnaires shall be prepared to cover different study areas. Field visits to different police departments are envisaged within this activity with the aim of exploring police procedures and existing police protocols with respect to cybercrime investigations. MS experts shall meet and interview police officers varying in rank and at different investigating and managerial levels in order to obtain a clear and wider picture of police procedures in use. The results shall be shown in an analysis report. MS Human :

11 3 STEs; Roberto FERNANDEZ ALONSO, Beatriz RAMOS IGLESIAS, Silva BARRERA IBÁÑEZ: 3 working days, 1 mission each (total 9 working days) 5 representatives of the Ministry of Interior Activity Conducting analysis of relevant procedures and practices related to cooperation of criminal police officers with their counterparts in international criminal investigations and preparing analysis report. MS short-term experts shall analyze the actual situation of the procedures and practices related with international co-operation, the recent inclusion of Croatia as an EU Member State and its implications on international police cooperation. Different research forms/questionnaires shall be prepared to conduct the analysis of the current situation of relevant procedures and practices concerning international investigations. In the course of analysis possibility to increase the awareness on the importance of participation on existing working groups, international projects and international cooperation instruments and organisations such as ECTEG, Europol, EC3, Interpol, Eurojust, CEPOL, etc. shall be discussed between MS and BC experts. The results shall be shown in an analysis report. MS Human : 3 STEs: Roberto FERNANDEZ ALONSO, Beatriz RAMOS IGLESIAS, Silva BARRERA IBÁÑEZ 2 working days, 1 mission each (total 6 working days) 3 representatives of Ministry of Interior Activity Producing Comprehensive Assessment Report with detailed recommendations for improvement of the system for fight against cybercrime. The recommendations should include: - Proposals for improvement of legislation in parts relevant for fight against cybercrime; - Proposals for improvement of procedures for cybercrime investigations;

12 - Proposals for improvement of procedures related to participation of criminal police officers in international cybercrime investigations. On the basis of the previous analysis reports, the experts shall produce an assessment report on police procedures and practices concerning cybercrime investigations as well as relevant procedures and practices concerning international investigations in this area, including proposals for improvement of legislation in parts relevant for fight against cybercrime, once discussed and approved by all relevant stakeholders which will be determined in cooperation between MS and BC experts. The report shall be based on the studies, research forms, interviews, etc developed by the experts. The latest Eurobarometer on cyber security factsheet ( will also be consulted regarding information for Croatia with the purpose of setting of expertise priorities which shall be addressed in the report (e.g. improvement of procedures for cybercrime investigations shall be guided by the areas mentioned in the report to be of the highest priority for Croatian Internet users). The report shall include recommendations for the improvement of the fight against cybercrime based on the experience of the investigators and their participation in international working groups, programmes as well as on joint investigation teams. The draft report shall be discussed with other stakeholders in order to ensure accuracy and ownership. MS Human : 4 STEs: Roberto FERNANDEZ ALONSO, Beatriz RAMOS IGLESIAS, Ana Maria MARTIN DE LA ESCALERA, Oscar DE LA CRUZ YAGUE 5 working days, 1 mission each (total 20 working days) 1 representative from Ministry of Interior Activity Drafting Standard Operating Procedures for cybercrime investigations for criminal police officers on the basis of the Comprehensive Assessment Report. Standard Operating Procedures (SOP) shall be developed based on the international principles, and the experience of the participants in the fight against cybercrime. These procedures must help to introduce and share EU best practices and fulfil specific needs and requirements of the Beneficiary Country and shall take into account the national specificities.

13 SOP shall include different levels of implementation to ensure their long-term sustainability. It shall be adapted to the specific needs of the Beneficiary taking into account the existing equipment. Some of the training materials freely available through the European Cybercrime Training and Education Group (ECTEG, and other available materials will also be used. ECTEG materials have been designed and elaborated by Member States police agencies with the support of the Prevention of and Fight against Crime (ISEC) Programme of DG Home Affairs; in some cases they include open source software. Using available and free of charge material would offer the possibility to train officials of the beneficiary administration on the same tools that would continue to be freely at their disposal after the conclusion of the project. The implementation of the Standard Operating Procedures for cybercrime investigations shall be based on the initial assessment in order to provide a tailor made programme. MS Human : 2 STEs: Roberto FERNANDEZ ALONSO, Mario FARNOS BUESA 5 working days, 1 mission each (total 10 working days) 2 representatives from Ministry of Interior Activity Conducting gaps and needs (G&N) analysis of the existing organisational model and administrative capacities for fighting cybercrime (e.g. number of police officers in charge for cybercrime investigations, equipment, etc.) of Criminal Police Directorate and of Police Administrations - PA Zagrebačka, PA Splitsko-dalmatinska, PA Primorsko-goranska, PA Osječko-baranjska, PA Istarska and preparing G&N analysis report. MS short-term experts shall be engaged in several field visits, to the Criminal Police Directorate and to the different Police Administrations in order to collect data on the existing organisational model and the real administrative capacities for fighting against cybercrime. MS experts shall also conduct consultations and interviews with the criminal police officers who are actively involved in fight against cybercrime. In order to carry out the consultations and interviews, several forms/questionnaires shall be prepared which shall cover different areas of analysis. The results of these activities shall be used to elaborate an extensive G&N analysis report based on the exhaustive information analysis gathered from the Criminal Police Directorate and Police Administrations.

14 MS Human : 4 STEs: Beatriz RAMOS IGLESIAS, Fernando FERNANDEZ LAZARO, Roberto FERNANDEZ ALONSO, Celia CARREIRA VIGO 5 working days, 2 missions each (total 40 working days) 5 representatives from Ministry of Interior Activity On the basis of the Comprehensive Assessment Report (Activity 2.1.4) and G&N analysis report (Activity 2.2.1), preparing proposal of organisational model of the Criminal Police Directorate and of Police Administrations. MS and BC experts shall form a working group in order to discuss details of organisational model to be proposed. According to the Regulation on internal organization of Ministry of Interior, the High-tech Crime Department within the National Police Office for Suppression of Corruption and Organized Crime was established in Currently, the unit has 5 specialized police officers (4 police officers and the Head of Department) dealing with hightech crime on a national level. MS short-term experts shall design a proposal of organisational model of the Criminal Police Directorate and Police Administrations on the basis of the analysis result of the current procedures and practices to fight against cybercrime and related to international police cooperation. The proposal shall be based as well on G&N analysis report of the existing organisational model and administrative capacities (police resources) for fighting cybercrime. MS Human : 3 STEs: Beatriz RAMOS IGLESIAS, Roberto FERNANDEZ ALONSO, Fernando FERNANDEZ LAZARO 3 working days, 1 mission each (total 9 working days) 1 representative from Ministry of Interior

15 Activity Presenting the prepared proposal of organisational model to at least 6 high ranked police officers of the General Police Directorate management and submission of the proposal for internal adoption. Once the proposal is prepared and designed as specified the previous activity 2.2.2, it shall be presented, as required in this activity, to at least 6 high ranked police officers of the General Police Directorate management. Moreover, further internal implementation of the proposal shall be discussed and recommendations produced in order to ensure sustainability of results. MS Human : 3 STEs: Beatriz RAMOS IGLESIAS, Roberto FERNANDEZ ALONSO, Fernando FERNANDEZ LAZARO 2 working days, 1 mission each (total 6 working days) 6 representatives from Ministry of Interior Interpretation by RTA Language Assistant Activity Conducting training needs analysis (TNA) of criminal police officers from central and regional NPOSCOC offices and from Police Administrations and preparing TNA report. MS short-term experts shall conduct consultations and interviews with criminal police officers from central and regional NPOSCOC offices and local Police Administrations, in order to determine the real training needs. Number of employees who shall be involved in the analysis (sample size) shall be determined in the workshop by MS and BC experts. In order to carry out the consultations and interviews, several forms/questionnaires shall be prepared which shall cover different areas of analysis. The results of the above activities shall be used to elaborate an extensive TNA analysis report based on the exhaustive information analysis gathered from the central and regional NPOSCOC offices and local Police Administrations. MS Human : 2 STEs: Fernando FERNANDEZ LAZARO, Beatriz RAMOS IGLESIAS 5 working days, 1 mission each (total 10 days)

16 2 representatives from Ministry of Interior Activity Designing training programme consisting of training modules on topics regarding prevention, suppression and investigation of cybercrime. Designing ToT programme. Preparing operational plan for implementation of respective trainings. TNA report prepared under Activity shall serve as a basis for the drafting of the necessary curricula to improve the training in the different areas analysed. Based on BC laws, BC gaps and needs, reflected in the TNA report, and MS experience a training program and a Training of Trainers program shall be designed. Moreover, the latest Eurobarometer on cyber security factsheet ( will also be consulted regarding information for Croatia with the purpose of setting of expertise priorities which will be addressed in the course of trainings (e.g. topics of the highest priority for Croatian Internet users will be included and elaborated). The programmes shall be divided into several modules of specialities in the area of fight against cybercrime. An operational plan shall be designed to implement the modules of the basic training and the ToT training. These modules shall depend mainly of the previous gaps and needs analysis, but shall always be associated with Telecommunications Fraud, Minors Protection, Open Networks, Fraud on the internet, Logical Security and Intellectual Property. Some of the training materials available through the European Cybercrime Training and Education Group (ECTEG, that cover relevant topics will also be used. ECTEG materials have been designed and elaborated by Member States police agencies with the support of the Prevention of and Fight against Crime (ISEC) Programme of DG Home Affairs; in some cases they include open source software. Using available and free of charge material would offer the possibility to train officials of the beneficiary administration on the same tools that would continue to be freely at their disposal after the conclusion of the project. MS Human : 2 STEs: Celia CARREIRA VIGO, Fernando FERNANDEZ LAZARO 5 working days, 1 mission each (total 10 working days) 2 representatives from Ministry of Interior 1 representative from Police Academy

17 Activity Preparing training materials for trainings implemented through Activity and Preparing training manual which will be used by future trainers in the process of continuous education of criminal police officers. MS short-term experts shall prepare training materials on the basis of operational plan implemented through Activity The training materials shall cover topics as cybercrime typologies, modus operandi, investigation techniques of each typology, gathering data from the cyberspace, digital evidence, search in electronic devices, training of trainers, etc. Materials freely available through the European Cybercrime Training and Education Group (ECTEG, and other available materials will be used. ECTEG materials have been designed and elaborated by Member States police agencies with the support of the Prevention of and Fight against Crime (ISEC) Programme of DG Home Affairs; in some cases they include open source software. Using available and free of charge material would offer the possibility to train officials of the beneficiary administration on the same tools that would continue to be freely at their disposal after the conclusion of the project. Following the feedback from the training participants, it would be possible to include any additional content considered necessary in order to achieve a comprehensive training in the field of fighting against cybercrime. Specific training manual shall be prepared for future trainers in order to ensure the continuous education of police officers. MS Human : 4 STEs: Celia CARREIRA VIGO, Juan Francisco BENITEZ IGLESIAS, David PEREZ MARTIN ESPERANZA, Manuel JURADO CASCALES 5 working days, 1 mission each (total 20 days) 1 representative from Ministry of Interior 1 representative from Police Academy Activity Conducting training on cybercrime investigations for at least 30 criminal police officers (at least 10 from NPOSCOC headquarter and at least 20 police officers from regional NPOSCOC and from Police Administrations).

18 MS short-term experts shall conduct several courses, each of 5 working days, where 30 BC criminal police officers shall gain the knowledge on methods and tools used by MS criminal police officers in cybercrime investigations. The training materials prepared in the Activity 2.3.3, shall be used to cover theoretical and practical trainings. Criminal police officers shall learn the best practices on investigative techniques and use of investigative data in the frame of cybercrime. MS Human : 6 STEs: Roberto FERNANDEZ ALONSO, Manuel JURADO CASCALES, Eduardo CASAS HERRER, Fernando FERNANDEZ LAZARO, Silvia BARRERA IBAÑEZ, Yésica LOPEZ VILAR 5 working days, 1 mission each (total 30 working days) 30 representatives from Ministry of Interior Interpretation by RTA Language Assistant Activity Conducting ToT courses on cybercrime investigations for at least 5 criminal police officers (future trainers). MS short-term experts shall conduct several ToT courses of 3 working days where 5 BC criminal police officers shall be trained as future trainers. BC police officers shall be thought the methods and tools used by MS trainers of criminal police officers when teaching and training police officers to become expert investigators in cybercrime investigation. The ToT courses shall focus on essential and necessary skills needed by the future trainers to transfer their knowledge and to train criminal police officers specialized in the fight against cybercrime in order to ensure the continuous education of police officers in the BC. MS Human : 3 STEs: Roberto FERNANDEZ ALONSO, Celia CARREIRA VIGO, Juan Francisco BENITEZ IGLESIAS 3 working days, 1 mission each (total 9 working days) 5 representatives from Ministry of Interior Interpretation by RTA Language Assistant

19 Activity Conducting one study visit for at least 11 criminal police officers in duration of 5 working days to MS cybercrime investigation centre with purpose to gain on-sight experience in cybercrime investigations. Preparing a study visit report. A study visit to Spain in duration of 5 working days for at least 11 criminal police officers shall be held, and shall be planned in full consultation with the Beneficiary. During the visit, in order to introduce the BC participants to the central as well as regional cybercrime investigation centres, the participants shall visit High Tech Crime Unit in Madrid for three days and study visit to High Tech Section in Barcelona or High Tech Group in Valencia or Malaga for two days. Through this study visit the Croatian experts shall have the opportunity of getting an in-depth first-hand practical experience and become fully acquainted with the Spanish National Police procedures and solutions applied on the different issues covered by the project. MS Project Leader, MS STEs and RTA shall accompany the BC police officers. Upon return, the BC participants shall prepare study visit reports. MS Human : Involvement of staff from MS institutions 11 criminal police officers Local travel Interpretation shall be provided by National Police Corp of Spain with no costs to the budget Activity Conducting gaps and needs analysis of the existing educational system (specialised courses for police officers, Police High School, Police College) of the Police Academy in relation to fight against cybercrime and preparing analysis report with recommendations for improvement of the educational system. MS short-term experts shall conduct consultations and interviews with criminal police officers from central NPOSCOC and Police Academy responsible for training in relation to fight against cybercrime in order gain information on the the current educational system in relation to fight against cybercrime.

20 In order to carry out the consultations and structured interviews, several forms/questionnaires shall be prepared which shall cover different areas of study. The feedback from these forms/questionnaires shall be used in order to prepare elaborate gaps and needs analysis report. MS Human : 3 STEs: Juan Francisco BENITEZ IGLESIAS, Oscar DE LA CRUZ YAGÜE, Celia CARREIRA VIGO 5 working days, 1 mission each (total 15 working days) 2 representatives from Ministry of Interior 1 representative from Police Academy Activity Designing proposal of cybercrime curriculum for future basic police training (high school level) and university level education with emphasis on scientific research. Based on the gaps and needs analysis report MS STEs shall design a proposal for an appropriate curriculum at different levels of training of the criminal police officers including the latest technical advances in area of cybercrimes and according to the legislation in force, i.e. BC Criminal Code, BC Criminal Procedure Act, Council Framework Decision 2005/222/JHA of 24 February 2005 on attacks against information systems (to be replaced by Directive 2013/40/EU of the European Parliament and of the Council of 12 August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA, deadline for implementation by MS: September 2015), Council framework Decision 2004/68/JHA of 22 December 2003, Directive 2011/93/EU of the European Parliament and of the Council of 13 December 2011, Council of Europe Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data CETS No. 108, Council of Europe Convention on Cybercrime CETS No. 185, Council of Europe Convention on the Protection of Children against Sexual Exploitation and Sexual Abuse CETS No. 201, etc. Emphasis shall be made on scientific research, specifically these topics: Child Protection in the use of new technologies Investigation of Peer-to-Peer networks and darknet/deepweb communication channels System intrusions Internet fraud: e-commerce Phishing and Pharming Applications and problems with mobile phones Legal framework on cybercrime Non-cash payment fraud