A/CONF. 187/10 National laws may impose different restricting conditions to be carried out by making use of system functions or here. In addition, the faithful and precise execution of the specific computer programs. Searching for data in judicial order may take a disproportionate amount of time, transmission can be done by system facilities (monitoring), leading law enforcement authorities to make a copy of as if provided for, or by technically intercepting the data flow much data as seems relevant for later analysis. National somewhere in the transmission facilities. Since data are in laws may or may not allow such a practice. Another many cases both stored and in transmission, or move important question is whether the person concerned should frequently from one status to the other, it will often be be informed about the data that are copied and taken away, possible for investigators to choose between seizure and how much detailed information should be provided and interception to obtain the same data. This may raise legal whether he or she should have a right to challenge the concerns, because the standards or safeguards which apply seizure legally. A further problem arises if data are under to the interception of communcations and the seizure of privilege or other legal protection. The question is how to stored materials are not the same in many States. The identify and protect such data in cases where authorities interception of data in transmission is often subject to a copy large amounts of data for later examination stricter standard because interception is a covert operation, 36. In addition, it should be noted that data are of a it may target data that did not exist when the search was volatile nature. They can be easily moved, erased or authorized or when it commenced and, in most cases,the altered without clear traces remaining. Distributed data parties concerned would not be aware of the interception processing is not the only factor that makes data volatile. and might not be informed of it, if at all, until long after it Electronic data processing involves the processing oflarge had taken place. The fact that network data can be either amounts of data of an ephemeral nature that are subject to seized or intercepted may erode the rights of suspects in erasure as soon as they are no longer necessary. Examples some cases, since it would allow law enforcement to apply of such data are log files and communication traffic data less restrictive legal search powers to some operations that Without knowledge of the"original "data set (if the term were more in the nature of interceptions has any meaning in data processing), it is difficult to detect 38. Electronic data, copied from data files or registere manipulations and restoring deleted files will be from data flows, usually demand special precautions and mpossible unless underlying back-up information was measures in order to serve as evidence in court, if it may be kept. The nature of data raises problems when physical used as such at all. In many justice systems, the principle searches are involved of immediateness that is. that all evidence should be (a) The search for data, electronically stored or presented in court, requires that the evidential material being transferred, in most cases needs to be carried out meet a very high standard. Some countries may have quickly and in a timely er in order to prevent formal requirements that impede or prevent the use of interference with the search or tampering with the data electronic data as evidence. Some laws require that the material be in writing so that it can be read in court, for (b)Special precautions need to be taken in order to example. In some countries, data representing sound or enable data to be presented as evidence in court. The images would not meet this condition and would therefore integrity of the data must be established from the point of not be admissible. Any doubt about the reliability of downloading or copying from the searched computer evidential material will also generally make it system to use in court inadmissible Since electronic data can easily be modified 37. The technical and legal distinctions between the without leaving traces, this puts a heavy burden on law seizure of stored data and the interception of data flowing enforcement authorities to gather such evidence according through the network have also become blurred. Data are to transparent and secure procedures that enable them to processed by means of a computer system, sometimes establish its authenticity. To verify authenticity, the court described as an automated data-processing device. Data must be able to review the reliability of the process of processing includes input, transfer to peripheral equipment copying and registering the evidence from the original data (e.g. video screen)and intermediate storage media, actual carrier or data channel. It must also be able to test the processing, transmission of the results to peripheral validity of( a)the preservation procedure and security of devices for storage and output or further transmission to the preservation itself, (b)any analysis of the material; and other system components. Intercepting data in a computer (c)whether the material presented in court matches the system generally comes down to the search for stored data. material originally seized and securedA/CONF.187/10 9 National laws may impose different restricting conditions here. In addition, the faithful and precise execution of the judicial order may take a disproportionate amount of time, leading law enforcement authorities to make a copy of as much data as seems relevant for later analysis. National laws may or may not allow such a practice. Another important question is whether the person concerned should be informed about the data that are copied and taken away, how much detailed information should be provided and whether he or she should have a right to challenge the seizure legally. A further problem arises if data are under privilege or other legal protection. The question is how to identify and protect such data in cases where authorities copy large amounts of data for later examination. 36. In addition, it should be noted that data are of a volatile nature. They can be easily moved, erased or altered without clear traces remaining. Distributed data processing is not the only factor that makes data volatile. Electronic data processing involves the processing of large amounts of data of an ephemeral nature that are subject to erasure as soon as they are no longer necessary. Examples of such data are log files and communication traffic data. Without knowledge of the “original” data set (if the term has any meaning in data processing), it is difficult to detect manipulations and restoring deleted files will be impossible unless underlying back-up information was kept. The nature of data raises problems when physical searches are involved: (a) The search for data, electronically stored or being transferred, in most cases needs to be carried out quickly and in a timely manner in order to prevent interference with the search or tampering with the data; (b) Special precautions need to be taken in order to enable data to be presented as evidence in court. The integrity of the data must be established from the point of downloading or copying from the searched computer system to use in court. 37. The technical and legal distinctions between the seizure of stored data and the interception of data flowing through the network have also become blurred. Data are processed by means of a computer system, sometimes described as an automated data-processing device. Data processing includes input, transfer to peripheral equipment (e.g. video screen) and intermediate storage media, actual processing, transmission of the results to peripheral devices for storage and output or further transmission to other system components. Intercepting data in a computer system generally comes down to the search for stored data, to be carried out by making use of system functions or specific computer programs. Searching for data in transmission can be done by system facilities (monitoring), if provided for, or by technically intercepting the data flow somewhere in the transmission facilities. Since data are in many cases both stored and in transmission, or move frequently from one status to the other, it will often be possible for investigators to choose between seizure and interception to obtain the same data. This may raise legal concerns, because the standards or safeguards which apply to the interception of communcations and the seizure of stored materials are not the same in many States. The interception of data in transmission is often subject to a stricter standard because interception is a covert operation, it may target data that did not exist when the search was authorized or when it commenced and, in most cases, the parties concerned would not be aware of the interception and might not be informed of it, if at all, until long after it had taken place. The fact that network data can be either seized or intercepted may erode the rights of suspects in some cases, since it would allow law enforcement to apply less restrictive legal search powers to some operations that were more in the nature of interceptions. 38. Electronic data, copied from data files or registered from data flows, usually demand special precautions and measures in order to serve as evidence in court, if it may be used as such at all. In many justice systems, the principle of immediateness, that is, that all evidence should be presented in court, requires that the evidential material meet a very high standard. Some countries may have formal requirements that impede or prevent the use of electronic data as evidence. Some laws require that the material be in writing so that it can be read in court, for example. In some countries, data representing sound or images would not meet this condition and would therefore not be admissible. Any doubt about the reliability of evidential material will also generally make it inadmissible. Since electronic data can easily be modified without leaving traces, this puts a heavy burden on law enforcement authorities to gather such evidence according to transparent and secure procedures that enable them to establish its authenticity. To verify authenticity, the court must be able to review the reliability of the process of copying and registering the evidence from the original data carrier or data channel. It must also be able to test the validity of (a) the preservation procedure and security of the preservation itself; (b) any analysis of the material; and (c) whether the material presented in court matches the material originally seized and secured