Introduction

This document presents the metadata that should be considered for automating the custody transfer of digital evidence items within a digital Chain of Custody (dCoC). The goal is to provide guidelines for a standardized metadata structure for auditing the custody transfer between stakeholders. These guidelines intend to support data integrity and to ensure compliance with business rules in each custody transfer point (CTP).

The proposed data structure is designated as Digital Custody Metadata (DCM). It is an essential tool for auditing the data governance workflow, providing a digital log with information about who has custody and how that custody was transferred between stakeholders. Such information should be admissible in administrative, disciplinary, and judicial proceedings. If a digital log of each custody transfer is not preserved, the evidence presented in court may be challenged and ruled inadmissible. Therefore, the goal is to provide guidelines for a non-repudiation digital log, ensuring a standard data structure for data management and auditing.

In order to understand who holds a CBRNE digital evidence item within each CTP lifecycle, the DCM should provide comprehensive information. This information encompasses details about the location and timing of the custody transfer, identification of the custody owner and receiver, and metadata about the package used for transporting the digital evidence items. Additionally, the DCM should provide insights into the status of the CTP, including information about successfully executed CTPs and triggers for situational awareness.

In this domain, actions related to situational awareness that necessitate the involvement of the Mission Command Team or pertain to suspicious situations potentially jeopardising the integrity of the DCM should be highlighted. These actions warrant specific instructions on how to proceed with the custody transfer. In such instances, the CTP dendrogram should clearly outline the particular CTP node that triggered the alert.

This document focuses on the CBRNE digital evidence item transport lifecycle, from collection to its final destination. Sample collection techniques, preservation and packaging procedures are outside the scope of this document as they are well documented in existing standards. A well-documented dCoC should be established through a data governance process and with guidelines to ensure the integrity of the DCM for each CTP in the dCoC process.

This Part 2 should be considered alongside with Part 1 - Overview and concepts. Together with Part 1 - Overview and concepts - it is possible to obtain a complete understanding of the custody transfer lifecycle.

PD CEN/TS 18053-2:2024

Digital Chain of Custody for CBRNE Evidence - Data Management and Audit

Current

Published:

30 Sep 2024