Digital Investigations

Scope: Proposals should focus on: Enhancing the operational capacity of law enforcement and/or judicial authorities to investigate cyber-attacks and cyber enabled crime, for instance through specific training, investigative techniques and tools (including for) with a focus on top threat priorities (excluding online child sexual abuse, which is covered by specific calls for proposals) as presented in Europol Internet Organised Crime Threat Assessment 2025.

Areas that have been identified by EU Member States as needing particular attention include: digital forensics (mobile forensics, computer forensics, network forensics, IoT forensics including automotive forensics, cloud forensics), visual data analysis, malware analysis and reverse engineering capabilities, cryptocurrencies tracing, identifying and disrupting criminal infrastructures, analysis and seizure, efficient storage, processing, analysis and transfer of big data and large datasets, understanding and exploiting “threat intelligence” and metadata, OSINT, crime involving the use of AI by offenders.

Enhancing the operational capabilities of law enforcement and/or judicial authorities to address the challenges posed by the use of encryption by criminals and its impact on criminal investigations, for instance through training and/or by supporting the establishment, extension and development of points of expertise and their networking at EU level or supporting the development of a toolbox of alternative investigation techniques to obtain needed information encrypted by criminals (with the exclusion of measures that could weaken encryption in general or could have an impact on a larger or indiscriminate number of people) Enhancing the capabilities of law enforcement and/or judicial authorities through the use and/or adaptation of Large Language Models and AI-based solutions to improve analysis, translation, transcription of data as well as detection of AI materials generated for criminal pruposes.

Enhancing the operational capacity of law enforcement and/or judicial authorities to cooperate across borders, for instance supporting the gathering and provision of digital evidence, supporting the secondment of officials, improving the efficiency of 24/7 (permanent) law enforcement contact points for cybercrime, establishment of dedicated platforms Enhancing the cooperation between private entities and/or authorities in the area of cybersecurity and law enforcement and/or judicial authorities, taking remedial action, including by setting of appropriate information exchange systems (or interfaces to make better use of existing systems) Increasing and enhancing reporting of cybercrime to law enforcement authorities