Ref. Ares(2015)3076177 - 22/07/2015
EUROPEAN COMMISSION
DIRECTORATE-GENERAL
JOINT RESEARCH CENTRE
Directorate G - Institute for the Protection and Security of the Citizen
Global security and crisis management
Limited1
Support to Open Sources User Community
Enclosure: First Interim Report
c.c.:
DG HOME
JRC
1 This document is sensitive and limited for use within the European Union institutions, other offices and
agencies established by virtue or on the basis of the Treaties, EU Member States and public
administrations.
Distribution on need to know basis
Not for public dissemination. It is otherwise accepted to upload to ARES or other internal IT
systems
Where e-mail is used, this must be encrypted using SECEM
May be distributed to other EU institutions or MS
Further distribution on need to know basis allowed but must be aware that document is not
released outside EU institutions and MS public administrations.
EUROPEAN COMMISSION
DIRECTORATE-GENERAL
JOINT RESEARCH CENTRE
Directorate G - Institute for the Protection and Security of the Citizen
Global security and crisis management
Limited
Support to Open Sources User Community
First Interim Report
Administrative Arrangement
Between
DG Home Affairs (DG HOME)
No. HOME/2014/ISFP/AA/001-A1
and
Joint Research Centre (JRC)
JRC Contract No. 33362-2014 NFP
European Commission, Via Enrico Fermi 2749, I-21027 Ispra (Varese) - Italy. Telephone: (39)0332-78-
Office:
. Telephone: direct line (39)0332-78-5
. Fax: (39)0332-78-
E-mail:
Document History
Date
Author
Comments
27.04.2015
Initial draft
07.05.2015
Improved formatting
20.05.2015
Reformatted using EuroLook
link to page 6 link to page 6 link to page 8 link to page 8 link to page 8 link to page 9 link to page 9 link to page 9 link to page 9 link to page 10 link to page 10 link to page 10 link to page 10 link to page 10 link to page 10 link to page 11 link to page 11 link to page 11 link to page 13 link to page 13 link to page 15 link to page 15 link to page 16 link to page 17 link to page 17 link to page 17 link to page 17 link to page 17 link to page 18 link to page 19 link to page 19
TABLE OF CONTENTS
1.
INTRODUCTION ....................................................................................................... 5
2.
PROJECT PLAN AND WORK PACKAGES ............................................................ 5
3.
DELIVERED WORK PACKAGES ........................................................................... 7
WP 3.1.1.1 OSINT Workshop for MS practitioners ........................... 7
Deliverables: ........................................................................................ 7
WP 3.1.1.2: Workshop Evaluation ...................................................... 8
Deliverables: ........................................................................................ 8
WP 3.1.1.3: Workshop for EMM Institutional Users .......................... 8
Deliverables: ........................................................................................ 8
WP 3.1.2.3: On-site user training for existing and new users ............. 9
Deliverables: ........................................................................................ 9
WP 3.1.3.1: Operational updates EMM OSINT Suite ........................ 9
Deliverables: ........................................................................................ 9
WP 3.2.1.1 On-site operation support with JRC trained
experts ................................................................................. 9
WP 3.3.1 Inception Report ................................................................ 10
4.
PROJECT PLAN FOR THE NEXT MONTHS ........................................................ 10
5.
RISKS AND CHALLENGES ................................................................................... 10
6.
ANNEX ..................................................................................................................... 12
6.1. EMM OSINT Workshop 2014 (26.-28.11.2014) Participant List ................... 12
6.2. Workshop Feedback ........................................................................................ 14
1.1.1.
Feedback Questionnaire .................................................................... 14
1.1.2.
Feedback Results ............................................................................... 15
6.3. Meeting Minutes Institutional Users of EMM Meeting November
2014 ................................................................................................................. 16
6.3.1.
Introduction ....................................................................... 16
6.3.2.
EMM Developments ......................................................... 16
6.3.3.
News from Participants ..................................................... 16
6.3.4.
Shared Repository Discussion ........................................... 17
6.3.5.
Conclusions and Actions ................................................... 18
6.3.6.
List of Attendees................................................................ 18
1.
INTRODUCTION
The goals of the new Administrative Arrangement (AA) are as follows:
(1)
Improve the capabilities of Member States law enforcement authorities in the use
of open source information to combat crime and terrorism.
(2)
Support DG HOME’s strategic analysis and response capability with EMM tools
and accompanying services.
This new arrangement is a continuation of the work of previous collaborations which
started around seven years ago with the goal to increase the use of open source
information for law enforcement purposes.
The Joint Research Centre (JRC) has been involved in scientific research to improve
multilingual tools and applications for Open Source Intelligence. With the mandate of
DG HOME the JRC was able to transfer these research results into operational tools to be
used by Member State law enforcement authorities and EU institutions for the purpose of
gathering information from the Internet.
This interim report revisits the project plan, then outlines the delivered work packages
and finally gives an outlook of the project going forward.
2.
PROJECT PLAN AND WORK PACKAGES
The different work packages are described in the technical annex as well in the inception
report. The following table shows a consolidated overview of all work packages (WP).
Ref
Description
Planned Execution
Community of OSINT practitioners in law enforcement
WP
Workshop for OSINT practitioners
Nov 2014
3.1.1.1
Nov 2015
Oct 2016
WP
Workshop Evaluation
after each workshop
3.1.1.2
WP
Workshop for EU institutional users
Nov 2014
3.1.1.3
Disseminate JRC developed software tools
WP
Usage Evaluation EMM OSINT May 2015
3.1.2.1
Suite
WP
Dissemination EMM OSINT Suite
June 2015 - Oct 2016
3.1.2.2
WP
On-site user training EMM OSINT on request
3.1.2.3
Suite
link to page 13
The following work packages have been delivered so far:
OSINT Workshop November 2014
Institutional Users of EMM Workshop 2014
On-Site Support
EMM OSINT Suite operational update
3.
DELIVERED WORK PACKAGES
WP 3.1.1.1 OSINT Workshop for MS practitioners
Organise three workshops for law enforcement practitioners about the use of open source
information and its practical application.
Deliverables:
Three workshops for MS law enforcement authorities
Supporting event web site with online workshop material
The first workshop for OSINT practitioners was organised by the JRC in November
2014. The workshop was attended by 50 participants2. The workshop featured hands-on
trainings both for EMM server and EMM OSINT Suite and the following presentations
by experts from the Member States:
“Trendwatching”
Belastingdienst/FIOD/ Strategische OpsporingsInformatie, The Netherlands
The presentation gave an overview about how the Dutch tax authorities keep track of
new trends, such as electronic money (for example: Bitcoin).
“The Monitoring of the Internet within the Austrian Ministry of Finance”
Bundesministerium für Finanzen, Österreich
This presentation gave an overview of the organisational structure and tasks of the unit
which monitors tax and customs relevant sites, such as online shopping and auction sites.
2 The participant list can be found in the
6.1
link to page 15 link to page 16
“Development of Open Source Collaborative Working in UK Law Enforcement”
National Crime Agency, United Kingdom
The collaboration between different law enforcement authorities within the United
Kingdom was the topic of this talk. It explained how Open Source Intelligence is taught
and how practitioners work together and also gave an outlook for an initiative for pan-
European collaboration in the field.
“Elements of Assessment on Individuals’ Radicalisation and Influence on Facebook,
Twitter and Instagram”
Romanian Intelligence Service
This presentation demonstrated how radicalisation tendencies can be spotted using social
media sites and tools these sites offer.
WP 3.1.1.2: Workshop Evaluation
Evaluate workshop to improve subsequent events based on feedback of attendants.
Deliverables:
On or offline survey to evaluate workshop results
Evaluation of survey and results summary
Changes top next event format
After the workshop we conducted a feedback survey by sending out an assessment form.
The form and the results are availab
le in Annex 8.2.
WP 3.1.1.3: Workshop for EMM Institutional Users
Organise a workshop for EU institutional users of EMM to exchange best practices.
Deliverables:
One workshop for institutional users of EMM tools at JRC’s premises
The JRC organised a meeting for EU institutional users of EMM. Please find the meeting
minutes i
n Annex 8.3.
WP 3.1.2.3: On-site user training for existing and new users
Provide on-site trainings for new and existing users of the EMM OSINT Suite. This work
package can be requested by MS authorities to learn how to use the software or how to
adapt it to special use case scenarios.
Deliverables:
Updated and customised training material
On-site training delivery
No on-site training was requested by Member States.
WP 3.1.3.1: Operational updates EMM OSINT Suite
Provide a quarterly release to keep the software current.
Deliverables:
Quarterly bug fix release
Release notes and announcement mail
An operational update 2.32 was issued in January 2015. The next operational update is
planned for May 2015.
WP 3.2.1.1 On-site operation support with JRC trained experts
The JRC provides on-site experts in order to support on-going operations and to facilitate
the transfer of technical knowledge. The experts are based mainly in Brussels but have
the opportunity to work in Ispra at specific intervals to get updated with the latest
technical knowledge.
Deliverables (on-site):
Operations support to keep EMM tools running
Development of new categories, refinement of existing categories for DG HOME’s
areas of interest
Production of open source daily products
Reducing operational risks by proving latest expertise on the use of EMM tools
Facilitate understanding of the system
Deliverables (Ispra):
Training of the experts in the latest EMM products and developments
Remote support of the experts
The on-site support commenced continuing operation from a previous arrangement as
planned in January 2015.
WP 3.3.1 Inception Report
Submit inception report within one week after kick-off meeting, describing project plan
for the first 6 months, team composition and further results of kick-off meeting.
The inception report incorporating the kick-off meeting was delivered in January 2015.
4.
PROJECT PLAN FOR THE NEXT MONTHS
The work on the arrangement will continue as planned. The following work packages
will be delivered within the next months
WP 3.1.2.1: A survey for the users of the EMM OSINT Suite software will be
designed and conducted.
WP 3.1.3.1: The EMM OSINT Suite software will receive an operational update to
stay current.
WP 3.1.1.1 EMM OSINT Public Workshop with 2015 edition
5.
RISKS AND CHALLENGES
The execution of several milestones faces certain risks and challenges.
We have identified the following risks:
Lack of collaboration of MS authorities (especially OSINT Survey WP 3.1.2.1)
Lack of interest in our community offerings (Website, OSINT Field Manual)
Development of software tools not meeting user requirements
Software tools not meeting minimal quality standards
Lack of personnel resources
To mitigate the risks the following measures will be taken:
Increase communication and collaboration with MS authorities and community
through website and dedicated mailing list
Software will be tailored for law enforcement purposes to cover domain specific
requirements
Incremental software delivery process which allows changes to user requirements all
along the way
Systematic testing of tools and deliverables to ensure decent quality
Timely reporting and discussion of activities between JRC and DG HOME to ensure
effort is directed towards joint goals
6.
ANNEX
6.1.
EMM OSINT Workshop 2014 (26.-28.11.2014) Participant List
The workshop was well attended with around 50 participants.
SURNAME
NAME
E-mail
AFFILIATION
Counter Terrorism Centre HR
Arma dei Carabinieri IT
Polícia Judiciária PT
Central Unit of Intelligence
Analysis RO
Ministry of Interiore FR
Ministry of the Interior NL
Council of the European
Union
Belastingdienst Internet
Service Centre
European Commission
Customs National Office NL
Council of the European
Union
Council of the European
Union
European Commission
Swedish customs SE
UAS Leiden
Council of the European
Union
VSSE-BE
Nationa Crime Agency UK
Tax Authorities SE
Ministry of the Interior CZ
EU ECDC
Ministry of the Interior CZ
Customs National Office NL
Customs National Office NL
Council of the European
Union
Irish Police
Counter Terrorist Center HU
JRC Ispra
JRC Ispra
IAEA
Ministry of Interior FR
EU Europol
EU Frontex
JRC-Ispra
EU OHIM-Alicante
Council of the European
Union
Ministry of Defence IT
European Commission
Belgian Customs / Cybersquad
JRC Ispra
Federal Ministry of Finance
AT
POLÍCIA JUDICIÁRIA PT
Council of the European
Union
JRC Ispra
Romanian Intelligence Service
JRC Ispra
European Commission
6.2.
Workshop Feedback
1.1.1.
Feedback Questionnaire
(3)
Agenda
(a)
The agenda (duration, structure, discussion vs speakers) was appropriate
for the event
(4)
Speakers
(a)
Speakers were professional and their knowledge of the subject was
appropriate
(b)
Presentation style was suitable for the event
(c)
Speakers covered all expected topics
(d)
Time for questions and discussion was sufficient
(5)
Documentation
(a)
Material covered all topics
(b)
Structure and layout was appropriate (i.e. easy to read, understandable,
etc.)
(6)
Facilities and Services
(a)
Presentation aids and room equipment were appropriate
(b)
Facilities (incl. room layout, group meeting rooms, etc.) were functional to
the purpose
(c)
Technical support staff was available when needed
(7)
Before the Event
(a)
Necessary information and enough support were available
(8)
Overall Outcome of the Event
(a)
My expectations about the event were met
(9)
Other comments and suggestions
For each question, the participant had the following answering options:
1
2
3
4
5
not agree at all not agree neutral agree to some extent fully agree
1.1.2.
Feedback Results
We received 15 returned forms from 46 external participants.
Question ID
Question
Average Score
Agenda
The agenda (duration, structure, discussion vs 4,27
speakers) was appropriate for the event
(1) (a)
Speakers
Speakers were professional and their knowledge of 4,73
(2) (a)
the subject was appropriate
(2) (b)
Presentation style was suitable for the event
4,60
(2) (c)
Speakers covered all expected topics
4,33
(2) (d)
Time for questions and discussion was sufficient
4,73
Documentation Material covered all topics
4,40
(3) (a)
(3) (b)
Structure and layout was appropriate (i.e. easy to 4,47
read, understandable, etc.)
Facilities and
Presentation aids and room equipment were 4,73
Services
appropriate
(4) (a)
(4) (b)
Facilities (incl. room layout, group meeting rooms, 4,67
etc.) were functional to the purpose
(4) (c)
Technical support staff was available when needed
4,80
Before
the Necessary information and enough support were 3,73
Event
available
(5) (a)
Overall
My expectations about the event were met
4,60
Outcome
(6) (a)
6.3.
Meeting Minutes Institutional Users of EMM Meeting November 2014
The workshop, jointly organised by DG HOME and JRC, brought together EU
Institutional users of the European Media Monitor (EMM) Applications active in the area
of security.
The main objective of the workshop was to discuss the requirements for a repository of
categories shared between the institutional users of EMM.
6.3.1. Introduction
The workshop was opened by
, JRC) who reminded the
participants of the aims of the series of meetings of EU Institutional Users of EMM:
Establish synergies in the definition of categories of interest,
Share best practises on the dissemination of information,
Share users’ needs with a view to guide the further development of EMM,
Create a repository where EMM users can share categories of common interest.
noted that there have been two main outcomes so far: a decision that it would be
useful to have a repository for shared categories, and a newsletter to inform participants
of new and planned EMM developments. She invited feedback on the newsletter, and
agreed that the previous edition would be made available on the website.
The specific aim for this meeting was to move towards more practical discussions on
how categories could be shared between institutions.
6.3.2. EMM Developments
JRC) presented the latest EMM developments, including the
use of social media, a Big Screen application, work on trend analysis and various
improvements throughout the system. These will feature in the next issue of the
newsletter.
6.3.3. News from Participants
, Europol) noted the interest of Europol to host their own EMM
installation, and perhaps to make it available to
. The Europol EMM is currently
housed at the JRC, and
described some of the practical issues making a move to
Europol difficult.
went on to announce that he would be leaving Europol at the end of 2014 to take up a
position in Germany.
Frontex) announced that
would be leaving
Frontex at the start of 2015.
6.3.4. Shared Repository Discussion
(JRC) presented the current JRC plans for the implementation of a shared
repository. This provided the basis for a lively discussion between all participants on how
best to share categories and manage their evolution.
Many points were covered, including:
The shared repository will build on the existing functionality of the category editor
and the workgroups defined in NewsDesk by adding a further level, sharing of
categories between institutions and the shared repository. Only those categories
chosen to be shared will be present in the shared repository, and will be visible only to
the owner, JRC, and other institutions chosen from a list of trusted partners. As new
institutions join the repository, existing members will decide whether or not to add
them to their list of trusted partners
.
The best granularity of categories for sharing – probably the best would be to share
categories matching a fairly tightly defined concept, such as the JRC country alerts,
which can then be combined to give specific results.
Management of updates by other users – once a category owner has shared a category
and allowed editing by others, should these edits go through moderation by the owner,
or would that risk slowing things down too much? The consensus was that moderation
would be needed.
The advantages of an iterative approach. Providing shared read-only access to each
other’s categories would already be very useful and might be used in a first prototype
of the system.
Incentives for sharing categories – why should institutions upload their categories?
JRC, as system experts, will be happy to check the organization and suggest
improvements to categories, but JRC does not have the domain or language expertise
needed to certify or quality stamp categories. The main expected benefits are to
receive suggested improvements from other EMM users, and to gain to increase the
pool of ‘building blocks’ from which further categories can be constructed.
The importance of category evolution over time was stressed, for example an alert on
Hacking would need to match the names of new groups as these appear. Having
access to categories maintained by others is a key advantage of the shared repository.
6.3.5. Conclusions and Actions
The main conclusions and actions of the workshop were:
The common interest in exploring synergies on categories was confirmed, and further
discussions based on a prototype system will be held at the next meeting, to be hosted
by Frontex towards the end of Q2 2015.
Discussions between experienced EMM users on best practice and future requirements
are very useful to all, and enough time should be allocated in future meetings to
encourage them.
JRC will continue with the definition and development of the shared repository
system, with the aim of having a prototype system in place for the next meeting.
Participants were encouraged to provide any further suggestions for functionality to
the JRC as early as possible.
6.3.6. List of Attendees
Person
Organisation
Email
JRC-ISPRA
@ec.europa.eu
DG HR-DS
@ec.europa.eu
JRC-ISPRA
@jrc.ec.europa.eu
EUROPOL
@europol.europa.eu
FRONTEX
@frontex.europa.eu
HOME-EXT
@ext.ec.europa.eu
JRC-ISPRA
@jrc.ec.europa.eu
JRC-ISPRA
@ec.europa.eu
HOME-EXT
@ext.ec.europa.eu