MPS – Digital, Cyber and Communications Forensics Unit Information for Prospective Bidders Version 4.4 12 June 2015 Page 1 of 21 ©MPS NOT PROTECTIVELY MARKED Contents 1.0  About Us .....................................................................................................3  2.0  What We Require........................................................................................4  3.0  Key Challenges and Drivers........................................................................7  3.1  Increased Technology Diversity and Sophistication.................................7  3.2  Handling Operational Peaks and Troughs ...............................................7  3.3  Research & Development ........................................................................8  3.4  Intellectual Property Rights Exploitation...................................................9  4.0  Current Arrangements.................................................................................9  5.0  Historic and Volumetric Information ............................................................9  6.0  Benefits of Operational Transformation.....................................................12  7.0  Digital Forensics Information Platform ......................................................13  8.0  Delivery of Digital Forensics Services Nationally ......................................15  Attachments........................................................................................................16  Attachment 1 ...................................................................................................17  Attachment 2 ...................................................................................................18  Attachment 3 ...................................................................................................19  Attachment 4 ...................................................................................................20  Attachment 5 ...................................................................................................21  Page 2 of 21 ©MPS NOT PROTECTIVELY MARKED 1.0 About Us The Metropolitan Police Service (MPS) Digital, Cyber and Communications Forensics Unit (the Authority) is a key component of the total forensics capability (Forensic Services) within the MPS and reports to the Director of Forensic Services. The provision of efficient and effective forensic services plays a key role in helping the MPS to achieve its priorities and objectives to thoroughly investigate all crimes. Devices and media are seized for forensic analysis in all areas of crime investigation and policing, from volume crime cases such as burglary and drugs offences to serious crime cases such as homicides and terrorism. Forensic Services provide comprehensive support from crime scene to court and are defined as those that fall within scope of the forensic regulation (digital and traditional) and that provide expert opinion within Rule 33 of the Criminal Procedure Rules. The construction of new, state of the art forensic laboratories will enable the co-location of all non-scene forensics services into Lambeth, South East London. This project is currently expected to be completed by Q1, 2016. The Authority is acknowledged within UK law enforcement as having one of the most advanced, innovative and successful digital forensics departments, with a national and international reputation as one of the world leaders in digital forensics. The Authority regularly contributes to training and technical innovation nationally and internationally. There are over 150 internal digital forensics staff supplemented by external support and resources from a number of external commercial digital Forensic Service Providers (FSP). These resources are managed by an experienced senior management team currently located in New Scotland Yard and Newlands Park as outlined in the organisation diagram (see Attachment 2). The Forensic Service’s mission is to support the effective delivery of the MPS’ business strategy and its constituent goals of; crime reduction, promoting public safety and enhanced citizen focus, meeting sanction detection targets, cost reduction, compliance and enhancing the organisation’s detection and prosecution capabilities. The Forensic Service is regarded as a trusted partner to frontline policing in providing a reliable and agile service. It not only responds actively to emerging business requirements but also acts as a change catalyst bringing new ideas to the wider business as to how digital forensics can be used to improve operational efficiency and effectiveness. In this context R&D based around casework is key to maintaining the capability to address more complex forensics challenges and in bringing new solutions to the examination of volume devices in the field. Page 3 of 21 ©MPS NOT PROTECTIVELY MARKED MPS has a number of key assets that make up and potentially enhance its digital forensics capability. These are set out below: ƒ ƒ ƒ ƒ ƒ 2.0 State of the art modern well equipped forensics laboratory facilities at Lambeth, South East London. 153 Staff comprising digital forensics; technicians, examiners, subject matter experts, analysts, managers, etc. Credibility in liaising with other UK and international law enforcement agencies. Links to operational policing to observe field requirements (crime scene, custody suite, etc.) and test new solutions. High and growing volume of digital forensics cases with the opportunity to insource work from other law enforcement agencies. What We Require Under the Met Change programme, strategies were developed to transform digital forensics services into the ‘Next Generation’, enhancing delivery effectiveness and efficiency and empowering frontline police officers to directly access information on digital devices seized during investigation. The proposed new Authority operating model (Attachment 1) provides three levels of service, supported by an external Managed Service Provider, to enable a move away from traditional central lab-based examinations and towards the provision of rapid resolution of most devices through frontline services, significantly reducing timescales and increasing investigative flexibility and agility for frontline officers. The strategic initiative to appoint a digital forensics service provider partner from the private sector is intended to help support the Mayor’s 20/20/20: to reduce crime by 20%, improve public confidence by 20% and cut costs by 20%. The three levels of service can be summarised as follows; Level Service Level 1 Frontline Self Service Kiosks (SSKs) Level 2 Frontline Supported Service (Hubs) Description Forensic analysis carried out by police officers using locally based SSKs Forensic analysis carried out with the support of or by the Authority’s digital forensic technicians and assistants and providing for police officers to be assisted and trained to perform their own downloads. Page 4 of 21 ©MPS NOT PROTECTIVELY MARKED Level 3 Laboratory More complex, lab-based forensic analysis carried out by digital forensic technical experts and analysts, including casework and R&D. Device examinations will be performed within one of the three levels of the Authority’s operating model as follows: Level 1 comprises all MPS sites, typically custody suites that house digital forensics SSKs and other frontline self-support tools. SSKs are typically available to frontline police 24x7 (unlike Hubs, see below). The MSP will deliver support services (maintenance and ‘break fix’) directly or indirectly to ensure that kiosk availability is maintained at a level agreed with the Authority. Further the MSP will deliver training to frontline police officers and specialist units to enable them to use the kiosks in the most effective manner. At the inception of a partnership arrangement the kiosk contacts will be novated to the MSP. The MSP will determine the most appropriate (effective and cost efficient) SSK solution and deliver this to the Authority and source the kiosk equipment accordingly. The MSP will allow for an appropriate (likely 12 month) transition period for any change to the primary kiosk supplier. Level 2 comprises eight dedicated digital forensics Hubs and four Falcon (cybercrime hubs manned by trained cybercrime investigators) sites distributed throughout the MPS to which at least a further four Hubs will be added. Generally, a Hub site is equipped with 4 SSKs, supported by a team of Authority staff comprising; a Digital Forensic Specialist, two or three digital forensics technicians and three or four technical assistance professionals. Each pair of digital forensic hubs is managed by a senior digital forensic specialist advisor, employed by the Authority. Hubs are generally open for a maximum of 15 Hrs 07:00 to 22:00 during weekdays depending on location and for shorter periods at weekends. The MSP will deliver support services (maintenance and ‘break fix’) directly or indirectly to ensure that availability of Hubs is maintained at a level agreed with the Authority. The MSP will ensure that kiosk equipment and processes are fully validated and quality assured in compliance with ISO17025 whether they are being used at Level 1 or Level 2. Level 3 activities are those procedures that are carried out within the MPS digital forensic laboratory (see Figure 1), an external commercial FSP laboratory or in some cases at a crime scene. Volume devices like phones and computers that are atypical (not from a mainstream manufacturer), Page 5 of 21 ©MPS NOT PROTECTIVELY MARKED have been password protected or encrypted will usually be escalated to the Authority’s Digital Forensics laboratory for examination. Eighty five percent of these are currently outsourced to one of a number of FSP’s. The MSP will put in place capabilities to dramatically reduce the amount of outsourcing undertaken by the Authority. The MSP will determine the most effective and efficient approach to contracting for any FSP services. The more complex high-end procedures like chip-off are also performed by the Authority’s senior technicians in the laboratory. The MSP will support the Authority by providing skills and expertise in the execution of complex examinations. The MSP will be responsible for determining the appropriate allocation of volume and specialist examinations and casework. The MSP should expect the scope of casework to expand over time to include, but not be confined to, vehicles, smart TV’s, smart watches, smart meters, etc. and will have the capability to follow market trends. Figure 1. Tier 3 Core Activities ƒ R&D projects are undertaken on a handful of programmes agreed with the authority. These focus on specific technologies that are likely to yield valuable investigative intelligence and evidence in the next 2 -5 years. Research & Development Business as Usual Casework Development ƒ Business as Usual comprises devices submitted from Hubs or SOC work that requires urgent resolution, or procedures that cannot be handled within Hubs. Excessive volume devices may be escalated to Tier 3. ƒ Casework Development involves working out tactical technical solutions to enable data retrieval from seized devices that are protected, damaged or out of the ordinary. The MSP will take responsibility for the outcome of R&D projects within the scope of the technology themes agreed between the Authority and the MSP. The overriding objective of these programmes is to maintain and if possible increase the proportion of devices that can be successfully examined at Levels 1 & 2. One of the MSP’s KPI’s will be maintaining the proportion of examinations that can be completed at Level 1 and Level 2. It is therefore a key requirement for Level 3 to deliver innovation and continuous process improvements to the frontline. Page 6 of 21 ©MPS NOT PROTECTIVELY MARKED 3.0 Key Challenges and Drivers The key objective is to enable frontline officers faster and easier access to digital information in order to improve the operational effectiveness and efficiency of frontline police resources through better use of tools, technology and improvements in process. The use of digital information for intelligence and as evidence in gaining criminal convictions is vital and trends suggest this source will become even more important in the future to deliver results and further improve outcomes. The MPS believes that a partnership with a commercial forensics service provider will contribute substantially to supporting the MPS in meeting its key objectives in the following areas: Increased Technology Diversity and Sophistication 3.1 The volume and complexity of digital technologies is forecast to increase rapidly over the planning period of the proposed Next Generation digital forensics model. In addition, the use of these technologies will become increasingly sophisticated such that devices are not used in a stand-alone manner but are linked to an internet of things using machine-to-machine communications. Social media will evolve as the primary communications medium gradually replacing fixed and even mobile voice communications. Key business drivers: 3.2 • Forecast for continued strong growth in demand for forensic examination of all types of digital device (average growth rate estimated at 7 percent per annum). • Need to contain budget spend on forensics interventions. • Need for quicker resolution of volume crimes where digital evidence is available. • Support achievement of the MOPAC’s 20:20:20 challenge: crime reduction, increasing public confidence and cutting costs. Handling Operational Peaks and Troughs Peaks in demand can occur due to a large scale or national investigations, these can currently only be handled through FSP’s with significant delays. The capability to resource large scale and prolonged investigation without adversely impacting ongoing frontline support is an important driver for change. Fluctuations in demand (e.g. News of the World investigation, device seizures related to suspected Child Sex Abuse), typically reduce capacity for business as usual requirements and impact response time particularly at Level 3, laboratory support. Page 7 of 21 ©MPS NOT PROTECTIVELY MARKED As the FSP market has contracted in size over the past four years it is increasingly difficult for any single FSP to deliver a very high volume of digital device examinations within a relatively short time frame. If recourse to the FSP market is required then this needs to be choreographed using multiple suppliers. Ideally increased automation of processes to handle volume devices will support peaks of demand driven by unanticipated events. 3.3 Research & Development It is vital that policing maintains its own R&D capability that will enable forensic examiners to keep pace with the rapid development of digital technologies. The Authority will be looking to utilise this in house expertise and enhance it with the capability of external commercial suppliers, universities and specialist science institutes to develop digital forensics solutions that will enable frontline policing to continue to obtain intelligence and evidence from digital sources. The Authority intends to work with the future Managed Service Provider to deliver an R&D Programme that will consist of a small number of focused ‘Themes’. These will be in areas of technology that are forecast to present significant challenges to digital forensics examiners in being able to assist police officers with their enquiries into suspected criminal offenses. The Themes within the programme will be evaluated periodically to ensure that they are of the highest value to policing outcomes. Themes that no longer qualify under the value evaluation criteria may be suspended or terminated. New Themes will be adopted into the programme as and when they meet the Authority’s aims and priorities. The initial programme envisages six key digital forensics R&D Themes: • Security, encryption & passwords • Smart devices and embedded systems • Automotive electronics • Cloud computing • Facial recognition • Cyber, WiFi and networks There will be a strong focus on development and innovation to lead digital forensics forward, reflecting the Authority’s aims of better enabling frontline policing. Page 8 of 21 ©MPS NOT PROTECTIVELY MARKED 3.4 Intellectual Property Rights Exploitation As a result of its casework and research the Authority has developed a number of digital forensics solutions and tools. In collaboration with commercial partners some of these IPR have been developed into products, to the point that they could be taken to market. Market research suggests that two products, derived from the Authority’s IPR, could be developed into commercial offerings; a Universal Memory Tool (UMT) enabling access to data on memory chips and FOCUS an evidence presentation. The Authority would be interested in exploiting the commercial potential of its current and future IPR to generate income for further R&D. The MSP may have, or develop IPR that, combined with that of the Authority, could contribute to the development of digital forensics solutions. If a product evolves to the extent that it can be commercialised, then the Authority and the MSP would agree an appropriate division of the proceeds of sales. 4.0 Current Arrangements The Authority rolled out Self Service Kiosks to eighteen of the MPS boroughs in mid-2012 with 350 frontline officers being trained in the use of the equipment. The roll out of Hubs commenced mid-2014 and will be completed by the end of 2015. On completion of the full implementation in March 2016 there will be SSKs in all 32 MPS Boroughs and 12 Hubs (8 MPS and 4 MPS Cyber Crime Unit Falcon), some of which may be co-located. The SSKs (Aceso units) are currently rented and maintained under an existing third party arrangement with Radio Tactics. The Authority has existing contracts with 15 FSPs for the provision of analysis of electronic and digital devices (lab based services (Level 3) via a Home Office framework and a video analysis contract. These arrangements are due to expire in April and July 2016. 5.0 Historic and Volumetric Information The MPS handles over 28 percent of the total volume of UK policing digital forensics exhibits, see Figure 1. By comparison the next largest UK police force (Greater Manchester Police) handles 8 percent. The generally higher volume growth experienced by MPS in Greater London and the increase in examinations conducted for other UK forces means that its share of UK digital forensics for policing continues to increase over time. Page 9 of 21 ©MPS NOT PROTECTIVELY MARKED Figure 2. UK Police - Digital Forensics Examinations Source: UK Crime Statistics / Surveys / Gartner The scale of the Authority’s operations (over 45,000 device examinations annually) means that it must sustain a strong learning curve as it tends to experience early exposure to new technology challenges, requiring development of innovative access and investigation techniques and methods. Figure 3 and Table 1, show the total numbers of digital device examinations by category for volume exhibits over the past five years. As shown in the diagram the introduction of Self Support Kiosks (SSKs), in the form of a pilot in 2012, has sharply reduced the volume of phone examinations and to a lesser extent computer examinations via the laboratory and FSP’s. Roughly 85 percent of volume phones and computers submitted to the laboratory are outsourced to FSP’s for examinations. Page 10 of 21 ©MPS NOT PROTECTIVELY MARKED Figure 3. Trend in Volume Digital Device Examinations Source: MPS Table 1. Trend in Volume Device Examinations Examinations / Year Phones (via Lab/ FSP) Phones (via SSK) Computers Computers (via Hub) Video Audio Total 2009/10 19,892 2010/11 21,039 7,256 2011/12 22,929 0 7,132 2012/13 18,529 13,452 6,203 8,402 4,648 3,801 36,743 4,796 2,564 35,655 5,336 2,794 38,191 5,101 2,135 45,419 2013/14 2014/15 14,129 10646 15,706 17508 5,273 3749 0 219 4,866 5000 1,475 1500 41,449 38,622 In addition to volume examinations, the Authority undertakes a range of complex digital examinations, including cell site analysis, facial recognition, satellite navigation systems, trackers, chip off – simple and chip off - complex (involving multiple chip transfers). The laboratory also deals with a wide range of specialist and emerging device forensics, for example, automotive systems. Table 2, provides a high level profile of the scope of the ‘business as usual’ workload that a commercial partner would be involved in delivering alongside the Authority. The volumes are annual minimum and maximum estimates based on forecast growth from the current digital forensics workload. It must be noted that the Authority neither warranty the accuracy or completeness of this information. Page 11 of 21 ©MPS NOT PROTECTIVELY MARKED Table 2. High Level Workload (annual volumes 2016/17) Task Min Max Kiosk sites supported Hub sites supported Mobile Device Examinations (Level 3) Computer Examinations (Level 3) Cell Site Analysis Specialist Audio & Video analysis Chip off - simple Chip off - complex 32 10 3500 2000 300 50 60 25 98 14 7000 5000 500 100 80 40 6.0 Benefits of Operational Transformation The use by MPS of SSKs and Hubs over the past few years has demonstrated major operational and financial benefits. Among these are: • • • • • • • Within the current hubs, over 90% of examinations result in interventions that facilitate; charging (31% of cases), elimination (7%) and line of inquiry intelligence (52%). A 40% increase in the number of mobile device examinations undertaken (demonstrating latent frontline demand). Reduction in bail applications to return annual savings >£1.2m (2013 est.). Officer travel and in transit cost annual saving £0.9m. Reduction in cost of outsourcing device examinations £3.4m. Reduction in harm resulting from crimes perpetrated by guilty parties while on bail. Provides evidence to charge criminals at high risk of jumping bail (e.g. foreign nationals, persons of no fixed abode). These results should further improve with the full roll out of SSKs and Hubs across MPS and the increased familiarity and confidence of frontline users of this equipment. However, in the medium term this initiative will primarily address the examination of mobile devices computers and CCTV. The Authority is aware that in order to maintain frontline capability in digital device investigation there will be a need to continuously improve forensic technology tools (SSKs) and the training of equipment users. In addition, the Authority must be proactive in developing the ‘Next Generation’ of digital forensics capabilities, to support MPS and UK law enforcement. These must address the top-end of casework R&D requiring the most advanced digital Page 12 of 21 ©MPS NOT PROTECTIVELY MARKED forensic capabilities to extract and interpret data stored on all types of electronic devices and in the cloud. 7.0 Digital Forensics Information Platform The ingestion of data from tens of thousands of digital devices annually at dozens of different locations introduces a complex data management challenge. MPS needs the capability to effectively and efficiently manage data through its life cycle, this will vary from deletion within days of capture to maintenance for an indefinite period extending for many years. The data must be available for analysis and evidential purposes to authorised personnel while it relates to active investigations and prosecutions. Crime data will be retained after a case is closed, retention periods will depend on the crime type but could extend to years which will necessitate long term archiving of data. Currently, the SSKs, Hubs and the Lambeth laboratory facility use a variety of media on which to store data extracted from devices under investigation. There is an active project in place, as part of the MPS ‘Digital Policing’ (In house ICT provider) initiative, to deliver an architected solution ‘LabNet’ for the Authority that will enable it to store captured forensic data from all facilities locations within a central repository. This will enable systematic case management and enable investigators and analysts to access and analyse data from multiple locations using appropriate eDiscovery tools. The digital forensic business processes supported by the IT infrastructure can be seen in the diagram Attachment 2, while a schematic of the LabNet architecture is shown in Attachment 3. The MSP will bring forward suggestions and recommendations on the best use of IT and investigative software tools to improve the capability of the systems in supporting investigating officers. LabNet will facilitate secure storage of all recovered data and enable data management to be carried out systematically according to the category of data and regulatory prescribed and approved retention times. The volume of data captured on a daily basis via the SSKs and Hubs may require storage subsystems to be available at SSK and Hub level in addition to high bandwidth connections between SSKs, Hubs and LabNet to facilitate data transfers. LabNet will be connected to the MPS ‘Aware’ private secure network to facilitate access for investigators to retrieved data and to Forensics Evidence Packs, prepared by digital forensics analysts, stored on LabNet. During the next few years the majority of the volume of data captured will be within the digital forensics laboratory. However, as more SSKs are rolled out and their use becomes more ‘business as usual’ the total volume of data captured at the SSK and Hub sites is forecast to overtake that captured within the laboratory environment, see Figure 4. Page 13 of 21 ©MPS NOT PROTECTIVELY MARKED Figure 4. Forecast Data Volumes Annual Data Volumes by Route (Tb) 250,000 Data Volume (Tb) 200,000 150,000 100,000 50,000 0 2015-16 2016-17 2017-18 2018-19 2019-20 Year SSK Data Volumes (Tb) Central Lab Data Volumes (Tb) HUB Data Volumes (Tb) Total Data Volumes (Tb) This may have some implications for the bandwidth required to connect SSKs and Hubs to LabNet in order to meet the two hour service level for availability. The raw forecast for anticipated data volumes is presented in Table 3 below. This forecast is mainly impacted by the assumptions that have been made about the rate of rollout of SSKs, the volume of devices submitted for examination at each level and the increase in the average volume of data held on each device. A significant shift from storing personal data on a device to storage in the cloud could also affect these forecasts. Table 3. Volume Data Number of SSKs (#) Number of Hubs (#) SSK Data Volumes (Tb) HUB Data Volumes (Tb) Central Lab Data Volumes (Tb) Total Data Volumes (Tb) 2015-16 66 8-12 32 2,031 18,243 20,305 2016-17 98 8-12 108 10,086 40,236 50,430 2017-18 98 8-12 9,218 27,133 54,225 90,576 2018-19 98 8-12 20,369 40,187 40,187 100,743 2019-20 98 8-12 60,568 80,229 60,136 200,932 Page 14 of 21 ©MPS NOT PROTECTIVELY MARKED 8.0 Delivery of Digital Forensics Services Nationally As the challenges facing law enforcement nationally relating to digital forensics intensify, it is likely that some changes to the current federated support model will result. While at this time it is unclear what the new national model for digital forensics will be, it is certain that as the largest entity the Authority will play a significant role in any reorganisation. For a number of years the Authority has supported other UK police forces with their complex digital forensics challenges by executing high end complex examinations requiring high levels of expertise and specialist equipment (e.g. chip offs). Due to increasing demand for this type of support, the Authority has recently begun to charge back for these services in order to recover its direct costs. The MPS vision is to extend this initiative in future by offering a full range of digital forensics services (excluding the examination of devices relating to volume crime) to other UK police forces and government agencies. The future scope of the Authority’s digital forensics remit for supporting national policing is not known, but will become clearer in the medium term. The Authority is aware that successful extension of its current remit will require realignment of its operations and importantly the ability to deal with other police forces and agencies as valued customers. This is an area in which the MSP would be expected to demonstrate significant expertise. The success of the commercial partnership in gaining recognition for service excellence within the wider law enforcement community will determine the extent to which its digital forensics service and product offerings can be extended. Page 15 of 21 ©MPS NOT PROTECTIVELY MARKED POLICE TOTAL POLICING PROCUREMENT SERVICES Attachments Page 16 of 21 NOT PROTECTIVELY MARKED METROPOLITAN POLICE TOTAL POLICING PROCUREMENT SERVICES Attachment 1 MP8 Operating Model SUPPORTING INFRASTRUCTURE I DIGITAL SERVICES OPERATING MODEL ?a Provided By Managed Service Provider Provided By MP5 FRONT UNE SELF SERVICE Forensic Stall I Knowtedge base [content provided by MPS) Technical mm by phone Techniml Educ! by video conference ?mt?u?m?ty I20 submit photographs of device 0W Technician to offer local advice OW Expert In o?er advice Risk assessment Forensic Science. digital oomnications data a open source considered in jo'ned up manner Development at lorensic mug}: SUPPORTED I "ii 7 HUB I I CAPTURE 1 SEARCH RETRIEVAL i REVIEWI i' REQUEST SELECTION . 0 Local equipment wereled by pdioe 0 User friendly touts locapture 6813. a Assistance 8. advice available from Digilai Technician More specialist tools operated try Digital Faci?eled self service e.g. equipment set up by technician for operation by police. Forensic Staff - More specialist lools operalad by Digital Technicians. . More specialist lools - Wing of?cer rem captured data over corporal: desktop. 3 Analytical tools to aid searching. . Complex data reviewed by operated by Digital Expenss? - Develop techniques for new devices or applications. Outsourced forensic analysis casework . Disseme dam to intelligence analysis. I Pro-processing of data. Prede?ned. integrated work?ow. FORE NSIC ANALYSIS I INTERPRETATION i' AUTH ENTICATION Forensic Analysis. 0 Interpretation of data. - Authenliuallon of Gala. Report. Sell evidenced Pro Forma Report. Date output. 59 statement. Dtjtal Tadanician Pro For-ma Report. Dela output. 59 statement. Digilal Technician Pro Forma Report. Digital expert CPR 533 Repon. Digital Expert Interpretation Rama. Digital Experl Mmentication Report. Court presentation Iool? Provide syslal tech a log to fun ctions at level. Provide sysle technology fr: functions al level with ti exceplion Provide sysli technology f: fu nation 5 at level with 1 exception Page 17 of 21 NOT PROTECTIVELY MARKED METROPOLITAN TOTAL POLICING PROCUREMENT SERVICES Attachment 2 MP8 Outline Future Organisation Chart Head of MP8 Forensics . . Head of DIgItal Existing Assistant Forensics Quality Hierarchy 2 Senior Digital . IP Technology . Manager 9 Manager 9 Forensics Forensics Level 1 2 Manager Manager - Support Group Quality Standards North Team South Team Level 3 Liaison External Services Manager &SupportManager I Technical Technical Technical Technical Manager Manager I Manager Manager . NORTH NORTH I I SOUTH SOUTH I ITIIra'mng I I I I Communications ?account anager I I I Unit anagers . Reporting Of?cer Reporting Of?cer Reporting Officer Reporting Officer IndUStry 8? Partner Programme 1'Man I I Manager Managers Of?ce I i?l?l i?l?i I I i?l?l i?l?l I I DataAcquisitionA DataAcquisitionB . . . . . Off. Forensics Triage External ep?mn9 'Cers Co?ordinator Partners I l\ Data Analysis A Data Analysis NORTH TEAM SOUTH TEAM Capability Development and Operation Penwithick Page 1 8 of 21 NOT PROTECTIVELY MARKED Attachment 3 Forensics Information Platform - Data Storage Architecture (Example) Page 19 of 21 ©MPS NOT PROTECTIVELY MARKED -- 90?? TOTALPOLICING PROCUREMENT SERVICES Attachment 4 Digital Forensics Business Processes Contact GIC Retenu'on Reminder Implement Deletion Process Send Flnal NO RESPONSE In- Response? POLICE DEFS Submission [or Receive Du?$?3ugnu Receive Examination Submission Submission 30 Years] Retention 1' Time Starts . l?N i 1! Examine Dispatch Examine Products Receive 'd Ema name Contemporaneoue Forensic News and? Data Son-ware Fllee IF Evidence Package Other Materials Copies Reports Emma Statemnte Statements Reports 1 IF Dispatch Evidence Update Retention RRD Package to OIC Duration Process Process TBD DEFE RED PROCESS OUTLINE DRAFT 02 '15 D5 2014 Page 20 of 21 NOT PROTECTIVELY MARKED Attachment 5 Definitions/Glossary   Term Definition BFM Borough Forensic Manager CBT Computer Based Training DCCFU Digital, Cyber and Communications Forensics Unit DP Digital Policing (Formally MPS Directorate of Information) FCMS Forensic Case Management System IO Investigation Officer IPR Intellectual Property Rights LEA Law Enforcement Agency MOPAC (London) Mayor’s Office for Policing and Crime MPLS Multi-Protocol Label Switching MPS Metropolitan Police Service OEM Original Equipment Manufacturer OJEU Official Journal of the European Union PFLU Police Forensic Liaison Unit POC Proof of Concept SAN Storage Area Network SC&O Specialist Crime and Operations SSK Self-Support Kiosk Page 21 of 21 ©MPS NOT PROTECTIVELY MARKED