First prize winner in category Digital Transformation in EPSA 2023-24
Context
Hansken is an open digital forensic platform that is owned and maintained by the Dutch government, via the Ministry of Justice and Security, and primarily services the Dutch criminal law justice system. The Netherlands Forensic Institute (NFI) acts as product owner and ensures that legal and forensic principles are applied to newly developed functionality. It was commissioned by the Dutch Public Prosecution Service.
Hansken emerged from a sudden practical need. In a major child pornography case in the Netherlands in 2010, the police urgently required a method to investigate the data. This need gave rise to Xirav, developed by the NFI and the precursor to Hansken in 2012. This investigative approach was developed in-house at the NFI and did not exist previously. The evolution of Hansken resulted in a broader and more scalable platform with technologies that enabled it to handle even larger amounts of data.
In a context where subversive and organised crime poses a serious threat to European citizens and businesses, knowledge collaboration is essential, especially given that the increasing volume and complexity of digital evidence in criminal investigations has become a serious challenge. The way digital forensics has been conducted in the past is no longer adequate. Solutions are needed that can adapt to the volume of data and find better ways to keep digital forensic knowledge up to date.
Objectives
Hansken allows detectives to investigate digital data and traces from seized evidence items, such as mobile devices, computers and storage media. The platform is publicly accessible and has become the platform where law enforcement agencies and academia can share digital forensic knowledge providing a constant source of innovation. Hansken aims for a transformation in digital forensics: a focus on the tactical investigators to search the digital data, instead of the digital experts, as they know their investigation best and therefore can most effectively ‘question’ the data, which gives the digital expert extra time to focus on more specialised issues. With Hansken, all parties – public prosecutors, judges and lawyers – can use the same source and see the same context in the digital data, which contributes to a fair trial. Furthermore, the new viewing facility enables lawyers to review the data from their own office. It was released in the Netherlands in June 2023.
Implementation
Currently, Hansken is in use in 13 countries, and there is a noticeable increase in its usage. This tangible collaboration is a significant innovative element of the platform. It involves parties working together, developing knowledge and methods in the field of digital forensics. The open nature of Hansken, working with APIs (application programming interfaces), enables all parties to apply and share their own methods within the community. For instance, there is an increasing integration of AI models into the platform: among others speech-to-text, text recognition and translation, CLIP image, semantic search – new functionalities based on deep learning models. This continuous enhancement keeps the platform at the forefront of innovation.
The Hansken Community facilitates knowledge sharing, software collaboration and joint efforts on current and future developments. The expanding international Hansken Community includes law enforcement and security agencies, police forces, special investigation services, public prosecution services, forensic institutes and academia.
The Tactical Board, the Forensic and Legal Board, and the Educational Boards meticulously oversee and embed the platform’s usage across all partner organisations. The NFI provides basic funding for Hansken, supplemented by various Dutch government departments including the Dutch Police, Fiscal Intelligence, the Food and Consumer Product Safety Authority, the Labour Authority, the Internal Investigations Department, Royal Dutch Marechaussee, the Intelligence and Security Service and the Public Prosecution Service. Additional funding comes from Hansken partners, who contribute financially based on the volume of data processed annually and the number of users. There is also the Hansken Academy, which also contributes to the sustainability of the platform.
In the past few years, the platform has been deployed at Dutch law enforcement and intelligence organisations and subsequently to similar agencies in other European countries. The platform has already proved itself in over 1500 crime cases and the quality and transparency of case reports withstand the judicial review in court, as the Hansken platform implements legal and forensic principles. For each trace, the chains of evidence and custody are in place, and the forensic measures are constantly monitored by a specialised board.