15th GCC Secured Judicial And Police Cooperation

15TH GCC eGOVERNMENT AND eSERVICES FORUM a secured eGovernment case study: Judicial and Law enforcement cooperation between EU Member States and EU agencies

May 23-27, 2009 - Al Bustan Rotana Hotel -

Dubai, UAE

1

Abdelkrim Boujraf

May 23-27, 2009 - Al Bustan Rotana Hotel - Dubai, UAE 15th GCC eGovernment and eServices Forum

2

¨  More than 10 years implementing/studying exchange of judicial and police information

¨  President of non-profit organisation ¨  Master in Business administration (Minor IT and

Human Resources) ¨  Graduate in Computer Sciences

Agenda

May 23-27, 2009 - Al Bustan Rotana Hotel - Dubai, UAE

15th GCC eGovernment and eServices Forum

p.3

¨  The EU political background ¤ Some facts (EU, International) ¤ The need to cooperate efficiently

¨  The case study ¤ The Interoperability issues ¤ The Service Oriented Architecture vision ¤  Imaginary screenshots

¨  The conclusions

The reality


4

¨  Public administrations must ¤  Provide efficient services to their citizens and businesses ¤  reduce their operational costs ¤  communicate efficiently with foreign public administrations

and organisations

¨  How do they achieve their goals starting from their political programmes to end with the software code?

¨  The case study’s focus on the judicial and law enforcement real life

Political background

The European Union


5



6

The European Union


7

¨  Member States: 27 ¨  Political centres: Brussels, Luxembourg, Strasbourg ¨  Official languages: 23 ¨  Formation

¤  Paris Treaty (18 April 1951) ¤  Rome Treaty (25 March 1957) ¤ Maastricht Treaty (7 February 1992) ¤  Lisbon Treaty (?)

¨  Population: 500 Million ¨  GDP: Total $19.195 trillion

What are the threats to the security of a “western lifestyle”


8

The climate

The migration

The agriculture

The terrorism

Three pillars (main political areas)


9

• Customs Union and Single market

• Common Agricultural Policy • Common Fisheries Policy •  EU competition law •  Economic and monetary union •  EU-Citizenship •  Education and Culture •  Trans-European Networks • Consumer protection • Healthcare •  Research (e.g. Sixth Framework

Programme) •  Environmental law •  Social policy • Asylum policy •  Schengen treaty •  Immigration policy

•  Foreign policy: • Human rights • Democracy •  Foreign aid

•  Security policy: •  European Security and

Defense Policy •  EU battle groups • Helsinki Headline Goal Force

Catalogue •  Peacekeeping

• Drug trafficking and weapons smuggling

•  Terrorism •  Trafficking in human beings • Organized crime •  Bribery and fraud

Pillar III: The political programmes


10

¨  Feb 1992: The establishment of Europol (The Hague, The Netherlands) was agreed in the Maastricht Treaty on European Union of 7 February 1992

¨  The “Tampere Program”, terminated in 1999 under the Finnish Presidency, was primarily a “management of migration flows”

¨  The Europol Convention was ratified by all Member States and came into force on 1 October 1998.

¨  Eurojust is established in 2002 by a Decision ¨  The “Hague Program” in 2004, it has been agreed upon for the creation of an

“area of freedom, security and justice”. Again it was decided on intensification of migration policy, including the construction of the Border Agency “Frontex” and the interception of refugees already in their home countries. “The Hague Program” puts the “defence of terrorism” in the centre. At the level of information exchange and cooperation we can now count on the “principle of availability”

¨  Autumn 2009, To adopt the new “Stockholm program”, containing a wish-list for "police cooperation, the fight against terrorism, management of missions in third countries, migration, asylum and border management, civil protection, new technologies and information networks ".

1992

07 Feb 1992: The establishment of Europol (The Hague, The Netherlands) was agreed in the Maastricht Treaty on European Union

1995

26 July 1995: Council Act drawing up the Convention on the establishment of a European Police Office (Europol Convention).

2000 1999

15/16 Oct 1999: Set up a unit called Eurojust, with the objective of coordinating the activities carried out by the national authorities responsible for prosecution

1998

1 July 1999: Europol commenced its full activities. Europol’ objective is to improve the effectiveness of, and cooperation between, the competent authorities in the Member States in preventing and combating international organised crime

29 June 1998: Objective of the European Judicial Network (EJN) in criminal matters is to facilitate mutual judicial assistance in the fight against transnational crime. It originates in a Joint Action adopted by the Council

2004

26 October 2004: Council Regulation establishing a European Agency for the Management of Operational Cooperation at the External Borders of the Member States of the European Union (Frontex)

28 February 2002: Council Decision setting up Eurojust with a view to reinforcing the fight against serious crime

4/5 Nov 2004: The “Hague Program” has been agreed upon for the creation of an “area of freedom, security and justice”. It was decided on intensification of migration policy, including the construction of the Border Agency “Frontex” and the interception of refugees already in their home countries. “The Hague Program” puts the “defence of terrorism” in the centre. At the level of information exchange and cooperation we can now count on the “principle of availability”

2002

2009

Autumn 2009: To adopt the new “Stockholm program”, containing a wish-list for "police cooperation, the fight against terrorism, management of missions in third countries, migration, asylum and border management, civil protection, new technologies and information networks ".

2005

20 Sept 2005: European Police College (CEPOL) is created. Its objective is to step up cooperation between national police schools in order to promote a joint approach to the major problems encountered in fighting crime, preventing delinquency and maintaining law and order.

Institutions & Authorities


15

¨  European Union’s Judicial Cooperation Unit Eurojust ¨  European Judicial Network in civil and commercial

matters ¨  European Police Office Europol

¨  Police academy CEPOL

¨  Border agency Frontex, committee for the Management of Operational Cooperation of all police agencies of the EU within its intelligence operation assessment centre.

Riots, Terrorist attacks, cross-border serious crimes

Facts


16


Frontex: Illegal Border Crossing by Member States in 2007


17


By Land By Air

*This table is provisional and contains the data provided by Member States until February 2008 The consolidated collected data will be presented in the Annual Risk Assessment to be distributed in June 2008

Frontex: Illegal Border Crossing by Member States in 2007


18


By Sea Total

*This table is provisional and contains the data provided by Member States until February 2008 The consolidated collected data will be presented in the Annual Risk Assessment to be distributed in June 2008

Europol: # of operational projects (between ‘06 and ‘07)


19

0 0.5

1 1.5

2 2.5

3 3.5

4

2006

2007

Europol: Progression of info. exchange from 2000 until 2007


20

Eurojust: Requested countries vs. Requesting countries


21


Terrorist attacks in Europe (between 2002 and 2009)


22

Riots in Europe (between Dec 2008 and Feb 2009)


23

Judicial and Law enforcement cooperation between EU Member States and EU agencies

The case study


24


EU Interagency Collaboration - The reality….


25

¨  During a routine check Spanish customs intercept a shipment of coffee containing cocaine in the harbour of Malaga.

¨  The container came from Caracas, Venezuela and was supposed to be transported by road to Antwerp and to be delivered to a trade company called BE.

¨  A number of persons are taken into custody, whilst investigations start….. ¤  The involved authorities (Europol and Eurojust) need to

collaborate in a quick and efficient manner. n  European Arrest Warrant

n  Rogatory Letter

n  Joint Investigation Teams

n  ….

¤  They need to remain in control of their systems

¤  They need to follow local as well as EU-wide laws, agreements and policies

High level exchange of information between National Judicial & Law Enforcement authorities, Europol and Eurojust

Page 26

Pan-European eGovernment Services (PEGS)

The European interoperability framework


27


Underlying principles for eGovernment Page 28

Scope / Area of validity Page 29

Businesses

Citizens

Administration A

Administration B

A2BA2C

A2A

Member States A

Businesses

Citizens

Administration A

A2A

Member States B

A2C

A2B

European administration

A2B

A2C

A2A

Software architecture


30


Bilateral architecture Multilateral architecture

Basics of software strategy Page 31

¨  Interoperability based on ¤ open standards

¤ open interfaces

¨  Goals … ¤ Create the lowest possible obstacles for adoption

¤  Independence from specific software vendors ¤  Long-term sustainability of software (moderate costs,

reusability, etc.) ¤  Security of communication and systems

Definition of an Open Standard


32

¨  The standard is adopted and will be maintained by a not-for-profit organisation, and its ongoing development occurs on the basis of an open decision-making procedure available to all interested parties (consensus or majority decision etc.).

¨  The standard has been published and the standard specification document is available either freely or at a nominal charge. It must be permissible to all to copy, distribute and use it for no fee or at a nominal fee.

¨  Intellectual property – i.e. patents possibly present – of (parts of) the standard is irrevocably made available on a royalty-free basis.

¨  There are no constraints on the re-use of the standard.

From the technical requirements to the code

Software architecture


33


Principles vs. Technical requirements

Privacy Technical Architecture Subsidiarity Software

Architecture


34


Enforcement of Steps – Levels of Enforcement

Confidence

Confirmation

Controlling by Process Design

Agreements and policies

Monitoring and Controlling

Dual Control

Direct control

Optimistic strategy

Pessimistic strategy

Security analysis


36

Security and Organisational Control Requirements

-  Collaboration

-  Transactions

-  Basic Security Services

-  Rights Management

-  Privacy

Cross-Organisational Workflow

privatepublic

publicprivate

private

public

A

A

A B

B

B

Security analysis


37


Coordination

ACID-Properties

Advanced Transaction Models

Pivot, Compensate, Retry

Mixed/Atomic Outcome

Time constraints

Enforcement (of steps)

-  Collaboration

-  Transactions



-  Privacy

Security analysis


38


-  Collaboration

-  Transactions



-  Privacy

Data Integrity

Non-Repudiation

Time Stamping

Authentication

Confidentiality

Traceability / ‘Structured Proof’

Assurance

Security analysis


39


Access Control

Revocation

Delegation

Separation of Duties

Obligation of Duties

-  Collaboration

-  Transactions



-  Privacy

Security analysis


40


Unlinkability / Unobservability

Anonymity / Pseudonymity

Data Control / Obligation Management

-  Collaboration

-  Transactions



-  Privacy

Unisys SOA reference architecture


41

Service Oriented Architecture


42


Enterprise Service Bus

Workflow Management System

Legacy Application

Web Services Contracts

Audit Control Security policy …

Enterprise Service Bus

Workflow Management System

Legacy Application

Web Services Contracts

Audit Control Security policy …

Privacy Preservation in distributed Role Based Access Control


43

IOP GW PEP PDPApplication ServicePEPPDP

request

autorisation request

authorisation decision

PAP

load policies

role mapping request

Oblig. Srv.

request with attribute certificate holding distributed roles and user pseudonym

send OUT

IOP GW

REQUEST .

request

auth. request

PAP

load policies

Request with attribute

certificate holding

distributed roles and user

pseudonym, signed by Root

CA of Organisation A

Oblig. Srv.

obligation service invocation

request with distributed roles

target service invocation

User X.Y..

Privacy Srv.

auth. decision

identity protection request

attribute cert.

Prosecutor

Organisation A

attribute certificate and request validation

Organisation A’s domain of trust

Organisation B’s domain of trust

Org-to-Org Confidentiality and Authenticity protection domain

End-to-EndDistributed role based access with subject privacy protection domain

Interoperability of qualified electronic signatures

R4eGov Breakthrough: Changing European practice on authority accreditation

WS-Choreography Description Language

07/08/12 Monitoring of Service Choreographies

Slide 45

Web service

Web service

Web service

process flow

Web service

Web service

Web service

collaboration

The BPEL view The CDL view

•  W3C recommendation

•  Describes the global view

BPEL: Business Process Execution Language CDL: Choreography Description Language

Cross organisation exchange of information

Imaginary screenshots


46


Imaginary screenshots Request for information


47

Imaginary screenshots Controlling the Choreography


48

Response XML abstract <?xml version="1.0" encoding="utf-8"?>

<soapenv:Envelope xmlns:soapenv=http://www.w3.org/2003/05/soap-envelope xmlns:wsa=http://www.w3.org/2005/08/addressing xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">

<soapenv:Header>

<rte:SecurityHeader xmlns:rte="http://r4egov.org/rte/sec">

<Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion“ xmlns:xsd=

http://www.w3.org/2001/XMLSchema xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol“ xmlns:xsi=

http://www.w3.org/2001/XMLSchema-instance xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion“ Issuer="EOL“ MajorVersion="1“ MinorVersion="1">

<Conditions NotBefore="2008-07-23T13:04:43.046Z“ NotOnOrAfter="2008-07-23T13:14:43.046Z" />

<AttributeStatement>

<Subject><NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName“>CN=EOL_investigation, OU=CE, O=EOL, L=Hague, ST=Hague, C=NL</NameIdentifier>

</Subject>

<Attribute AttributeName="resource“ AttributeNamespace=

"http://r4egov.org/rte/sec/attr">

<AttributeValue>searchByNameWS</AttributeValue></Attribute>

<Attribute AttributeName="roles“ AttributeNamespace=

"http://r4egov.org/rte/sec/attr"> <AttributeValue>Investigator</AttributeValue></Attribute>

<Attribute AttributeName="extraAttributes” AttributeNamespace=

"http://r4egov.org/rte/sec/attr"><AttributeValue>Portugal</AttributeValue></Attribute>

</AttributeStatement>

<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />

<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />

<ds:Reference URI="#_e059c0704eb304ccf80a84abedb2d715">

<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />

<ds:DigestValue>YwHY8wu9VEcZJ6Mlx9Vu1AP0Ys4=</ds:DigestValue>

</ds:Reference>

</ds:SignedInfo>

<ds:SignatureValue>LoEuzuKcpKJwMPBKmo6YSXpZwOhLOCdtygYw/zxg2cZii0Eow9F23JFkq5/5TyUhoSPsqArG08s+yU2sc7nJFBZCCwip5ClstezQYhkunOEaLQLu77+Y6NwssKHDVUE0HERWxP5hw2tfgi4/RD15A4uUQUuT8e4fRS8brvGcIs8=</ds:SignatureValue>

</ds:Signature>

</Assertion>

</rte:SecurityHeader>

</soapenv:Header>

</soapenv:Envelope>


49


Imaginary screenshots Retrieve data & Send response


50

Imaginary screenshots Controlling the Choreography (final step)


51

conclusions


52


Conclusions


53

¨  You need to incorporate the … constraints ¤ Political ¤ Business ¤ Organisational ¤ Technical

Conclusions


54

¨  Do you have … understanding each other? ¤ Lawyers ¤ Economists ¤ Linguists ¤ Business Architects ¤ Project managers ¤ Software Architects ¤ Software developers ¤ Testers

Conclusions


55

¨  Where can you find software developers knowing so much concepts?

¨  Do you use one methodology for each software development steps?

¨  COTS vs. Do-it-yourself? ¨  Have you developed a proof of concept using a

complex use case running under the selected software architecture?

Resources, references, contact details

Miscellaneous


56


Page 57

R4eGov ¨  Funded by: the European Commission through the Framework Programme 6

– Integrated Project

¨  Contract duration: from March 2006 to March 2009

¨  Budget: €11.4 millions (€7.4 millions financed by EC)

¨  Partners: 20 partners in 7 countries (BE, FR, IT, UK, NL, DE, AT)

¨  Tasks: 11 Work packages (Coordination, Dissemination, User Group / Case studies, Interoperability, Security, Integration, Training, Development of 2 Demonstrators)

http://www.r4egov.eu

Resources available Page 58

¨  Website: ¤  http://www.r4egov.eu

¨  Three Video presentations ¤  http://www.dailymotion.com/group/r4egov

n  Business Presentation n  Technical components n  Architecture mechanisms

¨  Tools ¤  eGovCube: http://www.uni-koblenz.de/~regov/

¨  European Commission ¤  Framework Programme 6: http://ec.europa.eu/research/fp6/index_en.cfm ¤  Information Society Technologies: http://cordis.europa.eu/ist/about/about.htm

References


59

¨  Eurojust: http://europa.eu/scadplus/leg/en/lvb/l33188.htm ¤  http://www.eurojust.europa.eu/press_releases/annual_reports/2006/Annual_Report_2006_EN.pdf ¤  http://www.eurojust.europa.eu/press_releases/annual_reports/2007/Annual_Report_2007_EN.pdf

¨  Europol: http://europa.eu/scadplus/leg/en/lvb/l14005b.htm ¤  http://www.europol.europa.eu/publications/Annual_Reports/EuropolAnnualReport2006.pdf ¤  http://www.europol.europa.eu/publications/Annual_Reports/Annual%20Report%202007.pdf

¨  European Judicial Network: http://ec.europa.eu/civiljustice/index_en.htm

¨  CEPOL: http://europa.eu/scadplus/leg/en/lvb/l14006.htm

¨  Frontex: http://europa.eu/scadplus/leg/en/lvb/l33216.htm ¤  http://www.frontex.europa.eu/gfx/frontex/files/justyna/annual_report_2006%5B1%5D.pdf ¤  http://www.frontex.europa.eu/gfx/frontex/files/justyna/frontex_general_report_2007_final.pdf

Riots / Strikes in Europe


60

¨  Greece (Dec 2008) http://en.wikipedia.org/wiki/2008_Greek_riots ¨  Iceland (Jan 2009) http://en.wikipedia.org/wiki/2009_Icelandic_financial_crisis_protests ¨  Sweden (Dec 2008) ¨  Lithuania (Jan 2009) http://www.nytimes.com/2009/01/17/world/europe/17lithuania.html

¨  Latvia (Jan 2009) http://en.wikipedia.org/wiki/2009_Riga_riot ¨  Bulgaria (Jan 2009) http://www.reuters.com/article/latestCrisis/idUSLE473019 ¨  France (Feb 2009)

http://www.heralddeparis.com/rage-and-violence-anti-nato-march-in-strasbourg-started-peacefully/29960

¨  Guadeloupe (16 Feb 2009) http://www.kuwaittimes.net/read_news.php?newsid=OTcwMjc3MzQ3

¨  Lampedusa – Italy (Feb 2009) http://www.timesofmalta.com/articles/view/20090219/world-news/illegal-immigrants-start-fires-clashes-at-lampedusa

References


61

¨  Pictures from http://www.flickr.com ¨  Maps generated by http://gunn.co.nz/map/ ¨  Definitions from http://www.wikipedia.org

Unisys representatives @ be.unisys.com

Abdelkrim.Boujraf Athina.Dalamanga

David.Huys Emidio.Stani

Philippe.Vlerick

Unisys Steering Committee member: Patrice-Emmanuel.Schmitz

Page 62

Documents

15th GCC Secured Judicial And Police Cooperation