Towards an Open European DFaaS Platform

Why this matters

Digital evidence has become a core component of nearly every criminal investigation. At the same time, the volume and complexity of digital data continue to grow rapidly. A recent European quick scan highlights the scale of this challenge: more than a quarter of participating countries report cases exceeding 50 terabytes of data, with some cases reaching over 300 TB. In addition, 92% of organisations regularly need to share investigation data with other EU countries or European bodies.

These developments show that traditional approaches to digital forensics are no longer sufficient. There is a clear need for scalable solutions that can handle large volumes of data while enabling efficient and legally compliant collaboration across borders.

Building on experience

Since 2012, the NFI has been developing Hansken, which is also a DFaaS platform that has been successfully deployed within Dutch law enforcement and intelligence organisations, and increasingly across Europe. Hansken has been used in over thousands of criminal cases and has undergone thorough judicial scrutiny.

A DFaaS platform in general, enables investigators to:

• process large volumes of digital evidence,
• transform data into searchable traces (such as chats, emails, documents and browser history),
• work within a forensically sound and legally compliant environment,
• and support collaboration between different organisations and roles.

A European perspective

Strengthening investigative capabilities requires close cooperation between law enforcement agencies and scientific institutes. Extending this collaboration to the European level offers clear advantages. A shared platform would increase the scale of the community, accelerate innovation, and significantly improve the exchange of information between countries.

However, creating such an open European DFaaS platform also raises important questions. The feasibility study focuses on key aspects such as alignment with European and national legislation, technical infrastructure, software requirements, and potential distribution and licensing models.

Exploring real-world use cases

To better understand how a European DFaaS platform could support investigations in practice, the study explores three key scenarios:

1. Centralised investigations by European agencies
European organisations such as Europol, Eurojust and EPPO often work on complex cross-border cases. A centralised analysis infrastructure could reduce duplication of work and enable investigators from different countries to work on the same data in a consistent way.

2. Joint investigations between multiple countries
In Joint Investigation Teams, multiple countries collaborate on a single case. A shared DFaaS platform would allow investigators to analyse data simultaneously, share findings directly within the system, and benefit from different national perspectives on the same evidence.

3. National investigations with European connections
When multiple countries use the same platform, it becomes easier to identify links between cases across borders. By sharing and cross-referencing data, investigators can uncover patterns and connections that might otherwise remain hidden.

Approach and next steps

The project aims to identify key stakeholders across European law enforcement agencies, gather their requirements through interviews, and consolidate these insights into a clear assessment of feasibility. This includes not only technical and legal considerations, but also operational needs and collaboration practices.

In the next phase, the NFI will conduct in-depth interviews with partners across Europe and explore the potential establishment of a European core group on DFaaS.

Looking ahead

This exploration lays the foundation for a future in which digital investigations in Europe are more scalable, more collaborative, and more effective. By working together, European partners can strengthen their ability to respond to increasingly complex and data-intensive criminal investigations.