This document summarizes a workshop on privacy and ethical impact assessment for the RAMSES project. The RAMSES project aims to develop a platform for law enforcement agencies to facilitate digital forensic investigations by combining tools to extract, analyze, link, and interpret information from malware samples on the internet and dark web. The workshop covered conducting a privacy and ethical impact assessment process to identify risks and develop safeguards, including breakout sessions to discuss potential risks and solutions. Potential use cases that RAMSES could aid with were also discussed.

1. Privacy & Ethical Impact
Assessment Workshop
Anna Donovan, Trilateral Research Ltd
23 November 2017
Canterbury UK

2. CONSORTIUM
COORDINATOR

3. The RAMSES project objective
 Design and develop a platform for Law Enforcement Agencies (LEAs) to facilitate
digital Forensic Investigations
 The system will extract, analyse, link and interpret information extracted from Internet
malware (ransomware & banking trojans)
 Achieved by:
 Combining intelligent software platform +
 Tools → scraping of public and deep web, detecting manipulation and steganalysis for
payments, extraction and analysis of malware samples, data analysis and visualisations
 Validated by:
 Validation pilots will take place in three different EU countries - Portugal, Belgium and
 Exploited through:
 Potential commercialisation – feasibility study for future adoption/ business models/ etc

4. P/EIA
 Systematic process for identifying and addressing ethical and privacy issues in an information
system
 It can be described as an early warning system that can help expose risks regarding the project
technology that is in development
 Should be conducted through the design & development cycle of a new tool or system
 Should include a consultation/ review by stakeholders
 Should be published to foster public trust and responsible innovation
*Wright, David and Paul de Hert, Privacy Impact Assessment, Springer, 2012

5. P/EIA process
Analyse user requirements, system architecture, map information flows
Identify privacy and ethical risks
Develop RAMSES specific safeguards – PbD
Consultation with stakeholders
Communicate these to design team and technical partners
RAMSES will have 2 iterations – design, development and pre-pilots

6. Breakout session 1: Risks
 Identified risks re: the platform & tools
 ways in which technical components and functionalities of the RAMSES platform may give rise to risks:
 privacy, data protection and ethical principles
 An assessment of the degree of risk and severity of impact. (although can be subjective)
 Intentionally focused on negative impacts (harm)
 The risks identified are not necessarily the only risks presented
 Brainstorm additional risks

7. Breakout session 2: Solutions & recommendations
 To emphasise privacy (including data protection) + ethical considerations throughout all stages of the project →
safeguards for privacy-by-design
 developed guidelines to be embedded in the design process and development of tech. eco system
 To the extent this does not hinder functionality
 direct response to the risks raised and the severity and likelihood of impact
 Strategies to eliminate, avoid, reduce or transfer the privacy risks:
 technical solutions, operational and/or organisational controls and/or communication strategies (e.g., to raise awareness).
 Primary aim is to ensure that the RAMSES technology respects the privacy and ethical values of citizens.
 Solutions identified are not necessarily the only ones
 Brainstorm additions solutions & recommendations

8. Breakout session 3: Use cases
 Ransomware infection
 Banking Trojan
 Malware-as-a-Service
 Keep in mind that throughout RAMSES will also aid with:
 Facilitation of communication between LEAs
 Sharing information about ongoing attacks (where LEAs choose to share it)
 Identification of ongoing / past campaigns
 Identification of clusters and central entities in spreading / selling / using malware

9. Thank you
 Anna Donovan
Trilateral Research Ltd
anna.donovan@trilateralresearch.com
 www.trilateralresearch.com
 www.ramses2020.eu