Benjamin Kellermann
email: benjamin.kellermann@tu-dresden.de

Open Research Questions of Privacy-Enhanced Event Scheduling

Keywords: event scheduling, electronic voting, superposed sending, anonymity, privacy-enhanced application design

Event-scheduling applications like Doodle have the problem of privacy relevant information leakage. A simple idea to prevent this would be to use an e-voting scheme instead. However, this solution is not sufficient as we will show within this paper. Additionally we come up with requirements and several research questions related to privacy-enhanced event scheduling. These address privacy, security as well as usability of privacy-enhanced event scheduling.

Introduction

For years, technical event scheduling has been done with applications like Microsoft Exchange or a central iCal-server within some intranet. Since Web 2.0 applications became very popular, an application named Doodle [START_REF] Näf | Doodle homepage[END_REF] which assists event scheduling in a very easy way became popular as well. In this solution, an initiator configures an online poll where everybody votes on dates that are shown to all visitors of the web page.

In contrast to the intranet solution, Doodle offers its event scheduling service to everyone. However, both solutions -the intranet solution and Doodle -have in common that everybody has to publish his so-called availability pattern. In contrast to a solution running in a company, within the Doodle-solution, the availability patterns are visible to the whole world.

An availability pattern contains at least two different types of information. The direct inference from the pattern are information which one can extract from the availability of certain dates ('Will my husband vote for the date of our wedding anniversary?'). Second, the indirect inference of a pattern reveals information, when connecting more than one information source ('The availability pattern of user bunny23 looks suspiciously like the one of my employee John Doe!').

However, Doodle offers users some sort of privacy-enhancing feature. An initiator has the possibility to create "hidden polls" where availability patterns are visible only to him. Together with an SSL based connection, one may achieve confidentiality for external attackers. However, the Doodle server and the poll initiator still learns the availability pattern.

Doodle also reacted to their users demand of security. In a normal poll, everybody may change everybody's vote. If one does not want to register to preserve one's unlinkability, Doodle offers the possibility to restrict changes to a vote from the initiator only. However, trust in the poll initiator and the Doodle server is needed in this case as well.

The outline of the paper is as following: We first raise requirements which we claim to be necessary for privacy-enhanced event scheduling in Section 2. Section 3 will give a short literature overview. Afterwards (Section 4) we discuss which questions are not fulfilled yet and should be target of further research.

Requirements

This section describes requirements for privacy-enhanced event scheduling. Even if there may be more general requirements applicable to privacy-enhanced event scheduling, we want to concentrate on the most restrictive ones which still fit the most use cases (but not all). Stating too general requirements might lead to a scheme, which is unnecessarily bloated and inefficient.

An event scheduling application typically schedules an event in a group of a few dozens of people. Even if there are use cases, where scheduling events in a group of people who do not know each other are imaginable,1 the most common use case of such an application is to schedule an event within a closed group where most of the participants know each other.

A typical web-based event scheduling application can be divided into 3 phases: poll initialization, vote casting and result publication. Figure 1 depicts these 3 phases. An initiator creates a poll in the poll initialization phase. There he has to define a set of possible time slots when an event might take place. Every user may specify his preferences in the vote casting phase. Finally, in the result publication phase, a time slot is chosen, when the event should take place. We call the rule, which chooses the time slot, the selection rule.

In a usable privacy-enhanced event scheduling application everything should be the same as in a normal event scheduling application with the difference that the availability pattern is confidential.

The following requirements should apply to a privacy-enhanced event scheduling application:

Untrusted single entity As little trust as possible should be placed in any single entity. Verifiability Every participant should be able to verify that no other participant has cheated (i. e., every other participant is authorized and behaves according the protocol) and that his preferences has been taken into account. Privacy Nobody should learn more than absolutely necessary about the availability of other participants and thus should not be able to infer on their identity, i. e., every participant should only learn that the one specific chosen time slot fulfills some selection rule. The amount of information which is leaked therefore depends on the selection rule. Note that this requirement does not mean, that all participants are anonymous.

It is easy to conceive, that verifiability and privacy are contradicting requirements. In a Doodle-like scheme without privacy, verifiability is given through the fact, that everybody can read the votes of the other participants. In a privacy-enhanced scheme, other mechanisms are needed.

Additionally, verifiability and privacy require, that the set of participants is fixed within the poll initialization phase and that the participants know each other. Knowing the identity of the other participants gives the possibility to make clear statements about the anonymity set and its size. Additionally one may observe that no attacker is able to add votes for faked participants (only authorized participants vote).

To gain a usable application, the following requirements have to be fulfilled:

Preliminary Steps An application should not require many preliminary steps (e. g., installation, registration etc.). Communicational Complexity An application should not require much more user interaction than existing event schedulers and should allow the user to be offline as it may be used in mobile scenarios. Therefore the scheme has to have few message exchanges. In Figure 1 one can see that typically every user has to interact 2 times with the application: in the vote casting phase and in the result publication. Both interactions are initialized through an email notification.

Computational Complexity As users do not want to wait long, an application should be efficient for large scheduling problems with many possible event dates.

Related Work

Privacy-enhanced event scheduling can be seen as a distributed constraint satisfaction/optimization problem (DSCP/DCOP) or a an e-voting instantiation. We will give a short literature overview of both and explain why they do not fit into the problem. Specific literature is discussed afterwards.

DSCP/DCOP

A constraint optimization problem consists of a set of variables in finite domains and a set of cost functions. The goal of the optimization is to find a binding for all variables, for which the global cost, calculated from all cost functions is minimal.

A constraint satisfaction problem is a special case of the optimization problem where the output of all cost functions is an element of {0, 1} and the global cost is calculated with the multiplication of all cost functions. In a distributed constraint optimization, every participant holds his own set of variables and cost functions. The solution to the optimization problem is found through sending messages between the participants with the assignment of variables and their costs.

There exist many algorithms for DCSP [START_REF] Silaghi | Asynchronous search with aggregations[END_REF][START_REF] Yokoo | Algorithms for distributed constraint satisfaction: A review[END_REF][4] and DCOP [START_REF] Modi | Adopt: Asynchronous distributed constraint optimization with quality guarantees[END_REF][START_REF] Maheswaran | Taking dcop to the real world: Efficient complete solutions for distributed multi-event scheduling[END_REF][START_REF] Mailler | Solving distributed constraint optimization problems using cooperative mediation[END_REF] and measurements of the information leakage were done by Franzin [START_REF] Franzin | Multi-agent meeting scheduling with preferences: Efficiency, privacy loss, and solution quality[END_REF] and Greenstadt [START_REF] Greenstadt | Experimental analysis of privacy loss in DCOP algorithms[END_REF]. These algorithms may solve complex scheduling problems where different subsets of the participants participate in different events. Each participant may have cost functions about the place, travel time, and constraints between the events. However, all DCOP algorithms share the problem that they are complex in terms of message exchanges even for basic scenarios. To solve the problem of message exchanges, agents are used which send and receive the messages. As usual users do not want to setup such an agent at some server, they have to run it locally and therefore have to be online at the same time.

Therefore the DCOP approach is too complex in terms of message exchanges and contradicts the communicational complexity requirement. A simpler solution for the simpler problem of scheduling a single meeting would be appropriate.

E-Voting

There is a lot of literature about electronic voting. It can be categorized into approaches based on mixes [START_REF] Chaum | Untraceable electronic mail, return addresses, and digital pseudonyms[END_REF][START_REF] Park | Efficient anonymous channel and all/nothing election scheme[END_REF][START_REF] Ogata | Fault tolerant anonymous channel[END_REF][START_REF] Abe | Universally verifiable mix-net with verification work indendent of the number of mix-servers[END_REF][START_REF] Jakobsson | A practical mix[END_REF], homomorphic encryption [START_REF] Cohen | A robust and verifiable cryptographically secure election scheme[END_REF][START_REF] Benaloh | Distributing the power of a government to enhance the privacy of voters[END_REF][START_REF] Sako | Secure voting using partially compatible homomorphisms[END_REF][START_REF] Baudron | Practical multicandidate election system[END_REF], and blind signatures [START_REF] Chaum | Elections with unconditionally-secret ballots and disruption equivalent to breaking RSA[END_REF][START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF][START_REF] Sako | Electronic voting scheme allowing open objection to the tally[END_REF][START_REF] Ohkubo | An improvement on a practical secret voting scheme[END_REF][START_REF] Durette | Multiple administrators for electronic voting[END_REF].

The difference between privacy-enhanced event scheduling and e-voting, and why e-voting cannot be applied directly to event scheduling was already discussed [24]. One of the main design criteria of electronic voting schemes is to have a computation and communication complexity, which is independent from the number of participants (voters). While this is valid when organizing an election for millions of citizens, this design criterion can be relaxed in the event scheduling approach, as we deal with smaller closed groups of participants. A design criterion for event scheduling should be that the computational complexity of the scheme scales in the number of time slots. However, if one applies e-voting schemes directly to event scheduling, they all have in common that the number of asymmetric operations scales linear with the number of time slots, i. e., one needs at minimum one asymmetric operation per time slot.

In the following, we will shortly discuss the three approaches separately and estimate the computational complexity in terms of asymmetric operations. Let |𝑇 | be the number of possible time slots an event may be scheduled at, and |𝑃 | be the number of participants voting in a poll.

Mixes Chaum invented mixes as building blocks for anonymous communication channels and he first proposed an election scheme based on them [START_REF] Chaum | Untraceable electronic mail, return addresses, and digital pseudonyms[END_REF]. Many extensions have followed thereafter [START_REF] Park | Efficient anonymous channel and all/nothing election scheme[END_REF][START_REF] Ogata | Fault tolerant anonymous channel[END_REF][START_REF] Abe | Universally verifiable mix-net with verification work indendent of the number of mix-servers[END_REF][START_REF] Jakobsson | A practical mix[END_REF]. The common idea is to build an anonymous blackboard with mixes. In a first phase, every voter has to generate an asymmetric key pair and publish the public key on that blackboard. In the voting phase, every voter encrypts his or her vote with the secret key and publishes the encrypted vote on the anonymous blackboard. Everybody can decrypt the votes and count the result.

Assuming ℓ mixes, to cast a vote, every voter has to encrypt his or her key and vote ℓ times asymmetrically. A naive adaption to event scheduling would imply one poll per time slot. Every voter would have to do 2 • ℓ • |𝑇 | asymmetric encryptions. Further, one must trust that the mixes do not collude to compromise one's privacy, and the mixes have to perform additional decryption operations, which add to the overall complexity.

Homomorphic Encryption Voting schemes based on a homomorphic encryption function use the property that one can add all the votes and decrypt the result without decrypting individual votes (i. e., one can find two operations ⊕ and ⊗ so that the encryption function E is homomorph to these operations E(𝑥 1 ) ⊕ E(𝑥 2 ) = E(𝑥 1 ⊗ 𝑥 2 )). A problem of plain homomorphic encryption is that cheating voters stay undetected as their votes are not decrypted separately. So practical schemes require extra effort to prevent this.

A voting scheme based on a homomorphic encryption function was first described by Cohen and Fischer [START_REF] Cohen | A robust and verifiable cryptographically secure election scheme[END_REF] and later extended by Benaloh and Yung [START_REF] Benaloh | Distributing the power of a government to enhance the privacy of voters[END_REF]. The scheme consists of different parts where a central entity and the voters have to commit to values and prove their correctness without revealing them. Proving a "primary" ballot is done by committing to several "auxiliary" ones, decrypting half of them and showing that the others are type-equivalent to the primary ballot. This proof is done twice in the whole scheme.

A direct application of this method for event scheduling appears to be inefficient: considering only the vote encryptions, with a security parameter ℓ, every voter would have to do ℓ • |𝑇 | asymmetric cryptographic operations.

Inspired by Benaloh, Sako and Kilian introduced a voting scheme that uses partially compatible homomorphisms [START_REF] Sako | Secure voting using partially compatible homomorphisms[END_REF]. Baudron et al. enhanced this scheme for multi-votes [START_REF] Baudron | Practical multicandidate election system[END_REF]. However, also in this scheme, a voter has to encrypt every single vote multiple times. Baudron's extension even targets multi-candidate elections, but this is not equivalent to the event scheduling problem, where repeated elections would be needed.

Blind Signatures Shortly after his mix-approach, Chaum came up with another voting scheme [START_REF] Chaum | Elections with unconditionally-secret ballots and disruption equivalent to breaking RSA[END_REF] which uses blind signatures [START_REF] Chaum | Security without identification: Transaction systems to make big brother obsolete[END_REF]. Fujioka et al. reduced the complexity of Chaums idea to adapt it to large scale elections [START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF] and many subsequent schemes were derived from the Fujioka-Okamoto-Ohta scheme [START_REF] Sako | Electronic voting scheme allowing open objection to the tally[END_REF][START_REF] Ohkubo | An improvement on a practical secret voting scheme[END_REF][START_REF] Durette | Multiple administrators for electronic voting[END_REF]. Some of them led to implementations [START_REF] Cranor | Sensus: A security-conscious electronic polling system for the internet[END_REF][START_REF] Herschberg | Secure electronic voting over the world wide web[END_REF].

The main idea is to split the protocol into two independent phases: (1) administration, which handles access control, and (2) counting of anonymously casted votes. The vote is blindly signed during administration, unblinded by the voter and then sent anonymously to the counter. As the casted votes contain no personal information, they can be published afterwards.

If one applies this scheme to the event scheduling problem, a voter would have to blind and unblind |𝑇 | messages and verify the administrator's signature of every message.

Specific Prior Work

There are two publications which specifically target the event-scheduling problem [24,[START_REF] Herlea | On securely scheduling a meeting[END_REF]. Herlea et al. [START_REF] Herlea | On securely scheduling a meeting[END_REF], covers three different approaches to the problem. One is a solution based on a trusted third party, which is efficient, but stands in contrast to the requirement of limited trust in a single entity. The second is a straight application of general secure distributed computing. Consequently, it suffers from high computational and communication complexity. The third approach, a "custom-made negotiation protocol" is most interesting and promising. It can be best described as a hybrid between the techniques reviewed in Section 3. The protocol is designed to schedule single events through a combination of homomorphic encryption with respect to the equality operation (in fact, addition modulo two) to blind individual availability pattern, and an anonymous channel, which is established by letting voters act as re-encrypting mixes. While the cryptographic operations are comparably efficient, the scheme requires way too much communication phases (|𝑃 | + 1 messages). (The authors acknowledge this and discuss ways to trade off communication complexity against trust assumptions.)

Based on superposed sending and Diffie-Hellman key agreement [START_REF] Chaum | The dining cryptographers problem: Unconditional sender and recipient untraceability[END_REF][START_REF] Diffie | New directions in cryptography[END_REF], Kellermann and Böhme described a privacy-enhanced event scheduling solution [24,[START_REF] Kellermann | Datenschutzfreundliche Terminplanung[END_REF][START_REF] Kellermann | Dudle homepage[END_REF]. Within this solution, every possible participant encrypts his availability pattern with a homomorphic encryption. The availability pattern itself contains a 1 for all available time slots and a 0 for time slots, the participant is unavailable. The homomorphism of the encryption is used afterwards to calculate the number of all available participants at the certain time slots.

Open Research Questions

Offering a privacy-enhanced version of a web-based event scheduling system raises several problems which are described in the following and should be target of further research.

Security Definition and Formal Proof of Correctness

The whole process of multilateral secure voting has assumptions about privacy and security. Security definitions of e-voting or DCOP can already be found in the literature [START_REF] Greenstadt | Collaborative scheduling: Threats and promises[END_REF]. However, a good application to privacy-enhanced event scheduling as well as a formal proof of correctness is still missing.

A good requirement formalization is still needed. With such a formalization, a proof of correctness of a certain scheme could be done.

Predefined Complex Selection Rules

A problem a privacy-enhanced event scheduling solution has to deal with is when not all people are available at a certain time slot. The most common selection rule is to choose one of the time slots where most of the people are available. However, it may be desirable to decide on other rules, than solely on the number of available participants. E. g., it may be the case, that some people are more important to be at a meeting than others. Another selection rule may depend on sets of participants, e. g., one may schedule a meeting between a number of organizations where it is necessary that one person of every organization attends the meeting.

When scheduling an event with an existing privacy-invasive solution, one may make such decisions, without the involvement of all possible participants. Even if no common time slot is found where all participants may participate, one is able to select a time slot on other criteria than initially defined. If the selection rule came to no result in a privacy-enhanced scheme one has the problem, that it is not possible to change it without the involvement of all participants. A possible solution may be the specification of more than one selection rule before scheduling an event. The additional selection rules are taken into account when the first one came to no result.

Specifying complex selection rules can be expressed in functions in a DCOP solution. However, e-voting solutions and the specific privacy-enhanced event scheduling approaches suffer these functionality. Here, only the sum of all available participants at the time slots can be taken into account.

A problem is that it is difficult to measure the privacy for an arbitrary selection rule. Measurements which can be found in the DCOP literature may be applied here as well. Furthermore, the amount of privacy has to be displayed to the participants when they state their availabilities. Additionally it is unclear which selection rules with their respecting implications are understandable for average users.

Specifying Preferences

Within the vote casting phase, every participant has to specify a binary choice if he is available at a certain time slot or not. Instead of sending this binary choice it may be desirable to specify preferences for every time slot. This can already be done in a Doodle poll. There one may create a so called "Yes-No-Ifneedbe"-poll where one has the possibility to select one out of three states for every time slot. Such a generalization is not necessarily possible in a privacy-enhanced event scheduling solution. E. g., when using homomorphic encryption the votes cannot be taken from an arbitrary domain. Consequently, one may not apply arbitrary operations to the votes. This should be target of further research and one may think of either giving the answers a meaning (like Doodle does) or let the user specify a preference value.

Prevent "Legal-but-Selfish Votes"

A legal-but-selfish vote is a vote where a participant indicates his availability only at his preferred time slot and not at all time slots he is available. Solutions which only come to a solution if all participants are available at a common time slot (e. g., DCSP) motivate users to anonymously send legal-but-selfish votes.

Within a scheduling solution where all participants can observe all indicated availabilities, the motivation of being selfish would go along with reputation loss. However, in a privacy-friendly solution selfish votes may be sent anonymously.

A possible prevention of selfish votes may let participants prove that they signaled availability for more than a certain minimum number of time slots. Knowing the fact that every voter must be available at a number time slots in order to participate at the poll would of course decrease the privacy of the voters.

Automatic Poll Termination

It was already mentioned, that it is necessary to fix the set of participants in the poll initialization phase. However, it might occur that a participant should be removed after a poll has started.

Kellermann and Böhme already discussed how to kick-out users who should not participate in the poll anymore. From a usability point of view, this seems to be a valid requirement, as depending on the scheme, the selection rule might be unable to calculate the result, if one of the participants does not vote. If one thinks one step ahead, an open question is how to handle an automatic termination of the poll, either after a specific amount of time, or after a specific number of participants voted. Such an extension should not undermine the privacy of the participants.

Dynamic Insertion and Deletion of Time Slots

Sometimes it may be necessary to dynamically insert or delete time slots, after the poll has already started. This may occur after participants already casted votes.

Dynamic insertion and deletion of time slots may not be obviously possible in a privacy-enhanced event-scheduling scheme (e. g., it may influence the cost functions of other time slots in a DCOP based solution). If one does, already casted votes should be taken into account. The privacy of votes for all time slots should not be affected, when the set of time slots is changed. Current schemes do not target this issue.

Updating and Revoking Votes

A feature offered by event scheduling applications is that one has the possibility to change or even delete one's vote at any point of time. This is not necessarily possible in an easy way within a privacy-enhanced solution.

Changing a vote within the vote casting phase might help an attacker to undermine the privacy of participants (e. g., it may release release information about the secret key in homomorphic schemes). Completely deleting votes might make the selection process impossible as it may be the case that all votes are needed for the selection rule.

Conclusion

We formulated requirements of privacy-enhanced event scheduling and gave a short literature overview of existing solutions. Open research questions belonging to privacy-enhanced event scheduling where raised. Some of the research questions where already fulfilled in existing schemes (e. g., DCOP may solve complex selection rules and specify preferences; there is no motivation of legal-but-selfish votes when using e-voting schemes). However, to the best of our knowledge there is neither a scheme which is designed to be usable nor an application which offers usable privacy-enhanced event scheduling currently.

Fig. 1 .

 1 Fig. 1. Phases of a typical web based event scheduling initiated by Carol

  The administrator would have to verify |𝑃 | signatures and has to sign |𝑇 | messages. The counter would have to verify |𝑃 | • |𝑇 | signatures. The overall effort is (|𝑃 | + 2) • |𝑇 | + |𝑃 | asymmetric cryptographic operations.

e. g., one needs to schedule a lecture and wants to find out the most acceptable time slot for the students

Acknowledgments The author thanks Stefanie Pötzsch and Sandra Steinbrecher for their valuable suggestions.

The research leading to these results has received funding from the European Community's Seventh Framework Programme (FP7/2007-2013) under grant agreement № 216483.


Vassilka Tchifilionova

Security and Privacy Implications of Cloud Computing -Lost in the Cloud

Keywords: Cloud computing, privacy, data, network, security, information

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The need to search and meet ever increasing IT demands has often been seen and based on purely an economical base, transforming computing into a utility where performance and efficiency have become a part of the product. Internet was just the tool, the infrastructure that provided the platform for utilization of new services.

Cloud computing has already proved that it can reduce infrastructure costs and offer the ability to pay for services only when requested. Some experts even argue that services delivered via cloud computing should be used as a public utility [START_REF] Mohamed | A history of cloud computing[END_REF].

In a similar way, others argued that companies will increasingly purchase IT as a utility service from outside suppliers [START_REF] Gourley | Cloud Computing and Cyber Defense[END_REF]. Others call it the "age of planetary computing" [START_REF] Reingold | Cloud computing: the intersection of massive scalability, data security and privacy (Part I)[END_REF].

The cloud computing has been on the market for years (e.g. Microsoft Exchange/SharePoint, Google Apps, Amazon's Simple Storage Service, Twitter, Facebook and others) but it was analysed in details by professionals the last two years ago and it took some time until a common definition emerged. One of the very recent working definitions is brought up by the United States National Standards for Information Technology that defines cloud computing as a model for enabling convenient, on-demand network access to a shared pool of configurable resources that can be rapidly provisioned and released with minimal management effort or service provider interaction [4].

Cloud computing is based on abstraction of infrastructure, it is service oriented with the opportunity to offer dynamics and elasticity and at the same time minimise consumption and billing. The abstraction level takes part between the physical infrastructure and the owner of the information being stored and processed. The most common model of cloud computing consists of the three major components: software, platform and infrastructure.

Consumers are not paying for infrastructure, rather they pay for capability. For instance, Microsoft's product Exchange and SharePoint are available online for a monthly subscription instead of buying the full license for their use. This provides for a better utilization of computing resources. In addition, it has also an application in the national security domain which allows the intelligence community to execute missions at all levels by utilizing simultaneously the large volume of capabilities the technology can offer [START_REF] White | Cloud computing for national security applications[END_REF].

To understand the scale of cloud computing, one should look at analysis that estimate that within the next five years, the global market will grow to 95 billion dollars and that 12% of the worldwide software will move to the cloud [START_REF] Lynch | [END_REF]. Another study reveals that 66% of Americans connected to the Web use some kind of cloud service since most popular consumer-facing services that enable better collaboration are cloud based [START_REF] Bruening | The Bureau of National Affairs, Inc. Cloud Computing: Privacy, Security Challenges , Privacy&Security Law[END_REF].

The most important question a company or a natural person should ask itself is not whether to move to a cloud but what part of the IT to move. Researchers argue that companies are forced to switch over to cloud computing in order to meet business' needs. Given the dynamic business environment and the focus on globalization, there are only a few enterprises that do not outsource some part of their business [START_REF]White Paper Cloud Computing: Business Benefits With Security, Governance and Assurance Perspectives[END_REF].

One can argue that this new approach is the future of networks capabilities and an innovative economical tool that would help companies to boost their performance by outsourcing fully their information systems and information technologies. But there are hidden costs and these are reputation, security and privacy. There are even experts that argue that the definition of cloud computing is unclear and that the benefits to the business are not being presented well [START_REF] Flinders | Microsoft slashes cost of cloud computing[END_REF]. The objective of this paper is to give the essence of security and privacy concerns that this new technological mean is facing and thus be a virtual checklist for all managers who consider or have considered the implementation of could computing approach. We are reaching a point where the implementation of cloud computing is inevitable.

Security Implications

It is well accepted in the business world that along with the benefits come risks and security concerns that must be taken into account. Managers should also consider the fact that new initiatives are most likely, unless fully examined, to bring potential for high risks. In general terms, information security is often associated with the tree principles of confidentiality, integrity and availability. Security risks such as viruses, Trojans, warms, spoofing, root kits and many others should not be ignored. Once they get into the cloud not only a single "customer" is at risk but the whole cloud with all its users. In that sense the security implication of a weak IDS and IPS will only increase the scale of damages caused not only to the cloud owner but to all the parties involved.

The very most well defined security concern is the abstraction between the physical infrastructure and the owner of the information being stored and processed. The traditional approach is based on the ownership of computer hardware where the data is stored. With cloud computing consumers do not own the computing infrastructure and often it is no longer clear who owns and controls the data if the third party is further outsourcing some of its infrastructure or services [START_REF]Webbmedia Group's Knowledge Basem, Cloud Computing Explained[END_REF], [START_REF] Binning | Top five cloud computing security issues[END_REF] or if the real owner is not mentioned in the provider's term of services. For example, if a government agency owns the provider, terms of service that allows sharing with affiliates could result in all of the user's information being obtained by prosecutor or intelligence agencies without further notice or process. In most cases, the provider would also maintain a full record of user's activities and these records for instance might be well used in a law case [START_REF] Gellman | Privacy in the Clouds: Risks to Privacy and Confidentiality from Cloud Computing[END_REF].

There is always the risk of compromising confidential information by third parties. Users are required in most cases to establish their identity by providing personal information [START_REF] Bertino | Privacy-preserving Digital Identity Management for Cloud Computing[END_REF]. With regard to this, personal information could be misused if not properly protected. The cloud provider has also responsibility to safeguard this personal information in accordance with the data protection legislations.

In general, critics do not accept counter-arguments that cloud computing may reduce the number of severity of breaches in comparison to those suffered by desktop users, as well as users who store data with third parties outside the cloud [14].

Criticality of the data handled is yet another risk to be considered. Security is no longer of use if the data is not stored and managed in a proper way. The cloud is a very dynamic structure and in time of crises and disasters information can not be available not to exclude also the unavailability of Internet at the user's end because of his physical location. That is why an important part of any contract should be the incident response policy. It is unrealistic to expect that no incident will ever happen with a cloud service provider irrespective of the measures he has taken to restrict damages and impact. This can also be linked to the physical risk which is also a major security concern. The facility where the data is stored should have adequate measures for physical protection.

The level of risk can be determined by whether an organization is outsourcing a service or infrastructure or not. In that sense, in a multi-tier service provider arrangement, each of the parties involved share the risk of security.

Companies providing cloud services need to understand that authorisation is a key point when dealing with many customers. Methods such as two-factor authentication are desirable but it is a question of applicability. If a company uses this method it has to reflect on whether it is possible to transfer it to the cloud and what the implications would be?

Current cloud computing security is weakened by the fact that most companies don't have a cloud strategy yet [START_REF] Zimski | Cloud computing faces security storm www[END_REF] and those who have, very often, over time not update their security policies and it is quite possible that they do not meet the current threats and vulnerabilities which make the security procedure very "relaxed".

Users should be well aware of what they can and cannot do in the cloud and therefore it is critical to set up their rights and responsibilities at the very start. Yet another problem is again whether the cloud provider would support a role-based model which will allow users to know exactly their user rights and to access that particular data or service for which they are authorized to.

Many cloud providers use third-parties for security audit and so they show their willingness to be accountable and reliable to their customers. The audit itself could be followed by obtaining some form of an accreditation. In general there are two benefits of an audit report: it evaluates the security risks of the cloud provider and so it gives a feedback to the user and on the other hand, it is beneficial to the cloud provider for future improvements.

However, there are certain systems which are not subject to audit by external auditors since the legal regulations do not allow such. Such an example is the US Health Insurance Portability and accountability Act [START_REF] Wang | Privacy-Preserving Public Auditing for Data Storage: Security in Cloud Computing[END_REF], [START_REF]104th Congress, The Health Insurance Portability and Accountability Act (HIPAA) of 1996[END_REF].

There are different clouds with different security models and it is up to the manager to assess the services he would like to outsource or take advantage of and the residual risks that would be the result of his choice. The human factor should not be excluded [START_REF] Yee | Cloud Computing Security Risks -Are they real?[END_REF]; it is indeed one of the highest security risks in any company. The people who are "running" the cloud should undergo a background check otherwise a company may face not only theft of data but also lack of competence in running a cloud service.

Once the expectation of the parties involved are clear, one can set up clear rules with regard to handling, use, storage and availability of information. A solution to the security problem would be the proper classification and labeling of information.

In addition to the above mentioned risk, there is also the possibility that the cloud provider may behave unfaithfully with regard to the users' outsourced data. For instance, for monetary reasons, reclaiming storage by discarding data that has been rarely accessed or not accessed at all, or in the worst case, hiding data loss as to maintain a reputation [START_REF] Wang | Privacy-Preserving Public Auditing for Data Storage: Security in Cloud Computing[END_REF].

The common practice of cloud providers to encrypt data does not imply that clients should not encrypt data themselves before sending it [START_REF] Andrei | Cloud Computing Challenges and Related Security Issues[END_REF]. However, if an intruder can figure out how to access your information in the cloud bypassing all authentication means he potentially can access all data and services. Cloud services should be addressed clearly by information security policies of the companies.

A recent survey by ENISA indicates the most important risks: lock-in, failures in mechanisms separating customers' data and applications, and legal data protection legislation [START_REF]Cloud Computing Benefits, risks and recommendations for information security[END_REF].

Many experts argue that unless one's company is in the security business it is quite clear that one's company would be less secure [START_REF] Bertino | Privacy-preserving Digital Identity Management for Cloud Computing[END_REF]. With that respect, cloud providers should use the principle of applying the highest security measures to the most risky client that would be in the cloud. Although security can be the weakest link of many cloud providers it can be also the strongest advantage of a service provider whose core business is information security. Therefore, one can argue that when we compare internal versus external information security we can be in favor of external. Some cloud computing service providers argue that cloud computing is more secure than desktop-based and enterprise computing [START_REF] Reingold | Cloud computing: the intersection of massive scalability, data security and privacy (Part I)[END_REF]. If the right security measures are in place on can argue that no data can ever be lost when a laptop is stolen or a desktop is attacked by unauthorized users since data is kept on private clouds and encrypted with access only provided to authorized users [START_REF] Gourley | Cloud Computing and Cyber Defense[END_REF].

The reason for that is very simple: Many companies have IT security as their core business. In order to examine why IT security is hard to achieve we should consider the following [START_REF] Almond | A Practical Guide to Cloud Computing Security: What you need to know now about your business and cloud security[END_REF]:

1. The number of highly skilled and experienced security technologists is very small. 2. Good security is expensive. 3. Your IT and security staff has an interest in the contents of your data. 4. Any resource (employees, contractors, service workers) in your organization that has access to your datacenter has access to all your data. 5. Most internal IT organizations grew with the business (Meaning that different systems over the time share common infrastructure).

And what happens if a vendor goes out of business?

To sum up, one of the few very important security issues before selecting a cloud vendor should cover privileged user access in order to know what people are oversighting such information and what the control over their access is. At second place, vendors should be willing to undergo an external audit and authentication. And last but not least, a vendor should state where exactly data is stored, under which jurisdiction and whether they will make a contractual commitment to obey privacy requirements [START_REF] Brodkin | Gartner: Seven cloud-computing security risks[END_REF].

In the context of European data protection the issue of data security is very much bound to the data controller who is responsible and remains such for the collection and processing of personal data also in the cases where data is processed by a third party. Some European data protection authorities require data controllers to obtain a prior consent before data is transferred abroad and very often this is followed by a detailed description of why this needed and the means for protection of the receiving body [START_REF] Tchifilionova | The mirage of law -an oasis for surveillance[END_REF].

It has to be stressed that not all types of could computing raise the same privacy and confidentiality risks. It is depends what type of information is published and the way it relates to a particular person and whether it was published with his consent. In reality these rights are ignored since consent has become a mechanism for guaranteeing continuous data flows, rather than a tool to protect individual rights [START_REF] Davies | Unprincipled privacy: why the foundations of data protection are failing us[END_REF].

The most common form of explicit consent nowadays is still the written contract. However, in the world of electronic transactions explicit consent is not that easy to come by. There is no comprehensive protective framework for safeguarding interests in the face of privacy of these new emerging technological applications.

Virtually every government worldwide would have a regulation that would allow an access to information that resides on a cloud. Cloud providers should discuss all these privacy and security implications and if necessary encrypt the data. This should be done in accordance to the current governmental legislation as not to be later considered a national threat.

A clear example for what the Government can do is the Patriot Act in the United States [START_REF]107th Congress, The Patriot Act[END_REF] where the federal government has the right to request details of ones online activities without the knowledge of the person. With that respect sometimes the forensics procedure may not be clear and so a third party can access your information in the cloud.

On the other hand, although the Government may have his legal right, a bigger concern should be the weak security systems of the websites where a phishing attack or key logging can happen easily. Even more than before, the importance of a strong password and any other form of authentication has came up so important [START_REF] Trapani | The Hidden Risks of Cloud Computing[END_REF].

It is quite interesting to note that information could be physically located in two or more different locations. And if the vendor moves this information without the knowledge of the owner then it is the case of changing the legislation and therefore suffering different legal consequences.

The trend toward adopting privacy and data protection legislation has continued consistently to the present. Most central European nations, as well as other jurisdictions, such as Australia, New Zealand and Hong Kong, now have so called "omnibus" data protection legislation.

The United States, however, has not adopted omnibus data protection legislation. The current culmination of three decades of European policy development is reflected in the European Directive 95/46/EC [27]on the Protection of Individuals with the Regard to Processing of Personal Data and on the free Movement of such Data.

The EU Directive contains a significant extraterritorial provision that the flow of personal data from any EU member country may be halted, if the jurisdiction to which it is being transferred is deemed not to have an adequate level of protection for personal data. American companies doing business in Europe have had to adhere to the data protection laws of each of the jurisdictions in which they operate. As a matter of fact, many American companies know how to and have been complying with omnibus data protection legislation in the countries that require it. The irony is that these companies may not be providing the same level of protection of personal data for Americans or individuals in other parts of the world where there is no statutory requirement. Law seems to be powerless when it comes to international boundaries [START_REF] Hurley | A whole world in a glance: privacy as a key enabler of individual participation in democratic governance[END_REF].

There is a common practice of cloud service providers to keep information in place after it has been removed from the user is in place. Most social networks misuse the information of their users and do not inform them about the privacy changes they made and in the worst case they inform them after the actual change leaving the users with no choice to delete or edit the information they have uploaded on the cloud.

In many instances a user may not be aware of the existence of a second-degree provider and often the cloud provider offers its facilities to the users without an individual concept. Changing the terms of the policy without limit would find a user a step back when he realizes that the privacy policy has changed and he has not had the opportunity to remove sensible data.

One of the greatest privacy concerns is the risk of compromise of confidential information which can pose a significant complication with regard to the fact that data could be handled and stored in different geographical locations. Compliance to regulations and laws in different geographical locations can be quite challenging. Although the legislation itself could be a solution to the privacy problem, during the years it has proved that in certain cases it would fail [START_REF] Tchifilionova | The mirage of law -an oasis for surveillance[END_REF] Unless there is a legislation explicitly governing cloud computing, no security means would be able to substitute for it. It is often the case that law is behind the technology developments.

Another security risk posed by could computing is the mix up of information assets which is usually the result of high-availability systems without the set up of private networks [START_REF] Bruening | The Bureau of National Affairs, Inc. Cloud Computing: Privacy, Security Challenges , Privacy&Security Law[END_REF].

In March 2009 the Electronic privacy information center filed a complaint and request for injunction before the Federal trade Commission exposing the security flaws of Google's Cloud Computing. In the above mentioned case, Google was unable to protect usernames and passwords allowing outsiders to "snoop on users' e-mail", another vulnerability was the security flow resulting from a vulnerability in Google desktop and Internet Explorer. [START_REF] Vijayan | Before the Federal Trade Commission, Complaint and request for Injunction[END_REF].

Privacy is not only about companies' and enterprises' data but it is very often a matter of revealing personal information as it was in the case of Google.

A more recent case was brought up to the light in February 2010 when the an Italian judge decided to invoke a six-month suspended jail sentence on Google's global privacy council and two other company executives. This case proves the public need to maintain privacy and to make even executives accountable which is also believed to be the first time in privacy history [30].

Users should be enabled to give informed consent once the cloud provider proves that they are trustworthy and handle the information with care. The privacy commissioner of Ontario argues that companies need to understand that identity management is not only a business process but also a user activity. The infrastructure must account for many devices and allow for a unified user experience over all devices [START_REF] Cavoukian | Privacy in the clouds: A White Paper on Privacy and Digital Identity: Implications for the Internet, Information and privacy commissioner of Ontario[END_REF].

It is common for a cloud provider to offer cloud services or infrastructure without individual contracts. If the user is bound by the general published terms of services it would be very difficult to stop the provider to acquire a variety of rights on the information [START_REF] Gellman | Privacy in the Clouds: Risks to Privacy and Confidentiality from Cloud Computing[END_REF].

It could also happen that the cloud provider acquires information that reveals transactions and relations which may have purely a commercial value. The simplest example would two companies negotiating a merger or being rivals on the market.

The core of privacy that law protects should be clearly defined in terms of harmful uses and remedies. Imaginary harms must be addressed by communication and education, not by legislation and regulation [START_REF] Bergkamp | EU Data Protection Policy[END_REF], [START_REF] Litan | Balancing Costs and Benefits of New Privacy Mandates[END_REF] Once people understand the business use of information, the benefits of free flow, and the cost of privacy, their privacy preferences may well appear to be not what we believe them to be. One of the latest developments in this area is the launch of the Privacy Impact Assessment by the UK Information Commissioners Office [34]. Similar Acts exist also in the USA, Canada and Australia where privacy commissioners are the primary privacy and data protection authorities. Most commonly, concerns arise when it is not clear why their personal information is requested or how it will be passed on to other parties [START_REF] Pearson | Taking Account of Privacy when Designing Cloud Computing Services[END_REF].

Conclusions

Companies need to be very specific in choosing a provider. Accountability is one possible way to state the responsibility of the company offering cloud computing services independent of the place it resides or is processed. Still, legislation should be in place and must be a must.

There is no doubt that cloud computing is becoming more of a utility than simple capability delivered over a network. One big advantage is the concept of risk-share but if you do not know what you are sharing then you can not define and demand a proper security frame. Furthermore, only the minimum information should be collected or stores, and so inform the users what type of information one is storing and for what purposes.

Unless your organization in the security business it is likely that the company will be less secure than the cloud provider. For that reason, one should first compare the levels of security of his company and the cloud provider. Cloud computing has significant implications for the privacy and security of information not only for private but also for business information.

Security and privacy will remain a major concern until users become fully aware of the "depth" of the cloud: who manages it, how he does it and whether the company can afford to "give away" its information -decision that can only be taken after a careful risks analysis and policy considerations otherwise we may simply get lost in the cloud.


-W Phan

Ahmad R Amran

John N Whitley

David J Parish

Evidential Notions of Defensibility and Admissibility; with Property Preservation

Loughborough University within the High Speed Networks (HSN) Lab of the Electronic and Electrical Engineering department LE11 3TU, UK {r.phan, a.r.amran, j.n.whitley, d.j.parish}@lboro.ac.uk Abstract. For security-emphasizing fields that deal with evidential data acquisition, processing, communication, storage and presentation, for instance network forensics, border security and enforcement surveillance, ultimately the outcome is not the technical output but rather physical prosecutions in court (e.g. of hackers, terrorists, law offenders) or counter-attack measures against the malicious adversaries. The aim of this paper is to motivate the research direction of formally linking these technical fields with the legal field. Notably, deriving technical representations of evidential data such that they are useful as evidences in court; while aiming that the legal parties understand the technical representations in better light. More precisely, we design the security notions of evidence processing and acquisition, guided by the evidential requirements from the legal perspective; and discuss example relations to forensics investigations.

Motivation

For the security fields that involve evidential data acquisition (e.g. monitoring or surveillance), processing, communication, storage and presentation (or reconstruction), such as network forensics [START_REF] Kenneally | Digital Logs -Proof Matters[END_REF][START_REF] Nikkel | Improving Evidence Acquisition from Live Network Sources[END_REF], border security and enforcement surveillance, the ultimate outcome is not so much the technical output but rather the physical prosecutions in court (e.g. of hackers, terrorists, law offenders) or counter-attack measures [START_REF] -W. Phan | Adversarial Security: Getting to the Root of the Problem[END_REF] against the adversaries behind malicious attacks.

This paper motivates the research direction of formally linking the above-mentioned technical fields with the legal field. The approach we suggest is to design the relevant security notions and the technical methods of evidence processing and construction [START_REF] Kenneally | Risk Sensitive Digital Evidence Collection[END_REF] guided by the evidential requirements from the legal perspective.

In more detail, we advocate the need to treat the following particular research directions, all of which are open problems to date.

• Formal definitions [START_REF] Rogaway | Practice-Oriented Provable Security and the Social Construction of Cryptography[END_REF] of evidential notions: we classify evidential usefulness in terms of how usable it is as the evidence (define this as admissibility) and whether the processes applied to the evidence from crime scene to court are legally appropriate (define this as defensibility). Doing so provides the framework to guide the design of technical evidential collection and construction, as well as gives a sound mapping between the technical and legal fields so to avoid ambiguity during the transition from one field to another and/or throughout the life cycle of the evidence. This is crucial as defensibility requirements dictate that continuity of evidence be ensured from crime scene (or observed event) through to court room. • Design of property-preserving processes for evidential data e.g. acquisition, duplication, storage, reconstruction: it is important that the evidence have continuity [START_REF] Turner | Digital Provenance -Interpretation, Verification and Corroboration[END_REF] from crime scene to court. Therefore, as the evidence is processed along the way, there is a need to ensure that the processes preserve the evidentiary properties [START_REF] Mocas | Building Theoretical Underpinnings for Digital Forensics Research[END_REF] of the evidence such as provenance [START_REF] Turner | Digital Provenance -Interpretation, Verification and Corroboration[END_REF], integrity and admissibility. • Design of abstract evidential data constructs satisfying legal admissibility requirements.

In this paper, we treat the first research direction. The last two directions are our on-going research.

Notions

We first define the primitive security properties desired for evidential data. We then define our main evidential notions, namely defensibility (dealing with the validity of the process) and admissibility (dealing with the validity of the final evidence presented to court).

Primitive Properties

Integrity, (source) authentication and linkability are the underlying properties that form the base of wider notions including defensibility and admissibility.

Integrity and Source Authentication. The integrity property and source authentication property of some evidential data can be based on cryptographic notions of integrity e.g. INT [START_REF] Bellare | Authentication Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm[END_REF], and unforgeabiilty (UF) [START_REF] Goldwasser | A Digital Signature Scheme Secure against Adaptive Chosen-Message Attacks[END_REF].

Linkability. Let w(E S , ID) denote a function that evaluates the weight of evidence E S at state S of the evidence life cycle with respect to how much it links to a particular individual of identity ID. An evidence E S is said to be linkable (LNK) to a particular person of identity ID if the weight of the evidence w(E S , ID) > ε for some negligible ε.

Defensibility

This notion can be defined to include the preservation of the properties of integrity, data provenance (a.k.a. chain of custody) and relevance (in terms of necessity, and linkability to the suspect and to the crime or event).

Property Preservation. The gist of the notion of property preservation (PPr) relates to the state of the evidential data E still retaining a particular property P even after undergoing a function f (•). Let f (•) denote a function ∈ {acquisition, processing, storage, communication, presentation, reconstruction} operating on some evidence E S at state S. See Fig. 1.

If E S exhibits a property P, denoted as Pr[E S → P] > ε for some negligible ε, then f (•) is said to be property-preserving in the sense of P if f (E S ) also exhibits property P, i.e. Pr[f (E S ) → P] > ε.

Define an adversarial game where adversary A interacts with a forensics challenger and is allowed oracle access to any f (•) ∈ {acquisition, processing, storage, communication, presentation, reconstruction}. Furthermore, A is given samples of some evidence E S exhibiting property P. The game ends when A outputs an evidence ẼS . Define A's advantage in winning the game as

Adv PPr A = ((Pr[E S → P] > ε) ∧ (Pr[f (E S ) → P] < ε)) ∨ ((Pr[E S → P] < ε) ∧ (Pr[f (E S ) → P] > ε)).
A function is property-preserving in the sense of P if Adv PPr A < ε. The adversarial winning condition here captures the case where a function f (•) negates the existence of an evidence E's property P. Provenance. This requires the integrity maintenance of custody information i.e. information about which party is responsible (holds the custody) over the evidence, at each state of the process from crime (or event) scene to court.

Relevance. For the relevance notion, we emphasize that besides capturing how the necessary evidential data are acquired and processed, as well as including linkability, the notion should also capture the assurance that non-necessary data is not represented e.g. private data that will intrude the privacy of non-involved passers-by who just happen to be there. This is an interesting open problem, since for instance current enforcement monitoring systems such as CCTVs and border security controls do not formally assure privacy preservation and this notion of relevance.

Admissibility

This notion emphasizes on the verification of the final evidence in terms of its integrity, provenance and relevance. Herein, adversarial games can be defined for each of the properties. While integrity will be more straightforward, the provenance property should include a measure of the evidential data origin including source (e.g. IP address for network forensics, or identification details of the suspect) and event/crime location details, whereas the relevance property is as discussed above in subsection 3.2.

Exemplification

To be more illustrative, we present some brief instances to exemplify the applicability of Section 3's notions in network forensics.

Integrity and Linkability

Consider an instance of telecommunications service in an organisation, telephone calls taking place on or through corporate switchboards (PABXs). Such switchboards routinely provide data about the numbers called and the time and duration of calls. They do so as a means to monitor costs for outgoing calls and to check on service quality with respect to internal calls. The logs produced can be of considerable value in many kinds of investigations. Some businesses routinely record phone calls as a check against disputed transactions, or to see whether their employees are misbehaving (misuse, corporate sabotage, terrorism etc).

In a forensic situation, the immediate and important issue is to be able to demonstrate that the logs and/or recordings are reliable and have not been tampered with. It is helpful to be able to say something about the specific PABX and what logging facilities exist. There should be some statements about how they were collected, by whom, what precautions were taken, and how selections of data were made. The data should also be subjected to some form of integrity check, as a guard against postcapture tampering and forgery. They can specifically be linked to alleged individuals and circumstances. Thus, any evidential data will be considered for weight of fact with respect to its persuasiveness and probative value.

Provenance, Weight of Evidence and Property Preservation

In any type of investigation, the forensics challenger must follow an investigation process. That process begins with the step of assessing the case and documenting them in an effort to identify the crime and the location of the evidence. An evidence's chain of custody (data provenance) must be prepared to know who handled the evidence, and every step taken by the forensic investigator must be documented for inclusion in the final report. Sometimes a computer and its related evidence can determine the chain of events leading to a crime for the investigator as well as provide the evidence which can lead to conviction. For instance, in a network attack instance; each adversary could have his own unique motives, methods and skills. He begins with little or no information about the target. However, depending on his skills, he might be able to construct a detailed roadmap that may enable the adversary to compromise the target. The adversary's approach generally covers several of these seven steps (or all of them based on their motives, methods and skills): 1) Perform a footprint analysis e.g., IP address, domain name, location, subsidiaries etc; 2) Enumerate information e.g., type and version of OS, ftp, mail and services running etc; 3) Attack the network and penetrate systems that have high vulnerabilities e.g., knowledge gained from published Common Vulnerability and Exposure (CVEs); 4) Escalate privileges to have access control e.g., social engineering and/or brute force; 5) Raid information and user records; 6) Install backdoor to circumvent trusted programs; 7) Leverage the compromised system. Any evidential data of any of these or more would cause a certain degree of severity to the damage done, and this relates to the weight of evidence.

Finding the evidence, discovering relevant data, eradicating external avenues of alteration, gathering the evidence, and preparing a chain of custody are processes where evidential properties need to be preserved through to court. A forensics challenger must ensure that evidential data still exhibits a particular property (e.g. integrity) from when they are first gathered and seized at the crime scene, through the processes of the chain of custody preparation, evidence transportation to and/or storage at forensics labs, to ultimately the court room.

Remarks

Defensibility methods could be designed as essentially protocols that have underlying security mechanisms for integrity checking (e.g. message authentication codes or hashes keyed by secrets), source authentication (e.g. digital signatures) and traceability. Parties are used to model the interaction from one intermediary spatial point or representative form to another during the course of the evidence from crime scene through to court.

Admissible methods could be designed as mechanisms rather than protocols as they do not involve interaction among parties but rather apply to the evidential properties of the final evidence.

Having explicit and non-ambiguous notions and processes allow the proper mapping from technical evidence processing of monitored scene through to legal courts and enforcement, and this will lead to effective evidential systems where the processing of evidential data is non-wasteful and fit for purpose.

Fig. 1 .

 1 Fig. 1. Evidential data going through multiple processes from crime scene to court.