Annex 1 TERMS OF REFERENCE Study on methodologies or adapted technological tools to efficiently detect violent radical content on the Internet 1. INTRODUCTION Modern information and communication technologies play an important role in the development of the threat which is currently represented by terrorism. In particular, the Internet is cheap, fast, and easily accessible and has a practically global reach. All these advantages, highly appreciated by law-abiding citizens that benefit from the Internet in their daily lives, are also unfortunately exploited by terrorists, who have perfectly understood the potential of the Internet as a tool to spread propaganda aiming at mobilisation and recruitment as well as to provide for instructions and manuals intended for training or planning of attacks at very low risk and cost. The Internet serves in this manner as one of the principal boosters of the processes of radicalisation and recruitment: it is used to inspire and mobilise local networks and individuals in Europe and also serves as a source of information on terrorist means and methods, thus functioning as a virtual training camp. The dissemination of such propaganda, instructions and manuals through the Internet has therefore empowered terrorists, making the terrorist threat grow. Often, law enforcement authorities lack capacity and expertise to cope with the volume and plurality of languages in which terrorists disseminate violent radical content. In addition, the nature of the Internet itself: its extra-territoriality together with the anonymity it provides seriously hinders the reaction of law enforcement authorities complicating both the removal of such content from the Internet and the investigation and prosecution of those responsible for a website and its content. Aware of these difficulties, the Commission has envisaged several actions aimed at supporting law enforcement authorities to counter the use of the Internet for terrorist purposes under the annual work programme 2008 - of the financial programme Prevention of and fight against crime. In particular, it envisages a study on methodologies or adapted technological tools to efficiently detect violent radical content on the Internet. 1
2. PURPOSE OF THE STUDY The aim of the study is to provide the necessary expertise to support the Commission policy making in the field. It should serve as a basis for the promotion, support, or help to develop methodologies or adapted technological tools to efficiently detect propaganda aiming at mobilisation and recruitment for terrorism as well as instructions and manuals intended for training or planning of terrorist attacks (hereinafter "violent radical content") on the Internet as well to identify those who spread this content. The study should analyse the needs of law enforcement authorities in the Member States concerning the detection of violent radical content and the identification of those who spread it. It should also examine the main methodologies and tools currently used in the European Union for the detection of specific contents on the Internet, and violent radical content in particular, for law enforcement purposes. The contractor should assess to which extent existing methodologies and tools meet the needs of Member States. Where the situation is not satisfactory, the study should specify whether the technological resources are not used in the most appropriate manner or whether the technological resources should be improved. On the basis of the previous finding, the contractor should suggest possibilities of improving the state of play by promoting, supporting, or helping to develop new methodologies or adapted tools to efficiently detect violent radical content on the Internet. The contractor should present different options, and assess their estimated costs, benefits and risks. 3. CONTENTS OF THE STUDY The study should at least cover the following aspects: 1) Methods of disseminating violent radical content, and needs, methodologies and tools to detect it. The study should describe the main needs of law enforcement authorities in the Member States concerning the detection of violent radical content and the identification of those who spread it. For this purpose, specific characteristics linked to the dissemination of violent radical content should be taken into consideration, such as the diversity of languages in which messages are conveyed as well as the extensive use of Islamic imagery and its symbolisms. The increased use of dynamic communication services such as Voice over IP, discussion forums, chat-rooms or instant messengers in detriment of static websites should also be taken into consideration. The contractor should present in a clear manner the main available methodologies or adapted technological tools currently used to detect specific content on the Internet for law enforcement purposes and identify those who spread it. In particular, it should focus on those methodologies and tools used for the detection of violent radical content in the Member States. The study should, to the possible extent, detail the state of play in each Member State and underline the differences between Member States as well as the similarities. It 2
should also reflect existing common initiatives, shared methodologies and tools between Member States or third countries. 2) Assessment methodologies or adapted technological tools used by the Member States to detect violent radical content The study should assess to which extent methodologies or adapted technological tools used by the Member States to detect violent radical content meet the needs of law enforcement authorities. To the possible extent, the contractor should present the kind of deficiencies/difficulties affecting each Member State and their importance. The origin of the deficiencies/difficulties should also be explained e.g. technological resources are not used in the most appropriate manner; the technological resources need improvement etc. In order to assess the efficiency of the methodologies or adapted technological tools used by Member States, the contractor may also take into consideration other methodologies and tools, available in the private sector or used by third countries which are most advanced as regards detection technologies, countering illegal content online or open source intelligence. 3) Advise on the promotion, support or help to develop methodologies or adapted technological tools to efficiently detect violent radical content. Based on the previous data, the contractor should suggest an adequate Commission's policy to promote, support or help to develop methodologies or adapted technological tools to efficiently detect violent radical content and trace those who spread it. The contractor should present more than one specific and feasible option and indicate their estimated costs, benefits and risks. The solutions may imply the development of new methodologies or the acquisition of new technological tools through co-financing of the Commission; they may entail the transferability of methodologies and tools used to detect other kind of illegal content on the Internet or even methodologies and tools used for detection in fields other than law enforcement. They may also imply the sharing of expertise and exchange of best practices between Member States and relevant European bodies as regards methodologies and the use of new tools. Concerning the development of new methodologies or acquisition of new technological tools, the contractor should be aware of the specific characteristics linked to the dissemination of violent radical content, as described under point 3.1. 4. SCOPE The study consists of an overview on methodologies or adapted technological tools used by law enforcement authorities in the Member States to detect violent radical content on the Internet; the assessment of their efficiency, based on the needs of the law enforcement authorities, and the presentation of different options to improve the state of play by promoting, supporting or helping to develop new methodologies or tools. 3
The study does not cover the question as whether the dissemination of violent radical content through the Internet should be illegal or not. Such question has already been dealt with at legislative level. In particular, the Council of Europe on the Prevention of Terrorism and the Council Framework Decision amending Framework Decision 2002/475/JHA on combating terrorism introduce three new offences - public provocation to commit terrorist offences, recruitment for terrorism and training for terrorism in both instruments - also when committed through the Internet. The study does not cover either non-legislative measures to prevent the distribution of violent radical content on the Internet, such as notice and take-down procedures and cooperation between NGOs and law enforcement authorities. This particular topic will be the object of a separate study, as referred to in the financial programme 2008 - Prevention of and fight against crime. 5. METHODOLOGY, ANALYSIS AND CONCLUSIONS The study must have a European perspective, but experience and approaches from outside the EU may also be taken into consideration. The study must treat the subject in the most comprehensive manner possible, through field work, collection of empirical data etc. Hence, the contractor can also use methods such as interviews, questionnaires, etc., but will have to explain, how this will enable him to obtain relevant information. The study should draw on evidence gathered from relevant stakeholders, in order to achieve a complete analysis of existing expertise and knowledge. These include the relevant authorities in Member States, relevant personnel of Europol, and main industry representative organisations concerned (e.g. EUROIspa, and the Eurosint forum - an association dedicated to European cooperation and use of Open Source Intelligence that prevent risks and threats to peace and security may prove to be a valuable contact). The contractor shall demonstrate in its bid a method how to access relevant actors at the EU and national levels. The Commission expects the contractor to be capable of engaging in discussions on sensitive topics, so appropriate security clearances must be in place during the entire period of the study. At the end of the study, the contractor must make concrete proposals or recommendations which the European Union or the Member States could implement in a practical manner. At the same time, the study should highlight any deficiencies in the evidence and the findings and, where necessary, the difficulties of drawing certain conclusions or the potential flaws that any conclusions might contain. 6. CONTEXT The tenderer should take into consideration the following documents: Council of Europe Convention on the Prevention of Terrorism Communication from the Commission to the European Parliament, the Council and the Committee of the Regions "Towards a general policy on the fight against cyber crime" of 22 May 2007; COM(2007) 267 final. 4
Proposal for a Council Framework Decision amending Framework Decision 2002/475/JHA on combating terrorism; (COM/2007/0650). Staff working document Impact assessment accompanying the proposal for a Council Framework Decision amending Framework Decision 2002/475/JHA on combating terrorism Green paper on detection technologies in the work of law enforcement, customs and other security authorities of September 2006; (COM/2006/474) Europol TE-SAT EU Terrorism and trends reports 2007 and 2008 The contractor should be knowledgeable about the work developed under the project "Check the Web" led by Europol, and seek for complementarities, avoiding any overlapping. In addition, there might be national projects of relevance for the present study. Awareness and knowledge of the work of main industry engaged in online detection technologies will be considered as an asset, as well as of the work of law enforcement authorities directly involved in the fight of illegal content online. 7. DOCUMENTS TO BE PRESENTED IN THE BID The tenderer is required to present a detailed action plan describing how he wants to achieve the delivery of the services within the contractual timeframe. The tender will present in a structured way: 1. an understanding of the purpose of the services and the nature of the tasks to be undertaken. Details should be given on a preliminary assessment of the difficulties and expected results. 2. proposed approach to develop an efficient and appropriate study meeting the scope requirements. 3. proposed methodology and tools that will be used to respect the terms of the action plan. 4. the proposed team organisation and structure which will be put in place to achieve the expected results. Details should be given on the allocation of staff profiles to different tasks. The description of the lines of reporting should be part of this section. 5. detailed business proposal (price). All unit costs should clearly appear. Management as well as travel and accommodation costs should be highlighted in the estimate. 8. REPORTS AND DOCUMENTS TO BE SUBMITTED The contractor shall be required to submit the following reports, in either French or English: 1) Inception report The contractor shall submit a draft inception report within two weeks of the date of signature of the contract and in advance of the kick-off meeting. 5
The draft inception report shall include a detailed methodology for the study, the composition of the team of experts and a detailed work plan for the first six months of the project. A revised document, based on the discussions in the meeting, shall be delivered within one week after the meeting. 2) Interim report The contractor shall submit a draft interim report will have to be submitted to the Commission six months after the entry into force of the contract and present it to the Commission in a meeting. This document shall consist of: an executive summary consisting of a succinct (typically less than three main body text pages) to update on the activities carried out, a progress report indicating main difficulties encountered and results obtained interim findings and conclusions on the substantive issues, particularly on parts 3.1 and 3.2 of the study an update of the work plan for the remaining period annexes listing documentary information gathered, relevant contacts made, meetings held. The draft interim report shall be provided in paper form and electronically as arranged with the Commission. The Commission shall comment on the interim report within twenty days of reception. The contractor shall submit updated documents within fourteen days of receiving the Commission's comments. 3) Final report The contractor shall submit a draft final report at the end of the nine months contractual period and present it to the Commission in a meeting. This report shall describe the work accomplished and the results obtained when carrying out the contract. The Commission shall have forty five days from receipt to approve or reject the report, and the Contractor shall have fourteen days in which to submit additional information or a new report. The final report shall be approved by the Commission in writing, and in any case will deemed to have been accepted if the Commission does not communicate any comments to the Contractor within forty five days of the date of receipt of the study. A final report, fully reflecting the Commission's comments, must be submitted no later than one month from the date of receipt of such comments in English (5 copies for the complete study and a electronic version in CD-ROM). The final report must contain a relevant executive summary that may be used for publication. 9. DURATION OF THE CONTRACT The duration of the contract shall be 12 months. 10. WORK CONDITIONS 6
Place of work The work shall be carried out on the contractor's premises. Missions The contractor may need to carry out missions in order to obtain information necessary for the study. Steering meetings with the Commission will in principle be held in Brussels. The cost of such missions shall be integrated in the overall costs of the study. Workshops The contractor may organise networking activities such as workshops in order to reinforce the exchange of information with external experts or stakeholders. The contractor will invite the Commission to such activities and will report specifically on the results. Confidentiality and security clearances The contractor will have to conform to the rules of access to classified information drawn up in the Member States and to make sure that its personnel holds the appropriate security clearance to handle classified documents granted by an EU Member State and valid for the duration of the contract. Tenderers are required to send proof of this with their bids - i.e. a copy of their Facility Security Clearance (FSC) up to UE SECRET level ("EU SECRET") issued by their national security authority. The FSC will be verified by the Commission's security office prior to the signature of the contract. Members of the study team are expected who might have access to classified information for the purpose of the study, must provide proof of security clearance along with the bid for this tender. The personnel security clearances will be verified by the Commission's security office prior to the signature of the contract. Meetings with the Commission The contractor may be requested, and should be prepared, to attend a kick-off meeting at the Commission s premises in Brussels. Two additional meetings in Brussels should be foreseen for the discussion of both the draft interim report and the draft final report. 11. MAXIMUM BUDGET The maximum amount available for presenting the study is 200 000 Euro. The budget is indicated in line with the principle of sound financial management, and the principles of economy and value for money shall prevail. While setting their travel budgets, tenderers are invited to take into account the requirements and the geographical coverage needed. 7