INTERPOL’s Forensic Report
on FARC computers and hardware
seized by Colombia
Bogota, Colombia – 15 May 2008
Press statement by Ronald K. Noble, INTERPOL Secretary General
Printable version
Ladies and Gentlemen,
Members of the press,
No person, no country, and not even INTERPOL, the world’s largest international police organization, can fully understand the extent to which the terrorist group FARC has prevented the Colombian people from leading their lives as freely as possible without fear of deadly attack, kidnapping, extortion or other crimes.
Only in the last 10 years, FARC has perpetrated 16,500 terrorist attacks; murdered 7,500 people; injured another 9,500; and kidnapped more than 12,000.
The father of your President was just one of the many victims murdered by the FARC. Several presidential candidates have been kidnapped by the FARC. Elected officials, civil servants, police officers and ordinary citizens – all of them have suffered at the hand of the FARC. Seated to next to me is the Head of your Departamento
Administrativo de Seguridad , Ms Hurtado Afanador, who herself was seriously injured in a FARC terrorist bombing.
Although the world has focused its attention on efforts to liberate Ingrid Betancourt, which INTERPOL strongly endorses, we all know that there are many others being held hostage by the FARC. Among them, Pablo Emilio Moncayo, who has been held hostage by the FARC since 21 December 1997 and whose loved ones long for his return.
This, and many other personal tragedies, explains why the Head of your National Police, General Naranjo, seated at my other side, and other police officers like him have dedicated their lives and careers to combating the FARC for more than 40 years.
So INTERPOL does not need to state the obvious by telling you why it is important that the FARC be investigated thoroughly and intensively, with full respect for the rule of law.
The reason for INTERPOL’s presence here today is because we were asked by Colombia’s Director of DAS and Head of the National Police to independently examine the contents of eight seized computer exhibits -- evidence recovered following a raid on a FARC terrorist camp on the Ecuadorian side of its border with Colombia on 1 March 2008.
What does it practically mean when a country calls on INTERPOL for help? Most of you know the name INTERPOL from movies or books. Thanks to the imagination of writers, the name INTERPOL has become larger than life. The reality is different, yet no less extraordinary.
INTERPOL has a rich history and celebrates this year its 85th anniversary. We currently have 186 member countries spanning the entire globe, which makes us the world’s largest police organization.
And those few countries that had yet to join INTERPOL have begun to do so in recent years. In 2006, the world’s oldest democracy ( San Marino) and then newest democracy ( Montenegro) joined the Organization. Just last week, we received strong indications that the State of Vatican City will seek to become INTERPOL’s 187 th Member Country later this year.
This reflects how more and more countries are recognizing that in the 21 st Century, on any given day and time, any country may face a crisis and may need independent international police assistance to deal with the situation at hand. When this occurs, the institution to which they turn is INTERPOL.
INTERPOL is not something tangible. It is not simply a Headquarters located in France or in offices around the world, even though those dedicated INTERPOL officials work tirelessly and under constant pressure to honor the ideal of international police co-operation. They are the ones who made our independent examination possible. To produce this report, 64 different INTERPOL officials have worked over 4,000 hours since 4 March of this year.
INTERPOL is intangible and more than the sum of its parts. INTERPOL incarnates the belief of law enforcement in our member countries that we can assist them during a crisis situation; that, when needed, we can provide specialized expertise to conduct a particularly complex investigation or deal with a disaster; that we can serve as an independent law enforcement body in international investigations; and, most importantly, that we will be there for them 24 hours a day/7 days a week
INTERPOL is the unique and combined strength of our 186 National Central Bureaus, our Sub-Regional Bureaus, our Liaison Offices and our member countries’ law enforcement services around the world that ensure that at any time and anywhere, whenever a law enforcement officer calls for assistance, that call will be answered.
Currently, INTERPOL is assisting China with its preparations to ensure a safe and secure 2008 Beijing summer Olympics. A little more than a week ago, we were asked by Norway to help identify a child sex predator who had been photographed sexually abusing young boys in Southeast Asia. Thanks to the confidence that the public has in INTERPOL, we were successful: within 48 hours of INTERPOL’s global appeal to the public, the prime suspect, Wayne Nelson Corliss, was located and arrested. Last year, INTERPOL coordinated a multi-country investigation into illegal gambling that led to the closures in seven jurisdictions of 472 illegal sports gambling dens which handled almost 700 million dollars annually in illegal bets.
Occasionally, INTERPOL is also called upon to help resolve factual disputes between INTERPOL member countries over how to interpret evidence. This was done when a person was arrested as an alleged terrorist suspected of the March 12, 2004 deadly Madrid terrorist subway bombings. This arrest had been made by one country based on one finger mark comparison. Spain did not agree with the conclusion reached by the other country that the finger mark matched. INTERPOL’s independent expert opinion was sought, and our analysis supported Spain’s conclusions. Eventually, it was determined the person was innocent and he was released.
On each occasion when INTERPOL’s independent expertise is sought, we establish clear procedures tailored to the case in question, with one overarching goal in mind: to provide an independent, thorough and accurate set of findings that is within the scope of our remit and that is influenced only by the evidence before us. We have no personal stake in the outcome of our findings; we are indifferent as to whether it validates or invalidates a piece of evidence or whether it proves the guilt or innocence of any particular person. We just want our assessment to be above reproach and to be as professional, independent and comprehensive as possible.
In this current dispute, we did not ask to become involved, but when the call for assistance came from Colombia, we did not hesitate to say yes – even though we knew that we ran the risk of becoming the target of unfair attacks questioning our independence, integrity and professionalism.
INTERPOL took a number of steps to clearly safeguard its independence. On Friday, 7 March 2008, I personally explained to all of our 186 member countries what had been agreed with the Colombian authorities and I emphasized that INTERPOL’s role was exclusively technical. We would provide Colombia with expert computer forensic assistance to examine the seized exhibits, but INTERPOL would not evaluate the accuracy or the source of the exhibits’ content.
In addition, I expressed my willingness and availability to travel to any INTERPOL member country that requested a meeting to discuss this matter.
I made it clear that I would travel to Colombia with our Incident Response Team to ensure that there is no misunderstanding about the team’s tasks and responsibilities; to ensure that the working conditions will permit them to function in an independent atmosphere; and to ensure that any last minute questions or issues can be efficiently dealt with and resolved.
On Saturday, 8 March 2008, while our Incident Response Team was making final preparations for its deployment the next day, I had a telephone conversation with Mr José Miguel Insulza, Secretary General of the Organization of American States (OAS) to advise him of the exclusively technical expertise to be provided by INTERPOL. Secretary General Insulza stated that he strongly and publicly supported INTERPOL’s independent examination. We also met in Bogota and I briefed an OAS delegation on INTERPOL’s role.
In addition, during INTERPOL’s 4th Heads of National Central Bureaus meeting held in Lyon, France, from 2 to 4 April 2008, I met with the heads of delegation from Colombia, Ecuador and Venezuela to explain the nature of INTERPOL’s assistance to Colombia. During that meeting, I reiterated my offer to travel to any INTERPOL member country that had concerns about INTERPOL’s deployment of the Incident Response Team.
I followed this up with separate letters to the national police commissioners of Colombia, Ecuador and Venezuela and to the Director of Colombia’s Departamento Administrativo de Seguridad .
Colombia was the only INTERPOL member country that asked to meet with INTERPOL’s Secretary General, and no country objected to INTERPOL’s computer forensic examination of the eight seized FARC computer exhibits.
Our Incident Response Team included two forensic experts from Australia and Singapore who were selected by their national police administrations, not by INTERPOL Headquarters. The experts came from outside of the region and did not speak Spanish, which helped to eliminate the possibility that they might be influenced by the content of any data they were examining. They were given complete discretion in determining how to conduct their examination. They were simply told to examine the seized evidence and present their findings. They divided the eight seized FARC computer exhibits equally between them and each of them examined four exhibits. They created their own key-word index without understanding Spanish. And, they produced what must be recognized as a comprehensive, independent and extraordinarily detailed classified report.
Using sophisticated forensic tools, INTERPOL's experts determined that the eight seized computer exhibits contained more than 600 gigabytes of data, including:
37,872 written documents,
452 spreadsheets,
210,888 images,
22,481 web pages,
7,989 email addresses,
10,537 multimedia files (sound and video), and
983 encrypted files.
In non-technical terms, this volume of data would correspond to 39.5 million filled pages in Microsoft Word and, if all of the seized data were in Word format, it would take more than 1,000 years to read at a rate of 100 pages per day.
A lot of effort went into breaking the 983 encrypted files; to do so, INTERPOL’s experts linked and ran 10 computers simultaneously 24 hours a day / 7 days a week for two weeks.
I cannot thank or compliment INTERPOL’s two experts enough. They devoted more than a 1,000 hours to analyse the seized FARC computer exhibits. I cannot say enough good things about my staff at INTERPOL Headquarters who helped to produce these reports in Spanish and English – including the classified report. I pushed them like no boss should ever push his staff, but they responded in an extraordinary fashion to make sure that Colombia and the world learns what INTERPOL’s experts found.
Let me highlight the key findings in lay person’s terms:
INTERPOL's team of forensic experts discovered “no evidence of modification, alteration, addition or deletion” in the user files of any of the three laptop computers, three USB thumb drives and two external hard disks seized during a Colombian anti-narcotics and anti-terrorist operation on a FARC camp on 1 March 2008.
Based on INTERPOL’s careful and comprehensive forensic examination of each of the eight seized FARC computer exhibits and on consideration of all the evidence reviewed by our experts, INTERPOL concludes that there was no tampering with any data on the computer exhibits following their seizure on 1 March 2008 by Colombian authorities.
From INTERPOL’s perspective this finding is central to our work and should be central to the Colombian people. Your police acted professionally, honourably and effectively.
I am currently in my second term as INTERPOL’s Secretary General and, during my tenure, have visited 116 countries and met with their Police Chiefs. So, when I say that the people of Colombia have reason to be proud of the manner in which their police handled the evidence seized from the FARC camp on 1 March 2008, my statement is based on significant experience of police practices around the world.
Let me turn to the other key findings:
INTERPOL confirmed that the Colombian Judicial Police computer forensic experts followed internationally recognized principles in the handling of electronic evidence from the time they received the exhibits on 3 March 2008.
INTERPOL did note, however, that between 1 and 3 March, direct access to the seized computer exhibits by Colombia's first responder anti-terrorist unit in order to view and download their contents did not follow internationally recognized principles in the handling of electronic evidence under ordinary circumstances.
INTERPOL’s experts verified that this direct access and downloading had no effect on the content of any of the user files on the eight seized computer exhibits.
Let me focus on this point for just a moment. It is all too common in law enforcement operations worldwide for first responder police units to directly access seized electronic evidence rather than make write-protected copies. Anti-terrorist units in particular think about analyzing the evidence right away to prevent that next attack. This is especially true after the September 11 terrorist attacks, when anti-terrorist units are now focusing more on disruption and prevention than on just gathering evidence to bring a prosecution. We really need to do more as a world police community to help our first-responders – especially in anti-terrorist operations.
Therefore, one of INTERPOL's three recommendations proposes that police devote more time and resources to training first responders in order to limit those situations when first responders are faced with the choice of either directly accessing the seized evidence or risking a terrorist attack. And to ensure that this recommendation can be effectively implemented, INTERPOL will explore the creation of a fully dedicated and well equipped global computer forensic unit at its Headquarters.
Finally, let me compliment publicly Colombia ’s Departamento Administrativo de Seguridad and the Colombian National Police for their courage in asking INTERPOL to conduct an in-depth, independent forensic examination of the seized FARC computer exhibits and for demonstrating such integrity in allowing INTERPOL to do its work without attempting to influence the outcome.
Let me thank Colombia’s General Prosecutor Mario Iguaran for trusting INTERPOL to safeguard this highly sensitive material during the course of our work.
Let me thank your Minister of External Affairs Fernando Araujo for hosting today’s press conference.
Since our work is now complete, I would ask my colleagues from INTERPOL to formally transfer our classified report and exhibits to the Head of DAS and Colombia’s National Police so that they may take custody of them and turn them over to the country’s General Prosecutor.
Thank you