20 May 2022

Cyber attacks are becoming an ever-greater threat to society, and digital information is becoming ever more important in its role as evidence. And in the hunt for digital criminals, technology such as artificial intelligence (AI) and picture analysis are important tools. But there is a lack of forensic scientists who can work with IT. That is why the network Digital Forensics Sweden, in which Linköping University (LiU) plays a central role, wants to create a national research centre in Linköping, and to initiate higher education in the area.

Person sitting at computer with his back to the camera.
Cyberattacks are becoming an increasing threat to society. eclipse_images

When carrying out an “ordinary” crime, such as a break-in or a murder, the criminals leave evidence – such as traces of blood, DNA and fingerprints – at the scene. But people who commit crimes also leave behind digital traces, which make for another kind of fingerprint. This is where digital forensics comes in. Lena Klasén smiles at the camera. Photo credit Annica Hesser

“There’s an unbelievable amount of digital evidence, such as from phones, which we carry with us everywhere. Our phone can reveal our movements and convey other kinds of information, such as pictures, positions and messages”, says Lena Klasén, research director at the Swedish Police Authority and adjunct professor at LiU.

Digital forensics is about searching after traces that can be connected to crimes, and turning them into relevant evidence during a trial. But it is also about investigating crimes with the help of advanced technology, for example by processing and analysing large amounts of data, detecting wanted individuals in CCTV footage, making 3D models of crime scenes etc.

“Digital forensics also includes the part of cyber security that is about preventing and discovering cyber attacks”, says Lena Klasén.

She has previously been head of the Swedish National Forensic Centre (NFC), and discovered during her time there the great need for digital forensics. Today, she runs several police projects related to AI. She is also one of the people behind the network Digital Forensics Sweden (DFCC), which is working to start a national, digital forensics research centre in Linköping. The goal is to gather together all of Sweden’s digital forensics expertise under one roof, and carry out world-class research. Another of their goals is to establish university programmes in digital forensics. LiU has concrete plans to have done this already by 2023.

We need to inject research, and above all AI expertise, into the police force. 

“We need to inject research, and above all AI expertise, into the police force. When I worked at the NFC, I quickly realised that it was a huge area. It’s hard to keep up with technological development and have the right expertise. So people need to align themselves with those who have experience and the right knowledge."

This was how the first steps were taken towards the DFCC network in 2018. Today, the network has grown and consists of some 30 partners, including several universities (among them LiU), several companies, and various public authorities within both the Swedish legal and civil contingencies systems.

Past experiences highlight needs

In 2021, the DFCC carried out a research study which showed that there is great demand for everything from digital forensic skills, digital tools and programmes to increased collaboration between various actors.

The global uncertainty which has, as a result of the war in Ukraine, arisen in 2022 has also contributed to increasing focus on the need for IT forensic scientists. And not just because experts have warned of an increased cyber attack threat.

“Several war crime investigations have been opened in Europe, and the investigators are going to receive incredible amounts information, such as heterogeneous information, pictures, videos, text, media reports and more. And they need to try and conclude what is true and what is not, and who did what”, says Lena Klasén.

When AI is misused

Criminals have also discovered the usefulness of AI, not least of all for distorting reality. This is according to Niclas Fock, adjunct lecturer at the Department of Electrical Engineering (ISY) at LiU. Niclas Fock smiles at the camera. Photo credit Annica Hesser

“Using today’s AI, you can in principle create material which looks truly realistic.”

He spends the vast majority of his time at the newly started Santa Anna IT Research Institute, which is connected to a project at the Department of Computer and Information Science at LiU. He works mostly with the initiative AI Sweden, Sweden’s national centre for AI. Among other things, the centre works with a talent programme to attract expertise to Sweden. He is also active in the DFCC network, and relates how the pre-study that was carried out in 2021 also revealed a great need to revise laws and frameworks in Sweden if digital forensics is to reach its full potential.

“In Sweden, public authorities are not allowed to tell each other which tools they have procured for, for example, scanning the internet and finding criminality. This is a big problem. We also have to take account of GDPR, and a new EU directive on AI.”

Can share methods

“But there are other solutions”, says Lena Klasén. In some projects, public authorities are able to bring in digital forensics-related AI technology, such as federated learning.
“When we can’t share information, we can at least share methods. Federated learning is not about sharing data. Instead, you break it up, share algorithms, and put the result together. AI also plays a big role in image analysis, which we used in the 3D model made by police after the terror attack on Drottninggatan in Stockholm”, she says.

The film, produced with the help of laser technology, shows how the perpetrator drove the lorry down the pedestrianised street before crashing into a shop.

“The film shows the course of events in less than a minute, something which would have taken several thousand pages to describe in a preliminary investigation report. The film turned out to be very useful, both in giving a picture of what happened and in helping relatives to understand it”, says Lena Klasén.

Technology helped identify the perpetrator

AI can also be used for biometrics at crime scenes, through technology which can automatically identify physical individuals. The technology was used to hunt down the perpetrator of the Drottninggatan attack by searching through pictures from the subway. Machine learning and deep learning are also useful AI technologies when looking for something specific – such as clothing or shoe colour – in large amounts of information.

“Another method we’re looking at involves using drones to document and map a crime scene. There’s always a risk of contamination when the first responders come to the scene”, says Lena Klasén.

Right now there are proposals and concrete plans for a master’s programme in cyber security, which will probably start in 2023. 

Academic education

DFCC is also working on university courses that will help make Sweden leading in digital forensics. “The expertise, technology and research which we require are all areas of strength for Linköping University, says Jan-Åke Larsson, head of department at ISY. Jan-Åke Larsson looks into the camera. Photo credit Annica Hesser

“We have several research groups working in this area, both at ISY and the Department of Computer and Information Science. We also do the image analysis – that is to say, computer vision – component. Right now there are proposals and concrete plans for a master’s programme in cyber security, which will probably start in 2023. There is a suggestion for a course in digital forensics during the second year of the programme. We also have a very popular course in cyber security. Now we just need to get the programmes started and researchers in place.”

“We have got off to a good start with the adjunct positions that Lena and Niclas have, and we have also got two PhD students working with Lena”, says Jan-Åke Larsson, and adds that he sees an opportunity to offer commissioned education to external partners.


Below you can se the film, produced with the help of 3D technology, that shows how the perpetrator drove the lorry on Drottninggatan i Stockholm. (Video: NFC)




More about Digital Forensics Sweden (DFCC)

lev dolgachov
The three people who have been interviewed stand next to each other in a bright room.
A national research center for in Linköping can make Sweden a world leader in digital forensics, says Niclas Fock, Lena Klasén and Jan-Åke Larsson who are active in the network Digital Forensics Sweden, in which Linköping University is an important partner. Annica Hesser

Their mission: Start a research center 

Digital Forensics Sweden is a network that aims to start a national research centre for digital forensics in Linköping. The goal is both to work operatively and gather together all expertise under one roof, carry out world-class research, and start university programmes in digital forensics.

The network consists of some 30 actors, including public authorities such as Linköping University, the Swedish Police, the Swedish Prosecution Authority, the Swedish Tax Agency, Swedish Customs, the Swedish Civil Contingencies Agency, Region Östergötland; several companies including SAAB, Sectra, Maxar, Ericsson; and centres of expertise such as Linköping Science Park, Visual Sweden, IoT World etc.

The network works actively with project applications in order to receive long-term funding. So far, the network’s activity has been funded by the Swedish Police and Region Östergötland.

Latest news from LiU

A man in a suit holds a green plant in his hand.

LiU involved in a megastudy on climate behaviour

What is the best way to make people behave in a more climate-friendly way? Researchers at Linköping University and Karolinska Institutet have contributed to a worldwide study on this topic.

Nerve damage from cancer treatment can be predicted

Many women treated for breast cancer using taxanes, a type of cytostatic drug, often experience side effects in the nervous system. Researchers at LiU have developed a tool that can predict the risk level for each individual.

Woman in safety helmet.

Her mission is difficult – but fun and achievable

We are in the midst of a tough transition towards more sustainable development. This requires innovation and knowledge, says Marie Trogstam, a LiU alumna who is now head of sustainability and infrastructure at the Confederation of Swedish Enterprise.