Digital Evidence in Domestic Core International Crimes Prosecutions Lessons Learned Germany, Sweden, Finland and The Netherlands

The conflicts in Syria and Iraq, being some of the most documented in history, have also led to one of the largest influxes of refugees to Europe in recent years. Many of the asylum seekers arriving in European cities identified themselves, or have been identified, as victims, witnesses or perpetrators of atrocities. Consequently, criminal investigations have been initiated by the local police with the aim of prosecuting those responsible for genocide, war crimes and crimes against humanity committed in Syria and Iraq. With an increasing number of war crimes prosecutions in European domestic courts relating to the atrocities committed, documented and shared by returning fighters, domestic authorities are compelled to find ways to effectively collect, process, analyse and share the user-generated data. This article discusses the ways in which digital evidence related to the conflicts in Syria and Iraq, particularly online open source materials, are being litigated and judicially evaluated in the domestic jurisdictions of Germany, Finland, Sweden and the Netherlands. Finding parallels between these approaches, with the aim of distilling best practices in evidence collection, processing and analysis, should inform future prosecutions of international crimes in domestic jurisdictions worldwide. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .


Introduction
The number of universal jurisdiction trials worldwide has been rising consistently in recent years. 1 Arguably, the Rome Statute creating a system of complementarity has had a significant impact on this proliferation. 2 It is possible to view the history of universal jurisdiction as a competition between two concepts on the state's role -the 'Global Enforcer' and 'No Safe Haven' approaches. 3 An illustration of the 'Global Enforcer' approach can be the domestic implementation of the Rome Statute accompanied by the creation of war crimes units across Europe. 4 It is suggested that the proliferation of war crimes units, as well as harmonization of core crimes definitions across different legal systems, is amongst the greatest achievements of the system of complementarity created by the Rome Statute. Moreover, a number of states, for instance Germany, the Netherlands, France and Sweden, have included the provisions allowing for the exercise of universal jurisdiction in legislation implementing the Rome Statute domestically. 5 On the other hand, the fact that states initiate investigations is often a result of national security concerns resulting from the presence of returning foreign fighters on their territory, 6 which illustrates the 'No Safe Haven' approach. With the increasing number of war crimes prosecutions in European domestic courts relating to atrocities committed, documented and shared by different fighters, domestic authorities are compelled to find ways to effectively collect, process, analyse and share the user-generated data to protect their citizens from extremist violence. While the domestic prosecutions in many European states may be viewed as an illustration of competing approaches, they have nonetheless paved the way for future prosecutions under the principle of universal jurisdiction.
Stemming from the idea that lessons learned from Germany, Finland, the Netherlands and Sweden should inform future efforts in establishing fully operational war crimes units, the analysis that follows will inevitably take a twofold approach. On the one hand, it will focus on the lessons applicable to the countries that already have specialized war crimes investigation and prosecution units, combined with the attendant legal and technological requirements in place, and on the other, countries that are planning to establish such units in the future. 7 The potentialities and limitations of investigations in both groups of countries will be highlighted. The country-based case studies were selected on the basis of their extensive experience in core international crimes prosecutions relating to the conflicts in Syria and Iraq in recent years.
The dynamic and pervasive nature of international criminal investigations, encompassing multiple national and international agencies, specialized teams and domestic courts across countries, enable fast and efficient trials. The Syrian conflict is one of the most heavily documented in history, 8 and the prevalence of digital evidence from Syria, as well as Iraq, on social media and YouTube helps in triangulation of the results and assists forensic experts and prosecutors in their work. Furthermore, it assists the courts in interpreting the results of forensic analysis. The following article focuses on the issue of how digital evidence is being litigated and judicially evaluated in Finland, Germany, Sweden and the Netherlands -from collection, to processing and analysis. It is a result of the study of domestic judgments, reports and qualitative interviews with practitioners -prosecutors and investigators involved in international criminal investigations on domestic level. In the second part of the article, the evidence collection methods are discussed, with a particular focus on the role of immigration authorities who seize asylum seekers' mobile phones and request access to their social media accounts. It is argued that these methods, while intrusive, often enable the national immigration authorities to identify perpetrators of core international crimes once they enter the state's territory, and to recover digital evidence. In the third part, the methods of digital evidence processing are analysed. The initial forensic analysis focuses on establishing the origin and metadata of video and audio files as well as photos or chat histories. As shall be seen, national forensic experts have established systems of rating digital evidence's authenticity which helps the courts in determining its probative value. Audio analysis helps identify the voices of perpetrators and shadow analysis helps determine the date and time, as well as duration of events. The fourth part of the article focuses on how evidence is analysed by the prosecution and how it is triangulated and corroborated by other types of evidence, including Twitter and Facebook posts, YouTube videos, WhatsApp chats and witness statements. Courts in Germany, Sweden, Finland and the Netherlands often call expert witnesses to testify, with the aim of ensuring that they understand the cultural and historical contexts, within which digital evidence should be interpreted. In addition, national forensic institutes -such as the Swedish National Forensic Centre or the Netherlands Forensic Institute -assist the national investigators in evidence analysis and interpretation. The fifth part outlines the cooperation and information sharing framework of the Europol Analysis Project on Core International Crimes and its likely increasing role in future prosecutions conducted by newly established war crimes units. Due to limited availability of sources on this topic, some sections primarily focus on one or two countries, whereas others discuss all four case studies. Conclusions and lessons learned applicable to countries with fully operational units, as well as countries still considering the creation of such units in the future, will be drawn from each section.

Evidence Collection
As alluded to in the European Union Council Decision on the Investigation and Prosecution of Genocide, Crimes Against Humanity and War Crimes, 9 multiple state agencies and actors may be involved in international criminal 9 13 Investigations are generally opened on the basis of information received from a special department of the Immigration and Naturalization Service. In Finland, the Homicide/Serious Crimes Unit of the National Bureau of Investigation is in charge of investigations of international crimes, including war crimes, and crimes against humanity. Some of these agencies are then forming inter-state Joint Investigation Teams (JITs) or submit information requests to organizations involved in private criminal investigations. 14 In countries with previous experience in core international crimes prosecutions, examples of which include the case studies discussed in this article, there may be pre-existing mechanisms in place for evidence collection, storage and processing, and prosecution units may already have access to specialized software to assist with this. On the other hand, newly established war crimes units may need to actively seek harmonization of the technological infrastructure in order to ensure that they have all the tools for effective collection and processing of evidentiary material. This means that all the state bodies involved in investigations (immigration office, police, prosecution or the Ministry of Justice) should have the access to the latest technological infrastructure in this area and be able to share information effectively, whenever they become aware of the presence of perpetrators of core international crimes on the state's territory.

A. Methods Used by the Immigration Authorities in Germany and Sweden
As rightly elucidated by Frédéric Mégret, victim and perpetrator diasporas 'provide the missing link in attempts to explain both the potential and limits of universal jurisdiction in the world today'. 15 Indeed it is often the residence of victims, witnesses and perpetrators in the host state which seems to frame approaches to universal jurisdiction. 16 In practice, victims, witnesses and perpetrators all tend to follow the same routes. 17 Germany has become a notable country of refuge following the outbreak of the Syrian conflict. 18 Both victims and perpetrators often reside in the same neighbourhoods and this results in identification, and complaints being submitted at the police by the victims or non-governmental organizations assisting them. 19 This also means, that local immigration authorities collect and process vast amounts of data relating to individuals identified as victims, witnesses and perpetrators.
In many instances, the investigation into core international crimes already starts the moment when an asylum seeker arrives in the country and submits their asylum application. In the Netherlands, for example, if the '1 F Unit' 20 of the Immigration and Naturalization Service has serious reasons to believe that 15  considering that: (a) he has committed a crime against peace, a war crime, or a crime against humanity, as defined in the international instruments drawn up to make provision in respect of such crimes; (b) he has committed a serious non-political crime outside the country of refuge prior to his admission to that country as a refugee; (c) he has been guilty of acts contrary to the purposes and principles of the United Nations.' an individual seeking asylum has committed an international crime, it informs the Openbaar Ministerie. The assessment is based, among other factors, on the analysis of the content of the asylum seeker's phone or any other devices that might be in his or her possession. 21 According to the recent report on Digitalisation in Migration Control in Germany and Europe since 2017, the central German migration authority, Bundesamt für Migration und Flüchtlinge or Federal Office for Migration and Refugees (BAMF), has routinely been reading and analysing data from electronic devices of asylum seekers. 22 The powers given to the German Immigration Office are extended as far as to allow the Immigration Office to copy the data from asylum seekers' mobile phones and other 'data carriers' including USB flash drives, hard drives, laptops, or even fitness wristbands and step watches. 23 Although not every asylum seeker's mobile phone is inspected, those without valid travel documents will certainly have to sign an agreement to have their phone inspected. Even children's devices can be read by the authorities. The asylum seeker is obliged to unlock the phone and enable an efficient reading of the device's contents. 24 The data are then saved on a computer, and a report is automatically generated. The applicant receives the device immediately after the process is completed. 25 The automatically generated report contains saved contacts, incoming and outgoing calls and text messages, the contents of all messenger apps (e.g. Telegram, Viber, WhatsApp), evaluation of country codes, calls duration and accessed internet addresses. 26 The German Immigration authorities can evaluate contacts in the address book on the basis of country codes, incoming and outgoing calls by duration and country codes, incoming and outgoing SMS messages according to country codes, language of incoming and outgoing SMS and chat messages, browsing history by country endings of websites visited, login names and email addresses used in apps, location data, for example from photos or apps. 27 In addition, the immigration authorities also use geodata from photo files that are included in the analysis. The authorities did not disclose whether all the app information, saved WiFi networks or recorded GPS data are used, 28 however all of the information that they use is aimed at determining the asylum seeker's country of origin and the exact route taken to Germany.
According to a response from the Federal Ministry of the Interior in December 2018, that is discussed by the authors of the report Digitalisation in Migration Control in Germany and Europe, the analysis software employed by BAMF currently distinguishes between 170 languages and dialects, although it is not possible to assess how reliable the recognition of the language module used by the BAMF is. 29 According to the report, the Immigration Office also refused to comment on the speech recognition algorithms that are used in their system, as well as the error rate of these algorithms. The authors of the Digitalisation in Migration Control in Germany and Europe report argue that some languages are more likely to be affected by incorrect results and thus lead to false identifications. It will be illustrated in the next part, that investigators often use speech recognition and audio analysis to determine whether the accused perpetrated the alleged crime in the video recording (when visual identification is not possible, for example due to face coverings). However, it is evident that speech recognition and audio analysis is the most effective when the language spoken is the language of the host country, as will be demonstrated in Part 3 in relation to the Swedish case of Al-Mandlawi and Sultan. 30 In the event that an asylum seeker does not have a passport, the Immigration Office seeks to establish their identity through various ways of identification on their mobile phone. They scan the names of user profiles from apps, and other user identities, saved information and email addresses. This information comes from Google or Apple accounts, but also for example from Tinder or Facebook, WhatsApp and Viber apps. It is not confirmed from what other applications the system can extract personal data, however the authors of the report have asserted that Booking.com and other travel booking applications are also analysed. 31 In addition, the authors posit that the results may be biased when the asylum seeker uses pseudonyms on their social media profiles or in the event that the Immigration Office does not support the country codes that the phone has saved. 32 According to the authors of the report, the Immigration Office is reluctant to comment on the error rate of speech analysis for text messages and other factors determining the reliability of the system used. 33 According to the authors of the report, the system used by the Immigration Office does not satisfy any of the transparency criteria identified by the German Data Ethics Commission's report published in 2018. 34 Nonetheless, the German authorities are one of the most active in Europe in investigating and prosecuting core international crimes. 35  obtained by the immigration authorities, concerning potential perpetrators, or even victims and witnesses, is used to support ongoing ZBKV investigations. 36 Similarly, in the Netherlands asylum seekers are obliged to hand in mobile phones as a part of the asylum process, 37 whereas in Sweden the Migration Agency may gain access to data carriers, such as USB flash drives. In the Saeed case before the District Court of Ö rebro in Sweden, the defendant participated in the non-international armed conflict between the Iraqi forces and the Islamic State (IS) in the spring/summer of 2015 in Daquq district of Kirkuk province in Iraq. He was photographed next to bodies of deceased persons, some of which were desecrated. He then published the photos on his Facebook profile, which was open to the public. 38 The defendant applied for asylum in Sweden in December 2015. The police found images published on the defendant's two Facebook profiles. The defendant's USB flash drive was taken by the Swedish Migration Agency when he applied for asylum. 39 Subsequently, over the course of the investigation and after discovering certain images on defendant's Facebook profile, as well as logins on Facebook in Iraq and Sweden, the investigators compared images found on the USB flash drive, Facebook profile and on defendant's computer. 40 The IT forensic examination of images confirmed that the images were not manipulated, that several of the pictures were taken at the same time and that one of the pictures showed a dead body. The Swedish National Forensic Centre verified the authenticity of the images. 41 The defendant was subsequently convicted for war crimes. 42 On the basis of the experiences of Sweden and Germany, the countries planning to establish war crimes units may need to ensure the access to the latest software enabling efficient evidence collection and storage. This might for example entail the need to obtain special software to analyse the contents of the accused's electronic devices, as well as software filtering social media content or the implementation of mechanisms which will facilitate cooperation and information sharing between different units within the national law enforcement as well as the Immigration Office. The software allowing for comparison between the social media content, the contents of the accused's devices might already be available to certain units of the national law enforcement, which could share their practices with the newly established war crimes unit.
Countries with fully operational war crimes units may need to modernize their immigration system to keep it up to date with recent developments in core international crimes investigations. The next part will discuss methods of evidence processing and verification by the domestic authorities.

Evidence Processing
Digital evidence has proven to be instrumental in domestic prosecutions of core international crimes. Moreover, in the absence of stringent admissibility rules, the court is entitled to admit any evidence that helps it meet its aim of discovering the truth. 43 The prerequisite for this, however, is that the video or photograph meets certain requirements as to the origin and date of creation. 44 When encountering difficulties in the processing of digital evidence, the domestic authorities have developed procedures for requesting external assistance from the United Nations bodies or European Union-affiliated institutions. In addition, forensic experts, as well as the analysts from the national forensic institutes, regularly assist war crimes units in assessing the authenticity and reliability of digital evidence. This assures that the evidentiary material which reaches court is of significant probative value and has not been manipulated.

A. Processing of Open Source Evidence -Assessing Authenticity and Reliability
Pursuant to section 244(2) of the German Code of Criminal Procedure, the competent investigating authority is free to take all admissible evidence into account and will designate its weight at its discretion. The prerequisite for this, however, is that the video or photo meets certain requirements as to the origin and date of creation. In Sweden, in accordance with the principle of freedom of evidence, open source materials, including social media content, are admissible at trial without specific requirements. 45 In Finland and the Netherlands, the principle of freedom of evidence also applies within certain limits prescribed by the law. For instance, in the Netherlands the prosecutor has to disclose to the judge and the defence where the material is coming from and prove its authenticity. In addition, a statement is needed from the police officer explaining how the evidence was stored and where it was taken from. 46 In the words of a Dutch investigator: When I see a photo being Tweeted from a Twitter account, I would look at the account and ask myself -why does this account have this information, how was it possible that it tweeted this photo. Is it possible that he took the photo, or is it because he retweeted it or uploaded it from someone else. Having the context of a certain source is extremely important. A source is not evidence by itself, it needs context. Either for me as a specialist or for the people from the Forensic Institute, country experts. So we have a source, and we provide it with context in the report. 47 Similarly to other jurisdictions discussed in this article, German courts do not normally exclude the evidence obtained from Facebook or the mobile phone of the accused. A case before the Dü sseldorf Higher Regional Court concerned alleged participation in a foreign terrorist organization, as well as war crimes against property and other rights. 48 The defendant was charged with participation as a member in IS and war crimes committed in the period between March 2015 and May 2016 in Syria and Iraq.
In this case, a Facebook post was used to prove that the accused participated in a foreign terrorist organization as a member. 49 The accused was arrested on her return to Germany on 17 October 2018 and the investigators found a USB flash drive which contained video, audio, image and text files in German, Turkish and English, amounting to 14.6 GB of data. It was secured for forensic purposes and assessed by experts in Islamic studies, together with several individual written texts and the accused's Facebook profile, 50 which helped the investigators in determining the extent of the radicalization of the accused. 51 This is an indication that user-generated evidence is rarely introduced or processed on its own, but once corroborated by other types of evidence, gains significant probative value in court. Open source evidence is often introduced in conjunction with files found on electronic devices and flash drives.

B. Obtaining External Assistance in Evidence Processing
When vast amounts of electronic (and physical) evidence are seized, or there is a need for corroboration by witnesses present abroad, domestic authorities seek assistance from international or non-governmental organizations or UN bodies. For example, Finnish prosecutors have requested assistance from the United Nations Investigative Team to Promote Accountability for Crimes Committed by Da'esh/ISIL (UNITAD) with respect to the provision of witness testimony, and the identification of information and evidentiary material. 52  provision of testimony by eight Iraqi witnesses that was fed directly into the Finnish appeal proceedings via video link. 53 UNITAD was also able to obtain judicially issued warrants leading to the collection of call data information from telephone service providers in Iraq that was relevant to the proceedings and provided them to the Finnish prosecutors. 54 The Iraqi authorities also provided technical and logistical support with respect to witness protection. 55 The German and Dutch authorities may send requests to various international and non-governmental organizations asking for assistance with the processing of the data. For instance, in the past requests were sent to the Commission for International Justice and Accountability (CIJA). 56 The Federal Prosecutor General has also received expert legal advice on Syrian criminal law, prepared by the researchers from the Max Planck Institute in Freiburg. 57 In addition, in the case of Abdullah the Södertörn District Court in Sweden extensively relied on the reports of the International Commission of Inquiry on the Syrian Arab Republic, which helped the Court ascertain the nature and type of the armed conflict in Syria at the time of the events in question. 58

C. Assessing the Authenticity and Reliability of Open Source Evidence with the Aid of National Forensic Experts
A number of cases before the Swedish courts illustrate the role of national forensic institutions in the assessment of digital evidence.
The Swedish National Forensic Centre (Nationellt Forensiskt Centrum -NFC) conducts forensic investigations for the purposes of criminal prosecutions. They use a unified 'scale of conclusions based on likelihood ratios that are applied to all casework that involves evaluative statements. The scale has nine levels from "-4 The results extremely strongly support that .  60 However, this does not mean that the national forensic institute is consulted in every case involving core international crimes and open source evidence. They are rather a second or third line of expertise aimed at clarifying the reliability of evidence, following the initial analysis prepared by the police experts. 61 In the Droubi case before the Södertörns District Court, the police obtained a video showing the accused and other persons assaulting an unidentified person at some point during spring or summer 2012 in Syria. Since the accused did not admit that it was him taking part in the assault, the police requested the Swedish National Forensic Centre to evaluate the authenticity of the video recording. 62 The aim of the forensic analysis was to determine whether the video (or audio) files were manipulated. 63 The Swedish National Forensic Centre concluded that the results strongly supported (grade 3þ) that the film had not been manipulated, 64 however no reliable conclusion could be drawn about the date of the recording. 65 The Court sentenced Mouhannad Droubi, for violations of international law and aggravated assault, to five years in prison. The Svea Court of Appeal increased the sentence to seven years in prison. 66 In the Al-Mandlawi and Sultan case in the Göteborg District Court, both accused took part in fighting in Syria, however the Prosecution did not establish whether they were part of a loosely composed group or a more organized unit for a longer period of time. During a house search of Al Amin Sultan's property, a USB flash drive was found, containing three execution videos. The first video showed preparations before the executions, while the second and third videos depicted the executions and decapitation. The National Forensic Centre's analysis suggested that the three videos showed different parts of the exact same event. The forensic experts were tasked with determining whether one or both accused were present in the execution videos. The perpetrators' faces were covered; therefore identification was based on voice analysis, physical attributes and on tattoos visible in the videos. Hassan Al-Mandlawi had an 'H' tattooed on his left thumb. A tattoo of the letter 'H' was also visible in the execution video. In addition, the NFC observed stark similarities between Hassan Al-Mandlawi and one of the perpetrators in the execution video (e.g. ear, nose, body size, hair colour and beard) as well as specific similarities regarding scars and a stain on the left index finger. 67 In addition, one of the perpetrators in the execution video was speaking Swedish which, according to the Court, limited the possibility of confusing the perpetrator with somebody else. 68 The NFC found that the 'results of their analysis determined with extreme certainty that Sultan was in the first video, and that the analysis extremely strongly supported that Al-Mandlawi was one of the persons speaking in the video'. 69 The Swedish National Forensic Centre conducted the analysis by assessing the investigation's main hypothesis against an alternative hypothesis. 70 There were also indications that the experts used automated biometric voice analysis provided by a private Swedish company, specializing in forensic phonetic speaker comparisons, speech transcription, speaker profile assessments, questioned utterance analysis, technical quality improvements of recordings, authentication of recordings, 'Voice Line-ups' and ear witness identification. The biometric voice analysis 'can be used to determine the likelihood ratio of the speech coming from the same voice compared with the probability of it coming from a different voice in a given population'. 71 On the basis of the processing and forensic analysis conducted by the Swedish National Forensic Centre, the District Court found that the two men had been executed.
In the Haisam Sakhanh case before the Stockholm District Court, the defendant was a rebel fighter, and a member of the Suleiman Fighting Company, an independent group comprised of Islamic rebel units, and operating in the rural area of the Idlib Governorate and in the countryside of Hama in Syria. The defendant posed for a video next to captured government soldiers in the Idlib Governorate in Syria. The prisoners were subsequently executed. Both the execution and later events were recorded. The video was allegedly obtained by Amnesty International, however the original source was not disclosed. 72 On 5 September 2013, the online version of the New York Times published a partially censored video displaying the Suleiman Fighting Company's execution of the seven Syrian soldiers. Other videos had been published by the rebel group on YouTube, 73 including an audio recording of the execution. 74 The Swedish National Forensic Centre determined that the video was authentic.
The defendant admitted that he had participated in the execution, however he denied criminal responsibility since he had 'implemented death sentences issued by a legitimate court'. 75 The shadow analysis technology enabled the forensic experts to determine what could be the possible length in time between the alleged court decision and the execution of the government soldiers. They first compared the sounds of shots from the execution video and the YouTube videos posted by the Suleiman Fighting Company's rebels. After determining that the shot sounds originated from the same source as the sound in the execution video, 76 they calculated the time of sunrise and sunset in the relevant region using the shadow analysis technology. The calculation of the length of shadows in the YouTube video and the execution video resulted in the finding that the action took place at sunset. The Prosecutor proved that the time between the capture and the execution amounted to about 1.5 days or a maximum of 41 hours. This strongly contradicted the accused's statement that he executed a death sentence issued by a legitimate court following a fair trial. 77 The Court considered that no fair trial, assuring all the rights of the defence, could have taken place in such a short amount of time.
The above analysis illustrated that domestic investigators triangulate the available user-generated evidence with the available expert reports and open source evidence available on social media. User-generated evidence is rarely introduced or processed on its own, but once corroborated by other types of evidence, can gain significant probative value in court. In the countries discussed in this article, it is not the admissibility concerns that are the centre of the legal dispute, but rather the issues of linkage. In many cases, when the face, voice or other characteristics of the perpetrator are easily identifiable, there is no need for specific software or tools to process the evidence and identify the accused. However, sometimes the assistance of specialists is indispensable. A number of ways of obtaining the relevant software that can facilitate and improve the processing of evidence may be available to countries which wish to establish war crimes units within their police, prosecution or immigration services. They can obtain it from private sector entities, as in the case of Al-Mandlawi and Sultan in the Gö teborg District Court, adapt the existing software available to the law enforcement, develop their own software or request specialized forensic and technical support from Europol. 78 The next section will address issues related to evidence analysis and presentation in court with the assistance of expert witnesses and triangulation of different types of open source evidence. 75

Evidence Analysis
The cases discussed in this part are largely based on evidence found on smart phones and social media. Although neither domestic nor international law expressly prohibits posing for photos with deceased persons, and subsequently posting the photos on the internet, the courts approach these cases in a holistic manner taking into account the cultural aspects, as well as the foreseeable suffering inflicted on the family of the deceased in the event that the photos of deceased, desecrated bodies are published online, which amounts to degrading treatment. 79 The following section will discuss the ways in which courts approach the analysis of open source evidence depicting deceased persons, with the aid of expert witnesses.

A. Analysis of Open Source Evidence with the Aid of Expert Witnesses
In Finland, according to the principle of freedom of evidence, open source materials are generally admissible. Social media content has been used as main evidence in cases relating to core international crimes. 80 The case of Hilal before the District Court of Kanta-Häme involved the publication of a picture on Facebook showing the accused posing with the head of a decapitated enemy soldier. The accused was a member of the Iraqi Special Operations Forces fighting against IS. 81 The accused admitted that it was indeed him in the photo and that he had posted the photo on Facebook, however he denied having decapitated the deceased. He argued that 'his intention was to take care of the head so that, for example, wild dogs could not eat it'. 82 The defendant also argued that he had 'grown up in a culture of violence and war and that in many ways was different from the Finnish culture, and that this background should be considered when his act was legally evaluated' with the aid of open source evidence. 83 The District Court discussed the prevalence of pictures of this type in the conflict. 84 In this case an expert witness (military researcher) was called to help the judges interpret the meaning of a Facebook photo that was posted by the accused. The expert witnesses expounded that in the area in which the events took place: strengthen an individual's position within an armed group, or to increase internal cohesion within an armed group by demonstrating that its members, if necessary, form a brutal team. The aim of posting these photographs is, thus, to send an enemy, such as ISIS, a clear message that where necessary, the party depicted in the photographs is able to carry out such acts. 85 Based on the expert witness' testimony, the District Court of Kanta-Häme held that the accused's conduct entailed inhumane and degrading treatment of the person photographed and referred to in the charge, causing an outrage to their personal dignity, as referred to in Article 8(2)(c)(ii) of the Rome Statute of the International Criminal Court. The Accused's conduct therefore amounted to a war crime under Chapter 11(5)(2) of the Criminal Code of Finland. 86 Recognizing that photos spread fast on the internet, the courts seek to gain understanding about the circumstances in which the open source evidence originated. When assessing whether the accused subjected the deceased person to degrading treatment, which was later recorded, the courts often call for expert witnesses, who are well-acquainted with the local culture and customs in the areas where the armed conflict took place. Cultural aspects were also addressed in the Swedish cases in reference to open source evidence presented before the court.
The Abdulkareem case was the first time a Swedish court examined the question of whether posing for photos with dead persons could constitute a war crime. It was also the first case where the Act on Criminal Responsibility for Genocide, Crimes Against Humanity and War Crimes applied. 87 Abdulkareem was a member of the Iraqi armed forces in the armed conflict between Iraq and IS in 2015. He posed and was photographed next to mutilated bodies of dead IS combatants, making a victory sign. Later, he published two photos on Facebook. 88 The bodies were tied up with chains and were dragged on the ground. The photos also showed Abdulkareem posing with a 'tool to poke a head laying in a bowl and which had been separated from the body'. 89 An expert witness opinion was provided by Mohammad Fazlhashemi, who is a professor in Islamic theology and philosophy at Uppsala University. According to his statement, the desecration of bodies is strictly forbidden in Islam. The ban applies to both Muslims and non-Muslims. The prohibition against desecration of bodies is based in principle on the notion that this act is inhuman and in violation of the right to dignity contained in the Qur'an. The expert witness testified that in the Islamic tradition, there are also statements of Muhammad forbidding desecration of corpses. 90  around year 624 CE. According to the Muslim tradition, the body should be intact at the funeral ceremony. 91 The District Court found Abdulkareem guilty of war crimes. 92 The Court ruled that the humiliating or degrading treatment was calculated at seriously violating the personal dignity of four protected persons by posing with their dead bodies and publishing the photos on social media. 93 On the basis of the cases analysed above, it is possible to discern that the courts are cognizant of the fact that wide availability of open source evidence does not go hand in hand with the availability of cultural interpretations of specific actions captured by the said evidence. This is especially important in cross-cultural contexts, including -but not limited to -domestic core international crimes prosecutions, where audio-visual materials may lead to biases and misinterpretations. 94 To mitigate the risk of biases, as mentioned above, war crimes units employ historians, anthropologists, 95 whereas courts employ expert witnesses in cultural and religious studies, to ensure that all contexts relating to open source evidence are taken into account in the evaluation.

B. Triangulation and the Issues of Linkage in Domestic Core International Crimes Prosecutions
The case of Oussama A. before the District Court in The Hague demonstrated that in the case of domestic core international crime prosecutions it is not the admissibility concerns that are the centre of legal disputes, but rather the issues of linkage. In the case before the District Court in The Hague, 96 the Court considered evidence including a payroll from IS, stating that the accused was employed by a so-called sniper battalion and the testimony from the accused's mother revealing that he had received a salary from IS. Moreover, the Court had access to various photos of the accused wearing combat clothing and being fully equipped with weapons. The Prosecution was also able to obtain incriminating chats of the accused from a mobile phone that the accused had access to. During his stay in Syria, the accused was photographed posing next to a deceased man hanging on a cross. He then shared the photo widely on Facebook. The Prosecution submitted that the accused violated the personal dignity of the deceased, which resulted in a war crime contrary to the 1949 Geneva Conventions. 97 Another photo that was found by the police depicted a desecrated body of a woman. The police searched for the same photo on social media and became aware of a series of Tweets where the said photo was found. The Tweet had the following description 'WARNING. #ISIS savages glorify in showing the #Kurdish #woman soldiers they slaughtered. #Syria #Iraq'. 98 The police discovered that the photo was widely shared on social media. The District Court established that there was 'insufficient evidence that the accused was the one who sent the photograph. The documents reveal that it was a chat conversation between the accused and the witness, but it has not become clear to the District Court whether the accused sent the photograph during the conversation or whether this was done by someone else. The photograph message does not fit in the context of the conversation and it cannot be excluded that the mobile phone was also used by someone else'. 99 The accused argued that he sent the photograph of the desecrated body of a woman to warn the witness about the fate of Kurdish women. This illustrates a significant challenge faced by investigators and courts in analysing and interpreting digital evidence and open source content in core international crimes cases. There may be multiple reasons for sharing or disseminating user-generated evidence.
In relation to the photo of a deceased man hanging on a cross, The Hague District Court held that by posting the photo on his Facebook account, the defendant ensured that a significant number of people had the opportunity to view it. By doing so, seen in conjunction with the fact that he himself posed for the photo, he further continued the outrage upon personal dignity of the deceased person. 100 The police carried out a detailed investigation of the mobile phone of a witness who was suspected of planning to leave for Syria and Iraq in order to participate in the armed conflict. The court dossier contained a chat conversation of 3 September 2016 between a witness and a user believed to be the accused, in which he stated that he had 'left' and was no longer with IS but joined a different group. At the trial of 8 July 2019, the suspect stated that after he left IS, he joined the Free Syrian Army. 101 Considering all the evidence, the District Court in The Hague ruled that the accused was a member of IS up to and including 3 September 2016.
The Court took note of the facial expressions of the accused in the photo, the fact that he himself posted the photograph on his Facebook account and that it was distributed to a large group of adolescents in Utrecht, the Netherlands. The Court also importantly considered the negative psychological impact of the 97  photo on the relatives of the deceased. In the case before The Hague District Court, Oussama A. was convicted to 7.5 years imprisonment.
As discussed above, the Prosecution must demonstrate that the chats, photos and social media posts found on the mobile phone of the accused can be linked to the criminal conduct of the said defendant. The witness testimony is of assistance here, where the witness can confirm that the accused in fact took part in the chats in question (and that it was not another person that had the access to their mobile phone). Tweets, Facebook posts and chats between the accused or the witnesses help corroborate evidence and establish guilt in core international crimes cases.
As rightly argued by Anne-Sophie Massa, essential evidentiary materials also include documents, assets and bank records, letters or telephone taps, however often they can be found on the territory of more than one state. 102 Close cooperation is therefore crucial if states want to greatly increase the chances of successful investigation and prosecution of atrocity crimes at the domestic level. 103 As shall be seen in the next section, the EU Member States have recognized the importance of close cross-border cooperation in the area of core international crimes investigations and prosecutions, including information sharing and exchange of best practices.

Evidence Sharing
Europol offers an opportunity for old and new war crimes units -both in the EU Member States as well as Third Operational Partners that are eligible for associated membership -to share information and intelligence relating to investigations and prosecutions of core international crimes. Joining the Europol Analysis Project on Core International Crimes may enable the newly formed war crimes units to obtain the necessary technical and forensic support and facilitate their work through evidence sharing.

A. Analysis Project on Core International Crimes (AP-CIC) and the Yazidi Initiative -Background
Victims and witnesses of crimes committed in Syria and Iraq, who are currently based in the EU Member States as asylum seekers or refugees, are often the initiators of core international crimes prosecutions. The Yazidi Initiative is one of the projects run by the Analysis Project on Core International Crimes (AP-CIC) at Europol and aims to collect and centralize witness information from Yazidi victims and witnesses world-wide in order to identify linkages to support identification of perpetrators. collection, storage, crosschecking and analysis of core international crimes information and intelligence. 104 For a long time, there has been a desire from Member States, expressed particularly strongly by Germany and the Netherlands, for a database at an international level which would centralize and help collect core international crime information and intelligence (for the purpose of crosschecking and analysis) in support of domestic core international crimes investigations. The armed conflicts in Syria and Iraq motivated an urgent need for establishing such a database. The reason for that was the fact that more countries suddenly became confronted with the terrorist threat connected to the rise of IS and the return of EU foreign terrorist fighters potentially involved in war crimes, which call for investigations. Additionally, the refugee crisis was an important element for establishing the AP-CIC, since many people from different conflict areas, including Syria and Iraq arrived in Europe with the aim of seeking refuge. Quite a number of them were identified as victims or perpetrators of core international crimes. 105

B. Establishing Operational Agreements with Europol
The types of information received and handled by AP-CIC are diverse and include biodata of individuals and communication data, document numbers, but also information on armed groups and militias, command structures, references to specific locations and events. However, this information does not belong to the Analysis Project or to Europol. Conversely, it belongs to the contributing countries, and in the event that the information links up in the Europol database, the Member States or Third Operational Partner countries concerned are notified of the linkages. The police authorities of those countries submit information from their war crimes investigations that they wish to have cross checked, stored or analysed within the Europol databases. AP-CIC is a highly secure offline database, that is connected to all other databases within Europol (including counter-terrorism database, as well as the serious organized crime database). This means that all information received is also cross-checked against all of the other information at Europol, which is the strength of Europol and of AP-CIC itself. 106 Both EU Member States and non-EU Third Operational Partners are eligible for associated membership to AP-CIC. Joining the Europol Analysis Project may be a way for newly formed war crimes units to receive forensic and technical support and facilitate their work through evidence sharing (including biodata, communications, locations etc.). Non-EU Third Operational partners and international organizations that have concluded an operational agreement with Europol can also exchange personal data with the AP-CIC.
Faced with impunity for crimes committed against the Yazidis in Syria and Iraq, AP-CIC started an initiative aimed at bringing together countries worldwide that host large numbers of Yazidi victims and witnesses, such as Australia, Canada, and Germany. If centralized, information obtained from these individuals might generate linkages and possible leads to identify perpetrators of atrocities committed against the Yazidis in Syria and Iraq. This could result in the formation of Joint Investigation Teams and lead to successful investigations and prosecutions. Some countries see the relevance of that, however it is not uncommon for countries to face legal challenges with regard to obtaining and/or sharing information originating from their immigration or asylum authorities. Other countries may favour a more individual approach, by focusing on specific cases that may involve identification of their own nationals as perpetrators of international crimes committed against the Yazidis. 107 Under the Europol Regulation, 108 Europol can only exchange personal data information with EU Member States or with third party countries or international organizations that have established an operational agreement with Europol. The same Regulation does not hold any provisions that would allow private entities to establish an operational agreement with Europol. However, unilaterally private entities can provide AP-CIC with information, either directly or through a Member State or Third Operational Partner.
Any country with a fully operational war crimes unit, or even countries considering the establishment of a new war crimes unit within their police services, might consider joining the Europol Analysis Project to benefit from, and contribute to, advanced and secured information sharing related to the crimes committed against the Yazidis in Syria and Iraq.

Conclusion
The proliferation of international criminal investigations in domestic jurisdictions presents a unique opportunity for testing the limits and potential of universal jurisdiction trials, together with the limits of introducing digital evidence in courts. On the basis of the analysis of domestic judgments, as well as qualitative interviews conducted with practitioners by the author, the above article has demonstrated that the courts in Germany, Finland, Sweden and the Netherlands have gathered significant expertise in collecting, processing and analysing digital evidence, leading to successful prosecutions and convictions for war crimes. The above article identified several themes and methods employed in these jurisdictions. First, it has been argued that efficient collection of evidence is enabled by the immigration authorities, who closely cooperate with the police and prosecution services. Second, advanced evidence processing techniques ensure that the digital evidence, that eventually reaches 107 Ibid. trial, is of significant probative value. The evidence can then be corroborated by witness statements, social media posts, WhatsApp chats, files contained on data carriers and expert witness testimony at trial, which helps the courts understand the cultural contexts of the open source evidence. On the basis of metadata, geolocation and shadow analysis, forensic experts can determine the time and location of events. Advanced speech recognition and audio analysis technology, often provided by the private sector, can help identify the source of sounds and cross-check it with different types of open source evidence, thereby attesting to the apparent authenticity of digital evidence. The analysis offered lessons applicable to both countries with fully operational war crimes units, as well as countries considering the creation of such units in the future. It has been suggested that the most efficient way to obtain the latest software for countries with new war crimes units, is to harmonize the available methods from other more established law enforcement agencies domestically or, for example, to seek the assistance from international organizations or EU institutions.