Like other Canadian police agencies, the Royal Canadian Mounted Police (RCMP) has difficulty accessing encrypted data seized during criminal investigations. That’s why they’ve commissioned Innovative Solutions Canada to challenge small businesses to come up with a legal AI-based decryption system to access data. The challenge began on November 4 and will close on December 16, 2021.

Canadian police face privacy and freedom advocates

The exponential growth of communications technology has led to an increase in cybercrime. Attacks target individuals as well as businesses and government agencies to exploit personal data (banking data, e-commerce identifiers), phishing or “ransomware”. The RCMP faces a major problem: while it can request a warrant to search a device, it cannot force a person to give up his or her passwords. It has tried to get the federal government to give suspects the right to unlock their encrypted computers and mobile phones and to pass legislation requiring telecommunications and Internet service providers to install interception and data retention equipment in their networks, but privacy and freedom advocates have objected.

The number of cyberattacks is increasing year after year. In 2016, Canadian police received 24,000 complaints, 58% more than in 2014, and many do not incriminate their cyber stalkers. When Brenda Lucki arrived in her position in 2018, she received a briefing note that stated that “the ability to police the digital domain is rapidly decreasing” and:

“Increasingly, crime is being conducted online and investigations are international in nature, but the RCMP’s investigative tools and capacity have not kept pace.”

To build its capacity to fight cybercrime, the RCMP is looking for a decryption system using artificial intelligence that can process seized data files and generate lists of specific words to analyze and access encrypted material. In response, Innovative Solutions Canada, a component of the Innovation and Skills Plan, was asked to launch a challenge. The goal of the challenge is to make Canada a world leader in an innovation-based economy that will create jobs and grow the middle class.

A challenge for small business

Small businesses have until December 16 to submit a proposal in response to the challenge. They can receive up to C$150,000 (about €104,000) to help them with their research or development activities through the Innovative Solutions Canada program.

Companies selected in the second phase can receive up to C$1 million (about ‘700,000) to develop a working prototype with the federal government as its first customer.

A mandatory request for results

The proposed solutions must :

• accept and process documents of any size from the most common forensic records;
• Generate subject-specific password lists based on activities related to user data, interests, and passwords discovered in forensic images embedded in the solution;
• process the web search history of the most common browsers (Chrome, Edge, Firefox, Safari);
• process common documents (MS Word, MS Excel, text files, Adobe);
• Export password derivatives in text format for use in decryption software.

Additional desired outcomes

The proposed solutions should:

• Recognize common encrypted files from images in the device (luks, bitlocker, truecrypt, etc.);
• integrating known passwords into a database and using said database to generate password derivatives;
• providing a user-friendly graphical user interface (GUI);
• initiating decryption jobs using the generated password lists using common decryption software (Elcomsoft, Passware, Hashcat, etc.)

Translated from Lutte contre la cybercriminalité : l’exemple du défi IA lancé par le gouvernement canadien aux petites entreprises