Ten Days, Eight Hours — and Your Logs Are Gone

Europol and Eurojust published the SIRIUS Electronic Evidence Situation Report 2025 in July. It describes how law enforcement and judicial authorities obtain data from service providers across borders. The data covers 2024, supplemented by surveys of 227 police authorities and 85 judicial authorities and interviews with twelve providers.

At first glance, an agency document. On closer reading, a precise status report on which digital traces still exist when it matters. That question concerns every organisation that suffers a security incident — or reports one.

The timing is not accidental. The EU Regulation on European Production and Preservation Orders has applied since 18 August 2026. A largely voluntary disclosure system is becoming a binding order system with hard deadlines.

What the report actually measures

Four numbers set the frame:

Official access to provider data is no longer a marginal phenomenon. It is routine, and it increasingly works. The interesting findings are not in the success rates but in the failures.

First: retention periods are an evidentiary question

41 percent of the judicial authorities surveyed report cases where the data they asked for had already been deleted by the time the request went out. In a third of those cases the loss measurably affected the outcome of proceedings; in just over half it caused delays and complications.

The cause is structural. Since the Data Retention Directive was struck down in 2014 there has been no uniform European framework. The Commission opened an impact assessment in 2025, with results expected in 2026. Until then the rule is simple: what was not stored does not exist — including for a court.

Applied to your own infrastructure, that is an uncomfortable thought. Most retention decisions are made on storage cost and data minimisation. The third dimension — provability — rarely enters the calculation. It should, because it decides whether an incident can be reconstructed, reported and prosecuted.

Concretely: a firewall that keeps connection logs for seven days is worthless against an intrusion with typical dwell time. Industry averages for detection still sit in the range of several months. The entire investigative approach lives in the gap between those two numbers.

Second: waiting for the authorities does not work inside 72 hours

For data held in third countries, 73 percent of EU judicial authorities name procedural duration as the main problem. Mutual legal assistance is regarded as too slow across every group surveyed, and the report states plainly that the existing framework no longer matches the reality of digital investigations.

For an affected organisation this is not an academic observation. NIS2 requires an early warning within 24 hours and an incident notification within 72. No mutual legal assistance request will be answered inside that window. Nor, in most cases, will a police request routed to a US provider.

Everything you can say with confidence in the first three days comes from your own telemetry: endpoint logs, authentication events, network flows, mail server records. If those sources are not centralised, tamper-resistant and deep enough, what you file is a supposition — and the regulator will record it as one.

Third: the quality of your complaint matters more than you would like

The most sobering part of the report concerns the authorities themselves.

• 40 percent of the police officers surveyed are not familiar with the e-Evidence package at all; only 8 percent describe themselves as well acquainted with it.
• 42 percent have never received training on cross-border access to electronic evidence.
• Among judicial authorities the well-informed share has actually fallen, from 26 percent to 19. Ten percent had never heard of the new instruments.

At the same time, the report requires precision from every request: a named person, specifically identified datasets, an exact timeframe, a proportionality justification. And respondents repeatedly cite the same friction — providers and authorities use different names for the same data types.

From which follows a practical consequence that is rarely said out loud: a criminal complaint after a cyber incident is only as good as the technical dossier attached to it. Hand the police a clean timeline, concrete indicators, the affected accounts, the providers involved and the data types named in the providers' own vocabulary — connection logs, subscriber data, registration IP — and you materially raise the odds that the request is made at all and arrives in usable form. Submit a prose account and you are competing with everything else in the inbox.

One aside with signal value: the service categories most relevant to investigations are social media, messaging apps and cryptocurrency exchanges, followed by fintechs and VPN providers. AI platforms appear for the first time at 8 percent, up from zero. An organisation without an inventory of the AI services in use has neither compliance control nor an evidentiary position.

Fourth: you may be on the receiving end

This point is barely registering in mid-market companies.

The e-Evidence Regulation is not aimed only at the large platforms. It covers providers of electronic communications services, domain name and IP numbering services, and other information society services that allow users to communicate or store data — provided they offer those services in the Union. That reaches hosting providers, SaaS operators, marketplaces, portals with user accounts, and vertical or practice software with a cloud component.

Anyone in scope must:

• maintain an establishment or designated legal representative in the EU,
• respond to a European Production Order within ten days,
• deliver within eight hours in an emergency,
• communicate through the EU's decentralised IT system with proper authentication,
• be able to assess the order legally rather than simply passing it along.

Eight hours means on-call staffing. It means a defined process, named responsibilities, documented review steps and a record of what was handed over, when and to whom. For a company of eighty people with a SaaS product, that is not a side issue.

Providers see it much the same way in the report: legal certainty, yes — but considerable implementation risk, not least because nobody knows what request volume to expect. German law, incidentally, does provide for cost reimbursement to providers; so far providers rarely claim it. The new deadlines are likely to change that.

What follows

Six items that can be checked immediately:

1. Build a retention matrix. For every log source: retention period, legal basis, forensic value. Anything under 90 days on a security-relevant source needs a justification — if only to yourselves.
2. Preserve before you rebuild. The most common avoidable mistake in an incident is reimaging before imaging. After that the evidence is gone for good; no provider and no authority will reconstruct it.
3. Make a filing-ready dossier part of the playbook. Fix the structure, the terminology and the receiving office in advance rather than improvising under time pressure.
4. Centralise logging with integrity protection. Without separate, integrity-assured storage, every log is contestable when it matters — technically and procedurally.
5. Inventory AI and third-party service usage. What you do not know about, you can neither switch off nor examine.
6. Test whether the e-Evidence Regulation applies to you. If your product lets users communicate or store data: legal assessment, designated representative, eight-hour process.

Reading the report critically

It has limits worth keeping in view. It rests on self-reported answers, the samples are small — 63 responses from EU member states on the judicial side — and the underlying data is from 2024, published in mid-2026. Statements about satisfaction and familiarity are perceptions, not measurements. The volume figures come from the transparency reports of a fixed set of providers and do not represent the whole market.

None of that changes the conclusions drawn here. The central finding — that evidence routinely no longer exists by the time someone asks for it — has been confirmed in every edition for years. And it applies to your own systems in exactly the way it applies to Google's and Meta's.