The challenges of cloud-derived evidence Professor Ian Walden Centre for Commercial Law Studies, Queen Mary, University of London

Introductory remarks l Cloud computing –A new ICT paradigm? –Crime follows opportunity.... l An environment for obtaining evidence –Addressing the data problems l Exercising law enforcement powers –Legality & enforceability l Jurisdictional reach –Evidential impact

Cloud computing l ‘X as a Service’ –Software, Platform or Infrastructure: SaaS, PaaS & IaaS –Flexible, location-independent, on-demand, shared, virtualised l Cloud multi-layered ecosystem –Service providers –Infrastructure providers –Communication providers l Deployment models –Public, private, community or hybrid

Forensic challenges in the Cloud l Multiplicity –e.g. Data replication for performance, availability, back-up & redundancy l Distributed storage –e.g. ‘sharding’ and ‘partitioning’ l The ‘loss of location’ l Protected data –e.g. cryptography l Identity –Establishing links

Identity l Target IP address –e.g –generated by application being utilised l IP holder –‘whois’ enquiry of regional, national or local registry databases l Logging history –e.g. DHCP allocation log l Subscriber details –e.g. Credit card details

CSP-derived data l Content & communications data –‘in transmission’ or ‘at rest’ l Edmondson & ors v R [2013] EWCA Crim 1026 l Expedited preservation (‘quick freeze’) –Cybercrime Convention, arts l Data retention –Data Retention Directive 06/24/EC l 6-24 months l Rights of access –‘serious crime’ or ‘crime’

Protected data l Another data problem! –‘going dark’ l ‘access’ & ‘conversion’ protections l Legal constraints –Time limits l Legal response –Criminalise the use –Obligation to assist –Break the protection

Criminalise use l Control export, import, use –Export control regulations: ‘Wassenaar Arrangement’ l Dual-use technologies, Category 5, Part 2: ‘Information Security’ l Breach of regulations is a criminal offence l Use in criminal activity –e.g. State of Virginia (US), Computer Crime Act at § : ‘Encryption used in criminal activity’ l “an offense which is separate and distinct from the predicate criminal activity”

Obligations to assist l Cybercrime Convention, art. 19(4) –“to empower its competent authorities to order any person who has knowledge about the functioning of the computer system or measures applied to protect the computer data” l Regulation of Investigatory Powers Act 2000 –RIPA Pt I: ‘Interception l Section 12 Notice –RIPA Pt III: ‘Investigation of Protected Electronic Information’ l Delivery-up of ‘key’: Failure to disclose (s. 53): 2 yr term (5 yrs for national security & child indecency cases) l Cutler [2011] EWCA Crim 2781: “a very serious offence because it interferes with the administration of justice” l Padellec [2012] EWCA Crim 1956

Breaking the protection l Ex ante measures –Mandating technology l e.g. US ‘key escrow’ & ‘Clipper Chip’ (1995) –Influencing the standards l e.g. Dual EC DRBG standard l Ex post arrangements –Expert resources l e.g. UK: National Technical Assistance Centre –Hacking l e.g. NSA’s ‘Tailored Access Operations’ l Based more on stolen goods than maths!

Human rights concerns –ECHR Article 6 – right against self- incrimination l S and A [2008] EWCA Crim 2177: “an existence independent of the will of the suspect” –US, 5 th Amendment l Boucher 2009 WL (D.Vt.) –Requirement to produce an unencrypted drive did not constitute compelled testimonial communication. l Kim 2009 WL (US District Court for the Southern District of Texas 2009) –Exceeding scope of warranted search & inapplicable ‘plain view doctrine’ resulted in suppression of child sexual abuse images discovered in encrypted folders

Law enforcement l Law enforcement access –Covert & coercive investigative techniques l Request recipients –Cloud users l Suspect, victim or 3 rd party –Cloud providers l Service providers l Infrastructure providers l Communication providers –Within & beyond the territory

LEA investigative powers l ‘Exercising a power’ –Permissible & impermissible conduct l e.g. entrapment l Expedited preservation, retention & delivery-up –Differential authorisation l Judicial, executive or administrative l Issues of legality & enforceability –Obtaining authorisation –Executing the authorisation –Recipient’s actions l e.g. Rackspace (2004)

Jurisdictional reach l Cybercrime Convention (2001) –Production order (art. 18) l Person ‘in its territory’ or ‘offering its services in the territory’ with ‘possession or control’ –Rackspace (2013) –Search & seizure l Domestic networks (art. 19) l International networks (art. 32) –Open source or lawful and voluntary consent of the person who has lawful authority to disclose Other forms are ‘neither authorised, nor precluded’ Contractual provisions

International co-operation l Mutual legal assistance –From harmonisation to mutual recognition l Convention on Cybercrime l TFEU, art. 82: European Evidence Warrant & European Investigation Order l Informal co-operation with foreign LEAs –Proactive disclosure & 24/7 networks l Direct liaison with foreign service providers –Council of Europe Guidelines (2008) l e.g. Google ‘Transparency Report l Engage directly with the material sought

Cloud-derived evidence l ‘fair trial’ and ‘due process’ considerations – Regulating investigative practices? Schenk v Switzerland (1991) 13 E.H.R.R. 242 United States v Gorshkov (2001) l Admissibility –Statutory rules l RIPA, s Inadmissibility of UK intercept product –Judicial discretion l PACE, s. 78 l Impact of lawfulness of obtaining, e.g. Suppression l Evidence gathered under MLA

Probative value l Provenance issues with remote & protected data  Need for experts l Authenticity –Link person/material test –Computer source test l, l Integrity –‘Operating properly’ test l e.g. Waddon (1999): ‘mere post boxes’ l Accountability –Acquisition test –Chain of custody test

Concluding remarks l Clouds & the ‘loss of location’ l Exceeding powers in application or reach –Surrendering sovereignty l From formality to informality –Issues of accountability & oversight l Harmonisation limitations –Building a ‘culture of co-operation’! l e.g. Amazon & WikiLeaks l Evidential implications