Chapter 4 - Facilitators and relevant factors

4.4 The future is already here

4.4.3 Cloud computing and services - Law enforcement considerations

The Cloud presents both challenges and opportunities for law enforcement [195]. The National Institute of Standards and Technology (NIST) report on Cloud Computing Forensic Science Challenges lists 65 technical challenges for forensic investigators in uncovering, gathering, examining and interpreting digital evidence in dynamically changing, elastic, on-demand and self-provisioning Cloud environments [196]. The report clusters these technical challenges in nine categories, including data collection, analysis, legal, standards, training and anti-forensics to specifically prevent or mislead forensic analysis such as obfuscation, data hiding and malware. While these challenges are technical in nature, the report highlights that almost all touch upon legal and organisational aspects.

Data stored in the Cloud might be physically stored in different jurisdictions, which may pose obstacles to investigations particularly if the service provider is not based in the EU. Furthermore, the virtualisation of hardware and infrastructure means that potential electronic evidence will not only be geographically distributed but also become more volatile, resulting in technical and legal challenges for LE. This is exacerbated by limited knowledge and support for keeping records and potential evidence on the part of Cloud providers. The increased use of encryption in the Cloud is likely to further complicate digital investigations [197].

The use of Cloud computing and services necessitates the use of different digital forensics methods such as Live Data Forensics, which is performed on a running (live) system to acquire and/or analyse the data from that system for use in a court. This will put a greater burden of proof on LE as the actions performed during Live Data Forensics will change the data stored on the system. There is also the risk of using digital forensic tools and methods that are not applicable to cloud forensics [198].

Furthermore, LE investigative activities in the Cloud run the risk of disrupting legitimate services and businesses that use Cloud services, and may lead to potential data privacy issues.

Apart from these challenges, the Cloud also offers some opportunities for LE as the service provider can act as a single point of contact for digital investigations.