Cloud investigations in line with the Innovation Act
More and more data is being stored in the cloud these days. As a result, it is becoming increasingly important as a source of evidence. Until recently, however, there was much ado about the legal admissibility of cloud data. But thanks to the new Dutch Innovation Act, this has changed.
The Innovation Act
The Dutch Code of Criminal Procedure is almost 100 years old and defines how offences are prosecuted. A lot has changed in 100 years. Digitisation has had a significant impact on how criminals operate and the type of evidence they leave behind. High time for a modernised Code of Criminal Procedure.
In recent years, the Dutch Ministry of Justice and Security and the Dutch Law Minister have been hard at work to create a new Code. However, before a new Code can be released, it is important to test whether the new legislation works in criminal justice practice. With this in mind, a bill was proposed to gain experience with the new possibilities of this new Innovation Act through five pilots for up to three years [1]. The pilots will be evaluated by the Scientific Research and Documentation Centre (WODC). Once accepted, the findings will be incorporated into the new Code.
The five pilots running under the Innovation Act are [1]:
- In the context of investigations, after seizing phones or computers, investigating officers are allowed to read messages that have entered the devices after the seizure. Police may also conduct network searches from these devices after the time of seizure. This means they are allowed to search a phone's cloud environment;
- Audio-visual recordings may be used as an alternative to a written official report. For example, interviews of suspects with the police or the footage of a shoplifting need not be written out in full. Recordings of these, together with an abbreviated report, are sufficient and can serve as evidence;
- The auxiliary prosecutor's powers may be extended, these are lighter investigative powers;
- Lower courts can have ‘legal questions’ presented to the Supreme Court in a complex case. Such 'preliminary' questions are meant to reduce the risk of contradictory rulings and prolonged legal uncertainty;
- Regulate how mediation can take place after the commencement of the hearing. Mediation refers to the mediation between defendant and victim.
The Innovation Act & cloud investigations
In particular, the first pilot offers additional opportunities in cloud investigations, e.g. when it comes to securing cloud data: Data no longer needs to be secured during a search (Article 125 I), this can now be done at a later time.
However, the investigation must first be approved by the public prosecutor and only digital investigators with cloud extraction training are allowed to conduct the investigation. They must also adhere to the procedural steps laid down in the pilot.
It is to be expected that some rules will be included in the new Code regarding the manner of securing. Consider, for example, data stored abroad or the investigation period that determines how much data can be secured.
Tooling for securing cloud data
Now that it is -at least temporarily- possible for investigators at the Police and the Dutch Tax Authorities to secure cloud data and use it as evidence in an investigation after a search, it is desirable to use supporting cloud forensics tooling. After all, with the large amount of data online in the cloud, manually searching the data is not an option.
A very suitable tool for searching and securing cloud data is Oxygen Forensic Detective. This software makes it possible to secure and display passwords and tokens from a mobile phone in a forensically sound manner. Then, from within the software, the obsolete passwords and tokens can be used to access the cloud applications. If the passwords are current, the data present in the cloud applications can be extracted and secured immediately.
Oxygen Forensic Detective currently supports 112 cloud applications. The main ones are Gmail, Google Locations, Google Drive, iCloud Drive, OneDrive and Outlook.
Source: Oxygen Forensics Detective
Trial licence
Are you curious about how Oxygen Forensic Detective can help you conduct a cloud investigation? Then request a trial licence from Oxygen Forensics. This licence allows you to try out all the functionalities of Oxygen Forensic Detective for 20 days. To apply for the trial licence here.
Do you have other questions following this article? Then please contact us.
Source
[1] https://www.tweedekamer.nl/debat_en_vergadering/uitgelicht/innovatiewet-strafvordering