Source: https://leb.fbi.gov/2014/october/executing-search-warrants-in-the-cloud
Timestamp: 2017-01-16 17:09:15
Document Index: 136669398

Matched Legal Cases: ['§2703', '§2703', '§2703', '§2703', '§2703', '§2703', '§2510']

FBI — Executing Search Warrants in the Cloud
By John M. Cauthen Special Agent Cauthen is assigned to the FBI’s Sacramento, California, office.
Law enforcement has been keeping up with changing technology, and officers are becoming skilled at finding and collecting the digital evidence on computers and cell phones. The legal system, however, has had difficulty keeping up with law enforcement in recognizing new technologies.[1]
Today both law enforcement and the legal system face a new challenge—digital evidence distributed in the cloud.[2] Technology requires investigators to change their methods from traditional passive searches to a new model focused more on live recovery.[3]
…officers are becoming skilled at finding and collecting the digital evidence on computers and cell phones.
A TWOFOLD PROBLEM Executing law enforcement searches in a cloud-computing environment presents a twofold problem. First, little, if any, data pertaining to a computer user is found in a single geographic location. Second, and more important, even when the data is recovered, it may not be able to be converted to a format understandable by a human reader.
Today most search warrants for the seizure of digital evidence reference a particular location.[4] This is understandable because many lawyers and judges do not have a strong understanding of how digital evidence works. They often make the analogy comparing the hard disk drive of a computer to a filing cabinet. Filing cabinets contain files and folders just like computers, so this is easily understood. They also are located in a specific place, so search warrants for data often are crafted like ones for information in a filing cabinet. However, unlike a filing cabinet, the investigator might not know the specific location of the digital data before the search begins.
Digital evidence is powerful andcompelling. Cloud computing is a similar concept, except that files are stored somewhere on the Internet instead of on the corporate network. Generally, the user rents cloud services from a provider who maintains the software and data storage facilities, which could be at a nearby data center, spread out over multiple data centers, or stored in foreign countries. The problem is that finding where this data is physically stored can be very difficult—even the user might not know where it is. If the user is connected with limited control, as is common with tablets and cell phones, that person might not even have the ability to determine where the data is physically located. Likewise, due to service-level agreements, the service provider might have physical access to the data but not have the ability to search or recover it as data often is encrypted with a key possessed only by the user.
Laws that apply to search warrants that deal with these issues may be challenged due to the increased complexity of cloud computing. Currently there are two types of warrants used for criminal searches. The first is the traditional search warrant under FED. R. EVID. P. 41, which covers a search of a particular location. The second is the search warrant under 18. U. S. C. §2703 where the court may issue a warrant for records held by cloud providers in another district.[5] Traditionally, investigators use warrants under §2703 for searches of e-mail accounts where the search may be performed by the provider who supplies all of the subject’s e-mails, which the investigator then examines for content authorized within the scope of the warrant.
For data overseas, investigators may use legal process according to the laws in the host country. In one situation when serving a search warrant for data on a computer in the United States, investigators were able to see that there was a direct link to data located in a foreign country. They took the opportunity to download the data from the computer located overseas. In this instance the court found that the data could be used against the subject in trial. However, investigators should be aware that executing an international search without permission of the host country could cause other problems.[6]
The most common option is to serve a search warrant on the cloud provider…. Virtualization is the concept of using a single computer to run multiple operating systems. Individuals can use virtual machines on their personal computers, but they are more commonly seen in large networks and, particularly, in cloud computing. From an investigator’s perspective this can be a problem, whether or not the virtual machine is in the cloud, because the data in a virtual machine is stored physically in a way that it is only viewable when the virtual machine is turned on.
Encryption is becoming more prevalent due to high-visibility data breaches. The most common option is to serve a search warrant on the cloud provider under §2703 as already is done for e-mail providers. This can work with a simple situation, like an e-mail provider, and is beneficial for providing transactional records, such as payments. However, cloud providers often do not have complete access to the customer data stored on their systems and may not be able to provide data in a complete or usable format.
With this approach, the investigator will need to understand how to operate database software and make queries. These queries must comply with the search warrant. The investigator must conduct the search carefully as actions taken on a live system will change the data on the computer. Using this method, it may be possible to obtain a single search warrant combining the provisions of Rule 41 and §2703; however, it should be noted that there is no case law yet on implementing this strategy. CONCLUSION
Where is the Data? On a Networkin a Single District
On a Network in Multiple Districts
On a Network with Data Stored Internationally
Unknown Where the Data is Stored (Cloud)
Search under Rule 41; consider noting in affidavit the possibility of other locations
Multiple search warrants for each district with data or §2703 Warrant served on service provider
Use legal process required in country hosting the data, or consider accessing data remotely with a search warrant under Rule 41
Search under Rule 41 for subject computers, and concurrently search under §2703 served on service provider
Seize the encrypted files and decrypt them using a password or key and the appropriate decryption software. OR Seize the data while it is in an unencrypted state.
Seize the virtual image file and open it with the correct password. OR Log into the virtual machine and seize the data while the virtual machine is turned on and in an unencrypted state.
Seize all the files containing records. Obtain a copy of the database software and rebuild the database. OR Log into the database while it is live and employ the application used to create and manage the database as a search tool. Download the data using the method allowed by the application, either in the form of printouts or data files.
[3] Tony Sammes and Brian Jenkinson, Forensic Computing: A Practitioner’s Guide, (London, UK: Springer-Verlag, 2000). Forensics was developed on the idea of copying data from a hard disk drive that was turned off or dead. Live recovery involves changes to the contents of a computer’s storage space, 18 U.S.C. §2510(15). Therefore, it is essential that someone competent to give testimony performs it, showing that the continuity and integrity of the evidence has been preserved. [4] U.S. Department of Justice, Computer Crime and Intellectual Property Section, Criminal Division, Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations 3d ed., (Washington, D.C.: Office of Legal Education, Executive Office for United States Attorneys, 2009), 84. Although the courts have not directly addressed the matter, the language of Rule 41 combined with the Supreme Court’s interpretation of “property” may limit computer searches to data that physically resides in the district in which the warrant was issued.
A New Approach to Countering Violent Extremism: Sharing Expertise and Empowering Local Communities -
Executing Search Warrants in the Cloud -
Forensic Spotlight Toxicology Evidence -
Leadership SpotlightAssertiveness
Bulletin Honors - Polk County Sheriff’s Office Memorial, Florida Bulletin Reports - Digital Evidence and Forensics