Searching the cloud

05 July 2021

Not reviewed after the date of publication

Question: 

We have arrested an individual for indecent images of children and he has been released under investigation. Prior to being released he gave officers details of his Cloud account login and password and agreed that they could search his account. The investigators now wish to search that account for evidence of a criminal offence.

What is the appropriate way to legally gain access to this material, would it be section 18, statutory powers under the Protection of Children Act or a DSA?

Answer:

A section 18 authority would not be appropriate in the circumstances you describe to gain access to the cloud storage of your suspect. We do not believe that any PACE power / authority would be applicable for an examination in your situation.

Information that is stored in the 'cloud' is effectively information that is stored on the remote online servers of the storage service provider. The storage provider being, for example, One Drive, Icloud , Google etc. who then provide the accounts through which a person can access their data, images etc. either free of charge or by payment. The account will generally have a login that is particular to the individual account holder for access by that individual. It can and should only be accessed by the account holder by means of the agreed terms with the provider.

Accessing stored communications is lawful if:

1. There is one-sided consent AND a DSA – Section 44 IPA and section 26 of the Regulation of Investigatory Powers Act 2000.

OR

2. It is carried out in the exercise of a statutory power - Section 6(1)(c)(ii) IPA.

Section 6(1)(c)(ii) of Investigatory Powers Act 2016 provides:

"6(1) For the purposes of this Act, a person has lawful authority to carry out an interception if, and only if –

(c) in the case of a communication stored in or by a telecommunication system, the interception –

(ii) is in the exercise of any statutory power that is exercised for the purpose of obtaining information or taking possession of any document or other property, or

…"

We believe that only option one above would be available as it is our opinion that the Protection of Children Act would not provide a statutory power for the purposes of option 2 above as the police have not exercised any power under that Act in relation to the 'cloud'.

We would also advise to check force policy and /or liaise with the force Hi Tech Crime Unit / Digital Forensics Unit as they will be able to provide more details on the process, for example, the forms to be used and procedures to be followed.

To read more legislation about this, login to the legal database. 

Back to Legal Questions