2

This is civil in the US. I work for a company that does litigation support - discovery. We have secure servers that we (the company) pay a lot of money for. Based on the case load we may need to scale up fast so must have expensive excess capacity on hand.

We lost some deals to bids that were less than our cost. I traced them out and almost positive they are using cloud computing. The reputable hosting companies typically have a statement about secure servers and signing for a chain of custody if they receive physical media.

I ran the cost and we can get server capacity on a cloud like an Amazon or Azure for literally pennies on the dollar and get (or release) capacity on demand.

The owner claims cannot satisfy chain of custody if the data hit a cloud. Is that true?

I know two questions is not protocol for this site but what if the cloud account is owned by the customer? We just sell software/service. Now the customer would most likely need to give us access to the data but very easy to only give us read only access - they control the cloud account. Anyone doing review would have read only access. Could a customer sign a (valid) chain of custody if the data hit a cloud?

I am clearly a techy. The original disc is still in a physical chain of custody. What is produced to the court is page by page tiff (or other rendition) redacted (or not) and stamped with a bates number. I know the law is the law and does not need to make sense but the original is not what is produced to the court. I am not getting touched a cloud would invalidate. Can you not just sign that Azure/Amazon was part of chain custody? It is not like the hammer that was used to crush the skull. Discovery data started as a clone of the collected physical disc or it was produces by the opposing party (still a copy).

Improve this question
1
  • A couple mid sized players are in the cloud now. There are some players out there
    – paparazzo
    Commented Sep 18, 2016 at 21:47

1 Answer 1

Reset to default
2

Owner claims cannot satisfy chain of custody if the data hit a cloud.

Is that true?

No. On the one hand, as you say, you can just include the cloud provider on the chain of custody. On the other hand, opponents don't ask for chain of custody. And when they do, it's going to take a pretty drastic series of events to diminish the admissibility or weight of the evidence in court.

Ten years ago chain of custody was taken more seriously but after many recent court opinions about proportionality and cooperation, lawyers don't challenge chain of custody unless something glaring appears to be wrong.

I could go on, but suffice it to say - I don't know of any case where chain of custody made a difference in civil litigation.

Be aware that adding cloud storage adds a step to your processing and production workflow. As it is, you probably receive original evidence and process the data, host it for review, and then convert to TIF for production. If the data is hosted in the cloud rather than your local server your attorneys will be waiting for you to get the data uploaded to the review platform. And then when the review is done the production might take longer because of the download. Obviously the production delay is not as severe as the upload for review. There are ways around this, like rolling the upload, but this takes more human hours because of the additional management required.

I'll also add security as the reason to stay out of the cloud. Litigation evidence is usually highly confidential and requires a high degree of security.

So, there are reasons for discovery vendors to avoid the cloud. Chain of custody is not one of them.

Improve this answer
7
  • I did not vote this down. If this is a incorrect answer I wish the down vote would comment. Cloud password based login is as secure as any. Some cloud providers let you send a physical disk for loads. You can get an office at a hosting facility with 100mb connection. Or just have staging server at local hosting facility for large up and down loads.
    – paparazzo
    Commented Oct 17, 2015 at 15:37
  • @Frisbee yeah, there are workflow workarounds for sure. My point is that chain of custody is not at the top of the list of considerations when deciding on remote storage. Chances are, the attorneys don't care about cloud vs local storage. Regarding security, attorneys are strange. There is an ethical duty to safeguard client property, yet we send out productions on unprotected DVDs. So it's tough to predict what attorneys want. As a side note, e-discovery services are largely commoditized and price is often the the paramount decision maker.
    – jqning
    Commented Oct 17, 2015 at 16:33
  • If you believe the documentation Azure will not send or receive a disk that is not encrypted. And they they now offer 2 phase authentication. ID, password, and they send a code to your phone.
    – paparazzo
    Commented Sep 18, 2016 at 21:52
  • Plenty of other things that people want to put into the cloud, such as data protected under HIPAA, are highly confidential and even regulated; cloud providers often offer specific support for security compliance. Further, security being a systemic issue, cloud providers may provide better overall security than you can at similar cost. (For example, a physical server or disk is probably a lot harder to steal from a cloud provider than from your office or even a cabinet you rent in a data centre.) In general, you can't say cloud gives you better or worse security without a detailed analysis.
    – cjs
    Commented Mar 17, 2022 at 1:04
  • @cjs A lot has changed in six plus years.
    – jqning
    Commented Mar 24, 2022 at 20:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .