클라우드 스토리지 내 디지털 증거 획득의 적법성 검토

Abstract

Cloud storage services can store files on remote servers using cloud computing technology. The author investigated types of data created, modified, and managed in cloud storage services, and suggested a method to acquire it. However, this method can be utilized for extra-territorial search and seizure of cloud storage by multinational companies headquartered abroad, which can lead to a number of constraints and legal issues. Thus, this study reviewed legal issues with acceptance of evidence on issues that may arise during extra-territorial search and seizure of various data generated within cloud storage, accessing, storing, and managing case-related data. For cloud storage of multinational companies, it can consider searching and seizing files after accessing the server using account information of the persons subject to search and seizure secured in advance through a computer at a separate location within the domestic jurisdiction. This method cannot be regarded as infringing on the jurisdiction of the country where the cloud storage server is located. because it justly uses the service provided by the service provider, and because it is the execution of files owned or possessed by the suspect who is the information subject by securing files in Korea through the Internet. The legitimate way to obtain account information and access the server is to obtain the cooperation of the persons subject to search and seizure or service provider, or if this is not possible, it is considered a legitimate connection if service users use the normal method of accessing it. According to ‘the Best Evidence Rule’, Photo and video files that do not exist the original file and are relatively low quality stored in cloud storage may be considered evidence ‘if the original used to exist’, ‘if it is impossible or difficult to submit the original’, and ‘if the original is recognized to have been accurately transcribed’. Although the file does not exist, to use the history as evidence, ① the requirements of relevance must be met as 'possibility' to be evidence of a crime during search and seizure, and ② the file name and file operation history(such as upload, modification, and deletion) must be related to each other. Downloading files from cloud storage to a PC in the place to be searched and selecting files stored is a necessary act to verify the content of digital evidence, such as non-visibility and non-readability, and should be viewed as a search rather than seizure. Furthermore, the selected file should then be viewed as a seizure when it is finally duplicated as the investigator's storage media or printed as documents. While search and seizure targeting servers based on cloud computing have common considerations, but there are also other considerations due to the different types and conditions of data present in each service. With the development of information and communication technology and computer technology, various types of data are being transferred from existing storage media to cloud storage. Therefore, it is hoped that cloud-related studies will be actively carried out and those relevant laws will be enacted and revised to reduce confusion and enhance legality in the case of cloud forensics investigations.