Data Chain Of Custody
<p>This is civil in the US.  I work for a company that does litigation support - discovery.  We have secure servers that we (the company) pay a lot of money for.  Based on the case load we may need to scale up fast so must have expensive excess capacity on hand. </p>

<p>We lost some deals to bids that were less than our cost. I traced them out and almost positive they are using cloud computing.  The reputable hosting companies typically have a statement about secure servers and signing for a chain of custody if they receive physical media. </p>

<p>I ran the cost and we can get server capacity on a cloud like an Amazon or Azure for literally pennies on the dollar and get (or release) capacity on demand.</p>

<p>The owner claims cannot satisfy chain of custody if the data hit a cloud. Is that true?  </p>

<p>I know two questions is not protocol for this site but what if the cloud account is owned by the customer?  We just sell software/service.  Now the customer would most likely need to give us access to the data but very easy to only give us read only access - they control the cloud account.  Anyone doing review would have read only access.  Could a customer sign a (valid) chain of custody if the data hit a cloud?</p>

<p>I am clearly a techy.  The original disc is still in a physical chain of custody.  What is produced to the court is page by page tiff (or other rendition) redacted (or not) and stamped with a bates number.  I know the law is the law and does not need to make sense but the original is not what is produced to the court.  I am not getting touched a cloud would invalidate.  Can you not just sign that Azure/Amazon was part of chain custody?  It is not like the hammer that was used to crush the skull.  Discovery data started as a clone of the collected physical disc or it was produces by the opposing party (still a copy).</p>

<blockquote>
<p>Owner claims cannot satisfy chain of custody if the data hit a cloud.</p>
<p>Is that true?</p>
</blockquote>
<p>No. On the one hand, as you say, you can just include the cloud provider on the chain of custody. On the other hand, opponents don't ask for chain of custody. And when they do, it's going to take a pretty drastic series of events to diminish the admissibility or weight of the evidence in court.</p>
<p>Ten years ago chain of custody was taken more seriously but after many recent court opinions about proportionality and cooperation, lawyers don't challenge chain of custody unless something glaring appears to be wrong.</p>
<p>I could go on, but suffice it to say - I don't know of any case where chain of custody made a difference in civil litigation.</p>
<p>Be aware that adding cloud storage adds a step to your processing and production workflow. As it is, you probably receive original evidence and process the data, host it for review, and then convert to TIF for production. If the data is hosted in the cloud rather than your local server your attorneys will be waiting for you to get the data uploaded to the review platform. And then when the review is done the production might take longer because of the download. Obviously the production delay is not as severe as the upload for review. There are ways around this, like rolling the upload, but this takes more human hours because of the additional management required.</p>
<p>I'll also add security as the reason to stay out of the cloud. Litigation evidence is usually highly confidential and requires a high degree of security.</p>
<p>So, there are reasons for discovery vendors to avoid the cloud. Chain of custody is not one of them.</p>

litigation data-storage