Who Controls the Evidence Stored in the Cloud?

The email that decides a dispute may sit on infrastructure the parties have never seen. A company in one country uses a provider headquartered in another, while the employee who wrote the message lives somewhere else. Copies may exist in several places.

Asking where the server is located only begins the legal analysis. The more useful questions are who controls the information, who can compel its production and which protections apply when it is obtained.

Control and jurisdiction

Physical location and legal control can point in different directions. A provider may be able to retrieve records stored abroad. A local subsidiary may have no technical or contractual ability to retrieve the same records. The company's brand name does not answer that factual question.

In the United States, 18 U.S.C. 2713 requires covered providers to meet the preservation and disclosure obligations of the relevant statutory chapter for data within their possession, custody or control, irrespective of its location inside or outside the United States. The provision does not dispense with the legal requirements governing the underlying demand.

An order must therefore be examined on its own terms. Who issued it? What power supports it? Which account, period and categories of data does it cover? What procedure exists to challenge it? A broad reference to a cross-border investigation cannot replace those questions.

Preservation and disclosure are different decisions

Evidence can disappear while lawyers debate jurisdiction. Retention periods expire, accounts close and devices are replaced. Preservation should be addressed promptly through lawful channels, with the request tied to identifiable accounts and relevant dates.

Preserving a record does not automatically entitle the requesting party to inspect it. The later disclosure decision may involve privacy, legal privilege, secrecy obligations or restrictions imposed by another country. Keeping those stages separate protects both the evidence and the opportunity to challenge access.

Account ownership also needs care. An employer's access to a business account does not necessarily authorise unrestricted review of every private message within it. Equally, a person who once used a system does not necessarily retain lawful access after leaving the organisation. An evidence collection plan should identify the authority for each collection method.

Faster cooperation still needs limits

The UK–US Data Access Agreement creates a framework for qualifying electronic data demands connected with serious crime. Its provisions address matters including targeting restrictions, safeguards and the use of information. It does not give either government unrestricted access to the other country's users.

The Second Additional Protocol to the Budapest Convention provides further cooperation mechanisms alongside human rights and data protection safeguards. Before relying on a treaty mechanism, counsel must check that it applies between the states concerned and that the particular request meets its conditions. Signature, ratification and operational applicability should never be assumed to be interchangeable.

Obtaining a file is only part of proving a case

A disclosed email may be incomplete. Attachments can be missing. An export can omit headers or convert timestamps. A message shown in isolation may conceal a reply that changes its meaning.

The collection record should explain the system used, the person conducting the export, the scope of the search and any changes made during processing. Relevant metadata and original formats should be retained where possible. A working copy can be convenient for review while an independently preserved copy remains available for verification.

The defence also needs a practical opportunity to examine the material. Access to an investigator's summary may be insufficient where context, completeness or attribution is disputed. Requests should identify the missing material and explain how it bears on a live issue.

A cross-border evidence strategy must connect lawful access with reliable proof. A court needs to understand both how the data was obtained and what it actually establishes. The cloud changes the route to that evidence. It leaves those obligations intact.