When is a cloud line of enquiry proportionate?¶

A cloud line of enquiry is proportionate when its likely evidential value justifies the time, intrusion, cost and delay involved.

Evidential caution: that every cloud artefact should be pursued because more data might exist.

What this means¶

Consider the seriousness of the matter, the relevance of the account or service, the volatility of the records and the availability of less intrusive evidence.

A targeted request for recent login and session records may be proportionate where attribution is central.

Also consider jurisdiction, provider delay, specialist resource and the burden on the organisation holding the data.

Preservation may still be proportionate even where full acquisition is not yet justified, particularly if the records are short-lived.

Stop where the likely benefit no longer justifies the effort or intrusion.

A proportionate cloud enquiry is focused, time-bound and connected to a real investigative decision.

Where records are highly volatile, the proportionality decision should be made quickly and documented. Delay can remove the option before the evidential value has been properly assessed.

What to check or do next¶

• Start with the investigative question.
• Ask what decision the cloud evidence could change.
• Record why the enquiry is being pursued, what records are sought, the expected value and when the line will be reviewed.
• Do not continue merely because the provider may hold something.

Evidential limits¶

A broad request for years of unrelated account content may not be.