Skip to content
Skip to main content
Cloud Services Offender Viewpoint

Dodgy Dave puts illegal waste disposal in the shared calendar

Dave charges businesses for compliant waste disposal, then sends selected loads to quiet patches of countryside. He keeps customer paperwork, route sheets and photographs in cloud folder F-7740, shared with driver Mo Reed. Dave calls this efficient logistics. The countryside would probably choose a different phrase.

The working principle
Cloud collaboration records the work as well as the files. Dave uses shared storage to allocate collections, alter destinations and prove jobs to customers. Those same functions create object, version, permission and synchronisation evidence.
Customer booking
Route sheet
Changed destination
Shared driver folder
Site photograph
Dave and Mo

Dave offers the respectable service

Customers upload collection details and receive certificates saying their waste reached an authorised facility. Dave stores the working files under cloud tenant D-44018. Each job receives an object and reference; the official destination appears in the customer copy.

Route object before Dave improves it
object_id=OBJ-7712filename=route-12-june.xlsxversion=V-03job_ref=DW-208declared_destination=North County Transfer Station
Established tenant D-44018 stored this job and declared destinationStill open who planned or carried out the actual disposal

Dave creates the driver's version

Dave edits OBJ-7712, replaces the destination with Gate 4 · Old Quarry Road and adds “after 23:00”. Version history retains both versions and records the account and session responsible for the change.

Cloud ownership still does not prove authorship. Dave's account could be shared or compromised. But the save event gives a precise action to compare with messages, devices and later conduct rather than leaving investigators with two contradictory spreadsheets and a shrug.

EstablishedAccount C-88410 saved the changed destination as version V-04.
Still openWhether Dave controlled that session and whether Mo understood the purpose of the change.

Dave shares only what Mo needs

Dave grants Mo's account C-55210 editor access to folder F-7740. Mo views the changed route, uploads a photograph from the disposal location and marks the job complete. The shared-folder record identifies the permission; provider events distinguish viewing, editing and uploading.

20:42Dave-associated session saves route version V-04.
21:07Mo's account views V-04 from application APP-91B2.
23:38The same application uploads site photograph OBJ-7720.
23:44Job DW-208 is marked complete.

The sequence does not by itself settle what Mo knew, but it is a strong route to testing participation. The cloud account record and session that changed the route give the propositions to compare with devices and communications. A driver who received the changed destination, attended it and uploaded the completion image has rather more to explain than someone whose name merely appeared on a rota.

Synchronisation distributes Dave's paperwork

The synchronised folder places route versions and certificates onto Dave's laptop and Mo's phone. Some files arrive automatically, so presence alone is not proof of reading. The sync databases also retain the tenant, account, object and version relationships, while recent-access records show which route each device opened.

Dave likes the fact that the files follow the business everywhere. The files have taken the instruction literally.

Dave empties the folder

After a disposal site is found, Dave deletes the route sheets and removes Mo's permission. Cloud deletion changes what users see, but provider audit events, recoverable versions and synchronised copies may remain. A timely preservation request can protect that history before retention rules or further account activity alter it.

What the dumping operation leaves behind

False accountCustomer and certificate objects record the destination customers were promised.
Working planVersion history preserves Dave's changed destination and time.
ParticipationPermissions and events show Mo viewing the route and uploading the completion image.
Personal responsibilitySynced devices, messages, location evidence and explanations test who controlled the sessions and what each person knew.
Operational takeaway
Dave used the cloud to coordinate the offending; the service recorded the coordination. Objects, versions, permissions and synchronised devices can explain the plan, the change of destination and each participant's apparent role.
Reference: CLD-175Cloud Services