What is unauthorised disclosure?¶
The practical answer¶
Unauthorised disclosure is the release, sharing or exposure of information to a person or destination without proper authority.
The key evidential caution¶
The dangerous assumption is that every disclosure is deliberate.
It may result from:
Key points¶
- wrong recipient
- misaddressed email
- misconfigured sharing
- public link creation
- lost device
- account compromise
- careless conversation
- deliberate sharing
- coercion
What investigators should establish¶
Investigators should establish:
Key points¶
- what information was disclosed
- to whom or where
- which account or process performed the action
- whether delivery or access occurred
- what authority existed
- whether the disclosure was intentional, reckless or accidental
A message sent to the wrong address may show an accidental act.
Repeated sharing with the same external account may support a different inference.
A public link may create exposure even where no third-party access can be proved.
Evidential limits¶
Do not assume the recipient account identifies the ultimate person who received or used the information.
Preserve message IDs, sharing records, recipient details, access logs, file versions, communications and any recall or containment action.
Where exposure is created through a public or shared link, preserve the permission scope, expiry, recipients and access history. The link may exist without being used, or may be accessed by many people. Creation, availability and actual disclosure are different stages.
Disclosure may also occur through spoken conversation, screen sharing or photography, leaving limited system evidence. In those cases, communications, witness evidence, device artefacts and recipient records may become more important than ordinary file-transfer logs.
Operational takeaway¶
Separate creation of exposure, successful delivery, recipient access and intent, and prove each stage from communication, provider and account evidence.