Remote copying from cloud storage: access and digital evidence under section 115f StPO

Section 115f(1) StPO permits the seizure of data and data carriers when it appears necessary for evidentiary reasons and specific facts support the assumption that it can reveal information essential to investigating a criminal offence. The provision therefore concerns access to data for evidentiary purposes. It does not create a blanket right to inspect every item on a device or in an online account.

A remote copy from cloud storage is characterised in practice by the fact that the relevant data are held at another storage location. The legal assessment depends on the specific access and its purpose. Securing a device, seizing data and preparing the data for use are connected steps, but they are distinct steps.

The comparison with a conventional seizure helps classify the measure. A remote storage location requires an additional description of the service, account and period. The word “cloud” alone does not provide that limitation.

Under section 115f(2) StPO, the public prosecutor orders the seizure on the basis of judicial authorisation and the criminal police carry it out. The roles are therefore divided. The order and the authorisation must be read together because the execution is bound by the judicial scope.

Section 115f(3) StPO requires, among other things, the designation of the proceedings, the name of the accused where known, the suspected offence and its statutory classification. The order must also state the facts showing why the measure is expected to be necessary and proportionate for investigating the offence.

The technical access to cloud data requires particular precision. The order must describe the data categories and data content to be seized and the period to which the measure relates. An indefinite description can therefore determine the scope of the measure and the later review.

Section 115g(1) StPO provides that every person must grant access to data when a seizure is intended. On request, data must be provided in a commonly used file format or made available for copying. The person must also tolerate the creation of an original forensic copy of data stored on the device or at another storage location.

The request should be recorded precisely. Preserve the sender, the affected account, the requested period, the data category and the technical form of access. The statutory duty to cooperate does not by itself answer which data are covered by the judicial authorisation.

Access credentials and the substantive scope of the measure must be kept separate. The account user should not delete, move or reorganise data after the request. Keep the communication with the authority and the account status at the time of access for later review.

In an urgent situation the criminal police may secure data on their own under section 115f(4) StPO if the statutory conditions are met. This includes a risk that the device or data stored on it or at another storage location would otherwise be lost. The provision also names other statutory cases, each of which requires its own assessment.

During an urgent measure, preliminary access and inspection are allowed to secure the data required within the statutory framework. The data examined must be recorded. For the person affected, the time, reason, scope and record of the securing are therefore particularly important.

Section 115g(3) StPO requires the criminal police to report to the public prosecutor without delay and at the latest within fourteen days. The public prosecutor must then apply to the court for seizure or order the measure lifted if its conditions are missing or have ceased to exist.

Section 115h StPO governs the preparation of data. An original forensic copy and a working copy must be created. The data are then prepared on that basis within the scope of the judicial authorisation. The result must be produced in a commonly used and structured file format.

The preparation report must document the process, any recovery of data and the criteria used to limit the data set. This keeps the path from the original forensic copy to the material used in the proceedings traceable.

Under section 115f(5) StPO, further access to the original forensic copy or working copy generally requires a new order and judicial authorisation. At the same time, section 115f(6) StPO excludes seizure, or requires it to be lifted on request, once recordings or copies fulfil the evidentiary purpose and the originals are not expected to be needed at trial.

Under section 115f(8) StPO, the person affected by seizure or urgent securing must receive a confirmation immediately or at the latest within 24 hours. The confirmation must also explain the right to apply for a judicial decision on lifting or continuing the securing.

This document is central to the next review. Keep the confirmation, order, judicial authorisation and technical record together. If the account, period or data category differs between the documents, record the difference precisely.

If the conditions for seizure no longer exist, the public prosecutor must lift it under section 115f(9) StPO. The review therefore does not end with the first copy. The continuing purpose and the handling of the original and working copy remain legally relevant.