클라우드 스토리지 내 디지털 증거 획득의 적법성 검토 = Review on the Legality of Acquiring Digital Evidence in Cloud Storage

다국어 초록 (Multilingual Abstract)

Cloud storage services can store files on remote servers using cloud computing technology. The author investigated types of data created, modified, and managed in cloud storage services, and suggested a method to acquire it. However, this method can be utilized for extra-territorial search and seizure of cloud storage by multinational companies headquartered abroad, which can lead to a number of constraints and legal issues. Thus, this study reviewed legal issues with acceptance of evidence on issues that may arise during extra-territorial search and seizure of various data generated within cloud storage, accessing, storing, and managing case-related data. For cloud storage of multinational companies, it can consider searching and seizing files after accessing the server using account information of the persons subject to search and seizure secured in advance through a computer at a separate location within the domestic jurisdiction. This method cannot be regarded as infringing on the jurisdiction of the country where the cloud storage server is located. because it justly uses the service provided by the service provider, and because it is the execution of files owned or possessed by the suspect who is the information subject by securing files in Korea through the Internet. The legitimate way to obtain account information and access the server is to obtain the cooperation of the persons subject to search and seizure or service provider, or if this is not possible, it is considered a legitimate connection if service users use the normal method of accessing it. According to ‘the Best Evidence Rule’, Photo and video files that do not exist the original file and are relatively low quality stored in cloud storage may be considered evidence ‘if the original used to exist’, ‘if it is impossible or difficult to submit the original’, and ‘if the original is recognized to have been accurately transcribed’.
Although the file does not exist, to use the history as evidence, ① the requirements of relevance must be met as 'possibility' to be evidence of a crime during search and seizure, and ② the file name and file operation history(such as upload, modification, and deletion) must be related to each other. Downloading files from cloud storage to a PC in the place to be searched and selecting files stored is a necessary act to verify the content of digital evidence, such as non-visibility and non-readability, and should be viewed as a search rather than seizure.
Furthermore, the selected file should then be viewed as a seizure when it is finally duplicated as the investigator's storage media or printed as documents. While search and seizure targeting servers based on cloud computing have common considerations, but there are also other considerations due to the different types and conditions of data present in each service. With the development of information and communication technology and computer technology, various types of data are being transferred from existing storage media to cloud storage.
Therefore, it is hoped that cloud-related studies will be actively carried out and those relevant laws will be enacted and revised to reduce confusion and enhance legality in the case of cloud forensics investigations.

참고문헌 (Reference)

1 전승수, "형사절차상 디지털 증거의 압수수색 및 증거능력에 관한 연구" 서울대학교 대학원 2011

2 이숙연, "형사소송에서의 디지털증거의 취급과 증거능력" 고려대학교 정보경영공학전문대학원 2011

3 이민병, "파일 시간정보 분석을 통한 클라우드 스토리지 사용행위 추적" 한국디지털포렌식학회 13 (13): 151-162, 2019

4 김민동, "클라우드 스토리지의 수사 활용가능 데이터 획득 방안 연구: 구글 드라이브와 구글 포토를 중심으로" 성균관대학교 2021

5 전수영, "컴퓨터 범죄" 한국학술정보 2012

6 김경선, "주석 형법 - 각칙 5" 2006

7 권영법, "정황증거에 의한 유죄의 인정" 대검찰청 (46) : 1-43, 2015

8 김기범, "정보영장 제도 도입방안 연구" 경찰대학 11 (11): 85-116, 2011

9 권오걸, "절도죄에 있어서의 점유의 개념과 점유의 타인성 - 특히 민법상의 점유개념과의 비교를 통하여 -" 법학연구원 (26) : 163-185, 2007

10 이상원, "전자증거와 원본증거의 법칙" 대검찰청 (36) : 50-104, 2012

11 조광훈, "전자정보의 압수수색절차에서 관련성·동일성·참여권" 2018 (2018): 2018

12 이정민, "외국계 이메일 계정에 대한 압수・수색의 정당성 – [대상판결1] 서울고등법원 제12부 2017.6.13. 선고 2017노23, [대상판결2] 서울고등법원 제8형사부 2017.7.5. 선고 2017노146 -" 한국비교형사법학회 19 (19): 117-147, 2017

13 조성훈, "역외 디지털증거의 수집과 국제형사규범의 발전" 법학연구소 43 (43): 93-150, 2019

14 김재중, "압수･수색 범위와 범죄사실과의 관련성" 한국형사정책연구원 27 (27): 1-33, 2016

15 천성덕, "실무적 관점에서 본 원격지 서버에 대한 압수・수색 절차 제언" 한국형사소송법학회 11 (11): 57-90, 2019

16 정대용, "수색 대상 컴퓨터를 이용한 원격 압수수색의쟁점과 입법론" 법조협회 65 (65): 40-84, 2016

17 전현욱, "사이버범죄의 수사 효율성 강화를 위한 법제 개선 방안 연구" 계문사 2015

18 최호진, "디지털증거 압수･수색에 있어서 해당 사건과의 관련성에 대한 검토" 3 (3): 2017

19 손지영, "디지털 증거의 증거능력 판단에 관한 연구" 사법정책연구원 2015

20 정소연, "디지털 증거의 역외 압수수색에 대한 법적 고찰" 한국디지털포렌식학회 11 (11): 61-71, 2017

21 정대용, "디지털 증거의 역외 압수수색에 관한 쟁점과 입법론 - 계정 접속을 통한 해외서버의 원격 압수수색을 중심으로 -" 법조협회 65 (65): 133-182, 2016

22 곽병선, "디지털 증거의 압수·수색절차상 문제점과 개선방안" 한국법학회 (51) : 249-265, 2013

23 이완규, "디지털 증거 압수수색과 관련성 개념의 해석" 법조협회 62 (62): 91-162, 2013

24 김영철, "디지털 전문증거 진정성립을 위한 디지털 본래증거 수집 방안" 대검찰청 (58) : 257-298, 2018

25 조성훈, "대물적 강제처분과 개인정보보호: 전자정보 압수·수색 제도의 개선방안을 중심으로" 대한변호사협회 (493) : 197-219, 2020

26 Cybercrime Convention Committee, "Transborder access and jurisdiction: What are the options?"

27 Shuyuan Mary Ho, "Following the breadcrumbs:Timestamp pattern identification for cloud forensics" 24 : 2018

28 박경신, "E-메일 압수수색의 제문제와 관련 법률개정안들에 대한 평가" 법학연구소 13 (13): 265-314, 2010

29 Steven W Teppler, "Digital data as hearsay" 6 : 2009

30 Cybercrime Convention Committee, "Criminal justice access to electronic evidence in the cloud: Recommendations for consideration by the T-CY"

31 Farid Daryabar, "Cloud storage forensics: MEGA as a case study" 49 (49): 2017