Legal authority and scope

Digital forensics is lawful only when it rests on proper authority, and it stays lawful only while the work remains inside the limits that authority sets. This lesson explains where authority comes from, who can grant it, how scope is written down, and what to do when the evidence leads beyond it. The details differ between countries, but these principles hold in every legal system. Privacy is covered in Lesson 2.2 and the examiner's own duties in Lesson 2.3.

Why authority comes first

Examining data without authority can be an offense in itself: most countries criminalize unauthorized access to computer systems, and privacy laws restrict who may process personal information. Even when no law is broken, evidence gathered without proper authority may be excluded or given less weight, and the examiner, not only the person who gave the instruction, can face complaints, claims or disciplinary action. Checking authority is part of the first phase of the forensic process (Module 1), not a formality.

Sources of authority

Five sources of authority exist, under different names, in most legal systems.

A useful rule follows from the last row: nobody can authorize what they have no right to do themselves. A client cannot instruct an examiner to break into the other party's email, and an employer cannot authorize access to an employee's private bank account because it was once opened on a company laptop.

Who can authorize what

Before relying on anyone's permission, establish what they actually control.

• Device owner: the person or organization that owns the hardware, such as an employer that issues laptops. Owning the device does not automatically extend to every account used on it.
• User: the person who actually uses the device. A user may consent for their own data, but not necessarily for other users of a shared device.
• Account holder: the person or organization in whose name an online account is registered. An organization that administers corporate mailboxes can usually authorize access to them, subject to its policies and local privacy law; a personal webmail account belongs to its holder.
• Service provider: the company that stores the data. Providers usually disclose customer data only at the customer's request or under a legal instrument.

Record who authorized what, and on what basis. When unclear, ask a lawyer before acting.

Scope: the boundaries of the work

Authority says that an examination may happen; scope says what it may cover. A good scope is written, specific and agreed before work begins. It usually defines five things:

• Devices and media: which laptops, phones, drives or servers, identified by serial number or asset tag.
• Accounts: which email, cloud or messaging accounts, and whose.
• Data types: for example email, documents, chat messages, USB device history or browser history.
• Time window: the period that matters, such as 1 March to 15 April.
• Search terms and questions: the keywords, names or file types to look for, and the questions the examination must answer.

Each element of the scope should be explained by the questions of the case (Module 1). Exceeding the scope is one of the most common ways that sound technical work becomes unusable: depending on the legal system, material found outside it may be excluded, may taint findings derived from it, or may lead a court to doubt the whole examination. It can also breach the privacy of uninvolved people and expose the examiner personally. Vague instructions invite drift, and drift is hard to defend.

When you find something outside scope

Examiners regularly meet material their authority does not cover, such as signs of a different offense. Legal systems treat such discoveries differently, but good practice is the same everywhere:

1. Stop examining that material. Do not open further files or run extra searches to "see what it is".
2. Document what was seen, where, when and how it came into view, in your contemporaneous notes (Module 5).
3. Preserve the item as it is, so that nothing is lost if authority is granted later.
4. Report the discovery to the person responsible for the case or to the authority that issued the instruction.
5. Seek further authority, such as a new or extended order, consent or instruction, before going any further.

Some material, such as suspected child sexual abuse material, may trigger immediate legal obligations; know in advance what your jurisdiction requires.

Data held abroad or in the cloud

Cloud data may sit in several countries, and the provider may be based in yet another. Three ideas help.

• Jurisdiction: a legal instrument issued in one country does not automatically reach a provider or data in another. Which law applies can depend on where the data is stored, where the provider is established and where the account holder lives.
• Mutual legal assistance: states ask each other for help with evidence through formal channels, often based on treaties, and requests can take months. The Council of Europe Convention on Cybercrime (the Budapest Convention, 2001) is one treaty that provides for such cooperation.
• Preservation requests: a provider can often be asked to preserve specific data quickly while the instrument for disclosure is obtained. Preservation keeps data; it does not give access to it.

Logging in to a cloud account with credentials found on a seized device is a new access to a remote system. Many legal systems require separate authority for it, so never assume it falls within a device examination.

A worked example: writing the scope

Mariana, compliance manager at a fictional logistics firm, Northline Freight, asks an external examiner to "check Tomas's computer, he leaked our tender to a rival". The examiner turns this into a written scope.

Both sides sign it. If the examination later points to Tomas's personal webmail, the examiner stops, records the finding and tells Northline that further authority is needed, which a company instruction alone may not provide.

Exam focus: Know the main sources of authority (court order or warrant, statutory power, consent, contractual or employment authority, client instruction) and that nobody can authorize more than their own rights. Tell device owner, user, account holder and service provider apart. Know the elements of a written scope (devices, accounts, data types, time window, search terms and questions), why exceeding it can make evidence unusable, and the steps when out-of-scope material appears: stop, document, preserve, report, seek further authority. Understand jurisdiction, mutual legal assistance and preservation requests.