Surveillance Video Stored on a Personal Phone and Shared Through Cloud Accounts
Investigator Vega is hired by an insurer to surveil a claimant who alleges a disabling back injury. On Day 1, Vega records 47 minutes of video on his personal smartphone showing the claimant loading 40-pound bags into a truck. He transfers the clips to his personal laptop, trims the first 12 seconds because his own reflection appears, renames the file 'claimant_final,' and texts a 20-second clip to the claims adjuster. On Day 3, he records 22 minutes, but his phone battery dies and he loses 8 minutes. He stores everything in a folder on his personal cloud account shared with his spouse. Six months later, the insurer's attorney asks for the original files and a chain-of-custody log before a hearing. Vega has no log, no hash values, and cannot locate the original Day 1 file because he deleted it after sending the clip.
1. Identify the evidence-handling problems in Vega's conduct and explain how each problem could affect the insurer's case.
Read the worked answer
The problems go to authenticity, completeness, and confidentiality. Recording on a personal phone mixes business evidence with personal data and makes access control difficult. Transferring files to a personal laptop and a cloud account shared with a spouse creates a confidentiality breach and weakens the claim that only authorized personnel handled the evidence. Trimming the first 12 seconds and renaming the file create an altered copy; opposing counsel can argue the clip was edited to remove favorable context. Sending a compressed 20-second clip by text degrades quality and strips useful metadata. Deleting the original Day 1 file after sending the clip is spoliation: the best evidence is gone, and the insurer may face an adverse inference or sanctions. Losing 8 minutes on Day 3 without documenting the cause creates an unexplained gap. No chain-of-custody log or hash values means Vega cannot prove the files are what he says they are, when they were captured, or who had access. The insurer may still use the remaining clips, but it should expect a challenge and should not overstate the video's completeness.
2. Describe a defensible chain-of-custody and evidence-preservation procedure Vega should have followed from Day 1.
Read the worked answer
Vega should have used a firm-issued, encrypted device dedicated to case work, with access controls and remote-wipe capability. At capture, he should record the date, time, location, device identifier, investigator name, and case number. Immediately after capture, he should preserve the original file in a read-only evidence folder and create a working copy for review. He should compute a cryptographic hash, such as SHA-256, for each original file and record the hash in a chain-of-custody log. Every transfer, viewing, copy, redaction, or export should be logged with who did it, when, from what device, to what destination, and why. Redactions should be made only on a copy, with the unredacted original retained and the redaction documented. The evidence should be stored in a firm-controlled encrypted system with role-based access, not a personal cloud account shared with family. A legal hold should prevent deletion when litigation is reasonably anticipated. If a device fails or footage is lost, Vega should document the failure immediately, preserve the device, and notify counsel rather than trying to recreate the file.
3. The insurer's attorney now asks for the originals and a chain-of-custody log. How should Vega respond, and what should he not do?
Read the worked answer
Vega should respond promptly and honestly. He should tell the attorney which files exist, which original was deleted, when it was deleted, what copies remain, and why the Day 3 gap occurred. He should produce the surviving files in native format with available metadata, not just the edited or texted clips. He should prepare a sworn declaration or affidavit describing his capture methods, the deletion, the trimming, the text transmission, and the storage on the personal cloud account. He should identify the devices and accounts involved and preserve them for examination. If the original cannot be recovered, he should not pretend the edited clip is the original or create a replacement log from memory and present it as contemporaneous.
He should not delete anything further, reformat the phone, clean up the cloud account, or ask his spouse to delete copies. He should not alter metadata or create a backdated chain-of-custody form. He should notify his firm's counsel and the insurer immediately so they can assess disclosure obligations and potential spoliation sanctions. The insurer may need to retain a forensic examiner to recover or verify what remains, and the attorney should decide how to present the authentication testimony.