Re: [logs] Data for Court

From: Tina Bird (tbird@precision-guesswork.com)
Date: Tue Dec 18 2001 - 16:29:47 PST

  • Next message: ALMEIDA Antonio Jose: "[logs] RE: [[logs] Backup]"

    Ah ha!  I think we've just reached convergence.  Yes,
    I think that the burden of proof will shift towards whichever
    party in a given case wants to use the computer records,
    to validate that the system is functioning properly.
    And I think we-the-mailing-list are a good group of people
    to develop those baselines and metrics.
    
    
    I suspect we've got longer than 6 to 9 months before the
    case law will change substantially, but that's a good a 
    time frame as any...
    
    On Tue, 18 Dec 2001, todd glassey wrote:
    
    > 
    > ----- Original Message -----
    > From: "Tina Bird" <tbird@precision-guesswork.com>
    > To: "todd glassey" <todd.glasseyat_private>
    > Cc: "Bill Spernow" <bill.spernowat_private>; "'jamie rishaw'"
    > <jrishawat_private>; "'Log Analysis Mailing List'"
    > <loganalysisat_private>
    > Sent: Tuesday, December 18, 2001 3:29 PM
    > Subject: Re: [logs] Data for Court
    > 
    > 
    > > I'm not sure what you're quoting, Todd, and I'd love to
    > > know, but according to Kerr pg. 2, last complete paragraph
    > > at the bottom of the page:
    > >
    > > "However, the fact that a computer, rather than a human
    > > being, has created the record alters the evidentiary issues
    > > that the computer-generated records present.  See, eg. 2 J.
    > > Strong, McCormick on Evidence 294, at 286 (4th ed. 1992).
    > > The evidentiary issue is no longer whether a human's out of
    > > court statement was truthful and accurate (a question of
    > > hearsay), but instead whether the computer program that
    > > generated the record was functioning properly (a question
    > > of authenticity).
    > 
    > This is the key here - The concept of proving that the record was
    > functioning properly.  My point is that the burden is shifting to a modality
    > wherein we will be called to prove that our systems are functioning properly
    > and that there will likely be BCP metrics for looking at what is and is not
    > considered "right".
    > 
    > >
    > > --> followed by more legal citations
    > >
    > > So in most cases, if we're talking about purely machine-
    > > generated logs, where there's no evidence of tampering,
    > > the data is >not< considered hearsay and can be admitted
    > > as evidence into court.
    > >
    > > It is also worth pointing out, as a reader did off-line
    > > this morning, that paper, chemical tests, and all sorts
    > > of other forensic results can also be tampered with,
    > > and have their reliability questioned.  So I remain
    > > unclear on whether or not computer logs are intrinsicly
    > > any more unreliable than other types of forensic data.
    > 
    > No I see your point - mine is that like PKI this is a moving target and I am
    > predicting where it will be in 6 to 9 months and then beyond that. The
    > issues are of establishing a set of metrics for addmisibility for digitally
    > generated testimony.
    > 
    > >
    > > Yours in multiple negatives -- tbird
    > >
    > > On Tue, 18 Dec 2001, todd glassey wrote:
    > >
    > > > ThunderGal - Tina
    > > >
    > > > ----- Original Message -----
    > > > From: "Tina Bird" <tbird@precision-guesswork.com>
    > > > To: "Bill Spernow" <bill.spernowat_private>
    > > > Cc: "'jamie rishaw'" <jrishawat_private>; "'Log Analysis Mailing
    > List'"
    > > > <loganalysisat_private>
    > > > Sent: Monday, December 17, 2001 8:32 AM
    > > > Subject: RE: [logs] Data for Court
    > > >
    > > >
    > > > > Logs do >not< fall under the hearsay exception unless they
    > > > > contain data manually entered by a human.  According to the
    > > > > Justice Department report I quoted, hearsay is specifically
    > > > > designed as information provided by a person, not information
    > > > > automatically generated by a machine -- so different rules
    > > > > apply.
    > > >
    > > > "Hear-say is any evidence that cannot be directly substantiated by first
    > > > hand testimony."  I.e. evidence that one "potentially not credible
    > source"
    > > > would enter into the record. Up until now it has been tradtionally human
    > > > generated or rendered but...
    > > >
    > > > As to why Computer Testimony is Hear-Say - Computers have exactly this
    > same
    > > > problem especially with Ethernet interconnects. The problem is that the
    > > > Courts do not know how to audit these systems and becuase of that are
    > making
    > > > all sorts of funny decisions at the lower offices of the court that are
    > > > being refuted at appeal.
    > > >
    > >
    > >
    > > ---------------------------------------------------------------------
    > > To unsubscribe, e-mail: loganalysis-unsubscribeat_private
    > > For additional commands, e-mail: loganalysis-helpat_private
    > >
    > 
    > 
    > ---------------------------------------------------------------------
    > To unsubscribe, e-mail: loganalysis-unsubscribeat_private
    > For additional commands, e-mail: loganalysis-helpat_private
    > 
    
    
    ---------------------------------------------------------------------
    To unsubscribe, e-mail: loganalysis-unsubscribeat_private
    For additional commands, e-mail: loganalysis-helpat_private
    



    This archive was generated by hypermail 2b30 : Tue Dec 18 2001 - 17:44:51 PST