On Tue, Dec 18, 2001 at 05:37:15PM -0800, todd glassey wrote: > > ----- Original Message ----- > From: "Tina Bird" <tbird@precision-guesswork.com> > To: "todd glassey" <todd.glasseyat_private> > Cc: "Bill Spernow" <bill.spernowat_private>; "'jamie rishaw'" > <jrishawat_private>; "'Log Analysis Mailing List'" > <loganalysisat_private> > Sent: Tuesday, December 18, 2001 3:29 PM > Subject: Re: [logs] Data for Court > > > > I'm not sure what you're quoting, Todd, and I'd love to > > know, but according to Kerr pg. 2, last complete paragraph > > at the bottom of the page: > > > > "However, the fact that a computer, rather than a human > > being, has created the record alters the evidentiary issues > > that the computer-generated records present. See, eg. 2 J. > > Strong, McCormick on Evidence 294, at 286 (4th ed. 1992). > > The evidentiary issue is no longer whether a human's out of > > court statement was truthful and accurate (a question of > > hearsay), but instead whether the computer program that > > generated the record was functioning properly (a question > > of authenticity). > > This is the key here - The concept of proving that the record was > functioning properly. My point is that the burden is shifting to a modality > wherein we will be called to prove that our systems are functioning properly > and that there will likely be BCP metrics for looking at what is and is not > considered "right". That's why establishing a 'baseline' of what is NORMAL is imperative. If you have old logs to show: This is how my system functions on a normal, ordinary day.. and here is my log data on the intrusion day.. which shows the normal stuff but it also shows this /new/ data.. I don't think there's much that can be debated, outside of accusations of blatant mischief/ forgery of logfiles, which, when presented as evidence, is comtempt, perjury, and who knows what else. -- jamie rishaw <jamieat_private> sr. wan/unix engineer/ninja // playboy enterprises inc. [opinions stated are mine, and are not necessarily those of the bunny] "UNIX was not designed to stop people from doing stupid things, because that would also stop them from doing clever things." -- Doug Gwyn --------------------------------------------------------------------- To unsubscribe, e-mail: loganalysis-unsubscribeat_private For additional commands, e-mail: loganalysis-helpat_private
This archive was generated by hypermail 2b30 : Wed Dec 19 2001 - 07:40:39 PST