Understanding the Conflict Between Computer Forensics and Legal Standards
This article explores the essential conflict between the principles of computer forensics and the requirements of legal standards. It defines "forensic" in a legal context and examines the implications for computer forensics due to the evolving nature of digital evidence. The discussion includes critical issues like the definition of "original" evidence, challenges posed by statistical arguments in court, the necessity of expert testimony, and the evolving standards for forensics training. It highlights how technological advancements complicate the pursuit of justice and the reliability of digital evidence in the courtroom.
Understanding the Conflict Between Computer Forensics and Legal Standards
E N D
Presentation Transcript
The Essential Conflict between “Computer” and “Forensics”Eur Ing Matthew W A Pemble CEngFBCS CITP FICAF MIET CISSP CFE CISM
What does “Forensic” mean • We understand “forensic” • (adv) Of, pertaining to, or used in a court of law, now /spec/. in relation to the detection of crime. or • (n) A speech or written thesis setting out one side of a question. US. • This could explain the abuse of “forensic” by American sales weasels. • Lawyers, judges and juries understand “forensic”
What about “Computer Forensics” We are: • Uglier than “Kay Scarpetta” • Thinner than “Cracker” • Have fewer guns than “CSI” • Better at stats than Dr Roy Meadows • Less likely to get ourselves sacked by writing a book than Prof Neil Barrett
“Why do I rob banks? Your honor, that’s where they keep the money.”
Issues with CF • Forensics is based on: • Analysis of the original • A (lawyers) understanding of the concept of “Best Evidence” (Springsteen case) • Expert evidence • “First Principles” science • Computers are based on: • Indistinguishably (relevantly) accurate copies everywhere • Permissions not people • Technicians not experts • Your bit of the technosphere
What is the “original” • I conduct a financial transaction from my laptop • Internet site; Websphere / Oracle; Z/OS Mainframe • Intranet site; 3270 emulation; Z/OS Mainframe • Where is the original? • RAM copy (long gone) • Virtual memory copy (probably overwritten) • Z/OS Backoffice (ever image a mainframe?) • What / which is a reasonable copy? • Hearsay exemption for business records • Challenge in days of trivial (undetectable) alteration?
Evidence & Statistics • Physical Evidence • Secure custody • Chain of evidence • Tamper-evident storage • Sign-in / sign-out • Original disks • Digital Evidence • Extract & hash • Sign (secure datestamp?) hash • Minimal subsequent requirement for security
Courts and Statistics • DNA Testing • Not permitted to adduce statistical arguments into court. • Roy Meadows • Correctly adduced statistical improbability of deaths not being linked • Incorrectly assumed only link could be murder • Current issues with hash algorithms • Encase still uses MD-5 • Could you argue stats in court regarding SHA-1?
Computer Action / Human Intent • This action was recorded on that computer • Did <any / a specific> human deliberately cause that action? • Prove “mens rea” • Specific intent is generally necessary for criminal conduct. • “somebody must have known my password” ! • Regina versus Snober (and others)
Forensics Training • Traditionally police & defense “expert witnesses” • Experience and closed (law enforcement) training • Vendor training • Irrelevant professional qualifications • Where now? • Public failures – Soham / Kelt • More aware lawyers & judges • Beginning academic discipline (Strathclyde et al) • National Occupational Standards • “Technically Competent Witness” – NVQ L3 or L4
“It is dangerous to assume malice in cases where incompetence is a valid explanation.”
