Digital Evidence in the 21st Century?

Digital Evidence in the 21st Century?

In many respects our legal infrastructure has changed little in the past centuries. While it has adopted email, electronic documents and digital evidence, it still generally struggles to move away from the good old traditional methods of lock and key, physical security and wet signatures. While digital forensics has come along as a new area, it is still seen as a bit like black magic, and where it often relies on a single expert witness to make sense of the 1’s and 0’s. But, increasingly, we need to digitize evidence, and then use electronic methods to share and analyse it, and so we must now build new platforms gather, process and share evidence, but still keep extremely high levels of trust.

Our governments often like to believe that they have transformed their economies to exist in the 21st Century, but only in places like Estonia and Finland do you see a true transformation in the way that the public sector uses digital methods. Having worked in health care research for many years, I know the resistance that you can face in properly digitizing things, especially when it involves integrating properly with citizens. I have lost count in the number of conferences I have attended that define information sharing across the public sector is the major barrier to improved services. At the core is a resistance to change, and a lack of any real vision as to what the data architecture will be.

And so I must smile a little when I see that there is a new £20 million project in Scotland which will create a shared portal for digital evidence in Scotland. My nightmare situation is that this just becomes a large-scale SharePoint integration, and where there is little in the way of creating something that it both trustworthy, and properly protects the rights of those involved. Could it just be the same old ways of handling digital evidence, but done with electronic access rather than with a USB drive?

I hope there is an open and public debate about the system, and where experts can review its design and operation, and properly build for the future. Fundamentally, as a base line, I would expect:

• A strong audit trail. This is one of the most fundamental things and where the evidence need to be traced and where every access is logged along with information around times of access, locations, and so on.
• Strong encryption. This must be fundamental in the system, and where every piece of evidence has its own encryption key, and where the encryption keys are properly managed for their accesses.
• Strong governance around access control. A strong policy-driven approach is required for the access to digital evidence, including using attributed-based policies (and not just roles). For example an evidence bag might has the policy that it can only be viewed by the client of the defence (a role), within a define police station, and only for a time locked period.
• Multi-factor authentication to be used. This would especially integrate biometric methods, and where out-of-band methods were used for the access requests. Google, for example, now use an authenticator on a smart phone, and where they send a request to the phone in order to agree to the login or not.
• Publicly verifiable hashed signatures. In order to increase trust levels, a publicly available signed hash should be placed on a ledger, in order that the hash can be proven in the future.
• Digital signing on everything. A fundamental part of this system must be the move towards digital signatures, and where each entity has its own public and private key, and where everything has a signature.
• Proper ways to archive the original data. In most cases, the access to the original sources of data would not be required — such as for CCTV video, or photographs — and this type of data could be protected and marked with meta tags. Evidence bags can then be created which have these meta tags and exported data, while the original data source can be secured within a highly trusted environment. Access to the original data will require high levels of access control.
• A proper meta data marking system. This meta data will be used for exporting key attributes of the evidence, such as “Image: Blood stain on carpet”.
• Proper tools for analysis. As much as possible, the downloading of digital evidence should be avoided, but there must be ways of those investigating having the tools to probe the evidence. Thus a strong usage of meta data and within a requesting system should be used, in order to protect the data, while allowing it to be used for an investigation.
• Citizen rights. While it can seem difficult, citizens do have rights to view some of the data that might relate to them. A modern system must thus thing about given rights to those outside the normal circle of trust, but still keep the system secure.
• A strong trust infrastructure. The management of public keys are important in this infrastructure, and where each entity involved has a private key that they sign with. The public key is then stored in a trustworthy form, so that other can check. Hyperledger Indy would provide a way to provide this, and where entities put their public key on the ledger, and then sign with their private key. Everyone involved can then check the signers.

So here is a start point of an overall design:

In this case a permissioned blockchain is used only to store the public keys of those involved in the ecosystem, and for signed hashed for the artifacts and for accesses. Trent is thus responsible for storing the original evidence artifacts, the management of encryption keys, and for access control policies. When a new case is created, Trent will define the roles involved in the case with their digital identifier, and the links and the meta data for the case. A hash — signed by Trent — will then be applied onto the permissioned blockchain for other to check the evidence bag, and that the hashes for the artifacts.

In this case, Bob, Alice and Carol are involved in the case, and only they will be able to access the evidence bag. Every access they have to it, and will be recorded on a case log with a signed hash. Access to review the original data will then be handled through Trent, and logged. Every evidence bag will have its own encryption key, and this key is likely to change as it moves through the process. Trent will then be responsible for managing these keys. An access control policy is then used for accesses to the evidence bag, and where roles (solicitor, judge, auditor, citizen, etc) and attributes (time limits, locations, etc) are defined for each bag.

Conclusions

The tiny amount invested in this — £20 million — might help a bit, but, I fear, it could end up just being a locked-down SharePoint site, where few people get the chance to review. As long as wet signatures still exist as a legal entity, I will have little in the way that belief that our legal systems are properly moving into a digital — and more trustworthy — world. I would love to see this project opened-up as a challenge to innovative companies, and where we used the latest methods, and innovated at every step, but I fear it will be another opportunity missed.