Are internal server logs produced by a firm that has no standards compliance certification and does not conduct any third party audits admissible as evidence? If not, what certification is generally sufficient?
1
-
7Country, please? In the US, see the Department of Justice's Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations. In particular, see the sections Devising a Search Strategy on page 61 and The Best Evidence on page 205.– jwwCommented Aug 18, 2019 at 1:57
Add a comment
|
2 Answers
Whether evidence is admissible in court or not doesn't depend on whether it conforms to any standard, compliance, or certification.
Those factors may affect how strong the evidence is (i.e how convincing it is), but those factors don't determine whether the evidence may be used at all.
Different jurisdictions have different rules, but in most places, as long as the evidence is relevant to the case in trial, then it is admissible.
There are usually rules which may render evidence inadmissible, such as if it was obtained illegally, or if it would have such a prejudicial effect on proceedings that it would undermine the fairness of the trial.
If you are wondering if evidence is relevent or not, an easy way to determine so is asking yourself: does this evidence help a party's case? Does this evidence undermine a party's case? If yes to either question, then it is relevant.
answered Aug 17, 2019 at 12:00
-
1My point is, if there is absolutely no third party involved and there is no guarantee that the logs are immutable, how does one ensure the logs are not fabricated/tampered with.– pulsejetCommented Aug 17, 2019 at 13:17
-
13
-
22Yeah. Usually in a civil case the witness will say something like "I am the chief engineer for this website, and we keep logs of activity, the logs are included as exhibit a/1 of my statement, the logs are truthful and represent what happened that day". And then the opposing lawyer will say "you said the logs are truthful, but they arent securely held, are they? Thats correct. They arent held to any standard or compliance, are they? Thats correct." The judge then concludes to himself, in private, whether he the logs were or were not reliable evidence of what happened. Commented Aug 17, 2019 at 13:36
-
10@PulseJet Any kind of record can be fabricated or tampered with, but the courts generally find the routine records of a business convincing. To refute them you'd need a better argument than its possible for them to be faked. Commented Aug 18, 2019 at 0:36
-
7@RossRidge For example, if someone at the company holding the log files would have an interest in forging them, and the ability to forge them. If X holds the log files, and X is suing me or I am suing X, the judge would be much more distrusting than in a case between two parties that have no relationship to X or any relevant employee of X. Commented Aug 18, 2019 at 12:38
Documents are not evidence - testimony is evidence
Documents don’t just magically become “evidence” - somebody (or more than one somebody) gives evidence about them. That is, they give testimony about what they are, where they come from, how they were created and how they got from there to here - that’s evidence. Those people can be cross-examined to test the strength of their evidence. The trier of fact then decides what weight to give to the testimony if it conflicts with other testimony or is not self-consistent.
If a disinterested third-party testifies to the veracity of a document that would normally give the evidence more weight than if only a party to the case does.
-
13To expand on this, the sysadmin responsible for the server would have to testify that these logs were indeed produced by the server, list anyone who might have had access to interfere with them, etc. The other side can then attempt to introduce doubt about their veracity by asking about security procedures, updates etc. Commented Aug 17, 2019 at 14:11
-
7And if someone tampered with the evidence, that could very easily much worse for them legally than losing the original court case. If your boss told you to modify a log file, and you were asked in court "Are these log files unmodified", well I would say "No, they are not unmodified, my boss told me to modify them and that's what I did". Few people would go to jail for their employer or their manager. Commented Aug 18, 2019 at 12:41