In law, when presenting evidence to a court, there exists a rule on the exclusion of hearsay as evidence.
Before admitting evidence, a court will generally ensure that it is both the relevant to the case and also evaluate it to ensure that it satisfactorily fulfils what it is claimed to provide. A court needs to determine whether the evidence is hearsay and otherwise determine its admissibility.
“Evidence is hearsay where a statement in court repeats a statement made out of court in order to prove the truth of the content of the out-of-court statement.”[1] An example of hearsay evidence would apply where a suspect has sent an e-mail purporting to have committed a crime. Law enforcement officials would still need other evidence (such as a confession) to prove this fact.
The rules of Scientific Evidence apply to digital forensics. In the US, Daubert v. Merrell Dow Pharmaceuticals, [509 U.S. 579 (1993)] set the standard for evaluating scientific evidence. The test developed in this case consists of:
1. A determination whether the theory or technique is capable of or has been tested;
2. The existence and maintenance of standards controlling techniques of operation and whether these are likely to result in a high known or potential error rate;
3. As to whether the theory or technique has been rigorously subjected to peer review and publication; and
4. If the theory or technique is subject to “general acceptance” within the relevant scientific community.
For the most part (and even though error rates have not been established the most digital forensic tools) electronic evidence has been accepted by the courts scientific evidence. Currently, the most effective approach to validating the methodologies and approach used by an investigator remains peer review. For this reason, it remains good practice to have another investigator double check any findings using multiple tools or techniques to ensure the reliability and repeatability of the process.
But what is this for the future and why will we no longer have Hearsay?
We already have an Internet of things more than people. The number of automated devices and servers has exceeded the number of users on the Internet for a couple years now and with IP addressing issued to light bulbs and FMCGs in coming years, we could see 100 billion nodes online at any time.
These are devices that all interact and can be correlated. Recently, it has been shown that Skype can be used to correlate IP addressing from this service with Bo torrent P2P traffic.The future will be one where purchases are matched and items can be used to trace movements and more.
Think of it, you have purchased a can of Coke with an IP address based on an RFID tag. You pay using a Visa Smart wave chip card. The smart checkout links the IP of the can with the card ID. Later, the can is located at a bin outside a premises you stated you did not go to. All of this adds together to form an evidence trail.
The future of the courts is one of digital evidence.
An email were you stated that you did something may not be admissible, but the business and automated processes surrounding devices are admissible. These are not hearsay.
In an Internet of things, we have a world of automated processes — all of which are admissible. They remove the requirements for hearsay as they capture and record automatically.
In coming years, more and more of what we say and do will be recorded. There will hardly be a street corner without a camera, hardly a playground without a microphone. This will happening, it is already and the tide has swept in so far that there is no stopping it or even now time to build a barrier to gain time.
What we now do matters, for we can make this a world where these changes will work for the betterment of society or we can allow little brother to take the place of big.
[1] Hoey, 1996