…has become a problem of epic proportions. Fabricated (phony) digital evidence is a product of digital surveillance and digital forensics. Digital surveillance and forensics are both performed on people who use digital electronic devices = a significant portion of the modern world.
There have been many examples of digital surveillance and forensics in recent years. Here are some gems from 2016:
1) Yahoo admitted that its own security teams had knowledge in 2014 that malware (harmful software) was installed in Yahoo’s systems. The malware was designed to facilitate government intrusion into their systems.
2) It was revealed that AT&T keeps records of ALL communications through its systems, including contents of ALL phone calls, text messages, emails, Skype(tm) video chats, and more — then sells the contents to police departments and law enforcement. AT&T has been keeping the records for decades. AT&T sells their information to law enforcement having cost taxpayers $10’s of USD-millions$ over the years.
2a) AT&T forces law enforcement to sign an NDA so that the source of the evidence is never revealed to U.S. Courts. In other words, it’s public knowledge that law enforcement fabricates the source(s) of evidence provided by AT&T.
3) Edward Snowden remains exiled in Russia.
4) Russia meddled with U.S. Elections by hacking into a variety of U.S.-based systems.
5) The FBI made headlines in summer of 2016 by claiming that it needed Apple to provide access to an iPhone that allegedly belonged to a domestic terrorist. The FBI wanted access for forensic purposes.
There are many other examples in recent years. In every case there is a U.S. Court with an honorable judge that somehow sees this information, one way or another. Never mind that most U.S. Judges barely know how to use the interwebs to access their email…some don’t use the interwebs at all…and most can barely setup a WiFi network at home.
The silliest part of all this digital evidence and surveillance is that it’s so easy to fabricate digital evidence. I mean…it’s so easy…
It’s ridiculously easy to fabricate digital evidence on any given digital electronic device because every single device is chocked-full of security flaws. In some cases the flaws are the actual things providing or collecting evidence (via surveillance or forensics).
To make matters worse, most digital electronic systems are not designed to keep an audit trail. In other words, the systems perform actions which are never recorded (internally and externally). In fact, not all of the actions can be recorded, but even when they are recorded it’s practically infeasible to keep audit trails of everything due to storage space requirements. It’s also difficult to verify if an audit trail is complete. For example, there are no automated tests that cover real-world usage of a public-facing web server to verify if an audit trail exposes all possible attack vectors. In other words, it’s practically impossible to test if an audit trail works.
It’s not just impossible to test the effectiveness of auditing (logging), it’s also impossible to perform some logging. A modern computer not only contains multiple CPUs (processing brains), but hundreds or thousands of smaller MCUs (smaller brains) that have their own dedicated purposes. These tiny parts send messages to each other that are never recorded, and in fact can’t be recorded.
In other words, much of the activity a computer performs to transfer 8-bits (1 byte) of data across its subsystems cannot be audited. To use an analogy, most digital surveillance and forensics are often performed by flaws in digital electronic devices, such as computers and smartphones, by leveraging the inability of those systems to know their hand from their foot. In other words they tap into systems that were not designed to be accessible, and internally the system has no way of knowing that it’s compromised. For example, the FBI did not require Apple to provide access to an iPhone in summer of 2016 to obtain aforementioned forensic evidence.
What seems to lost on everybody in America from journalist to judge is as follows: any so-called evidence obtained from a digital device can be easily fabricated and there is no way to determine the veracity of the evidence.
That’s right! It turns out every single system used to collect that evidence can be compromised and there’s no way to know.
To make matters worse, it’s possible to hack into any given digital system, fabricate evidence, and then remove any trace of the hack. Practically any digital electronic system or sub-system can be compromised and there is almost always an attack vector that allows the attacker to go undetected. Again…digital audit trails are almost always incomplete and impossible in some cases. Moreover, some of the latest attack vectors being revealed publicly use emissions of radiation to remotely hack into systems with no physical connection to the device(s).
Therefore, since it is impossible for practical intents and purposes to prove that any given piece of digital evidence is not fabricated, I think it should all be suppressed in U.S. Courts, and the Court of Public Opinion. I think it’s a complete pile of bullshit. It’s so easy to fabricate evidence on somebody’s phone, somebody’s phone logs, somebody’s email…and it turns out nefarious actors and legitimate law enforcement have secret and potentially illegal access to all of it.
All digital evidence is fabricated bullshit until proven otherwise. It will never be proven otherwise because modern electronic systems are unavoidably chocked full of flaws, errors, and bugs! They are designed to be full of errors and built with tools that are themselves full of errors.
It would take something like true quantum computing to change this state of affairs. Not only that, but it will take something like mass-production of true quantum computers to change this state of affairs. Furthermore, if the security claims behind quantum computing materialize then what will agencies and actors like AT&T, the FBI, and other law enforcement do when there are no security flaws to exploit?
Light as a Feather 