evidence hacking
How is authenticity of a given evidence determined?
<p>I was reading <a href="https://security.stackexchange.com/q/13374/71966">this</a> question on security SE. The title of the question is: "What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?"</p>

<p>This <a href="https://security.stackexchange.com/a/13383/71966">answer</a> suggests to "log everything you do just in case something bad happens and you need to prove it wasn't you, or wasn't deliberate!"</p>

<p>I thought "How would that even help? How hard can it be to forge a log file? Or better yet, how hard can it be to log only the "legal" actions you do and exclude the illegal ones, and present this log file as evidence?"</p>

<p>Similarly <a href="https://security.stackexchange.com/q/11025/71966">this</a> question. In the question, OP states that his boss asks him to forge a log file in order to win a dispute. The answers clearly suggests not to do it. They also suggest to get the requested action written <em>and</em> to make sure a copy of this document is available outside the work (just in case the boss tries to destroy the evidence in case of a legal action).</p>

<p>Again, assume that this incident is indeed carried to court and boss claims he did not request such thing. The employee claims the boss requested such thing and presents his copy of the written request as an evidence. The boss claims that this was forged by the employee. What is going to happen? Who is the judge going to believe?</p>

<p>Or yet a simpler example. Say Party 1 has some witnesses. Party 2 claims what these witnesses say is not correct and presents some kind of counter evidence. What is going to happen?</p>

<p>In the end, what determines which party the judge is going to believe?</p>

<p>In law there are two different concepts: admissibility of evidence and the weight of that evidence.
Your question concerns both. I will begin by discussing a little bit about what both these two terms mean.</p>

<p>Admissibility means that this evidence may go before the trier of fact. Typically the trier of fact is the jury, however, if both parties have waived their rights to jury trials (particularly the defendant) the judge is the trier of fact as well as the law. When documents or testimony by witnesses is admissible, the trier of fact can consider it in reaching a decision.</p>

<p>Weight of evidence is a different concept. The weight of evidence is what someone believes. For example if two witnesses who were bystanders testify that the light was red, but the defendant testifies that the light was green, most people would believe the bystanders. However, in this case the evidence by the defendant that the light was green is admissible, but the trier of fact may not afford it much weight.</p>

<p>Now let's consider these logs. In the United States all statements made out of court, whether verbal or written, are considered hearsay (with some exceptions, a couple will be discussed later). Hearsay is generally inadmissible; however, there are many hearsay exceptions.</p>

<p>One exception is a record of a regularly conducted activity. The requirements are (summarized, you may refer to the federal rules of evidence 803-6.) for the full text):
(A) the record was made at the time of the event by someone who knew about what happened
(B) the record was kept in the course of this regularly conducted activity
(C) making the record was a regular practice of that activity
(D) all these conditions are shown by the testimony of the custodian or another qualified witness
(E) neither the opponent does not show that the source of information nor or the method or circumstances of preparation indicate a lack of trustworthiness.</p>

<p>Now if these logs fit these requirements you can most likely use them in court. If they don't you probably will not be able to use to in court, unless one of the following applies:
1.) you are being sued by someone (or you are suing them) who made the logs and you are offering the logs against them (this is referred to in legal settings as party-opponent statements) OR
2.) the other party has offered evidence that you are lying and you are offering this logs to show you are telling the truth.</p>

<p>Most likely the only admissible evidence would be the testimony of the employee and the employer. This leads to a he said she said scenario and the legal results will be highly ambiguous. The credibility of both witnesses will be likely assessed by the trier of fact and the trier will consider who has a higher incentive to lie. If there are more witnesses saying one thing versus another, it is likely they will be believed unless there is a reason all of them are lying.</p>

<p>Although this is not legal advice, my suggestion for an employee in such a situation is to gather evidence that an employer asked you to commit a crime as part of your job. Print out emails, get written requests from the employer, and have witnesses present at the time of the request. Then the employee should refuse to perform the act. If as a result the employee is fired, one can sue. All these statements of the employer can be admitted as party-opponent statements. </p>

<p>Additionally I suggest that you advocate for your company to adopt policies which require record keeping, which will satisfy the hearsay exception given above.</p>

<p>How hard is it to commit a crime? </p>

<p>That is not the question - the question is what are the consequences. The first consequence is that instead of thinking of yourself as a decent person, and being proud of being yourself, you will forever be thinking of yourself as a cowardly criminal. For many people, that's enough reason. The second consequence is that there is a huge risk. If you have a decent job then the financial consequences of being caught committing a crime would be absolutely disastrous. </p>

<p>In your case with the forged evidence, it's not just he said / she said. A judge or jury would think about how much reason each person would have to lie. The employer may have huge financial gains from forging some evidence. The employee has nothing to gain from falsely telling the court that the evidence is forged, quite the opposite. And then of course there is the other side of the court case. Say I was supposed to pay a bill on the 1st of March. I say I paid on time. The boss says "here is the log file showing you paid on the 20th of April". The employee says "that evidence is forged". That's two people saying the evidence is false, and one saying it is correct. </p>
