16

Are internal server logs produced by a firm that has no standards compliance certification and does not conduct any third party audits admissible as evidence? If not, what certification is generally sufficient?

31

Whether evidence is admissible in court or not doesn't depend on whether it conforms to any standard, compliance, or certification.

Those factors may affect how strong the evidence is (i.e how convincing it is), but those factors don't determine whether the evidence may be used at all.

Different jurisdictions have different rules, but in most places, as long as the evidence is relevant to the case in trial, then it is admissible.

There are usually rules which may render evidence inadmissible, such as if it was obtained illegally, or if it would have such a prejudicial effect on proceedings that it would undermine the fairness of the trial.

If you are wondering if evidence is relevent or not, an easy way to determine so is asking yourself: does this evidence help a party's case? Does this evidence undermine a party's case? If yes to either question, then it is relevant.

  • 1
    My point is, if there is absolutely no third party involved and there is no guarantee that the logs are immutable, how does one ensure the logs are not fabricated/tampered with. – PulseJet Aug 17 at 13:17
  • 13
    @PulseJet somebody(s) testify that they haven’t been – Dale M Aug 17 at 13:21
  • 21
    Yeah. Usually in a civil case the witness will say something like "I am the chief engineer for this website, and we keep logs of activity, the logs are included as exhibit a/1 of my statement, the logs are truthful and represent what happened that day". And then the opposing lawyer will say "you said the logs are truthful, but they arent securely held, are they? Thats correct. They arent held to any standard or compliance, are they? Thats correct." The judge then concludes to himself, in private, whether he the logs were or were not reliable evidence of what happened. – Shazamo Morebucks Aug 17 at 13:36
  • 9
    @PulseJet Any kind of record can be fabricated or tampered with, but the courts generally find the routine records of a business convincing. To refute them you'd need a better argument than its possible for them to be faked. – Ross Ridge Aug 18 at 0:36
  • 7
    @RossRidge For example, if someone at the company holding the log files would have an interest in forging them, and the ability to forge them. If X holds the log files, and X is suing me or I am suing X, the judge would be much more distrusting than in a case between two parties that have no relationship to X or any relevant employee of X. – gnasher729 Aug 18 at 12:38
24

Documents are not evidence - testimony is evidence

Documents don’t just magically become “evidence” - somebody (or more than one somebody) gives evidence about them. That is, they give testimony about what they are, where they come from, how they were created and how they got from there to here - that’s evidence. Those people can be cross-examined to test the strength of their evidence. The trier of fact then decides what weight to give to the testimony if it conflicts with other testimony or is not self-consistent.

If a disinterested third-party testifies to the veracity of a document that would normally give the evidence more weight than if only a party to the case does.

  • 13
    To expand on this, the sysadmin responsible for the server would have to testify that these logs were indeed produced by the server, list anyone who might have had access to interfere with them, etc. The other side can then attempt to introduce doubt about their veracity by asking about security procedures, updates etc. – Paul Johnson Aug 17 at 14:11
  • 7
    And if someone tampered with the evidence, that could very easily much worse for them legally than losing the original court case. If your boss told you to modify a log file, and you were asked in court "Are these log files unmodified", well I would say "No, they are not unmodified, my boss told me to modify them and that's what I did". Few people would go to jail for their employer or their manager. – gnasher729 Aug 18 at 12:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.