Hypothetical situation.

Several years ago, Reddit co-founder Steve Huffman caused some controversy by editing comments that criticized him. On most social media platforms, staff cannot edit users' messages without direct access to the database.

However, this is often not the case for certain forum software, such as phpBB and vBulletin. In some cases, the forum does not even indicate that a moderator has edited a message. So if a moderator changes my post to say something illegal, then how could I prove in court that my post was tampered with?

Let's say I go on a forum and say I wish to meet the president of the United States. Suppose a mod decides to pull a "prank" and edits the message to say I want to murder the president of the United States, and I end up getting a visit from the Secret Service. To complicate matters, the forum requires registration to view and is not accessible to the Wayback Machine or Google caches. In this case, how could I prove I didn't threaten the POTUS?

  • 30
    How can they prove it was you who posted the offending content? Commented Jun 18, 2023 at 19:04
  • 2
    @GeorgeWhite That is the main issue. My understanding is that even archive.org only has "hearsay" status when it comes to strict interpretation of the law, so unequivocal proof would probably rely on covertly installing a keylogger and persuading the offender to repeat the threat... at which point the defence could argue entrapment. Commented Jun 20, 2023 at 10:08
  • 2
    They cannot prove you did it if you didn't do it.
    – user207421
    Commented Jun 20, 2023 at 10:13
  • 1
    Stack Exchange comments are editable, without notification, by moderators. It'll have the same "edited" logo, but also same message (won't say a mod did it). Something that's too casually accepted, for me. Commented Jun 21, 2023 at 2:47
  • 1
    And it just hit the news on reddit that reddit comments are being edited directly in the DB again.
    – Joshua
    Commented Jun 21, 2023 at 16:05

5 Answers 5


You do not have to. The burden of proof is on the prosecution to prove that you made the threat. Reasonable doubt exists in the circumstances that you describe, that there are no logs of who accessed what when and how. Your attorney may have to introduce expert witnesses who can explain how it is possible that text from your computer can end up on a web page, and they can testify that there are many ways that data can be entered into the database, only a few of which actually involve you.

  • 22
    The problem is that the operators of the forum can easily show a log which will incriminate you, they can show the police, look, at this time you posted from this IP address, and they can check with the ISP which will truthfully say that you used that IP address at that time to access that site. The only issue is the operators of the forum altering your text later, but not having any logs for it (as they own the system, they can erase their own logs without any trace, or maybe they didn't even log their editing).
    – vsz
    Commented Jun 19, 2023 at 5:50
  • 10
    @vsz Your attorney could probably make that issue a very important one. I'm not sure exactly how it would go (I'm not a lawyer), but I imagine it would involve trying to get the prosecution to defend the security of their infrastructure and provide evidence of who exactly could have accessed the database and whether that access would have been logged.
    – David Z
    Commented Jun 19, 2023 at 6:29
  • 5
    It bears mentioning that your ISP--a separate entity from the people who run the message board--should also have logs of your on-line activity. The prosecution will have to show not only that you posted the messages, but posted them at a specific time. If your ISP's logs show that you weren't active at that time, the case fails.
    – EvilSnack
    Commented Jun 19, 2023 at 12:18
  • 22
    @EvilSnack I don't think ISPs typically log this level of detail. Even if they did log that you're connecting to the server, the data would normally be encrypted so they can't tell what you wrote.
    – Barmar
    Commented Jun 19, 2023 at 14:32
  • 15
    Although this answer is legally correct, it's a long road between saying "I didn't do it" and "Somebody else did it" when nearly everything in the chain of events is falsified to point at you. The OP's question is harder to answer than saying "The burden of proof is on the prosecution." You need Perry Mason.
    – Wastrel
    Commented Jun 19, 2023 at 15:55

You're describing an attempt to incriminate you for a crime you didn't commit. This isn't unique to the Internet.

While in most countries with rule of law the prosecution needs to prove your guilt to a very high degree of certainty (e.g. "beyond a reasonable doubt" in the US), this does not mean absolute certainty. The fact that you can come up with a speculative alternative explanation of what happened is not necessarily enough to introduce reasonable doubt.

So just like in most criminal cases, a decision will be made on the specific facts of your hypothetical case. If you're talking about a major social network, the prosecution's case will be stronger than if you're talking about some guy's hobby project. If the prosecution shows that you have a history of crimes similar to the one you are framed for, that will make their case stronger as well. However, if you can show that someone with write access to your comments has a motive for framing you, that would be deadly to their case, as that shows a likely and coherent alternative explanation for the facts.

In the extreme case, though, where you're talking about a major social network and one of the database employees just decides one day to single you out for no reason and make you look like a lunatic that wants to kill the president (and he properly hides his tracks so the social network later insists you were the author), you're probably out of luck unless you can provide at least some proof. That hypothetical scenario is so far-fetched that in case it ever were to happen, no judge or jury would probably consider this a plausible alternative explanation without evidence.

  • 6
    I'm assuming hell would break loose if there was proof that employees of some major social network in fact did manipulate content in such a way.
    – PMF
    Commented Jun 19, 2023 at 9:41
  • >"In the extreme case, though, where you're talking about a major social network and one of the database employees just decides one day to single you out for no reason" At larger, more mature companies I imagine this would be quite difficult. There will be multiple loosely coupled systems like login, fraud detection, ad/engagement tracking, and data storage that would all have corroborative information on top of likely containing additional metadata about the device creating the post (IP address, User Agent, geo location, ad tracking data)
    – nijave
    Commented Jun 20, 2023 at 21:14
  • 2
    Note that while the burden of proof is "beyond reasonable doubt" for a criminal trial, it is only "preponderance of the evidence" in a civil suit. This can lead to the paradox outcome that one is (criminally) acquitted and (civilly) convicted for the same allegation, like OJ Simpson in 1995/1996. In my book a forum post without evidence of tampering would be preponderance of evidence. Commented Jun 21, 2023 at 18:01

While the situation you describe is very difficult for your hero, the company would have to have a hell of a reason to target your hero. Because, they only get to do that trick 2-3 times ever.

"The first time is happenstance. The second time is coincidence. The third time is enemy action." Military proverb.

The first person who claims this was done, straight faced, in open court, is an obvious liar. The second who claims it is a coincidence of liars. But the third is starting to get traction. Now the judge will be more tolerant of some exploration of this topic. People get subpoenaed, the logging system gets discussed, "how this could be done" becomes a topic of discussion. Third parties start snapshotting content from the site so alterations can be detected. The fourth time it happens, the company is caught red-handed, socially canceled, sued to oblivion, and some people go to jail for perjury and obstruction of justice in case #3.

So for this social media company to use one of its 1-2 "free shots" would require a truly extraordinary loathing from company management.

And here's the problem with that. That loathing wouldn't arise from nothing. It's gonna leave a documentation trail across social media or elsewhere in the world. It may be common knowledge among acquaintances that they had an acrimonious feud. There may be a restraining order or police records. So even defendant #1 would be able to show this to introduce doubt.

And similarly, as we certainly do know, a person doesn't get out of bed one day and decide to kill the president. Read "The Gift of Fear" by Gavin DeBecker. If they're active on social media, there'll be years of increasingly radicalized blah-blah. A conspicuous absence of such a profile makes it very much more likely to be a Joe Job by a third party.

The jury will figure that out, and so will the authorities. So their "one shot" probably wouldn't even work.

  • Also, a big company would have the system prepared for persistence .Things like daily (or hourly) backups, transaction logs... which -if carefully checked- are likely to keep traces of the message having been edited. Removing all traces would be much harder than just editing the message in the database (and even just editing the text might be complicated depending on their architecture, replication on multiple datacenters, etc.)
    – Ángel
    Commented Jun 20, 2023 at 18:28
  • Also, that kind of fraud would have a very short suspect list, as there's presumably only a relatively small number of people within the company who would have the necessary access to make such clandestine changes (or even if it's a larger company with lots of moderators, @Ángel 's comment applies, and it's still a very small list of people who could realistically do so without leaving a digital trail.) A bit harder would be if it was not an inside-job and the company was hacked by a 3rd party... Commented Jun 20, 2023 at 20:20
  • 3
    It's not absolutely the same, but en.wikipedia.org/wiki/British_Post_Office_scandal suggests that you can do this successfully for quite some time (although not indefinitely)
    – DavidW
    Commented Jun 21, 2023 at 9:07
  • 3
    I literally can't tell if this is serious or trolling. Your argument is that this can't possibly happen because the justice system is perfect and a jury would catch on? Seriously? Also, you are arguing that the company would get in trouble for this, when the question already points to the fact that one of the largest websites in the world already did this, and literally nothing happened.
    – Davor
    Commented Jun 21, 2023 at 12:50
  • 3
    @Davor "the question already points to the fact that one of the largest websites in the world already did this" The question mentions that "Steve Huffman [... edited ...] comments that criticized him", not that he edited comments to make them say something illegal.
    – JiK
    Commented Jun 21, 2023 at 13:48

The primary evidence against you would be based on server logs or database entries of the website where the illegal information is posted. You could counter that evidence by recording logs of browser submissions on your side. There are extensions (e.g. Form Vault) which automate saving of web form submissions in your browser. It's also possible to set up a local proxy / vpn server which your browser would use, and collect the server's logs.

The degree of trust in logs from both side will likely depend on expert judgement. If the website in question is a major platform with proper security practices (automated log handling, strict access control on servers which store the logs and regular security audits), the log on your side (which you may have forged) may not be enough.

For a smaller website the degree of trust would be comparable, so having local logs would be an effective defence.

  • "The degree of trust in logs from both side will likely depend on expert judgement." - Doesn't it really depend on the judgement of the jury, from which any experts will be excluded?
    – D M
    Commented Jun 19, 2023 at 11:43
  • 2
    @DM yes, but to which expert testimony will be presented.
    – phoog
    Commented Jun 19, 2023 at 12:10

First, you would deduce that the software in question has the ability to edit public user posts without the user's knowledge. You then read through the Terms and Conditions of said service to see if this capability is mentioned or not. If it is, then your lawyer immediately asserts that someone else, without your knowledge, changed your post, and the T&C says this is possible. Bad news for social media company.

Otherwise, you issue a subpoena for the source code for said software, asserting that you need to prove that this capability, in fact, does exist. Of course, the company will fight tooth and nail to prevent this. Even worse, they can change the code to remove any such functionality before answering the subpoena. So you really need to subpoena the version control history for the software going back to before the event in question occurred (probably reasonable to ask for changes up to 1 year before the incident).

However, if you can find an insider who will simply admit that this capability exists, then you have a star witness. The larger the company, the more likely that such a person exists, and has no particular loyalty to the company (and may themselves be disgruntled). Such a person would work in Operations. You can also subpoena documents related to Sarbanes-Oxley (SOX) controls. Every tech company needs to maintain legal info on who is able to access sensitive company data or not, because the CEO needs to certify that everything works as advertised. This allows you to find out how accessible the message database is, and who has write access to it. Everyone with direct write access becomes a potential suspect.

You don't need to wade through the entire source code to make your case. You just need to find the bits that can write to the message database, and see what controls exist. Almost certainly, Operations folks will have this capability themselves, to fix urgent problems during outages. But most likely executives will also be able to order underlings to make directed changes. Pretty much every system in the world works like this without exception.

Your lawyer will not be able to prove who did it, but that's ok. What they will do is demonstrate that a large number of people have the capability of writing to the database without leaving logs of their activity, and this means that any insider is capable of spoofing you. At this point, the corporation will not want this fact to be widely publicized, so they will likely offer to settle.

  • 1
    Seems like a lot of speculation. And there's no way the corporation can settle if it's your criminal case.
    – D M
    Commented Jun 19, 2023 at 23:36
  • 2
    Literally, every forum can modify your comments in its database. It's not even possible to build it differently.
    – Davor
    Commented Jun 21, 2023 at 12:53
  • ... but if one cryptographically signed ones messages, such editing would be obvious @Davor. It is possible to build a forum that requires all posts to be signed.
    – JCRM
    Commented Jun 21, 2023 at 14:42
  • @JCRM If I have access to the database and the key to how the signing is made, I can alter contents, creation date and the signature, making them perfectly legit.
    – Trish
    Commented Jun 21, 2023 at 16:00
  • 1
    @Trish the whole point of cryptographic signatures is that the signing key for an individual is only held by that individual. So yeah, if you have my signing key, you can impersonate me. But that is bad key management, not an intrinsic limitation of the system. Commented Jun 21, 2023 at 20:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .