This is what the authors of the book "Digital Forensics with Open Source Tools" say about the term evidence:

The examiner reveals the truth of an event by discovering and exposing the remnants of the event that have been left on the system. In keeping with digital archaeologist metaphor, these remnants are known as artifacts. As the authors deal frequently with lawyers in writing, we prefer to avoid overusing the term evidence due to the loaded legal connotations. Evidence is something to be used during a legal proceeding, and using this term loosely may get an examiner into trouble.

Is that true? Has there been a case out there where an examiner got in (serious?) trouble for calling something evidence when in fact from a legal point of view it really wasn't?

closed as off-topic by Rory Alsop Dec 17 '13 at 23:33

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • This question appears to be off-topic because it asks about whether or not people have encountered legal trouble for their choice of words. – Rory Alsop Dec 17 '13 at 23:33

The point at issue isn't so much a legal one as it is one of proper communication.

Most of the civilized world uses the word "evidence" to refer to signs of some particular activity or behavior or process. A dentist finds evidence of tooth decay, a home inspector finds evidence of rodents. The word in common usage is pretty broad.

But when talking to a lawyer, you say the word evidence, and she mentally appends "of criminal wrongdoing" without you putting the words there, because in her practice, that's what "evidence" always refers to.

So if, in analyzing a compromised system, you point out that there is some evidence of a failed login attempt at 7:35 UTC, she's possibly going to assume that you said there is evidence of an unauthorized break-in attempt at 7:35, when in reality you said no such thing. You simply said that someone tried to log in and failed, and you noticed that fact in the logs. The logs make no mention of whether or not that user had authorization to access the computer, and you have not done any additional follow-up work to determine whether that was the case. That is, the facts you uncovered are not necessarily the sort of "evidence" she's after, and you don't want to suggest that you have already determined them to be relevant.

So to save both of you a lot of misunderstanding and potentially some serious embarrassment in the courtroom, you avoid the word "evidence" because it has a special meaning to her. This is the sort of advice that is borne out of frustrating experience, and not a bad idea to follow.

Whether the examiner will personally get into legal trouble in such am instance isn't clear, nor do I think that's necessarily the implication. But you could certainly spark a misunderstanding which could damage the case in court, and that's worth considering.

  • "But when talking to a lawyer, you say the word evidence, and she mentally appends "of criminal wrongdoing" without you putting the words there..." But it seems to me that they're not just talking about the way lawyers understand the word evidence. They talk about loaded legal connotations that the word actually have, even though the examiner doesn't know them. – user3680 Dec 8 '13 at 13:37
  • "Whether the examiner will personally get into legal trouble in such am instance isn't clear" ... unless this happens to occur whilst giving testimony... Lawyers and courts are well known to expect and insist on (and even enforce) everyone using their terminology, with their connotations. – AviD Dec 9 '13 at 0:08
  • @user3680 the way the word is understood encapsulates any circumstantial connotations, so the ideas are roughly equivalent. But note that delivering a report is a different environment from testifying in court. In court testimony, the nuance is often more important than the true meaning since you're dealing with a panel of jurors who are hand-selected for their ignorance. In court, word choice matters a lot, so stricter standards can apply. – tylerl Dec 9 '13 at 0:58

I suspect the authors are being conservative in their advice. See how the word "conservative" I just used means different things when I use it here, compared to when a politician uses it to describe an opponent, compared to when a doctor uses it to describe not resecting something.

Similarly, when the IT consultant uses the word "evidence", it should be taken in the context of the report - that is, the same meaning any layperson would ascribe to it: some observed phenomenon in support of a particular conclusion.

The only people who should be held to the judicial systems' standard for the word "evidence" are those who work within the system itself and are aware of whatever special meanings apply, and have agreed explicitly or by association with the field to adhere to those standards of use.

Finally, I strongly suspect that if someone wanted to entangle you in legal proceedings, it would not matter what words you used, or indeed, whatever other resources you brought to bear. Newegg was recently accused of infringing a patent on an encryption method. They lost the case despite having Whitfield Diffie (one of the inventors of public-key cryptography) testifying on their behalf.

Not the answer you're looking for? Browse other questions tagged or ask your own question.