3 ms·

I have a few friends in law enforcement (from local to federal) and I gathered (through conversation with them) that there are "pretty good" processes and proce

I have a few friends in law enforcement (from local to federal) and I gathered (through conversation with them) that there are "pretty good" processes and procedures in place when it comes to chain of custody, verification, etc for physical evidence. This has likely evolved over the years with various high profile cases, perhaps most famously with the OJ Simpson trial[0]. Given it was the mid-90s that case had no digital forensic evidence that I'm aware of. With physical evidence this has evolved to a pretty tight system where evidence is tracked, sealed, and secured from collection to trial with physical security - relatively secure tamper proof seals, fairly strict chain of custody, logging, etc. In further conversations with them I was surprised to learn there is essentially nothing when it comes to digital evidence security, of which there is increasingly more and more of (of course). Everything from crime scene photos to phone dumps, entire hard drives, police body cam footage, etc. There is virtually nothing in place to track the chain of custody, detect potential evidence tampering, etc for this evidence. I'm convinced that if there were a high-profile case today with a modern legal "Dream Team" the lack of these systems for digital evidence verification would be front and center from an expert (and resource rich) defense. On the other side of the aisle, what's to stop the prosecution from actual digital evidence tampering? This was actually one of the applications that provided the genesis for my startup Tovera[1]. It's still in very early stages but I'm hoping we can make some inroads in law enforcement as I think it has real potential to address the digital evidence verification issue and make for a more transparent and secure justice system (which both sides of the process should value). It remains to be seen if they actually do. [0] https://www.pasadenastarnews.com/2014/06/08/oj-simpson-case-taught-police-what-not-to-do-at-a-crime-scene/ https://www.pasadenastarnews.com/2014/06/08/oj-simpson-case-... [1] https://tovera.com https://tovera.com

dylan604 5y ago
It's funny to me that they will build/secure/protect a large amount of physical square footage to store physical evidence, and that's part of its budget. It would not surprise me that things are so screwy that buying hard drives and other backup type of purchases are not budgeted for and have to be made at the expendable type of requests.
- kkielhofner 5y ago
  Governments tend to be reactive and only after multiple high-profile defeats and general pressure from defenses did they get around to taking evidence security seriously in their practices, budgets, etc. Unfortunately it's probably going to take many more multiple TB losses (resulting in failed prosecutions) for them to take this seriously with digital evidence as well.
- ocdtrekkie 5y ago
  It's very hard for some people to see and understand digital storage, in terms of capacity, redundancy, and reliability. Physical storage is very visual and very easy to understand: You put crud in a room and it sits there until someone does something with it. One of the things I find nontechnical people tend to fail to understand is the importance of organizing and cleaning up data. Often when we are running out of space, I get asked why we can't just buy another hard drive at Best Buy for $50. Then when people do clean up their data, they don't understand file space. They'll spend hours cleaning up old Word documents, but not touch the decade-old AVI video files which could at least be stored in a better format. Ask a government entity to buy a SAN, they complain. Ask them to buy a backup storage appliance, they ask why we need another SAN. And then in five years, they ask why you need another SAN if you bought one five years ago...
  - dylan604 5y ago
    My favorite reference for comparing physical/digital storage was from a former co-worker of mine. Imagine your vault/storage/library with all of the shelves with their contents clearly marked and organized. Now, imagine someone knocking all of the stuff off the shelves and shoving it all into a large pile. That's your harddrive.
csydas 5y ago
>what's to stop the prosecution from actual digital evidence tampering? This happens apparently already. A few days ago on HN: https://news.ycombinator.com/item?id=27959755 https://news.ycombinator.com/item?id=27959755 The EFF has already made commentary on this [0], and basically my understanding is that this technology is being advertised and positioned as "expert", and that there is deep science behind it, but in fact it's mostly interpretive, and ultimately state prosecution simply make fanciful deductions based off the results and omit sometimes very important facts. I think that it is incredibly important that as law enforcement continues to build technology that is only used for prosecution purposes, this technology is heavily public and auditable, as at least with the above, it's quite clear that law enforcement has not been handling the technology responsibly. My personal take is that the technology is only available to those interested in a prosecution, not those you may be saved by it. [0] https://www.eff.org/pages/gunshot-detection https://www.eff.org/pages/gunshot-detection Offtop with regards to your site: - As I get it, it's an NFT-esque system, yes? - For your signup, it would be useful to maybe do the verification code after the age verification has already been done, or at least make it clear that the verification part needs to be done. I found it when I couldn't click "Continue", but the button was kind of in a blind spot for me - Also, maybe do verification after you've confirmed age already on a separate screen so that 100% any email you collect there was collected under the indication from the user that they were older than 18 as per your requirements in the EULA - The download button for the test asset I uploaded, or doesn't seem to do anything really. - Edit cause click submit too soon: You might want to include a visual indicator on your copy to clipboard buttons that it triggered successfully - I'm not quite sure why you need geographical information to make an account; as I get it, no money is transacted so you don't have an obligation for much user data
- kkielhofner 5y ago
  Wow, thank you for the feedback and resources! I saw the ShotSpotter stuff but from a first glance didn't see how it really applies to Tovera. I'll take another look. - We store the asset ID, additional metadata, and associated checksum in our datastore (for reliability, scalability, and performance reasons). We then essentially mint an NFT with a URI to a JSON object stored in IPFS with a privacy-respecting minimal copy of the above as additional protection against our datastore being called into question. Eventually it may be 100% blockchain-something based but it's such a rapidly evolving space there's no clear "perfect" solution (just yet). - The age verification and jurisdiction stuff are related to COPPA in the United States (and similar in other jurisdictions). It's my first time dealing with it and what we have in place will evolve but EULA or otherwise I don't mind being perhaps a little more cautious on this front until I can get a better understanding of all the issues at play. In any case we could do a much better job explaining why we (probably? might?) need date of birth and country. - Overall I'm not thrilled with the signup and onboarding process and it's towards the top of the list for something we need to spend some quality time on. - I'll have to look into the download button issue (not sure how we missed that). - Great point on the copy to clipboard buttons! Thanks again for taking a look and providing feedback, I submitted to Show HN[0]two weeks ago but as you can see it never got any traction. Feedback like yours was exactly what I was hoping to get. Still trying to figure out what happened with our Show HN but that's a bigger issue. [0] https://news.ycombinator.com/item?id=28050000 https://news.ycombinator.com/item?id=28050000
teclordphrack2 5y ago
"that there are "pretty good" processes and procedures" They are gas lighting you.

dylan604 5y ago

It's funny to me that they will build/secure/protect a large amount of physical square footage to store physical evidence, and that's part of its budget. It would not surprise me that things are so screwy that buying hard drives and other backup type of purchases are not budgeted for and have to be made at the expendable type of requests.

kkielhofner 5y ago
Governments tend to be reactive and only after multiple high-profile defeats and general pressure from defenses did they get around to taking evidence security seriously in their practices, budgets, etc. Unfortunately it's probably going to take many more multiple TB losses (resulting in failed prosecutions) for them to take this seriously with digital evidence as well.
ocdtrekkie 5y ago
It's very hard for some people to see and understand digital storage, in terms of capacity, redundancy, and reliability. Physical storage is very visual and very easy to understand: You put crud in a room and it sits there until someone does something with it. One of the things I find nontechnical people tend to fail to understand is the importance of organizing and cleaning up data. Often when we are running out of space, I get asked why we can't just buy another hard drive at Best Buy for $50. Then when people do clean up their data, they don't understand file space. They'll spend hours cleaning up old Word documents, but not touch the decade-old AVI video files which could at least be stored in a better format. Ask a government entity to buy a SAN, they complain. Ask them to buy a backup storage appliance, they ask why we need another SAN. And then in five years, they ask why you need another SAN if you bought one five years ago...
- dylan604 5y ago
  My favorite reference for comparing physical/digital storage was from a former co-worker of mine. Imagine your vault/storage/library with all of the shelves with their contents clearly marked and organized. Now, imagine someone knocking all of the stuff off the shelves and shoving it all into a large pile. That's your harddrive.

csydas 5y ago

>what's to stop the prosecution from actual digital evidence tampering? This happens apparently already. A few days ago on HN: https://news.ycombinator.com/item?id=27959755 https://news.ycombinator.com/item?id=27959755 The EFF has already made commentary on this [0], and basically my understanding is that this technology is being advertised and positioned as "expert", and that there is deep science behind it, but in fact it's mostly interpretive, and ultimately state prosecution simply make fanciful deductions based off the results and omit sometimes very important facts. I think that it is incredibly important that as law enforcement continues to build technology that is only used for prosecution purposes, this technology is heavily public and auditable, as at least with the above, it's quite clear that law enforcement has not been handling the technology responsibly. My personal take is that the technology is only available to those interested in a prosecution, not those you may be saved by it. [0] https://www.eff.org/pages/gunshot-detection https://www.eff.org/pages/gunshot-detection Offtop with regards to your site: - As I get it, it's an NFT-esque system, yes? - For your signup, it would be useful to maybe do the verification code after the age verification has already been done, or at least make it clear that the verification part needs to be done. I found it when I couldn't click "Continue", but the button was kind of in a blind spot for me - Also, maybe do verification after you've confirmed age already on a separate screen so that 100% any email you collect there was collected under the indication from the user that they were older than 18 as per your requirements in the EULA - The download button for the test asset I uploaded, or doesn't seem to do anything really. - Edit cause click submit too soon: You might want to include a visual indicator on your copy to clipboard buttons that it triggered successfully - I'm not quite sure why you need geographical information to make an account; as I get it, no money is transacted so you don't have an obligation for much user data

kkielhofner 5y ago
Wow, thank you for the feedback and resources! I saw the ShotSpotter stuff but from a first glance didn't see how it really applies to Tovera. I'll take another look. - We store the asset ID, additional metadata, and associated checksum in our datastore (for reliability, scalability, and performance reasons). We then essentially mint an NFT with a URI to a JSON object stored in IPFS with a privacy-respecting minimal copy of the above as additional protection against our datastore being called into question. Eventually it may be 100% blockchain-something based but it's such a rapidly evolving space there's no clear "perfect" solution (just yet). - The age verification and jurisdiction stuff are related to COPPA in the United States (and similar in other jurisdictions). It's my first time dealing with it and what we have in place will evolve but EULA or otherwise I don't mind being perhaps a little more cautious on this front until I can get a better understanding of all the issues at play. In any case we could do a much better job explaining why we (probably? might?) need date of birth and country. - Overall I'm not thrilled with the signup and onboarding process and it's towards the top of the list for something we need to spend some quality time on. - I'll have to look into the download button issue (not sure how we missed that). - Great point on the copy to clipboard buttons! Thanks again for taking a look and providing feedback, I submitted to Show HN[0]two weeks ago but as you can see it never got any traction. Feedback like yours was exactly what I was hoping to get. Still trying to figure out what happened with our Show HN but that's a bigger issue. [0] https://news.ycombinator.com/item?id=28050000 https://news.ycombinator.com/item?id=28050000

teclordphrack2 5y ago

"that there are "pretty good" processes and procedures" They are gas lighting you.