Talking with Erin Kenneally about digital forensics in a connected world

My guest on this week’s Innovators show is Erin Kenneally, a lawyer who helps law enforcement agencies think about digital forensics, and about the authenticity of evidence in a connected world. Methods that were considered best practices not long ago — like shutting down computers, capturing images, and analyzing them — are no longer practical in an ecosystem of always-on services. It’s tempting to say that cyberspace rewrites all the rules of the game, but as Erin points out, that’s not really really true. There are always logs, and people responsible for those logs, and procedures for managing those logs — in physical as well as in virtual space. When a case comes before a judge, a well-documented set of best practices regarding physical custody of computer systems is likely to be as relevant as the cryptographic methods that may have been used to protect and validate the bits.

Someday all this will be relevant to the lifebits scenario I envision. In that model I push as much of my personal data as is feasible to the cloud, surround it with a set of access control and auditing services, and route transactions there whenever I can. When you and I do business, my view of our transactions is logged and audited in a system I control, governed by practices I can document.

What happens when I’m compelled to provide evidence or documentation, but don’t want to cough it up? If I’m running my lifebits service in a translucent way, the cloud infrastructure never sees my data unencrypted. But while that’s feasible, it radically limits my ability to allow automated transactions against my data. So in practice I’ll want to let the infrastructure to access the data as my proxy. Doing that in a controlled environment, with a robust access control scheme that’s uniform across all my transactions, and with comprehensive auditing, will be vastly preferable to the worsening mess we’re in now.