[roel_v]

'Chain of custody' only starts on seizure. There are no 'chain of custody' issues either when a drug lab is dismantled - sure, some guy in a ski mask might have broken into that garage the night before and put all that stuff there, doesn't make it a chain of custody issue. More similar to the OP, when an electrician finds a mj plantation when doing routine network maintenance (replace a meter, maybe), there is no chain of custody problem either.

[valarauca1]

So then it is on the FBI to prove beyond a reasonable doubt that the files were placed on the computer by the owner. Not by the technician.

Which in court will effectively end up being computer forensic expert vs computer forensic expert lecturing a jury of people who don't understand computers.

[roel_v]

Sure, but (unless I'm misreading your undertone) what's the problem then? When the police find a bloody knife on somebody's kitchen table and the blood matches that of the victim that bled out outside, they also have to prove that it's the owner's. Everybody in this thread is up in arms how there is no way to 'prove' the files were the owner's, like it's some sort of special case that no lawyer or judge ever had to consider before. There's nothing special about the 'evidence' angle of this issue.

[valarauca1]

The main issue is things get pretty harry around computers. Primarily because you can modify the state of a computer without physical entry.

For example if I plant murder evidence in your home either myself, or an associate of mine must of physically entered your residence. We likely came into contact with the physical item, handling it, etc. Furthermore the associate if caught is very likely to roll on me.

For computers none of these are true.

I could automate placing child-porn on THOUSANDS of computers. If done properly there would be little to no evidence the owner did not do this themselves.

I could plant child porn in your computer _while_ I'm pretending to be somebody else (IP + MAC + login location + OS + credentials, etc.) so even if the CP was proven to be planted it is traced to somebody else and they prosecuted.

There is no parallel to this in the real world. The game theory of bribing somebody to do your dirty work is far far messier then a bot. Computers offer ways of hiding that make the physical world laughable.

[roel_v]

Yeah, no. I know that us 'computer people' like to think that it's different but it's not. Anything you do digitally leaves traces. Sure, 'if done properly' (like if you're some sort of Mission Impossible or CSI: Cyber style 'hack god'), anything is possible. But that's the same for physical break ins - if you do it 'properly' you can frame someone else, too. No sure why you think the 'associate' scenario would be different between digital and physical either; why would a computer tech not 'roll on you'?

This discussion is in the context of evidence. People are insinuation that somehow digital crime is different because you can't 'prove' one thing or the other, because anything could be faked (that's the gist of the argument). My point is that this is vastly ignorant of the hundreds of years of experience dealing with such uncertainty in the judicial system. Sure, it's not statistics and it's not 'logic' the same way 'we' (i.e., quantitatively, closed-system oriented people) interpret those terms, but that doesn't mean we're now somehow in a completely different world. Put differently, the STEM mindset doesn't have a monopoly on 'the truth', as much as we like to think we do.