things and information

[Owen Blacker]

Brian Morrison, quoting Adrian Midgley:
> 
> > > The Police should be required to copy DVD's, CD's and hard
> > > drives, and give the copies to the suspect, _before_ they are
> > > allowed to remove media, if the suspect asks them to.
> > 
> > In the case of blood and urine samples related to an 
> > investigation, IIRC the suspect must be provided with a portion 
> > of the sample at the time it is sealed for use in evidence.
> > 
> > This allows them to have their own analysis made by another lab.

Yeah, that's definitely the case.  I remember a friend of mine having been
pulled over for drunk driving some years ago being somewhat bemused that the
police insisted he take an envelope with two vials of his bodily fluids.  He
promptly threw them away, of course; not least as he plead guilty.

> > [...]
> > 
> > And yet a computer is, and a hard drive is and a CD or DVD is.
> > And no provision appears to be made to allow the 
> > suspect/defendant to obtain an independent analysis, and for the 
> > Police to demonstrate that what they have analysed is one of a 
> > triplet of copies that includes one sealed at the time of 
> > seizure, one handed back or left with the owner, and one taken 
> > and used for analysis to determine if there is a case to answer.
> > 
> > I think the relevant bodies have sorted out _things_ some time 
> > ago, but have not really come to grips with information yet.  
> > But the difference in the medical evidence field is interesting.
> 
> That's a really excellent comment Adrian, I wish I'd thought of the
> analogy.

Indeed, me too!  :)

> I imagine the police would *really* have some explaining to do if they
> removed 8 pints or so of blood from each person they took a blood sample
> from ;-)

*VERY BIG GRIN*

> Knowing the ease with which a hard disk could become altered while in
> police custody it seems to me that forensic imaging tools that can take
> a frozen image of material at the time (and ideally place) of seizure
> should be made a priority, but I bet they won't be....

Indeed, even just from a "this won't interrupt the accused's (employer's)
business any" PoV.  The police would have all the information they needed by
imaging everything ~instead~ of seizing it.

This would, of course, mean that police investigations couldn't prevent any
potential further crimes being committed, in quite the same way, whilst the
investigation were ongoing, but surely, if one assumes innocence until
proving guilt, that's not the police's job in the first place and, if it
were a priority to do so, a judicial warrant for seizure (rather than
imaging) could be sought, perhaps?

But this prolly wouldn't go down well with the tabloids so, doubtless, is a
non-starter.  Or am I being too cynical for a Monday, now?  ;o)


O x
-- 
Owen Blacker
Senior Software Developer and InfoSecurity Consultant   Wheel: Group
See http://www.owens-place.org.uk/pgp.html -- more about my PGP keys
Sig  0xa7cb7592 | 9c1c 2996 075b 2daa 3660  6d2f ee34 fc94 a7cb 7592
-- 
Opinions might not even be mine.  Other people can go get their own!

_____________________________________________________________________
This e-mail has been scanned for viruses by MessageLabs.