Subject: RE: Repudiability

From: [email-masked]
Date: Wed, 8 May 2002 09:15:39 +0100

> -----Original Message-----
> From: Aryeh Katz [mailto:[email-masked]]
> Sent: 07 May 2002 21:43
> To: [email-masked]
> Subject: Re: Repudiability
> 
> 
> > It seems we have a poor basis for a new economy given that 
> we know how
> > to do these things properly.  I wonder how long it will be before a
> > test case arises.
> > 
> > Apart from the SSL stuff, we also need to be able to have the client
> > sign both the recieved form and the data they return as a 
> single unit
> > in order to prove the context of their submission.
> 
> I don't know that we're that bad. Netscape communicator does 
> have a Javascipt function called signText, which you could 
> use of form submission (along with client 
> certs). It's similarly possible to code an activex control 
> for IE that would sign a form.
> This is not to say that there couldn't be better repudiation 
> in the ssl layer. Merely, that if you had to, you could 
> conduct business in a reasonable fashion.
> 

I think the point about faking logs is relevant, but only if taken in
context. Like I said, IANAL, but I have taken a case all the way to the
second highest court in England and Wales and won.

Any evidence can be faked, regardless of where it came from. Any evidence
can also be mis-interpreted. I know a man who was imprisoned for murder on
the basis that his Taxi logs were missing on the night of the murder, the
victim had a scarf which was alleged to belong to this man and the victim
had the man's telephone number in his diary. He has now been freed.

Getting back to the point, server logs detailing abuse are admissible as
evidence, provided that the person submitting them is able to verify that
they haven't been tampered with. To state in court that they haven't been
tampered with when they have is perjury. That carries a prison sentence in
my country, and probably in many others too.

Having said that, it is entirely up to the Judge at the time to decide what
is and what isn't admissible as evidence. They could refuse any evidence you
have, even if you have perfect repudiation. Furthermore, no matter how
complex you make the identification, there is still a mathematical
possibility that the identification is incorrect. For example, when giving
fingerprint evidence juries have to be informed of the statistical
likelihood of two people having the same fingerprints. It used to be said
that this was as likely as winning the football pools every week for a year.

The only certain things are death and taxes (although they are many more
things I am certain of).

- 
John Airey
Internet systems support officer, ITCSD, Royal National Institute of the
Blind,
Bakewell Road, Peterborough PE2 6XU,
Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 [email-masked] 

The teaching of evolution as a proven fact rather than a theory has done
more harm to scientific progress than anything else in history.

- 

NOTICE: The information contained in this email and any attachments is 
confidential and may be legally privileged. If you are not the 
intended recipient you are hereby notified that you must not use, 
disclose, distribute, copy, print or rely on this email's content. If 
you are not the intended recipient, please notify the sender 
immediately and then delete the email and any attachments from your 
system.

RNIB has made strenuous efforts to ensure that emails and any 
attachments generated by its staff are free from viruses. However, it 
cannot accept any responsibility for any viruses which are 
transmitted. We therefore recommend you scan all attachments.

Please note that the statements and views expressed in this email 
and any attachments are those of the author and do not necessarily 
represent those of RNIB.

RNIB Registered Charity Number: 226227

Website: http://www.rnib.org.uk 

14th June 2002 is RNIB Look Loud Day - visit http://www.lookloud.org.uk to
find out all about it.

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]