In European, and American law, there is a wisdom that can, on first glance, look perverse. You take a digital photo of a person vandalizing your car. You then give the image to the police. They shake their heads and have to tell you that, although it suggests strongly to them who the perpetrator is, it isn’t evidence. It is the same with any digital materials. How can you prove that the materials have not been tampered with? How, in this case, can you prove a link between the moment of time captured by the camera and the submission of the material in court. The  struggle to be able to  prove provenance of digital data is becoming one of the sharp edges of software development. Since the Enron scandal, it has become increasingly obvious that email is at the heart of any investigation into company practice, and so a lot of thought has been put into giving ‘evidential weight’ to any digital materials  

When the current internet Email was invented, the legal issues that haunt us today, were the last thing on the minds of the pioneers who envisaged a communication system, SMTP,  for  academic rather than commercial use. There were plenty of other systems that had been designed for commercial use within organizations, such as Wang Office, but none could resist the adoption of internet mail via SMTP. It is flawed, it is insecure, but everyone uses it. For all their faults, Telex and Fax were trusted because they were, for all practical purposes, inherently tamper-proof. Email isn’t.

The subject can seem intimidating. Even reading the title ‘BIP 0008-3:2008 Evidential Weight and Legal Admissibility of Linking Electronic Identity to Documents. Code of Practice for the Implementation of BS 10008’ of the British Standards Institute document is a daunting task. The price of £60 for a 75 page booklet adds shock to the awe. However, the task could be simpler than this.

Exchange is packed with features, such as the journal, the application of policies and the advanced scripting, that can be used to assist in ensuring the provenance of intra-company emails, and with external customers and suppliers. It got us wondering, in our Simple-Talk editorial meetings, whether it was possible to use the features that were already there in Exchange to comply with the requirements of the legal department. Then the thought occurred to us that our readers would know a great deal on the subject. So how can you prove that the emails you have were sent by, and received by the people, groups or organizations that they purport to have done? We’d be fascinated to hear how you, or your company, approaches the task.

Cheers,

Michael Francis