With physical evidence this has evolved to a pretty tight system where evidence is tracked, sealed, and secured from collection to trial with physical security - relatively secure tamper proof seals, fairly strict chain of custody, logging, etc.
In further conversations with them I was surprised to learn there is essentially nothing when it comes to digital evidence security, of which there is increasingly more and more of (of course). Everything from crime scene photos to phone dumps, entire hard drives, police body cam footage, etc. There is virtually nothing in place to track the chain of custody, detect potential evidence tampering, etc for this evidence.
I'm convinced that if there were a high-profile case today with a modern legal "Dream Team" the lack of these systems for digital evidence verification would be front and center from an expert (and resource rich) defense. On the other side of the aisle, what's to stop the prosecution from actual digital evidence tampering?
This was actually one of the applications that provided the genesis for my startup Tovera[1]. It's still in very early stages but I'm hoping we can make some inroads in law enforcement as I think it has real potential to address the digital evidence verification issue and make for a more transparent and secure justice system (which both sides of the process should value). It remains to be seen if they actually do.
[0] https://www.pasadenastarnews.com/2014/06/08/oj-simpson-case-...
This happens apparently already. A few days ago on HN: https://news.ycombinator.com/item?id=27959755
The EFF has already made commentary on this [0], and basically my understanding is that this technology is being advertised and positioned as "expert", and that there is deep science behind it, but in fact it's mostly interpretive, and ultimately state prosecution simply make fanciful deductions based off the results and omit sometimes very important facts.
I think that it is incredibly important that as law enforcement continues to build technology that is only used for prosecution purposes, this technology is heavily public and auditable, as at least with the above, it's quite clear that law enforcement has not been handling the technology responsibly. My personal take is that the technology is only available to those interested in a prosecution, not those you may be saved by it.
[0] https://www.eff.org/pages/gunshot-detection
Offtop with regards to your site:
- As I get it, it's an NFT-esque system, yes?
- For your signup, it would be useful to maybe do the verification code after the age verification has already been done, or at least make it clear that the verification part needs to be done. I found it when I couldn't click "Continue", but the button was kind of in a blind spot for me
- Also, maybe do verification after you've confirmed age already on a separate screen so that 100% any email you collect there was collected under the indication from the user that they were older than 18 as per your requirements in the EULA
- The download button for the test asset I uploaded, or doesn't seem to do anything really.
- Edit cause click submit too soon: You might want to include a visual indicator on your copy to clipboard buttons that it triggered successfully
- I'm not quite sure why you need geographical information to make an account; as I get it, no money is transacted so you don't have an obligation for much user data
- We store the asset ID, additional metadata, and associated checksum in our datastore (for reliability, scalability, and performance reasons). We then essentially mint an NFT with a URI to a JSON object stored in IPFS with a privacy-respecting minimal copy of the above as additional protection against our datastore being called into question. Eventually it may be 100% blockchain-something based but it's such a rapidly evolving space there's no clear "perfect" solution (just yet).
- The age verification and jurisdiction stuff are related to COPPA in the United States (and similar in other jurisdictions). It's my first time dealing with it and what we have in place will evolve but EULA or otherwise I don't mind being perhaps a little more cautious on this front until I can get a better understanding of all the issues at play. In any case we could do a much better job explaining why we (probably? might?) need date of birth and country.
- Overall I'm not thrilled with the signup and onboarding process and it's towards the top of the list for something we need to spend some quality time on.
- I'll have to look into the download button issue (not sure how we missed that).
- Great point on the copy to clipboard buttons!
Thanks again for taking a look and providing feedback, I submitted to Show HN[0]two weeks ago but as you can see it never got any traction. Feedback like yours was exactly what I was hoping to get. Still trying to figure out what happened with our Show HN but that's a bigger issue.
Unfortunately it's probably going to take many more multiple TB losses (resulting in failed prosecutions) for them to take this seriously with digital evidence as well.
One of the things I find nontechnical people tend to fail to understand is the importance of organizing and cleaning up data. Often when we are running out of space, I get asked why we can't just buy another hard drive at Best Buy for $50.
Then when people do clean up their data, they don't understand file space. They'll spend hours cleaning up old Word documents, but not touch the decade-old AVI video files which could at least be stored in a better format.
Ask a government entity to buy a SAN, they complain. Ask them to buy a backup storage appliance, they ask why we need another SAN. And then in five years, they ask why you need another SAN if you bought one five years ago...
Don't overestimate Dallas. I can't speak to what the heck we're doing with actual tax revenue, but the city services and infrastructure are terrible. I actually don't have many complaints about the police, but it's not like my information is rooted in research and statistics. I've just lived downtown for a while and seen quite a few interactions between homeless and police and they seem unusually good at de-escalation and not just rushing in and beating people up as seems common in other big cities.
But ... our infrastructure is terrible. A quarter-inch of rain and over half the street lights in the city stop working. Any bit of wind knocks out power lines constantly, and it's pretty windy. Partly because they're all above ground, partly because the poles are old and falling over, partly because the city doesn't trim trees nor force property owners to do it, so branches are constantly overhanging and destroying things.
We had a somewhat notorious incident a few years ago where someone managed to set off all the tornado alarms citywide for a full day. They managed to do this because the control system was just radio. Not encrypted, not authenticated. Just direct the right channel at the right receiver and you could set off all of the city's tornado alarms.
City infrastructure here is an absolute mess, and if they cut costs on everything else by buying crap and not performing any maintenance, it doesn't surprise me one bit they do exactly the same thing with IT infrastructure.
1) Municipalities aren't allowed to run budget deficits, so whenever there is any sort of economic downturn and revenues are short of what they projected, maintenance is often the first thing to get cut. They call it "deferred maintenance" but in practice it's just a disguised form of borrowing because you need to do it eventually and it's only going to get more expensive, which is effectively a different kind of interest. In contrast, whenever revenues exceed projections, there is tremendous pressure to just cut taxes rather than build up any kind of rainy day fund.
2) The existence of cities like Highland Park and University Park. These are entirely contained with Dallas city boundaries, small, and near the city center. They seem to exist for the sole purpose of taking all the largest and most expensive mansions and a few associated shops and public services, and walling them off from the rest of the city to make sure the wealthiest people don't see any of their tax revenue going to benefit anyone except themselves.
We're not dysfunctional (yet?) like parent described so I'm not sure every problem in Texas can be attributed to bureaucracy.
So now that you make me think of it, we might actually be as dysfunctional as Texas but we just have better weather so it's not apparent as much.
Medicine is one. Law still is, though less so as digital document management has made their lives a little easier.
Law enforcement is a BIG one. You can sell snake oil to LEOs very easily, and many people DO. I think it's a combination of organizational hubris and a sort of "nobody understands our work" bullshit that keeps them from listening to industry authorities and makes them susceptible to ignorant charlatans peddling crap that's Made For Police or whatever.
There's a fuckboat of this kind of stuff, like you could write a book's worth on it considering how much is coming into the fore.
Reading the parent comment and it being pretty much "Blockchain for law enforcement and justice record keeping" definitely makes me feel a little off here but then again this one actually looks like it's at least trying to approach the problem of record keeping maintenance. I don't really think there's a hell of a lot out there but this field has an interesting and controversial history. Just check out the inslaw/PROMIS (prosecutor's management inventory system) scandal. I think the US Justice Dept concluded there was no wrongdoing but Canada's RCMP has a very different opinion about the compromising of their law enforcement record keeping system breach.
1. https://www.itnews.com.au/news/afp-told-to-end-over-reliance...
Thanks again!
But it's a big deal when it prevents the state from putting a person who committed murder in jail, right?
Humans make mistakes, but it seems like law enforcement should have a big enough budget to make that /really/ unlikely.
The complete breakdown of accountability is what concerns me the most. Not being forthcoming when something as critical as your evidence system fails is, at best, a huge cover up.
What's with the Texaphobia?
[0] https://en.wikipedia.org/wiki/List_of_states_and_territories...
It reads to me like any "phobia" over this simple fact is inferred by the reader, not implied by the writer.
https://regmedia.co.uk/2021/08/16/dallas_county_memo.pdf
Reading the actual memo, there's another interesting aspect on whatever "TechShare" is; a quick look suggests this is the site of the software in question[0], but there is absolutely no technical information available about it at all. Based on the blurbs, it looks like some project tracker but custom made for law enforcement, but again it's a complete black box as to what the software does, how it ensures data integrity, etc.
The memo is very specific about ensuring data gets uploaded to this TechShare, but this just makes me wonder "how does TechShare guarantee data integrity?", and I question if it really would have helped, but it's impossible to know because both the Dallas County's data processing methods and any information on TechShare are complete black boxes. This adds no value to security for them, and in fact probably just makes it worse as the software is never really audited nor are the IT practices.
Combined with the fact that this data-loss was not announced for 4 months after the fact and that cases that may have been affected by the data-loss (e.g., missing evidence), I come away with a very bad picture of law enforcement technology. I'm not sure why there isn't more publicly available scrutiny on the IT practices of law enforcement †, particularly when it comes to handling evidence/case data.
[0] https://techsharetx.gov † As I'm very cynical of US law enforcement in general (many more of course, but right now focusing on US), my own answer for this is that it's intentionally done to obfuscate the process, but this is just the cynical and myopic part of me, which I want to separate from the rest of the post.