Blog

409Information Systems AuditTrails in Legal Proceedingsas EvidenceCaroline AllinsonInformation Security Section, Information Management Division, Queensland Police Service,GPO Box 1440, BRISBANE Qld 4001,Australia.andResearch Student, Information Security Research Centre (ISRC), Queensland University of Technology,Brisbane. Queensland.Australia.Keywords: Law enforcement, audit trails, evidence, investigation, expert witness, information security, policy, court, survey,computer.AbstractAustralian State and Commonwealth Governmentsare interested in the collection, storage and presentation of audit trail information, particularly within alegal framework. Law enforcement agencies have alegal obligation to keep audit records of all activityon information systems used within their operations. Little to no research has been identified inrelation to the use of internal audit systems forevidentiary purpose.A brief history of audit trails is given with requirements for such audit trails beyond the year 2000.The Queensland Police Service (QPS), Australia, isused as a major case study . Information on principles,techniques and processes used, and the reason for therecording, storing and releasing of audit informationfor evidentiary purposes have been studied.To assist in determining current practice in theAustralian Commonwealth and State Governmentsthe results of an Australia wide survey of all government departments are given and contrasted to themajor study for QPS.Reference is also made to the legal obligations forauthorization of audit analysis, expert witnessing andlegal precedence in relation to court acceptance orrejection of audit information used in evidence.It is shown that most organizations studied generateand retain audit trails but the approach is not consistentnor is it comprehensive. It is suggested that these materials would not withstand a serious legal challenge.1. IntroductionThis paper examines the status of computer basedinformation systems audit trails in relationship to theirpresentation in legal proceedings as evidence.Over the past few decades audit has developed morethan one meaning. Traditionally it was used inComputers & Security Vol.20, No.5, pp.409-421, 2001Copyright © 2000 Elsevier Science LimitedPrinted in Great Britain. All rights reserved0167-4048/01$20.00Information Systems Audit Trails in Legal Proceedings as Evidence/Caroline Allinsonaccounting for the checking of financial reliability ofa business. This has changed and audit has nowbecome a process where a record is maintained of aparticular series of events in order to provide evidencein the case of a dispute, to ensure compliance withcertain rules and regulations, to check on the effectiveness of control systems, and to provide evidence inthe case of criminal activity. These records are commonly known as audit trails or audit logs. [1]This process has been extended to include information systems and significant work has been undertaken by the Information Systems Audit and ControlAssociation (ISACA) in the development of guidelines for the process of information systems audit. [2]There is little research by academic, law enforcementand government institutions in relation to audit forevidentiary purpose. Organizations have employedbasic manual and semi automatic electronic processesfor a considerable amount of time without regard tothe rapid escalation of information technology andchanging business practice. Legislation is out datedand in some areas under review[3]. The Australianstandard for information security does not adequatelyaddress audit trails.[4]Due to attitudes within Information Technology(IT)divisions not all organizations have comprehensiveaudit systems in place and the majority of those thatdo, cater for technology implemented in the 1970sand 1980s only. In many cases there are no definedpolicy and procedure sets and very limited evaluationperformed. History shows that security has alwaysbeen an “after thought” but this is now beginning tochange.Law enforcement agencies have a two fold interestand legal obligation pertaining to audit trails. Thefirst is where audit trails are used by criminals in thecommission of crime, and the second is when audittrails are generated by the information systems usedby the officers themselves in support of the recording and investigation of crime. Little to no work hasbeen done in relation to the security required for theaudit trail as an entity. Research work undertaken todate has concentrated on the search and/or seizureof digital evidence and not the securing of audittrails themselves. Audit trails are one component ofdigital evidence and in many cases are heavily reliedon during an investigation of computer crime or system misuse. Current procedures provide for thesecuring of digital evidence once it has been seizedwithout consideration as to the history of securitysurrounding its existence.A management challenge in today’s electronic worldis the monitoring, auditing and controlling of activity in a maze of interconnected computer devicesknown as distributed computing. Security must bebuilt into all aspects of the systems and environments.These information security systems must haveaccess and privilege controls, logging and audit controls, accountability controls, and monitoring andreporting controls in accordance with the level ofsensitivity of the electronically or digitally stored,transmitted and processed information. Neverbefore in the history of electronic information processing has the audit trail been as important as it istoday. Security against loss and/or damage of audittrail information to ensure the level of protectionwill satisfy legal requirements is a major issue andone that has not been addressed adequately. In general, it is mostly assumed that the audit trail is secure,reliable and acceptable from a legal perspective.This can be observed from research into digital evidence and written work produced as a result . Casey,Yancey, Gahtan, and law enforcement agencies havecompiled comprehensive information on work performed in relation to electronic evidence and bestpractice for discovery.Whilst this work is of excellentvalue for law enforcement agencies and legal professionals there is a need for it to be extended toinclude security controls in existence for audit trailswhen the evidence was seized or discovered.[5],[6],[7],[8].Law enforcement and affiliated agencies also have alegal obligation to keep audit records of all user activity performed on sensitive information systems that areprovided for law enforcement operational and supporttasks. This requirement to generate and retain audittrails is the motivation behind a decision taken to use410411the Queensland Police Service(QPS) current systems asa major case study for the development of a securityframework for evidentiary purposes. In order toachieve this objective a survey of all AustralianCommonwealth and State Government organizationswas undertaken. The purpose of this paper is to provide details of this survey with results and findings.The ultimate aim is to determine legislative andsecurity requirements of audit material for evidentiarypurpose.2. History of Audit TrailsAudit trails have been developed for and utilized byinformation systems since the inception of computers. The definition and use of an audit trail haschanged over time to reflect the escalation and proliferation of computer systems and networks. In particular the growth of distributed computing, usingpersonal computer based workstations, via data networks has placed pressure on earlier definitions andprocedures related to audit trail collection and presentation.When the computer system was limited to “numbercrunching” and “data storage” as a “mainframe”, audittrails were used as a method of verifying data input.These audit trails were stored for the verificationperiod and the time taken to process the data input.The audit trail for data input is still in existence but isnow more sophisticated.Audit trails in the form of system journals and databasejournals are written for technical reasons. Audit trailshelp to ensure the integrity of the system itself bychecking that unauthorised changes to software havenot occurred, file access controls are properly set andthat the communications network has not changed.They also help to ensure that the organization is complying with regulatory controls and assist in the detection of suspicious patterns of access such as log-onattempts outside normal hours of business. [9]A system and/or a database crash can cause the loss ofdata. The journals reflect the modifications, additionsand deletions to the data and are used to restore thesystem and/or database to its original state. Date in[10] explains the process of database recovery as verycomplex.“Design of database systems has always incorporated notonly a variety of checks and controls to reduce the likelihoodof failure, but also an extensive set of procedures for recovering from the failures that will inevitably occur despite thosechecks and controls. Recovery in a database system meansprimarily recovering the database itself. That is restoring thedatabase to a state that is known to be correct after some failure has rendered the current state incorrect. Or at least suspect. There are many possible causes of such failure, programming errors in an application or in the operating systemor database system itself. In all cases underlying principleson which recovery is based are quite simple and can besummed up in a single word: redundancy. That is, the wayto protect the database is to ensure that any given piece ofinformation in it can be reconstructed from some other information stored redundantly somewhere else in the system”.This is achieved by the following process.Periodically the entire database is copied or dumpedto archive storage. Every time a change is made to thedatabase, a record containing the old and new valuesof the changed item is written to a special data setcalled the database journal/log. If a failure occurs andthe database itself is damaged then the database isrestored by loading it from the most recent archivecopy and then using the database journal/log to redoall changes made since that archive copy was taken. Ifthe database is not damaged but its contents are, thedatabase is restored to a correct state by using thedatabase journal/log to undo all “unreliable” changes.The archive copy is not needed in this case.There are many reasons why audit trails are used. Twoadditional and motivating factors for the introductionand use of audit trails beyond the year 2000 areunethical/unauthorized behaviour and “proof ofbusiness process”. These two concerns includeexceeding access control rights, inappropriate andillicit release of information, correct adherence torequired business procedures and fraud prevention.With the prospect of litigation looming, and in manycountries a reality, the need to meet a challenge in acourt of law is very real for all organizations.Computers & Security, Vol. 20, No. 5Information Systems Audit Trails in Legal Proceedings as Evidence/Caroline Allinson2.1 The Audit Trail Beyond 2000An audit trail written for confirmation of a transaction, whether it be for commerce or operational activities as is the situation with law enforcement, must bea complete record of all activity; a “snap shot” in timewith ability to reconstruct all events.When provided as evidence in a court of law, theaudit trail must be able to meet any challenge.Therefore it must be generated, retained and presented within an environment where a security framework has been implemented.The main areas that must be considered for a securityframework are:a) Positive identification of a user with the ability totightly couple the user to the audit trail for proof ofuse. In high confidentiality and integrity environments this must be something the person is, not justwhat is known or possessed.b) Integrity checking of audit trail information toensure no malicious or accidental changes haveoccurred. Checksumming which incorporates theidentification of a user, hence, making it more difficultfor a change to be made.c) Secure storage, sealing and responsibility for audittrails need to be in place with associated documentation of processes and procedures.d) A security infrastructure for the information system/s must exist with segregation of audit trail information from the databases and systems for which theyare generated. This is especially relevant in caseswhere intrusion has been detected and the court isbeing asked to believe an audit trail that resides on asystem that has been compromised.3. Major Case StudyOne of the first objectives was to fully examine theinformation systems and processes in place at theQPS, as an example of a leading law enforcementorganization. The principle aims were to:• obtain a background and full description of theprinciples and techniques used for audit and evidence presentation;• obtain an understanding of the organizational processes and procedures implemented by the QPS toaccommodate the legal obligations and politicalprinciples for audit trail analyses; and• to obtain full description of the configuration andtechnical implementation of information systems inuse by the QPS.Information security for the QPS is centrally controlled. The Information Security Section(ISS) is a unitwithin the Information Management Division.The ISShas the responsibility for and is the Owner of all audittrails. All technical aspects of the system are provided bythe Information Systems Branch, also within the Information Management Division. For obvious securityreasons not all findings in relation to the QPS systemsare listed. Policy and procedures related to audit trailactivity is formed by and documented by the ISS. Thispolicy is subject to peer review inside the QPS.The ISS provides assistance to operational policeinvestigations and internal investigations into inappropriate use of QPS information systems. This assistanceis usually by way of audit trail searches.Security officers from the Information Security Sectionare required to appear in court to give evidence in relation to the process and the results of audit trail searches. Court appearances number approximately ten(10)per year and this number is steadily increasing.3.1 QPS Audit SystemsSince the inception of electronic based informationsystems for the QPS, it has been standard practiceto keep a full audit trail of all user activity againstthe QPS corporate and mainframe databases. Initially,auditing was developed to facilitate system and application programmers in determining errors.The process of auditing involves full details of alluser queries, additions, modifications, deletions. Every412413keystroke and action is written to an audit trail with asubset of the main criteria written to a command logor activity log. Due to the volume of data written tothe audit files, the command and activity logs are usedas an initial search facility and if necessary used as apointer into the main audit trail files.The QPS receives over 400 requests per year for audittrail searches. The three main reasons for these requestsare technical, operational police investigations andinvestigations into possible misuse.a) Requests are received from Information SystemsBranch technical staff requiring assistance with dataproblems, application problems and system failure.Ten percent of the requests for audit searches aretechnical.b) Requests are received from operational police officers wishing to clarify certain activity, e.g. clarifyingtimes transactions were done where time is importantto an offence such as drink driving, burglary, etc. Alsoidentifying transactions that were performed in the pastand that are now important is another request type e.g.vehicle or person subject of a routine search who maynow be a suspect in an offence. Thirty five percent ofthe requests for audit searches are operational.c) Requests are received from the Criminal JusticeCommission1, Ethical Standards Command2 and QPScommissioned officers involved in investigation of system misuse i.e. unauthorised access and disclosure ofinformation.Fifty five percent (55%) of the requests foraudit searches are for investigations of possible misuse.Other requests for audit searches are received forproactively analysing system activity and Freedom ofInform

ation.3.2 Audit Trail as EvidenceMany of the audit trail searches result in the securityofficers from ISS being required to give evidence incourt. Section 95 of The Queensland Evidence Act1977 is relied upon as the basis for many of the security procedures in place and the provision of evidence incourt.In 1997 the Queensland Law Reform Commission(QLRC) commenced a review of this law in relationto the Court’s receipt into evidence of informationthat is stored and/or conveyed using various electronic and similar media. [3] Three of the seven issuesraised by QPS with the QLRC relate to informationsystems operation.The Queensland Evidence Act 1977, Section 95“Admissibility of statements produced by computers”isrelied upon for the above mentioned assistance andcourt appearances. Several issues with respect to Section 95 have been raised by the QPS IT Management.Section 95(2)(c) refers to “operating properly”;there is no definition as to what constitutes a computer operating properly; no standards, procedures orsecurity and audit references are made. What constitutes operating properly in one organisation may notbe the same in another. If this were to be used as adefence, what is the court’s expectation of “operatingproperly” for a Law Enforcement information processing environment?Section 95(2)(b) & (d) refer to “ordinary course”;there is no definition as to what constitutes ordinarycourse. There needs to be clarification of “ordinarycourse” in relation to the computer staff performingcomputer related activities and the actual user baseperforming operational activities.Section 95(3) is very broad; “All computers aretreated as one”. In the current information technology environment this is not only inappropriate butincorrect. Network capabilities certainly give the “onecomputer”appearance but data and information can beshared and this could span several organizations eachunder different managerial and legal control. In thisComputers & Security, Vol. 20, No. 51 The Criminal Justice Commission was established in 1989 by an Actof the Queensland Parliament – the Criminal Justice Act 1989 – on therecommendation of the commission of Inquiry into Possible IllegalActivities and Associated Police Misconduct (known as the ‘FitzgeraldInquiry’), chaired by Mr G E Fitzgerald QC.2 Ethical Standards Command commenced operation in 1997 andwas established within the Queensland Police Service Structure to promote ethical behaviour, discipline and professional practice with the goalto ensure the community has full confidence in the QPS.Information Systems Audit Trails in Legal Proceedings as Evidence/Caroline Allinsonsituation who is then considered to be “the personoccupying a responsible position” in relation tothe computer operation? Even if the system is notseveral organizations, the networked information technology facilities are such that in large organizations it isnot possible for one person only to be knowledgeablein all areas.3.2.1 Audit Trail Investigation ProcessRequests for audit trail investigation are acceptedfrom a commissioned officer or equivalent manager.When a request is received the security officer conducts a search of the audit trails based on the searchcriteria given. A copy of the results of the search aregiven to the investigating officer, with assistance ifrequired. Results may be incorporated into the“record of interview”.If the audit trail is required in court, the security officer prepares a statement and obtains a certificate undersection 95 of the Queensland Evidence Act 1977. Thecertificate requires the person occupying a responsible position to provide a statement that the computer systems were “operating properly”.The security officer attends court with the originaldocuments. In many cases the copy provided to theinvestigating officer is admitted as evidence andbecomes the exhibit. This raises concerns about theability of the courts to deal with electronic evidence.There appears to be no concern or request to differentiate between the original and the copy.A study of cases involving evidence given by QPSinformation security officers has shown that none ofthe evidence presented has ever been rejected or seriously challenged from a technical perspective.The lack of competence of the legal profession forboth prosecution and defence in the presentation andchallenge of electronic evidence is strongly evident.This has been observed from the court room andthrough the investigation processes. It is also possiblywhy QPS evidence in relation to audit trailshas never been rejected or strongly contested andchallenged.To assist in actual court proceedings, development of anew information system for QPS has provided a “playback facility”. The new audit system captures auditinformation, stores the information in “session files”which provides a facility to play the session back as ifthe person was sitting at the screen. The hardcopy ofthe audit trail is still required as the exhibit. The playback facility is an in-court presentational aid only.4. Policy V’s ControlsPast experience is indicative that policy is necessarybut does not provide evidence if there is an operational need to investigate system use or system misuse.The Carter Enquiry, which was an investigation ofcases involving Queensland Police Officers, demonstrated this in Justice Carter’s report [11]. A recommendation was made to implement an audit trail forthe QPS internal e-mail system. QPS has policy toprint and retain copies of e-mails if they are considered to be for official purposes. If the hard copye-mail is produced as evidence there is no back up ofproof to show the e-mail is valid. It is a simple process to reproduce an e-mail message by means of aword processing facility.Analysis of the report by the Independent CommissionAgainst Corruption (ICAC) into New South WalesPolice Service [12] showed inadequacies in the abilityto audit and monitor information systems. A recommendation was made to introduce audit trails.The QPS access control systems and audit systemshave been reviewed and the relationship between thetwo is very loosely coupled and the inability tosecurely identify a user is evident. “Users” are authenticated and recorded by “user-identification code” and“password” alone but an individual cannot be positively and uniquely identified at the time of access,e.g. user identity and password may have been“captured” by a third party, etc.4.1 Government PolicyA Protective Security Manual(PSM)[14] has beendeveloped for Australian Commonwealth Government414415departments. It outlines that government’s protectivesecurity policies, principles, standards and proceduresin relation to information technology systems and processes. Part VI,Section 6.40 of the PSM addresses audittrails. It provides for both generation and content.However, there is nothing relating to the safe andsecure handling of the audit files themselves. AustralianCommunications-Electronic Security Instructions33(ACSI 33) [17] section 17 does provide moredetailed instruction in relation to the handling of audittrails and logs. This relates to intrusion detection.The Queensland Government has produced an information standard [15] for information security. Thereis no specific section on auditing.The Australian and New Zealand Standard for Information Security Management[4] section 7.7 providesguidance for monitoring system access and use. Thissection does not provide for the handling of audittrails and the security mechanisms required to protectand secure them.The Commonwealth Privacy Act in Principle 4Storage and security of personal information part a)states: “A record-keeper who has possession or control of arecord that contains personal information shall ensure:a) That the record is protected, by such security safeguards asit is reasonable in the circumstances to take, against loss,against unauthorized access, use, modification or disclusure,and against other misuse.”The words “against unauthorized access, use,modification or disclosure” would imply that anaudit trail record needs to be kept; incorporating boththe part of usage and the “users” of the data.4.2 Law Pertaining to ForensicComputingThe International Association of ComputerInvestigative Specialists(IACIS) sets the policy andprocedure for forensic computing. This policy andprocedure has been analysed and set out in a comprehensive form by the United States JusticeDepartment. It is important to relate the internalrequirements for electronic evidence in the form ofaudit trails to the requirements set down for theforensic computing environment. In particular thesepolicies and procedures dictate the use of “checksum”techniques for record integrity, “sealing” of total filecontents for original and working copies and requirement for “expert examiners” who also provide“expert witness”.4.3 Other Related WorkIn 1994 Canada appeared to be leading the way witha comprehensive paper “Computer-produced recordsin court proceedings” produced at the Uniform LawConference of Canada in 1994[13]. Although thisdoes not deal specifically with audit trail informationit does address many of the issues which need to beresearched.5. Government SurveyTo obtain a better understanding of the current security and audit practices of other organizations andprovide a base from which comparison could bemade, a survey was developed. The survey was interested only in “traditional” information systemsinvolving computers and data networks.All Australian government organizations were chosenas the population size. The number of responsesbecame the sample size. It was not intended thatcomplex statistical methods would be used.Frequency analysis and percentages, with some crosstabulation only, were required.5.1 Materials and MethodThree hundred and ninety organizations were identified as the population. Twenty surveys were sent toCommonwealth departments and related departments and 370 were sent to State GovernmentDepartments and related Departments throughoutAustralia (see table 1). The addresses were obtainedfrom the Brisbane telephone directory and theQueensland State Library. Not all the relateddepartments were included.Computers & Security, Vol. 20, No. 5Information Systems Audit Trails in Legal Proceedings as Evidence/Caroline AllinsonA sample size of 118 was determined by the responses received(see table 2). A 30% sample sizewas considered more than adequate as most statistical analysis is done on a sample size of 10 to 20percent.5.2 The SurveyTo assist in the development of a framework the survey was divided into five sections.Section one addressed audit trail generation andretention:• Retention period• Existence of a single audit facility• Consistently implemented• The way in which they are written or generated• Application driven• Office systems and e-mail• Ability to inhibit• Recording of system use• Legislative requirementSection two addressed storage and backup of audittrails• How they are stored• Enhanced security mechanisms employed• Type and number of backupsSection three addressed the purpose and use of audittrails• Reconstruction of activity performed• Produced as evidence in a court of law• Purpose and useSection four addressed responsibility and control foraudit trails• Who is responsible• Is responsibility in job description• Protection from IT technical support activity• Policy and procedureSection five addressed the organization• Type of organization• Size of organization416 Commonwealth Departments20State Governments IdentifiedTasmania6Victoria1South Australia7Western Australia13New South Wales11Northern Territory7Queensland7Unidentified46 Total 118Table 2. Survey Sample Commonwealth Departments20State GovernmentsTasmania17Victoria22South Australia31Western Australia43New South Wales77Northern Territory30Queensland150 Total 390Table 1. Survey Population4176. DiscussionA good cross representation of organizational size wasreceived. One third representation from small, medium and large organizations. (see table 3,Appendix 1)Of the 118 responses received 100 said they generateaudit trails. Of these 100, 96 said they retain them.Thirty percent retain indefinitely, with a further thirty percent retained between 5 to 10 years. It is reasonable to say that from these results, governmentorganizations in Australia have a need and/or arerequired to generate and retain audit trails for a significant period of time. (see Table 4,Appendix 1)Although required to generate and retain audit trailsthe manner by which this is done is inconsistent.Eighty six organizations said they do not have a single audit trail facility implemented and 64 of these donot implement their audit trails consistently.There is a very strong reliance on in-house developed, application driven audit trails.Where used Microsoft Corporation’s “Windows NT”is relied on for audit trail generation for office systems. A larger number of organizations than expected are generating audit trails for office systems. Thenumber for audit trails for e-mail was also greater thanexpected. This is significant given most e-mail systems do not have full auditing capability built in.The ability to inhibit audit trails was high. This raises concerns over the ability to prove if an audit trailsystem was operating at a given time.Recording of system use and activity is inconclusiveas 13 only record every keystroke; 31 record everyquery but in section 3, 64 said they could reconstructall activity performed on a data element. It is not possible to reconstruct all activity unless queries havebeen recorded. (See Table 4 & 6,Appendix 1).It is interesting to note that finance and audit legislationis still the main legislative driver for audit trails. Oneonly organization said they keep audit trails for privacylegislative reasons. (See table 4,Appendix 1).There is very little segregation of audit trails, andenhanced security mechanisms such as check summing and encryption are rarely used. Backup is takena little more seriously with 50% implementing twocopies with one copy off site. Thirty one percent ofthese organizations secure one copy as the original.(See Table 5,Appendix 1).Twenty eight organizations have been required toproduce their audit trails as evidence in court.Sixteen of these organizations indicated they were lawenforcement or law enforcement affiliated or part ofthe criminal justice system. This would indicate thatthere is a need for other organizations to have security consistent with law enforcement for evidentiarypurposes. (See Table 6,Appendix 1).Whilst the requirement to produce their audit trails incourt is “moderate” to “low” 50% of organizationskeep audit trails for business/operational purposes. Itis predictable that the electronic business and commerce direction of information technology will causethis requirement to increase and the need to produceaudit trails in court to increase also.The 50% for business/operational purposes and the58% for system misuse are similar and consistent withthe need and use of audit trails for the QPS. (SeeTable 6,Appendix 1)The responsibility and control for audit trails is verypoor from a security perspective. The results forSection four show that the technical information systems staff are responsible for audit trails. More than halfhave no responsibilities written in job descriptions;45% have no clear lines of segregation;47% do not protect or monitor technical support staff; and 33% onlyhave a policy for Audit Trails.(See Table 7,Appendix 1).7. ConclusionIt has been shown that most organizations studied generate and retain audit trails. When compared to themain areas that must be considered for a security framework mentioned in section 2.1, the current practicesemployed by Australian government organizations arenot consistent nor comprehensive. It is suggested thatComputers & Security, Vol. 20, No. 5Information Systems Audit Trails in Legal Proceedings as Evidence/Caroline Allinsonif tested in a court of law the Audit Trails would notwithstand a serious legal challenge.Preliminary findings, which are the subject of thispaper, were presented at the “Security in GovernmentConference 1999” in Canberra Australia and the IFIPWG 9.6/11.7 Working Conference on “Security andControl of IT in Society-II (SCITS-II)” in Bratislava2001.References[1] T. Parker and C. Sundt, “In