Using Blockchain to Secure Electronic Evidence
The Philippine judicial system, despite best efforts to keep apace with technological advances, remains largely non-electronic. Digitized record-keeping in the courts is not widespread; the submission of pleadings in electronic formats is almost unheard of. The handling of electronic evidence is potentially rife with inaccuracies, given the lack of technological infrastructure and the inexperience of those in the chain of custody.
The primary procedural rule which governs electronic evidence in the Philippines is the Rules of Electronic Evidence (Administrative Matter No. 01-7-01-SC) issued in 2001 by the Supreme Court of the Philippines. These rules outline how electronic evidence should be treated in the context of court proceedings. However, the Rules are silent as regards the handling of electronic evidence outside the court, potentially affecting the integrity of the chain of custody. Multiple parties may be able to access electronic evidence from the time it is collected, until their presentation in court. Absent explicit safeguards, the integrity of electronic evidence may be compromised with relative ease within the chain of custody. After all, digital evidence can be easily modified by someone who has access to any device which can read such evidence.
Blockchain technology can play a vital role in securing the integrity of electronic evidence. Blockchain can store a series of transactions in a way that cannot be changed. In essence, the blockchain stores each transaction to ensure that the details of each stage in the “journey” of the data is verified and included in the chain. Once a piece of evidence is entered into the system, every alteration is seen and recorded in the chain, thereby eliminating the possibility that evidential material be successfully falsified without any receipts.[1]
The blockchain technology was originally employed for the Bitcoin cryptocurrency. It consists of a sequence of blocks containing the transactions of an online ledger. This ledger is accessible in a peer-to-peer network, where all participating nodes (i.e., a person with a computer) maintain a full local copy of the blockchain. Transactions in the blocks are sorted chronologically and each block contains a cryptographic hash or “key” of the previous block in the chain. Nodes create new blocks as they receive transactions which are broadcasted in the network.
Once a block is complete, nodes with new blocks start a consensus process to convince other nodes to include it in the blockchain. There are several existing models for this consensus process. In the original blockchain technology employed in Bitcoin, this consensus process is based on proof-of-work – nodes competing in confirming transactions (and creating new blocks) by solving a mathematical puzzle. To incentivize this computationally intensive task, solving a block will yield bitcoins as a reward, hence the term miners.[2]
Another type of consensus process is called proof-of-stake, where instead of solving mathematical problems to affirm the integrity of transactions, a set of nodes (called validators) take turns proposing new blocks and voting on them. They put a stake in the network, such as a certain amount of cryptocurrency, akin to betting, and are incentivized to act honestly in order not to lose money. The blockchain keeps track of these set of validators, and they are ousted if they behave maliciously.[3]
A variation of the proof-of-stake consensus process, called proof-of-authority (PoA) puts an individual’s identity i.e. reputation, instead of cryptocurrency/money, at stake. In PoA, validators are preventively authorized, and their identities are known to the public. Thus, acting maliciously results in losing personal reputation and expulsion from the validator set.
Of all the available models, PoA is particularly appropriate for securing electronic evidence, as it is suited for both public and private networks. Moreover, PoA is typically employed in permissioned blockchain networks, that is, networks within which nodes cannot freely join and become validators, but rather they have to be preventively authorized.[4] As such, PoA is appropriate for storing highly sensitive information such as evidence or information which would affect national security. The authorization for the permissioned blockchain may come from the government agency in charge of evidence keeping, for example, and validators may technical assistants sanctioned by pertinent government authorities.
In the Philippines, the usage of blockchain to secure digital evidence and preserve its integrity throughout the chain of custody is easier said than done. One hurdle is insufficient technological expertise, especially concerning blockchain, within government circles. While this gap may theoretically be addressed by outsourcing the blockchain to service providers, doing so may in turn give rise to various security issues since sensitive data would now be in third-party hands. The chances increase that the custody of such data would end up compromised once outside the control of the government, especially if it somehow falls into the hands of unscrupulous entities.
Blockchain technology as it exists today may already provide a more secure means of securing the integrity of highly sensitive data, such as electronic evidence. Still, much deliberate thought and action, including the contemplation of unintended consequences, is necessary to ensure that such highly sensitive data can be legitimately processed for official use in the Philippines through blockchain.
[1] https://www.lawyer-monthly.com/2018/08/the-law-courts-the-case-for-blockchain/
[2] Lone, Auqib. (2017). Forensic-chain: Ethereum blockchain based digital forensics chain of custody. Scientific and practical cyber security journal. https://arxiv.org/pdf/1807.10359.pdf
[3] Id, page 3.
[4] Ibid.