Log Law: Is Your Log Data Guilty?

Log Law: Is Your Log
Data Guilty? A Conversational Approach to
Legal Issues White Paper October 20, 2006
Contents
Building a Solid Foundation. 1 Civil Law, Common Law With the emergence of log consolidation and analysis as a sub-What's the Difference?.......... 2 market of Security Information and Event Management, there Some Important Terms and has been no end to the fear, uncertainty and doubt that vendors, media and pundits have raised and pontificated on regarding the Why People Throw Them legality and admissibility of log data in court. Around.................................... 2 While I am not a lawyer, and do not even pretend to play one on How Evidence is Attacked .... 4 TV, I have done a fair amount of research in this area, and in this White Paper, I will attempt to share those findings with you. Of Chain of Custody - If You course, there is the "get out of jail free" clause that I am required Break The Chain Will You to place here in the abstract, which says that the information Feel the Pain?......................... 6 contained herein does not constitute explicit legal advice and therefore, you should engage your own personal or corporate Specific Laws Affect the Use legal counsel for such matters. However, I do believe that this of Computer Logs In Court.. 8 White Paper will get you into the infield of the ballpark when you are making business decisions concerning the collection, Beyond Reasonable Doubt or analysis, and use of log data. Preponderance of the The contents of this White Paper will cover the different types of Evidence - That is the legal systems in the world, how these systems tend to view log Question.........10 data, and the fundamental questions you should be aware of when considering the use of log data in criminal and civil Standards, Standards, Oh proceedings. Aren't There Some Standards? ........................... 11 But what kind of vendor White Paper would this be if there was not at least one plug for the vendor. So let's get the first one out How About the New of the way. NetIQ does have a product, NetIQ Security Manager, eDiscovery Amendments to which focuses on log consolidation and analysis. If you find this the Federal Rules of Civil White Paper useful and you are looking into log consolidation Procedure?............................11 and analysis for whatever reason, then we encourage you to please visit www.netiq.com, and check out NetIQ Security How Do I Make This Manager. Information Work for Me (a.k.a. The Summary)....12 Finally, a Word from our Sponsor..........13 Bibliography.......15 THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT ARE FURNISHED UNDER AND ARE SUBJECT TO THE TERMS OF A LICENSE AGREEMENT OR A NON-DISCLOSURE AGREEMENT. EXCEPT AS EXPRESSLY SET FORTH IN SUCH LICENSE AGREEMENT OR NON-DISCLOSURE AGREEMENT, NETIQ CORPORATION PROVIDES THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SOME STATES DO NOT ALLOW DISCLAIMERS OF EXPRESS OR IMPLIED WARRANTIES IN CERTAIN TRANSACTIONS; THEREFORE, THIS STATEMENT MAY NOT APPLY TO YOU. This document and the software described in this document may not be lent, sold, or given away without the prior written permission of NetIQ Corporation, except as otherwise permitted by law. Except as expressly set forth in such license agreement or non-disclosure agreement, no part of this document or the software described in this document may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, or otherwise, without the prior written consent of NetIQ Corporation. Some companies, names, and data in this document are used for illustration purposes and may not represent real companies, individuals, or data. This document could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein. These changes may be incorporated in new editions of this document. NetIQ Corporation may make improvements in or changes to the software described in this document at any time. © 1995-2006 NetIQ Corporation, all rights reserved. U.S. Government Restricted Rights: If the software and documentation are being acquired by or on behalf of the U.S. Government or by a... [download for more]