Burdens of Proof: Cryptographic Culture and Evidence Law in the Age of Electronic Documents - By Jean-François Blanchette

What proof do you have to back up that belief? The review appears in the issue of JASIST that you are reading, likely in an online format. The review is attributed to the two authors mentioned in the byline. Yet the possibility exists that this review was written by someone else—possibly for nefarious purposes—and somehow slipped into the publication process without the knowledge or consent of Stanton or Rothke. Burdens of Proof: Cryptographic Culture and Evidence Law in the Age of Electronic Documents takes on and analyzes the very issues of authentication and authenticity raised by the questions above. Author Jean-Francois Blanchette, currently a faculty member in the Department of Information Studies at UCLA, knits together a tangled story of French bureaucracy that illustrates the intrinsic difficulty and complexity of ensuring that digital documents fulfill the same functions (and provide the same essential level of trust) as their paper predecessors. Part of the reason that you may trust that we wrote this review is that the first author had to log in with his own username and password to an online submission system in order to submit the manuscript. The web browser used to accomplish this submission has built-in capabilities for establishing an encrypted connection to the journal’s server. This connection, based on a technology known as “public key cryptography,” made it possible to send a secret (such as a password) over the Internet without having that secret readable by outsiders. As Blanchette aptly points out in Burdens of Proof, however, these cryptographic facilities alone are not nearly sufficient to support the chain of custody that brought the document from the author’s keyboard to the reader’s eye. In fact, a whole host of social conventions, laws, standards, and policies were at work behind the scenes to enable the reader, the publisher, the editor, and the author to assert that the work you are viewing was created by the authors who claim it. Blanchette uses France’s transition to so-called “digital government” during the late 1990s and early 2000s as a case study to illustrate the pitfalls of overreliance on cryptographic technology. He details a compelling story from the well-informed perspective of an insider: He was a member of a task force appointed in 1999 by the French Ministry of Justice to provide guidance on the reform of the rules governing the admissibility of digital evidence in French courts. Blanchette notes that one of the greatest impediments to moving to a digital documentation framework in France was a group of individuals known as the French civil-law notaries or notaire. French notaries are much more powerful than a notary public in the United States. The notaire are a wealthy and powerful belief with immense influence on purchases, sales, exchanges, co-ownerships, land plots, leases, mortgages, and the like. Before the adoption of digital methods of document authentication, the French notary profession had a national monopoly to grant authenticity to documents. No workable methods of electronic authenticity could emerge and succeed if the methods did not meet the criteria of the notaire. Blanchette uses the story of the notaire to illustrate two key points. First, although paper-based trust (e.g., through contracts with ink signatures) may be intuitive today, this was not always the case. Historically, when paper documents first entered into widespread use they did not immediately inspire trust. As with other innovations, there was a long and complex period of evolution needed to gain acceptance. Second, and most important from a contemporary perspective, those who develop cryptography repeatedly underestimate the difficulty of deploying the technology within the complex social and institutional setting in which it will be used. The challenge with getting digital signatures and other cryptographic techniques to work is not a technology problem per se; rather it is a challenge in making the technology function effectively in the context of the underlying societal infrastructure—the norms, conventions, and beliefs that shape individual and organizational behaviors. Burdens of Proof could serve as a highly readable and engaging text for use in a liberal arts course on digital government or a nontechnical course on cryptography. The first few chapters provide a compact overview of the history of cryptography. Chapter 3, “On the Brink of a Revolution,” provides an excellent summary of research in this area from 1976 on, starting with seminal research by the notable cryptographers Whitfield Diffie and Martin Hellman, as well as Ronald Rivest, Adi Shamir, and Leonard Adleman (the inventors of RSA public key encryption). Chapter 4 digs more deeply into the concept of digital signatures, but stays very accessible even to a nontechnical audience. © 2014 ASIS&T