Chain of custody: what turns a saved page into evidence

A screenshot is a picture of a screen. It shows that an image existed on some machine at some point. It does not show where the content came from, when it was there, whether it is complete, or whether anything was changed after it was captured. Every one of those is a separate question, and the standards that govern digital evidence answer them separately.

This note sets out what those standards ask for. It describes a design. Civic Shield is not operating a collection system, holds no case files, and has produced no records.

The four questions

Handling guidance for digital material is set out in ISO/IEC 27037:2012, which covers the identification, collection, acquisition and preservation of potential digital evidence. The Berkeley Protocol on Digital Open Source Investigations, published by the UN Office of the High Commissioner for Human Rights with the Human Rights Center at UC Berkeley, applies the same logic to publicly available online material gathered for international criminal, human rights and humanitarian law investigations.

Read together, they ask four things of any item.

How was it acquired? Not who saw it, but what process produced the file, and what that process retained and discarded.

What fixes the content? Something has to make later alteration detectable.

What fixes the time? A claim about when a page said something is a separate claim from what it said.

Who handled it? Every transfer between people and systems is a point where material can change, and an unrecorded transfer is a gap that cannot be closed afterwards.

The digest fixes the content

A cryptographic hash function turns a file of any length into a short fixed-length value. Change one byte and the value changes. SHA-256, the function most often used for this, is specified in FIPS 180-4, published by the National Institute of Standards and Technology.

What a digest does is narrow. It does not conceal the file, protect it, or prove where it came from. It establishes one thing: that the bytes now are the bytes then. That is why a digest is recorded at the moment of capture rather than calculated later — a digest computed after an edit records the edit.

The practical use of this is recognised in US evidence law. Rule 902 of the Federal Rules of Evidence makes certain electronic records self-authenticating: paragraph (13) covers records generated by an electronic process shown to produce an accurate result, and paragraph (14) covers data copied from an electronic device and identified by a process of digital identification, in each case certified by a qualified person. The committee note to paragraph (14) describes matching hash values as reliable evidence that a copy and its original are identical.

The time stamp fixes the moment

A digest says nothing about when. Binding a digest to a time is a separate operation, defined by the Internet Engineering Task Force in RFC 3161, which specifies how a request is sent to a time-stamping authority and what comes back. The authority signs the hash together with a time, so the pair can later be checked without the original file leaving the holder.

In the European Union the legal weight of that operation is set by the eIDAS Regulation. Under Regulation (EU) No 910/2014, a qualified electronic time stamp enjoys the presumption of the accuracy of the date and time it indicates and of the integrity of the data bound to them. The presumption is rebuttable, and it attaches to qualified time stamps specifically — the ordinary kind carries no such presumption, only the technical property.

The custody log fixes the handling

The first three answers are cryptographic. The fourth is procedural, and it is the one that is usually missing.

A custody record states who or what took each action on an item, when, and why. Its value comes from being append-only: entries are added, never edited or removed, so a gap is visible as a gap. A log that can be rewritten answers the question it was created to answer.

Both ISO/IEC 27037 and the Berkeley Protocol treat this as part of the evidence rather than as administration around it. Material with an unbroken record of handling and material without one are not the same item at different quality levels. They are different claims.

What is not settled by any of this

None of the four answers says the content is true, that it means what a reader thinks it means, or that the person who posted it is who they appear to be. They establish that a specific artefact existed in a specific state at a specific time and was handled in a recorded way. Everything after that is interpretation, and interpretation is where error enters.

That separation is the reason Civic Shield’s design keeps preservation apart from assessment, and keeps a severity judgement apart from a confidence judgement. The evidence layer can be strong while the reading of it is uncertain, and a system that merges the two reports a false certainty about the part that is actually in doubt.

Standing

The standards above are published and can be read in full at the links given. Civic Shield’s own evidence design is set out on the methodology note, which is a draft, is versioned, and describes nothing currently in operation. No monitoring is running. No record has been produced. Nothing on this page should be cited as a description of an operating system.