Chapter 5: The Hash
Peter Lang returned to the witness stand after the recess with his folder squared in his hands and his tie straightened, a man reassembled. The jury, sent out for twenty minutes with coffee and instructions not to discuss the case, had nonetheless discussed the timestamp with their faces the whole way through the door. Judge Callahan reminded everyone that the matter before the Court was a narrow technical question. Camille intended to keep it exactly that narrow, because narrow questions are the ones a witness cannot wriggle out of sideways.
"Mr. Lang," she began, standing at the lectern with her notebook open, "you certified the integrity of Exhibit 18. In your field, how is integrity verified?"
"By hash value," Lang said. "The system computes a hash when a file is uploaded. If the file changes, the hash changes."
"A cryptographic hash," she said. "A fingerprint made of mathematics. Change one frame, one second, one pixel in a file, and the fingerprint afterward is a different fingerprint. Is that correct?"
"That is the principle, yes."
Krol sat very still at the prosecution table, his pen motionless. He had objected three times in the first five minutes, foundation, scope, argumentative, and Judge Callahan had overruled him each time with decreasing patience, because Camille's questions were, in form, impeccable. They were also, in sequence, a corridor.
"The State has suggested," Camille continued, "that the modification recorded at two forty-one a.m. on September twenty-fifth might be a synchronization artifact. A server reconciling its clock, or its records, in the night. You heard that suggestion?"
"I heard it, yes."
"You are the State's evidence technician for this file. In your experience, can a synchronization artifact change a file's contents?"
Lang's hand moved to the folder and stopped. "A sync process updates records. It can update a displayed time."
"I did not ask about a displayed time, Mr. Lang. I asked about contents. Let me be precise, because precision is your profession too. Can a mere synchronization artifact change a cryptographic hash?"
The courtroom was quiet enough to hear the ventilation. Lang looked at Krol, a glance that lasted less than a second and contained, Camille thought, an entire request. Krol did not move. Whatever answer Lang had been prepared to give, it was not the one now standing between his oath and his training.
"A hash reflects the file," Lang said slowly. "If the hash value after an event differs from the hash at upload, then the file that exists after the event is not identical to the file that was uploaded."
"That was not my question," Camille said, gentle and exact. "My question was whether synchronization, by itself, can change that hash."
"No," Lang said. "Not by itself. Synchronization does not recompute content. If the hash changed, the content changed first."
She let the answer stand alone for a moment. Somewhere behind her, June Castellano's pen scratched steadily, and Camille found herself grateful for the clerk's thoroughness, for a record being made carefully even now.
"Do we have, in evidence," Camille asked, "the hash value computed at upload on September twenty-third, and a hash value computed after two forty-one a.m. on September twenty-fifth, so that this jury can compare them?"
"We have the certification," Lang said.
"The certification is a statement, Mr. Lang. I am asking for the values."
"The values would be in the audit log."
"The audit log the defense requested twice and has not received."
Krol was on his feet with an objection about argument, and Judge Callahan sustained it as to form while her eyes stayed on the witness, silver head tilted, her famous patience now bent toward a new object. Camille withdrew the question and asked a cleaner one.
"Mr. Lang, whose credential was used to access this file at two forty-one a.m.?"
Lang hesitated. It was not the hesitation of a man searching his memory, Camille thought. Memory hesitates forward, groping. This hesitation pulled backward, a man deciding how much of what he already knew he could afford to say aloud. He glanced at the evidence record on the monitor, at the line that had started all of this, as if the time itself might answer for him.
"The audit log records the access credential for each session," he said at last. "That record would identify the account."
"And you have not brought it."
"I was not asked to bring it this morning."
"No," Camille said. "You were asked two weeks ago." She closed her notebook over one finger to hold her place. "Nothing further at this time, Your Honor, subject to recall when the log is produced."
She sat down beside Darnell, whose hope was so visible it frightened her, because hope unprotected by proof is a fragile exhibit. The judge ordered the audit log produced and called the next recess with a gavel stroke that sounded, for the first time that day, less like an ending than like someone knocking, deliberately, on a door.