Designing Systems for Dispute Resolution

Courts, in England and Wales, consider computers to have been working correctly unless proven otherwise. Therefore, any evidence produced by the system or computer is considered reliable as well. This presumption stands in the way of a party attempting to dispute electronic evidence and is often impossible to overcome. When the reliability of electronic evidence is called into question the burden of proof is on the objecting party. This party often lacks access and knowledge of the system they are trying to dispute and faces insurmountable difficulties. The case of the Horizon Post Office scandal is a clear demonstration of the shortcomings of this presumption. The Post Office falsely prosecuted hundreds of postmasters and employees based on evidence produced by the accounting system Horizon. Challenges to Horizon's correctness could not rebut the presumption of reliability and any identified shortcomings that could have been caused by software errors, were incorrectly attributed to theft or fraud. The legal presumption, when applied in practice, has been the cause of widespread injustice and could raise similar issues in other situations where the reliability of computer evidence is questioned, such as in payment disputes.

There is a serious need for the presumption to be reassessed to prevent further injustices. This project is about how systems can be designed to provide evidence of their own correctness and the correctness of any data they produce. If a system is put in a position where its reliability is called into question, it will be able to produce documents that can justify or disprove accusations against the evidence being questioned. If critical systems (ones that have a likelihood of producing data in a court case) incorporate this kind of design, then the presumption can still function in the way it was intended without putting an undue burden of proof on either party.

The EPSRC Centre for Doctoral Training in Cybersecurity will train over 55 experts in multi-disciplinary aspects of cybersecurity, from engineering to crime science and public policy.

Short term impacts are associated with the research outputs of the 55+ research projects that will be undertaken as part of the doctoral studies of CDT students. Each project will tackle an important cybersecurity problem, propose and evaluate solutions, interventions and policy options. Students will publish those in international peer-reviewed journals, but also disseminate those through blog posts and material geared towards decision makers and experts in adjacent fields. Through industry placements relating to their projects, all students will have the opportunity to implement and evaluate their ideas within real-world organizations, to achieve short term impact in solving cybersecurity problems.

In the longer term graduates of the CDT will assume leading positions within industry, goverment, law enforcement, the third sector and academia to increase the capacity of the UK in being a leader in cybersecurity. From those leadership positions they will assess options and formulate effective interventions to tackle cybercrime, secure the UK's infrastructure, establish norms of cooperation between industries and government to secure IT systems, and become leading researcher and scholars further increasing the UK's capacity in cybersecurity in the years to come. The last impact is likely to be significant give that currently many higher education training programs do not have capacity to provide cybersecurity training at undergraduate or graduate levels, particularly in non-technical fields.

The full details of our plan to achieve impact can be found in the "Pathways to Impact" document.