Provenance - Computers and Law

Computers and Law

The term provenance is used when ascertaining the source of goods such as computer hardware to assess if they are genuine or counterfeit. Chain of custody is an equivalent term used in law, especially for evidence in criminal or commercial cases.

Software provenance relates to establishing the origins of software and identifying what licensing terms the individual components of that software fall under. For example, before an organization might incorporate an open source software component in an enterprise application it may wish to establish provenance on it to ensure the it does not contain source code under a viral licensing agreement which may in turn force it to release any derivative works. A number of commercial software companies produce applications and offer services specifically designed to audit source code and/or software binaries to help identify the origins of subcomponents and what licensing terms each fall under. Palamida, Inc. and Black Duck Software are the two largest suppliers of such applications and services.

Data provenance covers the provenance of computerized data. There are two main aspects of data provenance: ownership of the data and data usage. Ownership will tells the user who is responsible for the source of the data, ideally including information on the originator of the data. Data usage gives details regarding how the data as been used and modified and often includes information on how to cite the data source or sources. Data provenance is of particular concern with electronic data, as data sets are often modified and copied without proper citation or acknowledgement of the originating data set. Databases make it easy to select specific information from data sets and merge this data with other data sources without any documentation of how the data was obtained or how it was modified from the original data set or sets.

Secure Provenance refers to providing integrity and confidentiality guarantees to provenance information. In other words, secure provenance means to ensure that history cannot be rewritten, and users can specify who else can look into their actions on the object.