What Makes a Compliance Record Tamper-Evident (and Why It Matters in a Dispute)

What Makes a Compliance Record Tamper-Evident (and Why It Matters in a Dispute)

A record is tamper-evident when any change to it can be detected. In practice that means a cryptographic hash is stored, the hashes are chained so an entry cannot be altered in isolation, and the chain is timestamped independently. It shows a record has not changed since a point in time, not that the record was true.

This article is for general information purposes only and does not constitute legal advice. Landlords should seek independent legal advice for their specific circumstances. It describes the position in England.

Tamper-evident is a narrower claim than tamper-proof

The two terms are used interchangeably and they should not be. Tamper-proof would mean a record cannot be altered, which is not achievable for anything a landlord controls. Tamper-evident means that if a record is altered, the alteration can be detected. That is achievable, and it is the useful property.

The distinction matters because the second claim is defensible under scrutiny and the first is not. Anyone selling the first is overstating, and a claim that collapses under questioning is worse than no claim at all.

Why this comes up in a dispute at all

Records are challenged because the alternative to a contemporaneous record is recollection, and courts have a settled way of preferring the former.

Hearsay is admissible in civil proceedings under section 1 of the Civil Evidence Act 1995. Section 4 then directs the court, when estimating the weight to be given to it, to have regard to any circumstances from which an inference can reasonably be drawn about reliability. The listed factors include whether the original statement was made contemporaneously with the matters stated, whether any person involved had a motive to conceal or misrepresent, and whether the statement was an edited account or made for a particular purpose.

Every one of those factors is a question about when and how a record came into existence. A landlord who says a repair was logged in March is asserting exactly the thing section 4 asks about, and a spreadsheet with a March entry does not answer it, because a spreadsheet row can be typed at any time and dated anything.

The practical consequence is visible across possession claims, council record requests and redress complaints. The tenant's dated messages are contemporaneous by their nature. The landlord's record often is not, and cannot easily be shown to be.

Part one: hashing, in plain English

A cryptographic hash function takes any input and produces a fixed length string of characters. SHA-256 produces 256 bits, usually written as 64 hexadecimal characters. Three properties make it useful here.

It is deterministic. The same input always produces the same output, so the hash can be recomputed later and compared.

It is sensitive to any change. Altering a single character in a document produces a completely different hash, not a similar one. There is no partial match.

It cannot practicably be reversed. The hash reveals nothing about the content, so it can be stored or published without exposing the underlying document.

The result is a fingerprint. Store the hash of a gas safety certificate when the certificate is uploaded, and at any later point the certificate can be hashed again. If the two hashes match, the file has not changed. If they do not, it has.

Part two: chaining

A single stored hash proves a single document has not changed, but it does not prevent a record being altered as a whole. If the same party holds both the record and the hashes, both can be recomputed together.

Chaining addresses this. Each new entry incorporates the hash of the entry before it, so the entries form a sequence in which every hash depends on everything that came before. Changing an entry from six months ago changes its hash, which changes the next entry's hash, and so on to the end of the chain. An alteration cannot be made in isolation. It requires rewriting everything after it.

That converts a quiet edit into a visible break. It still does not solve the last problem, which is that a party holding the whole chain could rebuild the whole chain.

Part three: independent timestamping

The final component moves the evidence outside the control of whoever holds the record. If the state of the chain at a given date is committed to something the record holder cannot rewrite, the chain can be shown to have existed in that state on that date.

OpenTimestamps is an open standard that does this by publishing a commitment to the Bitcoin blockchain. Many hashes are combined into a single value which is anchored, and each individual record retains a proof linking it back to that anchor. LLCR uses this approach: entries are hashed and chained, and the chain is anchored daily.

The property this adds is existence at a point in time. A record accompanied by a valid timestamp proof can be shown to have existed in its current form on the anchored date, and that demonstration does not depend on trusting the party producing it.

What this proves, and what it does not

Being precise here is more useful than being impressive.

That last row is the one most often overstated in this market, so it is worth setting out directly.

The trust services framework recognises a category of qualified electronic time stamp, issued by a qualified trust service provider, which carries a presumption of the accuracy of the date and time indicated and of the integrity of the data bound to it. A blockchain anchor produced through an open standard is not a qualified electronic time stamp and does not carry that statutory presumption. Anyone describing one as though it did is describing something else.

What a blockchain anchored hash chain provides is evidential support: a verifiable, independently checkable basis for saying a record existed in a given state at a given time, which a court or an adjudicator can weigh alongside everything else. That is a real advantage over an unverifiable record. It is not a shortcut past the rules of evidence, and it is not legal advice about how any particular tribunal will treat it.

Where it changes the argument

The value shows up at a specific moment: when the other side suggests the record was written after the fact.

Without tamper-evidence, that suggestion is difficult to answer. The landlord asserts the record is contemporaneous, the tenant asserts it is not, and the tribunal weighs two assertions with nothing to separate them.

With it, the question becomes checkable. The record either verifies against an anchor predating the dispute or it does not. That does not make the landlord right about the underlying facts. It moves the argument off the reliability of the record and back onto the substance, which is usually where a landlord with a genuine case wants it.

What to do about it practically

Most of the benefit comes from ordinary discipline rather than from cryptography.

Record at the time. A tamper-evident record of an entry made three months late proves you made a late entry. The mechanism preserves contemporaneity; it cannot create it.

Keep it continuous. A chain with a gap invites the question of what was in the gap. Log routine events as well as significant ones.

Do not overclaim it. In correspondence with a council, a tenant or a redress scheme, describe what the record shows and not what it proves about the merits. Overstatement invites scrutiny of the strongest part of your evidence.

Do not treat it as a substitute for the underlying obligation. A tamper-evident record of a lapsed certificate is excellent evidence that it lapsed.

LLCR hashes and chains every compliance entry and anchors the chain daily using OpenTimestamps, so a record can be independently verified as having existed in its current form on a given date.