Pular para o conteúdo principal

Testifying as an expert witness in computer crimes cases

Testifying as an expert witness in computer crimes cases: "
In the U.S., our criminal justice system consists of three major branches: law enforcement, the court system and the corrections system. Law enforcement officers are charged with detecting criminal activity, identifying and apprehending suspects, and gathering evidence necessary to convict a suspect in court. The court system is responsible for examining the evidence presented by both the prosecution and defense, rendering a verdict (either by judge or jury), and deciding punishment. The corrections system carries out the punishment.

Evidence can be physical (actual objects), intangible (intellectual property) or direct (what some person saw, heard or otherwise experienced with one of the five senses). Regardless of the type of evidence, its presentation in court is done through witnesses, persons who testify under oath to facts or veracity of physical evidence.

When we think about witness testimony, most of us think first of material fact witnesses (lay witnesses). These are persons who have first-hand knowledge of matters relating to a particular case. For example, if you as an IT professional observed child pornography on the computer of one of your users at work, you could testify to this as a material witness.

An expert witness, on the other hand, is not involved in the case at hand, but has special knowledge and expertise pertaining to the subject matter of the case. For example, if you are recognized as an expert in the subject of malicious software, you could testify as to whether and how a malware infection could cause illegal pornographic images to be downloaded to a person’s computer without his or her knowledge. A major difference between material fact witnesses and expert witnesses is that the former are not generally allowed to give opinions or draw conclusions, whereas experts are. Another difference is that expert witnesses are generally paid for their testimony (by the prosecution or defense, depending on the side for which they’re testifying).

If you’re an expert in computers, networking, and related matters, you might be able to qualify as an expert witness in court cases (both criminal and civil) that involve the use of computers and networks. Here’s what you can expect if you go the expert witness route.

NOTE: Prosecutors and defense teams also sometimes employ “consulting experts,” who provide technical explanations and opinion in helping the prepare the case, but don’t actually testify in court.

Qualifying as an expert witness


Court systems cover different jurisdictions (city, county, state, federal) and each jurisdiction has its own set of rules. Most are based on the Federal Rules of Evidence, which say, “If scientific, technical, or other specialized knowledge will assist the trier of fact to understand the evidence or to determine a fact in issue, a witness qualified as an expert by knowledge, skill, experience, training, or education, may testify thereto in the form of an opinion or otherwise, if (1) the testimony is based upon sufficient facts or data, (2) the testimony is the product of reliable principles and methods, and (3) the witness has applied the principles and methods reliably to the facts of the case.”

To testify as an expert, you must be formally qualified and accepted as such by the judge presiding over the case. This qualification process is generally “on the record,” with questions asked of the witness in court to establish his/her expert status (this is called a voir dire examination). Because juries tend to believe whatever a professed expert says without question, judges must be convinced that you are competent, knowledgeable, and credible before allowing you to testify. To establish you as an expert, the attorney that is calling you to testify will ask you questions about your education and training, skills and experience, awards and recognitions, and so forth. Some factors that help to establish your expertise include:

  • Advanced academic degrees or advanced training in your field.
  • Area(s) of specialization within the field.
  • Recognition as a teacher, lecturer or trainer in your field.
  • Professional licenses, if applicable.
  • Membership in professional organizations; positions of leadership within such organizations.
  • Publication of articles, books, and other materials, especially peer-reviewed works.
  • Long-term work experience in your field.
  • Technical certifications.
  • Awards and recognitions within the industry.

This is the easy part. The more difficult part comes when the opposing attorney is allowed to question you, and will usually attempt to discredit you as an expert. Be sure to tell the attorney for whom you’re testifying if there is anything in your background that could be used to discredit you (job terminations, failures or disciplinary measures in school, drug/alcohol programs, conflicts of interest and so forth).

In some cases, the opposing attorney may stipulate to the witness’s credentials. This doesn’t mean you’re off the hook. In fact, it may mean that the opposing attorney believes you have weaknesses that can be exploited in cross examination after you’ve testified on the subject matter.

Having been qualified to testify as an expert in previous court cases may carry weight when the judge is evaluating your qualifications, but it doesn’t guarantee that you’ll be deemed qualified to testify. And every expert witness obviously has to testify for the first time before going on to build a reputation as an expert witness. If it’s your first time to testify, the more education, awards, publications and so forth that you have, the better.

In some cases, lack of experience in court can even be a positive factor (assuming your creds are solid otherwise) as you may be less likely to be seen as a “professional” witness who will say anything for money.

It’s important to know that an expert witness cannot have any vested interest in the outcome of the trial. This means even if you’re otherwise qualified, you would not be found competent to testify in a case where your employer, for example, was the defendant (in a criminal case) or a party to the suit (in a civil case). Not only must you be unbiased, you must also avoid even the appearance of bias.

Note that if you testify as an expert, notes, reports and opinions you prepare in relation to the case are subject to discovery and must be produced for examination by the opposing side. Be careful in your note-taking and avoid recording anything that might be misleading.

Get it in writing


When you’re asked to testify as an expert witness, clarify what will be required of you (research and testing, consulting, testifying in a deposition, testifying in court). Clarify what, when and how you will be paid. Normally, travel and other out of pocket costs will be reimbursed along with the hourly fee for your time. Get the agreement in writing.

The contract should cover such matters as whether you will need to provide estimates of your expenses or get permission for expenditures over a specified amount, whether you need to keep task and/or travel logs to account for your time and expenses, whether you can subcontract pre-trial work such as research and testing, and what the deadlines are for any work you must produce, such as the summary document discussed in the next section.

Preparing to testify


Under Federal rules, you can’t just go into court and testify off the top of your head. You’re required to first create a written summary which includes not just your opinion regarding the subject of the case and the basis for that opinion, but also a record of your previous testimonies and depositions, a list of your publications and a disclosure statement that includes, among other things, compensation you’re receiving for your testimony. This is prepared in conjunction with the attorney for whom you’re working.

Regardless of how well you “know your stuff,” preparation is essential, especially for your first appearances in court. Pre-trial preparation allows you to clarify exactly what area of your expertise is being requested, why the attorney needs expert testimony and what issues will be addressed. Witness lists must be shared with the other side during the discovery process. Find out what other experts will be testifying, both for the side for which you’re testifying and for the opposing side. Particularly in the case of opposing side witnesses, find out as much as you can about the witness, read what he or she has written on the relevant subject matter and try to anticipate the arguments that the opposing attorney will make based on the witness’s testimony. Many court cases turn into a “battle of the experts” and you must be prepared to have what you say rebutted by others who are also recognized as experts in your field.

Be prepared for the fact that the opposing attorney is allowed to question you about your compensation. There is nothing illegal or unethical about getting paid for your time as an expert - but the opposing attorney will try to use it to imply to the jury that you’ve been “bought off” and thus your testimony isn’t reliable or trustworthy.

Being part of the team


As an expert, you can point out things that the attorney, who lacks your technical expertise, may not know or recognize. You can advise the attorney about reports that may be generated by software, that could be relevant to the case. You can advise about photographs that should be taken or documents (such as network use policies) that should be obtained.

When you examine evidence, point out information that is unfavorable to the case as well as that which is favorable, so the attorney can be prepared for that information to be brought up. Provide the attorney with articles, papers, etc. that shed light on the subject matter. If you’re familiar with the person(s) who will testify as expert witnesses for the opposing side, advise the attorney about their strengths and weaknesses.

Testifying in court


It goes without saying that you should present your most professional demeanor from the moment you arrive in court. Dress professionally and conservatively. Be cordial but serious. Don’t allow the opposing attorney to provoke you into making angry or emotional statements or blurting out answers without thinking about them.

When testifying, don’t use technical jargon or try to “sound smart.” Explain things in simple language that’s understandable to the average non-technical person. Juries and judges are often not technically savvy at all. Don’t talk down to them, but use plain words and analogies to explain difficult concepts. Here are some tips for testifying effectively:

  • In direct testimony (when being questioned by the attorney that called you to testify), answer only the question that is asked. Don’t expound on the matter until or unless you’re asked to do so. If you’re asked a yes or no question, answer yes or no without explanation. If the attorney wants you to say more, you’ll be asked to elaborate.
  • If you don’t know the answer to a question, say so. Don’t make something up or evade the question. Don’t offer opinions that are not in your area of expertise.
  • If you don’t understand the question, ask for clarification and don’t answer it until you’re sure you understand it.
  • Pick your words carefully. Be sure to say exactly what you mean.
  • In both direct and cross examination, if an attorney objects to a question you’re asked, don’t answer the question until the judge rules on the objection.
  • Use visual aids (white board, video, photographs, slides, computer demonstration, etc.) to help explain difficult concepts, demonstrate how a particular task is accomplished, or show relationships of items to one another.
  • Be able to back up your opinions and conclusions with hard data.

Summary


IT professionals who are recognized as experts in their fields have the opportunity to help convict criminals in computer crimes cases or see justice done in civil litigation cases that involve technology, and make some extra income at the same time, by serving as expert witnesses for the prosecution, defense or one of the parties to a lawsuit. However, preparation, qualification and testimony in a court case are serious undertakings that involve a great deal of work, and you need to know what you’re getting into and what to expect before you take on the challenge.




"

Comentários

Postagens mais visitadas deste blog

Improve Windows Security By Closing Open Ports

Improve Windows Security By Closing Open Ports : " A standard Windows operating system has a number of ports open after installation. Some of these ports are needed for the system to function properly while others might not. These ports can pose a security risk as every open port on a system might be an entry point for a malicious user. A port basically allows communication to or from the device. Characteristics are a port number, an IP address and a protocol type. This article will give you the tools at hand to identify and evaluate the open ports on your Windows system to make a decision in the end whether they can or should be closed or left open. Software programs and tools that we will use: CurrPorts : Available for 32-bit and 64-bit editions of Windows. It is a port monitor that displays all open ports on a computer system. We will use it to identify the ports and the programs that are using them. Windows Task Manager: Also used to identify the programs and link some p

Diagnosing a Blue Screen of Death Error in Windows

Diagnosing a Blue Screen of Death Error in Windows : For many years now the famous Blue Screen of Death (BSoD) has been the ultimate indication that something disastrous has happened to make your computer die, but how useful is the information in the BSoD and the respective crash dump file that Windows produces? The best article I ever found explaining the BSoD in depth is here on the Microsoft website, however it’s quite technical and doesn’t discuss how to actually troubleshoot a problem. The crash dump file is just technical details of what was being held in the computer’s memory at the time of the crash, and this will include details on every driver and service that was loaded, and every piece of software that was running. The most useful pieces of information are to be found on the BSoD itself and are highlighted on the screenshot below. These are the BSoD error name, the stop error code and the name of the driver or service that has failed (this last one might not always appea

Use BGInfo to Build a Database of System Information of Your Network Computers

Use BGInfo to Build a Database of System Information of Your Network Computers : " One of the more popular tools of the Sysinternals suite among system administrators is BGInfo which tacks real-time system information to your desktop wallpaper when you first login. For obvious reasons, having information such as system memory, available hard drive space and system up time (among others) right in front of you is very convenient when you are managing several systems. A little known feature about this handy utility is the ability to have system information automatically saved to a SQL database or some other data file. With a few minutes of setup work you can easily configure BGInfo to record system information of all your network computers in a centralized storage location. You can then use this data to monitor or report on these systems however you see fit. BGInfo Setup If you are familiar with BGInfo, you can skip this section. However, if you have never used this tool, it takes ju