Court - Expert Witnesses - Explaining Complex IT Theory

Hi Steve,

I'm currently on the expert witness Bond Solon training at the moment which does discuss some of these areas. I also found this thread helpful in understanding some of the different analogies people use.

Getting the Jury to understand what your saying is definitely a challenge expert witnesses face when under cross-examination, especially if you have a decent defence barrister who will try to undermine your integrity.

I'm actually going to get cross examined tomorrow by Rob Gray (as part of Bond Solon's training course) on one of my expert witness reports I produced as part of my university degree. I've seen him cross-examine professionals on real previous cases (on the training course) and it's scary to see the way he spins such trivial errors (page numbering for example) into a way which makes you look like you don't know what your saying, but in a safe environment where nothing can go wrong!

Your point about a jury not understanding what you are saying - if they are unsure about any of the points and are confused about the evidence you have presented then they are instructed not to come to any decision. After all, if you just get 3 of the 12 jurors to come to this same conclusion then your case will not progress any further as you need them to come to an almost unanimous decision (10 out of 12 I believe).

Thanks Chris

Really appreciate your time responding!

Good luck tomorrow!

Thanks for the link. In my opinion, it is worrying how 'exposed', within the court environment, some digital forensic expert witnesses seem to appear, but also does supports the fact how key a robust 'audit trail' is, to support any expert witness statement.

Personally, I do not feel that any expert witness should enter a court environment, concerned at what a defence barrister will ask. Maybe that is a rather 'purist' view….but something I feel, however things are going to get more complicated in the future e.g. how would you explain TOR (Onion-routing)?

Re the jury. Having been on a jury…I am not 100% sure how many people are willing to admit their lack of understanding. Look at the number of IT-related fraud cases (e.g. 419s) not reported… But I guess that is a different discussion outside the remit of this forum!

Steve

I'm actually going to get cross examined tomorrow by Rob Gray.

Lucky you, I still have the scars! )

Give him my regards.

I find the challenge is more about trying to convey the bounds of your analogies. For example, you can give an analogy for deleted files, unallocated fragments and so forth. So many people use things like a encyclopedia removing references to entries and so forth, a video library perhaps, the list goes on. Once you get past a few steps, and into describing how the entry could still be there, but the data overwritten, or vice versa, its easy to lose some of the jury. Then, often enough an opposing barrister will be trying to deduce something from that 'ah, so in that case………', which would then need explaining why exactly that could or could not be the case depending on a variety of factors/processes, human interaction or not, and so forth.
Dates and times as you rightly say are ALWAYS a nightmare, I don't know many people who find otherwise. You can always try to explain what the various timestamps mean in general terms, common ways they should be treated with caution (disabling of last access, copying/cutting, moving from different media/media types and so forth). Then no doubt you'll end up with the opposing side going 'ahhh but what about this one', pointing to a timestamp that essentially makes little sense. Again suddenly going into a discussion about how that might have been perhaps copied from another device such as a USB stick used on a computer with a differently set clock, been a timestamp preserved by a backup/archive utility, the list goes on!
Shadow volume copy entries are always fun too. (especially if its about just a fragment from that area which didnt warrant the longer process of trying to mount/image this area or wouldnt be paid for by the client/requesting authority) 😉
To be fair to juries i think they usually give things due consideration and don't just accept things, and would certainly say that from my experience of jury service as well. However if it all becomes a bit too confusing/technical relating to many different items/aspects and potential scenarios, then i think it definitely comes down to the individual juror as to whether they try to make the best judgement from all they heard or understood, get led by other jurors, or just comment/decide based on a few bits that stuck in their mind.
Its not only the jury that can have trouble understanding things, you'll get a wide range of IT literacy from counsel too, and their own level of knowledge can definitely both help and hinder things in many ways. A novice barrister could just misunderstand everything and fail to represent their client properly due to a lack of even basic IT literacy, similarly an extremely IT savvy one, could keep bringing up things either deliberately to muddy the waters, or accidentally on the basis that a little knowledge is a dangerous thing, drawing many wrong conclusions and confusing all concerned.

I'm not sure analogies are a good idea as they invariably only fit for a narrow area of the topic under discussion and then if they get tested by opposing counsel it can become confusing. Best to stick to trying to explain in simplified terms the actual issue.

Pat

Thanks Rich and Pat.

Just illustrates what a minefield it can be…

Rich - re your jury - you must have been lucky. Mine were asking for the death penalty…as the charges were being read out.

SteveD you can use analogies in order to communicate the technical issue into a language a court may appreciate. For instance, you might want to find an analogue about IP addresses

"It may help the court (as an anology, and generally speaking) to perhaps think of an IP address as a Post Code, identifying where communications are sent and received…."

Quite often I use the analogy the

IMEI (the handset serial number) is the equivalent of a vehicle chassis number

MSIDN (the mobile telephone number) is the equivalent of a vehicle registration number

If any expert get to the point of being flustered or it seems like they aren't an expert on something other than the data itself being presented, then they are a poor expert.

You're taking a course so you want to learn how to do it or learn how to do it better. A good expert can go Spin city on opposing counsel when they try to do things like that. That's why this business isn't for everyone. If you can't think fast on your feet and hurl right back at them, then you're a dead duck. You can do things to slow the pace down, but you do so at the risk of your reputation to the Judge or Jury. you can ask for questions to be repeated, or rephrased but once again you do so at your expense. In my opinion the real beauty to being an expert witness is to take such instances and make the person questioning you come out as a bully and grasping at straws.

On cross it's told to use short answers but not so short you come across as smug or holier than thou. As tactics change, so must you.

What I find funny about being en expert witness is that there is so little training, most people MAY get 1 mock court (which is totally watered down) and that is their experience. Would you get 1 forensics class and consider yourself an expert? You need a month of mock trials every single day, several times a day to get good at your craft.

__________________________________________________________
I'm actually going to get cross examined tomorrow by Rob Gray (as part of Bond Solon's training course) on one of my expert witness reports I produced as part of my university degree. I've seen him cross-examine professionals on real previous cases (on the training course) and it's scary to see the way he spins such trivial errors (page numbering for example) into a way which makes you look like you don't know what your saying, but in a safe environment where nothing can go wrong!

I did not realize Bond Solon did training in the US.

Can you provide some links?

Or, did you travel to UK?