For the defense

Larry,

I am a L.E. examiner who does private work as well. Obviously now I don't do defense work as it would be a conflict of interest. I have given much thought to the question of whether I would when I leave law enforcement. The answer for me is no.

A large percentage of the analysis I do are child sex offenders. It varies, but at least 50%. I am answering under the assumption that these cases would make up a large percentage of the work I would do working for the defense.

I am not one who disparages that work at all. I think it is very important, just as the work of the defense attorney is important. I believe that a strong defense is an essential element in any prosecution. I also believe that defense experts make prosecution experts better in the long run.

Still, maybe it's easier for someone who is not "crossing over". I have seen too much over the past nine years. Unspeakable evil that I'll never forget. I could not bear it if another child was victimized because of the work I did.

I can imagine examining a computer and pulling out bits and pieces to establish reasonable doubt. But what if, in the big picture, you don't believe that there is any doubt at all? Do you get the opportunity to say that?

In short, I do think it's necessary, but not something I will ever do.

A very honest answer, Greg, thank you. I'm sure it will strike a chord with many others.

What do others think of Larry's questions? Indeed, what do you make of Greg's reply?

I am a former LE forensics examiner who has been in private practice for over 4 years now. The vast majority of my cases are civil litigation - not because I won't do criminal defense, but because that's where the action is, at least in this market. There are enough civil disputes to keep you busy if you choose not to do criminal work.
I've assisted the defense in criminal cases 6 times and 3 of those involved CP. None of those 3 went to trial because I advised my client that LE had a solid case and there was nothing I could say that would help the defendant. Everyone is entitled to a competent defense, but you don't have to compromise your integrity or your ethical standards to give them one. I don't tailor my reports to fit the desires of my clients. If they want an opinion unsupported by the facts, they can shop elsewhere.

I think criminal defense is probably as specialized as the financial/fraud work that we perform. Since everyone is entitled to the best defense, I feel we would be ill equipped to even consider criminal work. For example I read many of the posts here and on other forums about chat programs, sharing programs, etc. that are used in trafficking IIoC and we never run into those programs in our work. Likewise investigators involved in criminal defense work probably do not deal with Quickbooks, Peachtree, Sage, Excel and all the industry specific bookkeeping solutions as often as we do. How could an investigator contribute to a proper defense if they have no knowledge in the subject area?

On a personal note, my brother is in LE, because of that I have numerous friends in LE, two of my groomsmen are in LE, and I do some low cost work for some of the smaller LE agencies in the area that do not have CF in-house, so I would not be inclined to do criminal defense work.

I have worked for both the prosecution/plaintiff and the defense, though most often for the former.

I have no problems working for the defense as long as my task is to determine, to a reasonable degree of forensic scientific certainty, what the computer evidence indicates likely happened.

We always make it clear (and our standard consulting engagement agreement specifies this), that we cannot suborn criminal activity nor can we suppress evidence. We also state that should our investigation unveil any evidence of criminal activity or threats to life or property, they will be reported to the appropriate legal authority (in addition to our client or their legal representative).

That having been said, we have turned down a few cases because we didn't feel we could add anything of value to the case. In one instance, we prepared a report which was never used as evidence. It was in a case of shooting death in which our client was pleading self defense. The computer evidence did not paint him in a very flattering light and, at least circumstantially, might have called into question his version of events, but the prosecution had access to the same information and chose not to use it nor, indeed, any of the computer evidence for their case. Since the issue was not one of fact but of interpretation, the defense chose not to use the report nor did they provide a copy to the prosecution.

Those are excellent and considered responses. Thank you all very much for taking the time to share your positions.

I don't approach criminal cases as an advocate, but as a forensics professional who's job it is to locate, verfiy and present the facts to the defense attorney, good, bad, or ugly.

My concern is not so much with the facts as the LE guys on the other side do a great job of finding and delivering the facts in the cases I work.

However, those facts are subject to interpretation and presentation in court. To me, that is where I feel that I can bring balance to the table.

It is one thing to tell a jury that there were 200 hits on the word murder found on the computer and quite another to explain that a raw hit number can be very inaccurate due to duplicates, etc. and to show the actual number of unique hits that are relevant.

My point is that once the LE forensics team gives a report to the prosecution, it is up to the prosecuting attorney to argue the facts and present an interpretation.

My job is to just try to keep both sides honest. )

The other big challenge is that defense attorneys are not computer savvy people for the most part and can end up at the mercy of the state if they do not have someone to guide them through the process of reviewing the digital forensics data and reports.

I completely understand why people would not want to work for the defense based on their past experiences in law enforcement or for other reasons.

To me, it is about trying to keep representation fair as much as I can through my contributions to the system. And I have developed a real passion for it because of that.

And yes, doing defense work is very specialized since the criminal side of the justice system does not work much like the civil side at all.

Friends of mine are L.E. and they have an opinion that Digital Forensics should be a restricted area, because they think "bad guys" should not advised with tricks to prevent detections in digital crimes. Hence, lots of tools, such as COFEE?, should be restricted from public.

I have a thinking that digital forensics should have at least 2 aspects on its bright side

1. It serves and helps investigators, especially the L.E. to locate the trace or evidence in a digital crime case, and/or;

2. It is absolute independent from any side, to find facts that whether a crime has been committed (by the computer or a person) or not. In other words, any professional in Digital Forensics should produce the same results and reports on a investigated case.

Any comments?

There is a definate preference to try to restrict private forensics consultants from operating on the defense side. At one time Guidance Software was going to exclude us from their forums and restrict consultants to a single forum.

In my mind, once you start restricting tools that can be used for the defense, you may as well start restricting access to other expert tools as well.

It kind of like restricting the law books to just the prosecutors.

Friends of mine are L.E. and they have an opinion that Digital Forensics should be a restricted area, because they think "bad guys" should not advised with tricks to prevent detections in digital crimes. Hence, lots of tools, such as COFEE?, should be restricted from public.

That argument makes little sense to me for a couple of reasons.

First, the defense is entitled to examine witnesses, evidence, etc. If the prosecution introduces evidence obtained through the use of tools which are only available to LE, I would submit that a good case could be made to exclude this on the basis that the defense has no ability to question the reliability of the tool or of the process by which the evidence was obtained.

But, more importantly, it is simply not that hard to get ahold of copies of LE restricted tools if you're determined to do it. I know of at least one IT forensic company that uses more than one tool which was supposed to be restricted to LE. I assume that they had personnel on their staff who were former LE and brought the tools from their old jobs. While it may not be possible to present evidence obtained through the use of these tools in court, if the argument is to protect the technology from antiforensics exploits it is too late. The cat is out of the bag.

Finally, and most importantly, there is a great deal of information which is simply not published and through the exchange of knowledge acquired from forensic examination and experimentation, our profession is constantly enhancing its knowledge base. This knowledge comes from both the LE and private sector forensics communities and I'd venture to say that neither community would be as successful without contributions from the others. The benefit of this open exchange of knowledge, I believe, far outweighs the risks of such knowledge being used for nefarious purposes, IMHO.