I also agree with the whole 'balance' issue but if only one expert was assigned, appointed by the court, who was under no pressure one way or the other, surely they would produce a report that is free from any bias (intended or unintended).
This assumes, of course, that the expert was correct. Unfortunately, not all experts are.
For example, in a case in which I was involved, another expert noted that there was an apparent inconsistency in the presence of temporary files in the OLKXX directory, which is where e-mail attachments are temporarily cached in Windows. Available LNK file data showed that some temporary files had been present in the past, but had been deleted while other files were intact. He concluded that this was evidence that the missing files had been "surgically removed."
As it would happen, the real explanation lies in the fact that when messages containing attachments are opened in Outlook, if the message is closed before the application used to view the attachment is closed, the attachment will persist in the OLKXX folder, however, if the attachment is closed before the message, the temporary file will be deleted.
The difficulty is that is not a well documented feature of Outlook/Windows. In fact, at the time that this case was heard, there was a single reference to this in the Microsoft Knowledge Base and unless you knew the precise terms needed to search for it, you wouldn't be likely to find it.
Had this expert been appointed a special master, he might have erroneously concluded that spoliation had occurred when it hadn't.
What I am trying to say is that while there can be a benefit to the use of court appointed experts, there is also the opportunity for error. In my own experience, when both sides use a common expert it is frequently the case that one side ends up disagreeing with that expert's conclusions and hiring their own expert for rebuttal. In many cases, both sides are not willing to agree to a court appointed expert for obvious reasons.
I honestly don't see what the problem is seeing as expert witness' first duty is to the court, not the client.
Ah, but the Court doesn't pay your bills.
Seriously, in civil cases it is understood that the role of the expert is to advocate for his or her client. This does not mean to suggest that the expert should perjure his or her self nor, indeed, violate any other code of professional conduct or rule of law. But it does mean that when you are retained by a client, you have a duty to that client and unless you are an officer of the court, your duty to the court is no different than that of any other citizen. If your findings make you uncomfortable with the thought of advocating for your client you are free to discharge the client.
As for the "damaging" effects of the adversarial process, in my view it takes two to tango. When working on the side of the plaintiff or prosecutor, I do my best to limit my conclusions to those matters which I feel can be convincingly demonstrated by the evidence. But as a defense expert, I am often put in the position of having to rebut the points made by the adversary which means it is the plaintiff who controls what I must do. In many cases I have found that the adversarial nature of the case has led to a more refined view of what constitutes digital evidence and what conclusions can be drawn from it. Over time, this process can actually benefit our field because it pushes crackpot theories out of the playing field.
I honestly don't see what the problem is seeing as expert witness' first duty is to the court, not the client.
Ah, but the Court doesn't pay your bills.
Seriously, in civil cases it is understood that the role of the expert is to advocate for his or her client. This does not mean to suggest that the expert should perjure his or her self nor, indeed, violate any other code of professional conduct or rule of law. But it does mean that when you are retained by a client, you have a duty to that client and unless you are an officer of the court, your duty to the court is no different than that of any other citizen. If your findings make you uncomfortable with the thought of advocating for your client you are free to discharge the client.
As for the "damaging" effects of the adversarial process, in my view it takes two to tango. When working on the side of the plaintiff or prosecutor, I do my best to limit my conclusions to those matters which I feel can be convincingly demonstrated by the evidence. But as a defense expert, I am often put in the position of having to rebut the points made by the adversary which means it is the plaintiff who controls what I must do. In many cases I have found that the adversarial nature of the case has led to a more refined view of what constitutes digital evidence and what conclusions can be drawn from it. Over time, this process can actually benefit our field because it pushes crackpot theories out of the playing field.
Good post. It'd be interesting to hear from UK based forensic examiners and where their duty lies in civil cases.
Ah, but the Court doesn't pay your bills.
I can understand the argument and, as before, I agree with key points.
In cases where I've been on the defense team I've usually been paid through legal aid as most people can't afford to pay their fees, I just think that this wuld be a simpler method rather than the government paying twice for, effectively, the same examination.
I am a private computer forensic expert who does mostly work for the defense because I am referred by other defense attorneys. A large percentage of my defense work is for possession of CP. I don't necessarily like this work because of the horrible images and horrible people connected with them but it is a lot like performing autopsies, you have to steel yourself and concentrate on the science to determine who is guilty and who isn't. Just like a doctor performing an autopsy, you call it as you see it and let others decide how to use that information. I find a lot of personal satisfaction when I can determine that the accused is guilty as charged and tell the defense attorney this guy needs to be put away. Just as I do when I find an innocent man has been falsely accused and can present the evidence to prove it. What I do is find the truth. The victims deserve it and the innocent deserve it. I have the deepest respect and admiration for the LE examiners who look for evidence of innocence as much as evidence of guilt. Because they do the same thing I do. LE who just finds a picture in UA and turns it over to the prosecutors without looking to see if there is any possibility the defendent didn't knowingly acquire it either by accident or someone else using his computer do a great injustice. I'm strongly against child abuse but I am just as strongly against hammering an innocent person. I've had LE tell me that they wouldn't do the work I do. To me that is a sure sign they are biased. What if one of their colleagues, friends or family was accused of CP possession and asked them to help. What if they said, "Man I didn't do it, honest, I didn't want it and didn't know it was there." Would the LE examiner refuse to help? Would he refuse to use his talents and training just because it was for the defense? If he wouldn't, then why would he do this for his friend but not for a total stranger who just as entitled to his talents as his friend? I think LE thinks that if they work for the defense, they have to hide evidence and lie due to an obligation to "win" the case for the one who's paying them. That's not true and the expert has the opportunity to excuse themselves from any case where the defense attorney expects that. Seanmcl hit the nail right on the head with what he said. Computer experts, whether for LE or for the defense, should be driven to find the truth no matter what the consequences for who they work for. In a perfect world, one expert using peer reviewed software and tools could work for the court and provide all the evidence. But in the real world, biases and agendas enter into human activities whether conciously or not. It helps to have opposing experts working on a case. Sometimes we learn a great deal from each other and it makes us both better experts to find the truth in the future. I enjoy sharing the tricks and tips I've discovered on my own with LE and I would hope they feel comfortable sharing their knowledge with me. Virtually all the LE experts I have met have been true professionals who are as passionate about the truth as I am. I have run across private experts who were incompetent but I haven't run across any yet who would lie or deceive for their attorneys. I doubt there are many out there who could continue practicing if they did.
This field begs for people of integrity and skill to learn as much as they can about the science and then to apply it to discover the truth whether it is for the prosecution or the defense. I know the arguments between the lawyers can get pretty dirty and pretty intense, but the arguments between computer experts should be on the truth of the evidence and we should support and encourage each other to find that truth.
These forums are a good place to do that and I hope we can get away from the "us versus them" mindset between LE and defense experts. We all want justice for the victims and justice for the innocent. Anyone who doesn't should not be accepted by either side in this community.
Here, here!
Last week I was teaching a class in Vegas and this topic was brought up. I wanted to find out the students initial response, and then discuss the topic, and see their reaction after a bit of thinking about being a forensic practitioner, an expert, our adversarial legal system, etc.
Without a doubt as they were new to the field many indicated that they were unsure or maybe defense work wouldn't be for them.
However, after my soap box lecture, indicating that when _you_ are in the chair you will want the most qualified expert to assist you (or you child, your grand child, your spouse, your friend or colleague, etc.), every single student agreed that working as an expert for the defense is not A) something bad, B) inherently evil C) or should preclude you (the expert) from membership or participation.
What is important is that both sides have competent experts to assist in their case. Not all defense work is child pornography. Not all defense counsel and experts are bad people or liars. Not all prosecution is fair nor just. Not all police are honest, competent, or neutral in their work and findings.
If we agree that the forensic practitioner is to analyze data and report their findings and conclusions in a neutral manner, with no predisposition as to guilt nor innocence, then one should be comfortable working any case from either side. But …
Cheers!
farmerdude
http//
http//
To those posters who feel they could never work for the defense, or for a client so obviously guilty I envy your certainty. I am merely a fallible mortal, not some super-being who can decern guilt and innocense from a cursory examination of a few suspect images.
One suspects that the 9/11 hijackers bore a similar mindset.
How does one KNOW a person is guilty? Only by rigorously respecting all his rights (even those that just get in the way), following all procedures (ditto), and never forgetting that there are innocent men on death row. As has been proven repeatedly.
A little humility might help also. To wit, I have yet to receive from any board member heartfelt assurances that their work product is anything but an educated guess. Example The email attachment issue. Sure looks black and white, doesn't it, until you learn more of the products involved. EnCase's impressive– and imposing– printouts are predicated on, for one thing, timestamps. Which are trivially modified. And since when did the presence of anti-forensics tools equate to possession of burglary tools?
LE– in my admittedly limited experience– tends to wear their purity as a badge of honor. Whatever, a shiny badge, pure thoughts, and otherworldly benefits package– while all quite impre$$ive– does NOT make one right. Perhaps one is convinced one is right, can see no alternative which would throw doubt on this rightness– see the email issue– but a humble man (by definition NOT in LE) would step back. And attempt to find fault with his hypotheses.
But I could be wrong.
To those posters who feel they could never work for the defense, or for a client so obviously guilty I envy your certainty. I am merely a fallible mortal, not some super-being who can decern guilt and innocense from a cursory examination of a few suspect images.
You certainly read the responses differently than I did. I even went back and re-read the posts from those that stated a choice not to perform criminal defense and I did not interpret their choices as being based on "a client so obviously guilty". Many who stated a choice to not perform criminal defense work are former LE and would not be personally comfortable working for the defense (possibly opposing their mates/friends or because of their previous experiences), which has little to do with guilt or innocence it is just a preference.
Also defense is a side of the prosecution/defense equation not based on a predisposition of guilt (is it not innocent until proven guilty?). So the certainty of working for the defense or prosecution is really based on the chosen sides of the equation and not a fallible mortal judgment based on guilt or innocence.
As far as your comments regarding LE examiners, I think you should consider the previous response of mark777
I am an LE examiner and most of my time is spent doing CP. When I conduct an examination I act as an independent examiner. I do not just look for evidence to prove the suspect committed the offence but I also look for evidence to say he/she didn't. I have no time at all for Child abusers but my role is the administration of justice. Can you think of anything worse than being branded a paedophile when you are not just because somebody couldn't be bothered to do their job right and was only interested in data that said you had this stuff on your computer and didnt bother making sure it was you who put it there. I get as good a feeling proving someone innocent as proving someone guilty.
To those posters who feel they could never work for the defense, or for a client so obviously guilty I envy your certainty. I am merely a fallible mortal, not some super-being who can decern guilt and innocense from a cursory examination of a few suspect images.
It's easy to speak up and say what we should be able or willing to do as impartial examiners. Just as you (sarcastically) recognize your fallibility I tried to genuinely express mine. We are human beings after all, that makes us fallible. I’m not sure how many depictions of child rape you have to look at before you reach a point when one decides as I have the type of work I will or wont do. I suspect that for most people there is a limit.
Before you deride our integrity you need to understand a little about what a law enforcement examiner does. Most of us are investigators as well. I assure you that cases are built on much more than time stamps as you suggest. In fact they are built on more that the digital evidence itself. First there is the evidence that leads us to seize the computer in the first place. Then there are the suspect’s statements (in the vast majority of cases they admit the crime), and other evidence recovered during the service of the search warrant. Only then do we look at the computer.
Can I be impartial in my analysis and still not want to work for the defense? Absolutely, the evidence is either there or it isn’t. I rely on my training and experience to interpret that evidence. I do so without prejudice. You are right in that we go to court “sure” of the suspects guilt. If I’m not sure of it I have no business making the charge. That surety is based on far more than “a cursory examination of a few suspect images”. I have been involved in many cases where we have declined prosecution because the evidence simply was not strong enough, or there were other possible explanations.
You betray your own prejudices when you say that law enforcement examiners are by definition not humble. To be frank I don’t appreciate your mischaracterization of the work of a law enforcement examiner. I would suggest that you learn more about computer forensics first; perhaps then you’ll understand a little better what goes into a proper analysis.
…Many who stated a choice to not perform criminal defense work are former LE and would not be personally comfortable working for the defense (possibly opposing their mates/friends or because of their previous experiences)…
Not sure I understand this. Would LE decline to, for instance, investigate, arrest, prosecute, and escort to prison, these same "mates/friends" regardless of guilt? You are either a professional or you are not. There is no semi-pro state. Or is this my naivety on display?
I know, I know… I cannot know the stresses of the Badge.
…I’m not sure how many depictions of child rape you have to look at before you reach a point when one decides as I have the type of work I will or wont do…
This would not be a plea for sympathy, would it? "You simply cannot know the EVIL I have seen. My puirty and motives are not to be questioned by one so unworthy as you."
I have seen a similar jaundiced outlook in an emergency room physician. If I had to guess this is something of an occupational hazard among those who Plumb The Depths of Human Existence.
An explanation, perhaps, but certainly not an excuse. If one wishes to argue a position it is best to stick with facts. Not emotions– "My wife has cancer so please cut me some (professional) slack." It weakens your position.
… you need to understand a little about what a law enforcement examiner does.
Yep, that is the problem. If I only understood I would be, well, a duplicate of you. No questions because… questions mean I do not understand. Which conveniently relieves you of the burden of proof.
You betray your own prejudices … I would suggest that you learn more about computer forensics …
This is actually priceless. It is my ignorance and prejudices which prevent me from joining LE on the Light Side. Ever hear of VNC? It allows a remote user (thousands of miles away) to take control of a target machine. Which back in the Dark Ages was how computing was done… terminals and servers. The same concept behind botnets. The person actually sitting at the machine would know naught of this unless he knew how to look. As he explored www[dot]jobsinlawenforcement[dot]gov and read the Campus Crusade For Christ discussion board his computer was the epicenter of Cyber Depravity.
But to LE– and the Prosecution Apparati– when a machine "goes" to an illegal website, downloads, transacts, chats, whatever, it is PROOF that the user sitting at the machine is the Bad Guy. "Your Honor, EnCase shows…" Forget about the Ukranian uber-whiz who actually committed the Evil Acts.
Ever participate in a no-knock warrant only to discover a grandmother whose PC has been hijacked? Red faces all around but… and this is key… in the state of California that kindly old lady is by definition a sex felon. She had possession and control of CP. And once the state is through then the feds will take their shot. Or vice versa, whichever jurisdiction won the "First to Prosecute" coin toss. An absurd case? Does the law allow for such trivial concepts as innocent presence when computers and CP are involved?
No, Officer Friendly, I "suggest" (insofar as it is even my place to presume to suggest to anyone) that you expand your skillset. LE is fighting a modern war with ancient tools. Preposterous! you say? Think the 1939 Polish horse-mounted cavalry as it charged German tanks. Those Polish generals were certainly convinced in the righteousness of their thinking…
This has devolved into a flamefest, not the reason I joined the board.