Education

Testifying as an expert witness in computer crimes cases

As an IT pro, it's possible that you may be called to testify as an expert witness in cybercrime cases if your training and expertise qualify you. Deb Shinder tells potential expert witnesses what to expect and how to prepare.

In the U.S., our criminal justice system consists of three major branches: law enforcement, the court system and the corrections system. Law enforcement officers are charged with detecting criminal activity, identifying and apprehending suspects, and gathering evidence necessary to convict a suspect in court. The court system is responsible for examining the evidence presented by both the prosecution and defense, rendering a verdict (either by judge or jury), and deciding punishment. The corrections system carries out the punishment.

Evidence can be physical (actual objects), intangible (intellectual property) or direct (what some person saw, heard or otherwise experienced with one of the five senses). Regardless of the type of evidence, its presentation in court is done through witnesses, persons who testify under oath to facts or veracity of physical evidence.

When we think about witness testimony, most of us think first of material fact witnesses (lay witnesses). These are persons who have first-hand knowledge of matters relating to a particular case. For example, if you as an IT professional observed child pornography on the computer of one of your users at work, you could testify to this as a material witness.

An expert witness, on the other hand, is not involved in the case at hand, but has special knowledge and expertise pertaining to the subject matter of the case. For example, if you are recognized as an expert in the subject of malicious software, you could testify as to whether and how a malware infection could cause illegal pornographic images to be downloaded to a person's computer without his or her knowledge. A major difference between material fact witnesses and expert witnesses is that the former are not generally allowed to give opinions or draw conclusions, whereas experts are. Another difference is that expert witnesses are generally paid for their testimony (by the prosecution or defense, depending on the side for which they're testifying).

If you're an expert in computers, networking, and related matters, you might be able to qualify as an expert witness in court cases (both criminal and civil) that involve the use of computers and networks. Here's what you can expect if you go the expert witness route.

NOTE: Prosecutors and defense teams also sometimes employ "consulting experts," who provide technical explanations and opinion in helping the prepare the case, but don't actually testify in court.

Qualifying as an expert witness

Court systems cover different jurisdictions (city, county, state, federal) and each jurisdiction has its own set of rules. Most are based on the Federal Rules of Evidence, which say, "If scientific, technical, or other specialized knowledge will assist the trier of fact to understand the evidence or to determine a fact in issue, a witness qualified as an expert by knowledge, skill, experience, training, or education, may testify thereto in the form of an opinion or otherwise, if (1) the testimony is based upon sufficient facts or data, (2) the testimony is the product of reliable principles and methods, and (3) the witness has applied the principles and methods reliably to the facts of the case."

To testify as an expert, you must be formally qualified and accepted as such by the judge presiding over the case. This qualification process is generally "on the record," with questions asked of the witness in court to establish his/her expert status (this is called a voir dire examination). Because juries tend to believe whatever a professed expert says without question, judges must be convinced that you are competent, knowledgeable, and credible before allowing you to testify. To establish you as an expert, the attorney that is calling you to testify will ask you questions about your education and training, skills and experience, awards and recognitions, and so forth. Some factors that help to establish your expertise include:

  • Advanced academic degrees or advanced training in your field.
  • Area(s) of specialization within the field.
  • Recognition as a teacher, lecturer or trainer in your field.
  • Professional licenses, if applicable.
  • Membership in professional organizations; positions of leadership within such organizations.
  • Publication of articles, books, and other materials, especially peer-reviewed works.
  • Long-term work experience in your field.
  • Technical certifications.
  • Awards and recognitions within the industry.

This is the easy part. The more difficult part comes when the opposing attorney is allowed to question you, and will usually attempt to discredit you as an expert. Be sure to tell the attorney for whom you're testifying if there is anything in your background that could be used to discredit you (job terminations, failures or disciplinary measures in school, drug/alcohol programs, conflicts of interest and so forth).

In some cases, the opposing attorney may stipulate to the witness's credentials. This doesn't mean you're off the hook. In fact, it may mean that the opposing attorney believes you have weaknesses that can be exploited in cross examination after you've testified on the subject matter.

Having been qualified to testify as an expert in previous court cases may carry weight when the judge is evaluating your qualifications, but it doesn't guarantee that you'll be deemed qualified to testify. And every expert witness obviously has to testify for the first time before going on to build a reputation as an expert witness. If it's your first time to testify, the more education, awards, publications and so forth that you have, the better.

In some cases, lack of experience in court can even be a positive factor (assuming your creds are solid otherwise) as you may be less likely to be seen as a "professional" witness who will say anything for money.

It's important to know that an expert witness cannot have any vested interest in the outcome of the trial. This means even if you're otherwise qualified, you would not be found competent to testify in a case where your employer, for example, was the defendant (in a criminal case) or a party to the suit (in a civil case). Not only must you be unbiased, you must also avoid even the appearance of bias.

Note that if you testify as an expert, notes, reports and opinions you prepare in relation to the case are subject to discovery and must be produced for examination by the opposing side. Be careful in your note-taking and avoid recording anything that might be misleading.

Get it in writing

When you're asked to testify as an expert witness, clarify what will be required of you (research and testing, consulting, testifying in a deposition, testifying in court). Clarify what, when and how you will be paid. Normally, travel and other out of pocket costs will be reimbursed along with the hourly fee for your time. Get the agreement in writing.

The contract should cover such matters as whether you will need to provide estimates of your expenses or get permission for expenditures over a specified amount, whether you need to keep task and/or travel logs to account for your time and expenses, whether you can subcontract pre-trial work such as research and testing, and what the deadlines are for any work you must produce, such as the summary document discussed in the next section.

Preparing to testify

Under Federal rules, you can't just go into court and testify off the top of your head. You're required to first create a written summary which includes not just your opinion regarding the subject of the case and the basis for that opinion, but also a record of your previous testimonies and depositions, a list of your publications and a disclosure statement that includes, among other things, compensation you're receiving for your testimony. This is prepared in conjunction with the attorney for whom you're working.

Regardless of how well you "know your stuff," preparation is essential, especially for your first appearances in court. Pre-trial preparation allows you to clarify exactly what area of your expertise is being requested, why the attorney needs expert testimony and what issues will be addressed. Witness lists must be shared with the other side during the discovery process. Find out what other experts will be testifying, both for the side for which you're testifying and for the opposing side. Particularly in the case of opposing side witnesses, find out as much as you can about the witness, read what he or she has written on the relevant subject matter and try to anticipate the arguments that the opposing attorney will make based on the witness's testimony. Many court cases turn into a "battle of the experts" and you must be prepared to have what you say rebutted by others who are also recognized as experts in your field.

Be prepared for the fact that the opposing attorney is allowed to question you about your compensation. There is nothing illegal or unethical about getting paid for your time as an expert - but the opposing attorney will try to use it to imply to the jury that you've been "bought off" and thus your testimony isn't reliable or trustworthy.

Being part of the team

As an expert, you can point out things that the attorney, who lacks your technical expertise, may not know or recognize. You can advise the attorney about reports that may be generated by software, that could be relevant to the case. You can advise about photographs that should be taken or documents (such as network use policies) that should be obtained.

When you examine evidence, point out information that is unfavorable to the case as well as that which is favorable, so the attorney can be prepared for that information to be brought up. Provide the attorney with articles, papers, etc. that shed light on the subject matter. If you're familiar with the person(s) who will testify as expert witnesses for the opposing side, advise the attorney about their strengths and weaknesses.

Testifying in court

It goes without saying that you should present your most professional demeanor from the moment you arrive in court. Dress professionally and conservatively. Be cordial but serious. Don't allow the opposing attorney to provoke you into making angry or emotional statements or blurting out answers without thinking about them.

When testifying, don't use technical jargon or try to "sound smart." Explain things in simple language that's understandable to the average non-technical person. Juries and judges are often not technically savvy at all. Don't talk down to them, but use plain words and analogies to explain difficult concepts. Here are some tips for testifying effectively:

  • In direct testimony (when being questioned by the attorney that called you to testify), answer only the question that is asked. Don't expound on the matter until or unless you're asked to do so. If you're asked a yes or no question, answer yes or no without explanation. If the attorney wants you to say more, you'll be asked to elaborate.
  • If you don't know the answer to a question, say so. Don't make something up or evade the question. Don't offer opinions that are not in your area of expertise.
  • If you don't understand the question, ask for clarification and don't answer it until you're sure you understand it.
  • Pick your words carefully. Be sure to say exactly what you mean.
  • In both direct and cross examination, if an attorney objects to a question you're asked, don't answer the question until the judge rules on the objection.
  • Use visual aids (white board, video, photographs, slides, computer demonstration, etc.) to help explain difficult concepts, demonstrate how a particular task is accomplished, or show relationships of items to one another.
  • Be able to back up your opinions and conclusions with hard data.

Summary

IT professionals who are recognized as experts in their fields have the opportunity to help convict criminals in computer crimes cases or see justice done in civil litigation cases that involve technology, and make some extra income at the same time, by serving as expert witnesses for the prosecution, defense or one of the parties to a lawsuit. However, preparation, qualification and testimony in a court case are serious undertakings that involve a great deal of work, and you need to know what you're getting into and what to expect before you take on the challenge.

About

Debra Littlejohn Shinder, MCSE, MVP is a technology consultant, trainer, and writer who has authored a number of books on computer operating systems, networking, and security. Deb is a tech editor, developmental editor, and contributor to over 20 add...

2 comments
jmswnstck
jmswnstck

In the UK - need an expert witness as had a bad builder - why are they so expensive? Go quoted 235 to do a small report on our patio which I think is extortionate. You can view it here: http://www.hdforensics.co.uk/

HAL 9000
HAL 9000

Now I know why I have fought with every Judge and Legal Professional when they attempt to call me an [b]Expert.[/b] I've personally never liked it all that much and have found things confronting when you are expected to know more than you actually do. But no matter how many times I have told these people I'm no expert in anything it has yet to stop them setting me as a Expert Witness who knows it all. What a joke. Of course it doesn't hurt to be perfectly honest and tell the Court that [b]You Don't Know[/b] every time you are asked something that is way out of Left Field or when they expect me to come up with a Iron Clad idea on why someone did something. :D Col

Editor's Picks