Chapter 11: Expert Witness Ethics

This is the final step in your digital forensic investigation: you, as the investigator, have received a subpoena to testify in a judicial or administrative hearing. Now, it is time for you to explain your actions and findings to an unbiased third party, that is, the jury. It does not matter how good or strong the evidence you found during your digital forensic investigation is if you cannot testify effectively. You must be able to testify and authenticate the evidence in your actions.

I know some digital forensic investigators who hate to testify. They love the collection of evidence; they love doing the exam and finding the relevant artifacts, but to get them into a judicial/administrative proceeding is very difficult. The first time you walk into a courtroom, it can be an intimidating environment. You may not know the rules, the procedures, and you may be afraid of making mistakes. To overcome those issues, you will need to...

Understanding the types of proceedings

There are a variety of proceedings where you may be called to testify or to present evidence. We will discuss some of the more common proceedings that you may encounter (The following are US-based proceedings; your jurisdiction may differ.):

• Grand jury: A grand jury is a panel of citizens empowered to investigate potential criminal conduct and to determine whether the conduct requires criminal charges. A grand jury will have subpoena powers that could include compelling testimony or requesting physical evidence.
• Arraignment: This is the formal reading of a criminal complaint. The accused is present and informed of the charges.  At this hearing, the accused will plead guilty/not guilty.
• Detention hearing: This is a proceeding before a judge to determine whether the accused is to be detained/released while the matter is progressing in the criminal justice system.
• Evidentiary hearing: This is a hearing...

Beginning the preparation phase

As a digital forensic investigator, your role in a judicial/administrative proceeding can be defined in two ways:

• Witness (also referred to as a lay or fact witness): You will testify about events you observed. You are just presenting facts that you have personal knowledge of, such as where the evidence was found.
• Expert witness: You can testify to everything a lay/fact witness can, but now you may offer your opinion. You form your opinions based on your training and experience as a digital forensic investigator. It is your ability to provide an opinion that makes you an expert witness.

Your preparation starts with your participation in the investigation. You should treat every investigation as if it will go to trial and you will have to testify. No matter which side you are on in the judicial/administrative proceeding, start communicating with the attorney at the very beginning. Discuss...

Understanding the curriculum vitae

A curriculum vitae (also known as a CV) is a document you create that outlines your education and experience, as well as your certifications and membership and professional organizations. The court and attorneys who determine your qualifications as an expert witness will use your CV to make that determination. The contents of your CV will contain a synopsis of what makes you an expert; it will highlight all your experiences that make you an expert in your field.

There is no a specific format you have to use when creating your CV, but all of them will contain the same content as it is the history of your professional life.

At the top of the CV will be your name and contact information. This ensures that your name is spelled correctly throughout the proceeding and when added to the witness list.  You will also want to identify the field you are an expert in. If the attorney, judge, or court clerk is dealing with multiple experts...

Understanding testimony and evidence

You are at the point in the trial where you are asked to take an oath and promise to tell the truth.  You then take your seat, and the focus of the room is on you.  You may have the judge sitting next to you at an elevated position.  Across from you, you may see two tables. One table will be hosting the prosecution, which could be one or more attorneys.  At the next table will be the defense, which can also comprise more than one attorney and the subject of the trial.  There could also be a jury box that could contain 12 or more citizens whose job is to determine the guilt or innocence of the accused.  Every single one of them is now watching you.  This can be a little stress-inducing.  Take a deep breath and focus on the questions that are being asked of you.

Your testimony will comprise technical details and your expert opinion.  The technical information will include you explaining complex technical...

Understanding the importance of ethical behavior

You have the responsibility to conduct due diligence, be truthful, and be objective during your digital forensic investigation.  Your personal and professional ethics determine the baseline of your behavior.  Failure to act ethically during your digital forensic investigation can cause the evidence to be excluded and/or result in you facing professional repercussions.

As a digital forensic investigator, you have specialized knowledge that has the potential for misuse.  Failure to follow up on potential leads you discovered during your forensic examination is an ethical lapse that could have repercussions on you, a third party, or your organization.

What is the definition of ethics? It is the moral principles that govern the behavior of an individual or activity. It is not a distinct standard; it will depend on your culture to determine what is acceptable and what is not. In a professional setting, an organization...

Summary

During this chapter, you learned how to prepare to give testimony in an administrative or judicial proceeding.  You can now identify the different proceedings and the participants.  You can also create a CV and differentiate one from a resume.  You also have the skills to ensure that you conduct your digital forensic investigation and exam while maintaining your objectivity and impartiality through the use of a code of ethics.

Thank you for your efforts and for working through my book! I am confident that you can use the skills you've learned here and apply them to a real-world setting.

Questions

1. An expert witness can offer _______________.

   a. Testimony

   b. Facts

   c. Opinion

   d. Hearsay evidence

2. Preparation starts ________________.

   a. When you receive a subpoena

   b. When your supervisor tells you to begin

   c. When the judge calls you

   d. When you start the investigation

3. Which court officer represents the sovereign?

   a. The judge

   b. The prosecutor

   c. The court reporter

   d. The bailiff

4. In a trial, the fact finder will be who?

   a. The jury

   b. The grand jury

   c. The judge

   d. The attorney

5. Which of the following should you NOT include on a CV?

   a. Formal education

   b. Teaching experience

   c. Professional memberships

   d. Salary

6. Which of the following is an appropriate answer to a question you do not understand?

   a. I do not know.

   b. You should try and guess.

   c. Ask to repeat the question.

   d. Look to the judge for help.

7. Why should you adhere to a code of ethics?

   a. To maintain your impartiality

   b. To make sure the correct side wins

   c. To ensure the accused is found guilty

   d. To keep your...

Further reading

Refer to the following sources for more information:

• Smith, F. C., and Bace, R. G. (2003). A guide to forensic testimony: the art and practice of presenting testimony as an expert technical witness. Boston, MA: Addison-Wesley (available at https://www.amazon.com/Guide-Forensic-Testimony-Presenting-Technical/dp/0201752794)
• Poynter, D. (2012). Expert witness handbook: tips and techniques for the litigation consultant. Santa Barbara, CA: Para Pub (available at https://www.amazon.com/Expert-Witness-Handbook-Techniques-Litigations/dp/1568601522)