/ LEGAL FEATURE
thE WILy WItnEss
Key Legal Issues and Courtroom Advice
by Eric Fiterman Methodvue
/ ENTRY
E
xpert opinion testimony is a legal tool frequently used It is also important to appreciate the impact and scope of
in civil and criminal cases involving the collection, ac- expert witness testimony for a related class of litigation: intel-
quisition, and examination of digital evidence. The U.S. lectual property (IP) litigation. Many businesses invest heavily
Supreme Court has suggested that expert witness testimony in the development and protection of intellectual property,
should be based on scientific, repeatable, and reliable meth- thus making information an asset with significant intrinsic
ods that are generally accepted by the scientific community. value. The ease with which these assets can be misappropri-
When delivering expert witness testimony, in particular under ated or stolen is a compelling reason that organisations fight
cross examination, forensic practitioners must be aware of aggressively to protect their positions, investments, and
these legal requirements, as well as common pitfalls to avoid competitive advantage.
when expressing facts and technical data in the courtroom. Businesses aren’t alone. Take a moment to think about your
This article explores key legal issues affecting forensic most sensitive and private information – is there anything you
experts, and provides recommendations for witnesses to can identify, that isn’t stored in electronic form? Your financial
improve the quality and defensibility of opinions delivered in history, health records, online habits, and personal history are
the court room. all held on a computer somewhere. Stringent privacy laws in
the EU, and legal requirements governing the unauthorised
/ What Expert Witnesses Need to Know and Do disclosure of data (so-called “Data Breach Laws”) create an
In civil and criminal litigation, an expert witness may be environment fraught with legal and technical challenges.
called to provide testimony or opinion on complex matters When sensitive information is stored in electronic form,
in order to interpret and present case circumstances to a trained personnel will be required to protect this information
non-technical audience. The expert witness often plays an and to explain in legal proceedings how and why it may have
important role in the formulation and execution of an effec- been compromised.
tive legal strategy, and is consequently held to some of the
highest legal, ethical, and professional standards in her field. / Technical and Legal Challenges
While expert witnesses come from a variety of backgrounds, When called to provide expert witness testimony, the forensic
the specialised skill and experience of computer forensic practitioner is faced with a number of challenges. For one, an ex-
practitioners is increasingly in demand. pert may be required to examine evidence involving commercial,
closed, or proprietary systems. This means that the full details of
It Is not unCoMMon For
a component’s operation and functions are not readily available
for inspection. Consider, for instance, Microsoft’s Windows series
ForEnsIC prACtItIonErs to of operating systems. Microsoft does not publish every detail
tEstIFy In hIgh-stAKEs CIvIL
and specification of Windows – the source code for Windows is
protected as proprietary and confidential information.
LItIgAtIon And busInEss torts Consequently, some of the best resources on Windows
forensics are produced by technical experts, who aren’t em-
While law enforcement and investigative agencies pio- ployed by, or affiliated with, Microsoft. One example is Brian
neered many of the methods and techniques used to examine Carrier’s book, File System Forensic Analysis, which details the
digital evidence, it is not uncommon for forensic practitioners results of Mr. Carrier’s own independent research and findings
to testify in high-stakes civil litigation and business torts. related to the mechanics of Microsoft file systems. The infer-
Modern commerce and governance structures are tightly ence here is that the expert witness must conduct her own
coupled with technology: communications, core business independent tests or rely on published works and consensus-
processes, and infrastructure all depend on software and developed tools to perform her analysis, while acknowledging
hardware systems to function properly. When involved in a that this analysis is typically based on observation, without
legal dispute, businesses are frequently required to furnish detailed (or, perhaps, any) inspection of the source materials.
evidence stored in these systems, often with the assistance Another challenge faced by forensic experts is that, unlike
of technical experts who are able to extract and present this the system of common law, technical systems are based on
information to the court. dynamic, fluid, and changing paradigms. New software devel-
30 Digital / ForensicS
DF1_30-32_1st Legal Feature.indd 30 29/10/09 5:45:40 pm
Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25  |  Page 26  |  Page 27  |  Page 28  |  Page 29  |  Page 30  |  Page 31  |  Page 32  |  Page 33  |  Page 34  |  Page 35  |  Page 36  |  Page 37  |  Page 38  |  Page 39  |  Page 40  |  Page 41  |  Page 42  |  Page 43  |  Page 44  |  Page 45  |  Page 46  |  Page 47  |  Page 48  |  Page 49  |  Page 50  |  Page 51  |  Page 52