1. Computer Forensics Principles and Practices by Volonino, Anzaldua, and Godwin Chapter 13: Ethical and Professional Responsibility in Testimony

2. © Pearson Education Computer Forensics: Principles and Practices 2 Objectives Understand the importance of adhering to ethical duties in court Identify the responsibilities of an expert witness to the legal system of justice Explain courtroom procedures and the requirements and challenges of testifying Explain how to offer effective testimony Identify academic and professional degree and certificate programs

3. © Pearson Education Computer Forensics: Principles and Practices 3 Introduction This chapter prepares you to perform a significant role in the justice system—to provide testimony as an expert witness. Given what is at stake, witnesses have ethical responsibilities that cannot be compromised. You learn about the common challenges of giving testimony in open court and the stages of a trial.

4. © Pearson Education Computer Forensics: Principles and Practices 4 Qualified Expert Witnesses Qualified experts can give opinions or make inferences though they are not eyewitnesses Qualified expert witnesses must submit a vita and disclose:  Qualifications, including all publications  Compensation being paid  List of cases in which the witness testified as an expert during the past four years

5. © Pearson Education Computer Forensics: Principles and Practices 5 Expert Reports Federal Rule 26 requires an expert to write and sign an expert report containing a complete statement of all opinions to be expressed and reasons for opinions Expert report must be provided to opposing lawyer who will use it during cross- examination

6. © Pearson Education Computer Forensics: Principles and Practices 6 Cautions Before accepting a case, an expert must ensure there is no conflict of interest Compensation must be disclosed; avoid unreasonably high compensation Expert must write the expert report People may attempt to falsify e-evidence so lawyers have right and obligation to question the validity of the evidence

7. © Pearson Education Computer Forensics: Principles and Practices 7 In Practice: Judges’ View of Expert Testimony after Daubert Surveys of federal judges conducted in 1991 and 1998 about experiences with expert witnesses Survey revealed that after Daubert (1993), judges were more likely to scrutinize expert testimony before trial and lawyers were more frequently filing motions in limine challenging admissibility of expert testimony

8. © Pearson Education Computer Forensics: Principles and Practices 8 Reliance on Forensic Experts Computer forensics field is growing Investigation, interpretation, and presentation of e-evidence are complex and filled with technical terms Explaining e-evidence to nontechnical jurors is not an easy task

9. © Pearson Education Computer Forensics: Principles and Practices 9 In Practice: Expert Opinion Is Subject to Challenge In State v. Summers, judge decided that expert testimony did not infringe on the right of the defendant to have jury decide guilt The court noted that expert testimony helped the jury understand the case’s drug trafficking issues Courts widely agree that expert testimony about drug-trade practices is admissible

10. © Pearson Education Computer Forensics: Principles and Practices 10 The Trial Process Tasks that take place before the trial  Discovery  Pretrial motions  Depositions  After discovery and pretrial motions: A civil case may be dropped, settled, or proceed to trial A criminal case can be dropped by the prosecutor, the defendant can accept a plea bargain, or the case can proceed to trial

11. © Pearson Education Computer Forensics: Principles and Practices 11 The Trial Process (Cont.) During the trial  Lawyers publicly present their evidence and legal theories to judge and jury  The judge ensures that only proper evidence and theories are presented to the jury  Jury members ultimately decide the weight and credibility of evidence they are allowed to consider  Lawyers are obliged to try to impeach witnesses  There will be conflict with respect to what each side claims are the facts

12. © Pearson Education Computer Forensics: Principles and Practices 12 The Trial Process (Cont.) An expert witness has an ethical duty to protect the legal system and Constitution As a professional, your duty is to the truth, not to the person who hired you Voir dire is a preliminary examination of witnesses to determine their competence  Witness is examined to prevent damaging evidence from a witness who may not be credible  Voir dire also applies to prospective jurors

13. © Pearson Education Computer Forensics: Principles and Practices 13 The Trial Process (Cont.)  Opening statements  Prosecutor’s direct examination (direct)  Defense lawyer’s cross- examination (cross)  Prosecutor’s redirect examination (redirect)  Defense lawyer’s recross examination  Prosecution rests  Directed verdict of acquittal (possible)  Defense presents evidence and witnesses  Defense rests  Closing or final arguments  Instructions and charges to the jury  Deliberation by the jury  Posttrial appeal Steps in the testimony process

14. © Pearson Education Computer Forensics: Principles and Practices 14 In Practice: Importance of Instructions to the Jury Frank P. Quattrone was indicted for obstruction of justice, obstructing an agency proceeding, and witness tampering because of an e-mail message to “clean up those files” He was convicted but appealed on the grounds that the judge had given flawed instructions to the jury

15. © Pearson Education Computer Forensics: Principles and Practices 15 Cautions Weak testimony: weak arguments weaken strong cases Voir dire is often used to cast doubt on an expert witness’s opinion testimony

16. © Pearson Education Computer Forensics: Principles and Practices 16 The Trial Process (Cont.) Dynamics of court testimony  Jurors rely on expert testimony  Jurors come into the trial typically without technical, financial, or specialized knowledge to understand the evidence  Verbal and nonverbal behaviors are both taken into account when assessing the credibility of others

17. © Pearson Education Computer Forensics: Principles and Practices 17 In Practice: Evidence Not Admitted During Trial Is Not Allowed During trial of Zacarias Moussaoui, jurors asked for a dictionary to use during their deliberations Judge Leonie Brinkema denied the request on the grounds that supplying the dictionary would be adding evidence in the case

18. © Pearson Education Computer Forensics: Principles and Practices 18 Guidelines for Testifying Testimony requires clarity, precision, conciseness, and completeness of your findings and facts relating to the case You are paid for your time and expertise You are NOT paid for your opinion Those with opposing views will fight fiercely to prevent the jury from believing you

19. © Pearson Education Computer Forensics: Principles and Practices 19 Cautions Perjury is a criminal offense punishable by imprisonment or fine Work product subject to scrutiny, which means opposing counsel can review it and attempt to refute your findings

20. © Pearson Education Computer Forensics: Principles and Practices 20 Guidelines for Testifying (Cont.) Preparing for testimony  Prepare by reviewing documentation made during the case, methods and tools used, and results of analysis  Work closely with the attorney to review details of testimony and anticipate questions  Remember the jury may still reject what it cannot understand or believe

21. © Pearson Education Computer Forensics: Principles and Practices 21 Guidelines for Testifying (Cont.) During cross-examination, an expert’s opinion may be impeached because of  Bias or partiality  Interest, or amount of pay  Prior inconsistency  Insufficient qualifications  Insufficient basis Adequate preparation can eliminate such weaknesses in testimony

22. © Pearson Education Computer Forensics: Principles and Practices 22 Guidelines for Testifying (Cont.) Presenting evidence  Present a professional appearance and demeanor by Speaking slowly and clearly and avoiding nonverbal communication Being truthful, careful, precise, and patient Dressing like an expert Not arguing, shouting, avoiding answers, or becoming defensive Being relaxed and looking at the jury while answering

23. © Pearson Education Computer Forensics: Principles and Practices 23 Guidelines for Testifying (Cont.) Presenting evidence (cont.)  Respond appropriately to counsel by Waiting for each question and learning to speak for the record Making sure you understand the question before beginning to answer Answering the question specifically without trying to avoid it Avoiding answering ambiguous questions, trying to educate the questioner, or trying to argue, bluff, or hide harmful facts

24. © Pearson Education Computer Forensics: Principles and Practices 24 Guidelines for Testifying (Cont.) Interactions with counsel may resemble the following exchanges:  What is the evidence, or what does it purport to be? “This is a printout of data that I recovered on 6/15/2006 from the hard disk drive primarily used by John Doe of the Big Ace corporation.”  From where did the evidence allegedly come? “The hard drive was taken from the office of John Doe on 5/15/2006. It was contained within a Generic PC bearing model XXXX and S/N YYYY.”

25. © Pearson Education Computer Forensics: Principles and Practices 25 Guidelines for Testifying (Cont.) Presenting evidence (cont.)  Handling painful testimony You may need to testify in a full range of crimes, from harassment to homicide No matter the circumstances, you must be prepared to discuss the evidence directly and professionally Witness immunity doctrine allows witnesses to testify freely without fear of lawsuits arising from their testimony

26. © Pearson Education Computer Forensics: Principles and Practices 26 Professional and Educational Resources A wide range of academic and professional computer forensics programs are available  Graduate degree or certificate programs  Undergraduate bachelor and associate degrees  Academic certificate programs  Professional training

27. © Pearson Education Computer Forensics: Principles and Practices 27 Summary Working in the legal system imposes a huge responsibility on expert witnesses Juries rely on forensics experts to help them understand the meaning of the e-evidence Jurors are not required to have any technical knowledge Experts may have to refute or validate other investigator’s testimony

28. © Pearson Education Computer Forensics: Principles and Practices 28 Summary (Cont.) Witnesses need to be prepared to withstand scrutiny from judges, jurors, and attorneys Witnesses have an ethical responsibility that cannot be compromised To be effective, you must understand:  The legal system  Specific courtroom communication skills  How to prepare for legal testimony  Skills for enduring cross-examination