Extracted from the N.I.J. publication, “Digital Evidence in the Courtroom: A Guide for Law Enforcement and Prosecutors “
A trial that involves digital evidence differs in two fundamental respects from most other trials. First, legal issues concerning the admissibility of digital evidence will nearly always arise. Those issues are discussed in chapter 3, “Courtroom Preparation and Evidence Rules.” Second, a prosecutor’s presentation of digital evidence may involve terms, issues, and concepts that are complex or unfamiliar. Therefore, the opening statement should be crafted to introduce the jury to the terminology and types of digital evidence that may be presented during the trial. Careful planning of case presentation and how digital evidence will be used throughout is essential to the successful outcome of a trial.
This chapter provides guidance on how to successfully present a case that involves digital evidence.
I. Educating the audience
If a case is complex, educate the audience—both the judge and the jury—at every stage of the litigation process:
Pretrial hearings (including Daubert or Frye challenges).
Jury selection.
Opening statement.
Witness testimony.
Objections (both in making and answering them).
Closing argument.
Although it is important to bring an audience up to a minimum level of competency or understanding, do not attempt to make them experts. The general rule of prosecution is to keep it simple. This holds especially true in the presentation of a case that is complex by nature.
II. What needs to be proved or disproved?
Every case requires a careful examination of the elements of the charges to ensure that convincing evidence will be presented on each element. Digital evidence cases often require a determination by the prosecutor of what can and should be eliminated as reasonable explanations for the evidence. The key questions to consider are:
Can all reasonable alternative explanations be disproved?
Is it necessary to disprove all alternative explanations?
A. Technical anomalies
In some instances, no complete or clearly adequate explanation can be found for a particular anomaly in the evidence. In other cases, the cost of explaining the anomaly (e.g., by a computer programmer or an electrical engineer) will be prohibitive as a practical matter.
As computers and operating systems have become more complex, most network administrators and computer maintenance personnel limit their problem solving to the most frequently recurring problems. Computer experts accept the existence of unexplained “bugs” or “glitches” without doubting the validity of information stored or processed by computers.
B. Disproving alternatives
What a prosecutor has to disprove depends on what issue is involved and the strength of the rest of the case.
When a crucial element is knowledge, such as in a case involving possession of child pornography, the prosecutor must be prepared to disprove defense claims that the pornography was stored on the defendant’s computer without his knowledge. The prosecutor does not, however, need to disprove unreasonable alternatives (e.g., a power surge caused child pornography to appear on the computer).
C.“Timing is everything”
When to rebut a defense assertion is important. For example, if the defendant’s knowledge of the contents of the computer will be crucial, it is sometimes wise to let the defendant raise the issue first and allow the evidence—through either cross-examination or rebuttal—to disprove the claim rather than assert the disproof in the case-in-chief. A jury often will attach more importance to issues raised in the State’s case and hold the prosecutor to a higher standard than they will if the defense attorney has raised the issue and the prosecutor is merely attacking the defense argument.
III. Expert witnesses and technical evidence
A. Deciding whether a technical expert witness is needed
A major decision in cases that involve complex technology and extensive examination of digital evidence is whether to use an expert witness; that is, one qualified by special training, knowledge, or experience.
If the witness renders an opinion, he or she must be qualified as an expert. In some instances, a witness may testify to complex matters without having to qualify as an expert because the witness does not offer an opinion. Judges also may have differing standards with regard to whether witnesses who offer non-opinion, technical testimony will be required to be qualified as an expert.
In many cases that involve digital evidence, either the investigator at the scene or an examiner can testify as to how the digital evidence was found. Although the examiner may have used expert skills and techniques, the only relevant issue at trial is whether the evidence in question was on the suspect’s computer, not how it was found. Either it was or was not on the computer. Thus, for that question, the examiner is a fact witness.
Unless an expert is giving an opinion based on a method that relies on technical or other specialized knowledge, even if such knowledge was used to find or identify evidence, the method does not have to meet the Daubert or Frye standard discussed in chapter 3. For example, a metal detector may have been used to find spent cartridges at a crime scene, but the technology of metal detectors would not need to be qualified. Once the cartridges are found, the issue focuses on them. Cases that involve digital evidence may be similar.
B. Using technical fact witnesses and expert opinion witnesses effectively
Although an expert is not needed to explain how the cartridges or bullets were found in the metal detector example above, the opinion of an expert qualified in firearms and toolmark examination will be required to demonstrate whether the lands and grooves on a particular bullet can be matched to a bullet fired from the suspect weapon. Similarly, digital evidence cases may sometimes need expert opinion testimony.
C. Identifying a community of qualified technical experts
Although experts in digital evidence examination may lack the traditional trappings of other recognized disciplines, they may nevertheless be well qualified. In fact, practice-based qualifications can be superior to qualifications based only on graduate degrees and memberships in recognized professional peer groups. Whatever the credentials of the expert, be prepared to demonstrate knowledge and understanding of the matters about which the expert is testifying. When selecting prosecution experts to assist in investigations and to testify at trial, determine whether a recognized community of experts in the relevant area of expertise exists and how the candidate is evaluated within that community.
D. Explaining the issues in the case and the legal constraints for examining the available evidence
The prosecutor should ensure that the expert understands how the rules of evidence and procedure affect the admissibility, discoverability, and usefulness of the expert’s observations and conclusions.
The expert may help the prosecution critique the evidence and determine whether a plea bargain is more appropriate than taking a particular case to trial.
E. Planning to deal with a Daubert gatekeeping challenge
The prosecutor should prepare the witness for meeting a Daubert or Frye challenge (see chapter 3 for details). Although this type of challenge is usually encountered in pretrial motions, it can also occur during the trial, either as an admissibility or credibility issue.
F. Preparing the witness for trial
Preparing a witness to testify about digital evidence involves all the considerations that apply in other cases as well as some special concerns. The following is a nonexclusive list of points to keep in mind:
1. Preparing for direct examination.
a. The expert should assist the fact-finder by adopting and maintaining an objective role at all times during the litigation process.
b. The prosecutor should provide the witness with a copy of all relevant materials (e.g., police reports, forensic records, transcripts, defense materials, if any).
c. The prosecutor should prepare the witness to testify at pretrial hearings (e.g., a Daubert hearing) about his or her qualifications and testimony and remind the witness that he or she will be asked again to testify before the jury about qualifications, opinion (if any), and the reason for that opinion.
d. The prosecutor should suggest that the witness inform the prosecutor if he or she is contacted by the defense team.
e. The prosecutor should encourage the witness to prepare his or her testimony on direct examination so that it is simple, understandable, and interesting. It may be helpful to use a “storytelling” approach.
f. The prosecutor should inform the witness about the questions he or she will be asked on direct examination. The witness should tell the prosecutor about the exhibits he or she will be using, audiovisual equipment needs, and texts or articles on which he or she relied in preparing to testify.
g. The witness should know that any materials he or she used to prepare testimony or will use during testimony may be subject to production to the defense.
h. The witness should explain all technical terms and acronyms in simple language. For example: “I ran an MD5 hash algorithm against the forensic image and the hash values had not changed. This means that every file on the copy was identical to the file on the original.”
i. The witness should direct his or her testimony to the jury, not to the attorney asking the questions.
j. The prosecutor should explain to the witness that the judge may limit the scope and nature of the testimony. The witness will have to testify within the limits established by the trial court.
k. An investigator who is identified as part of the prosecution team must nevertheless testify in an objective manner. To avoid appearing biased, the witness should be aware of his or her overall demeanor, including body language, tone of voice, and facial expressions, while testifying.
2. Preparing for cross-examination.
a. The witness should never be combative on cross-examination. It alienates the jury and weakens his or her effectiveness.
b. The witness should keep in mind: “Your testimony is not about you, it is about the evidence.”
c. The defense attorney will take control of cross-examination by asking leading questions; that is, questions that suggest their own answers. Do not avoid (or appear to avoid) answering the question. The witness should answer the asked question, not the implied question. For example:
Attorney: “Isn’t it true that you waited until 3 days after receiving the computer to book it into a secure evidence room?”
Witness: “Yes.”
OR
Witness: “Yes, and I can explain my answer if you’d like.”
BUT NOT:
Witness: “I was scheduled to go on vacation, and the department refused to authorize the overtime, and . . . .”
d. The witness should never compete with the defense attorney. The witness’s demeanor on the stand on cross-examination should be the same as on direct examination. If the witness feels as though he or she is on trial rather than the defendant, this could indicate that the witness is trying to compete with the defense attorney. The witness should be reminded before trial that the prosecutor will have an opportunity to ask more questions on redirect examination. If the prosecutor and the witness have worked together as a team, the prosecutor should know how best to proceed following cross-examination.
3. Preparing for rebuttal.
Sometimes the defense calls its own witness or witnesses to address digital evidence offered by the government. These witnesses may be highly qualified professionals. In some cases, they may be professionals with legitimate forensic practices who may not have had access to all the relevant data. It is also possible that they are “professional” defense witnesses with no actual experience with forensic practices. After the defense witness testifies, the prosecution witness may be called back to rebut the testimony. This should be anticipated and prepared for prior to trial.
Register HERE for updates on the CSI TECH BLOG SignUp
JOIN US ON FACEBOOK
Comments