Chapter 13. Qualifying an Expert in Court
Information in this chapter:
• Qualifying an expert
• Qualifying experts in court
Qualifying an examiner as an expert in court appears to be a very straightforward process on the surface. However, making sure you know what the minimum qualifications should be for a computer forensics expert or other type of digital forensic expert is important for two reasons: One, can the examiner you have engaged qualify as an expert? And two, does the expert on the other side have the necessary qualifications to testify as an expert? It happens too often that someone will try to pass themselves off as a forensics expert when in fact they have no training or experience in the field. Persons with computer experience alone, no matter how extensive, are not forensic experts and should not be allowed to qualify as such.
Keywords
Qualifying Experts, Qualification Questions, Federal Rules of Evidence
Introduction
Before attempting to qualify an expert in court, it is important to determine whether he or she has the necessary qualifications in the first place. This may seem obvious, but if we look at it a little more closely, it makes sense. Before hiring an expert, it is important to determine if he has the qualifications necessary to be an expert witness when it comes to the evidence in your case. For example, just because an examiner may be an expert in computer forensics, this does not mean he is an expert in cell phones. Likewise, an examiner may be proficient in cell phone forensics, but this has little to no bearing on being an expert in cell tower technology forensics. While expertise in computer forensics can lend credibility to the examiner’s knowledge of other areas, this expertise is no substitute for actual experience and training in a specific subdiscipline of digital forensics. Work with your expert to make sure he has the needed qualifications in the specific area of forensics you will be qualifying him in, and work with him to prepare the qualification questions to be used in court.
One way to compare the difference is to look at the difference between a medical pathologist and a medical forensic pathologist. They are both medical doctors and both have training in pathology. The study of pathology is the training needed to determine the cause of a disease or ailment. Forensic pathology includes specific training to determine cause of death. Only one of these two areas requires specific forensic training.
13.1. Qualifying an expert
To qualify an expert in court, she must meet the standards set forth by the local jurisdiction for expert testimony. The issue with qualifying experts in the various areas of digital forensics is that the field is not very well known and assumptions are made about what a digital forensics expert is. This becomes more complex as you attempt to qualify an expert in a specific area such as cell phone forensics.
13.1.1. Federal Rules of Evidence: Rule 702 Expert Witnesses
Rule 702 of the FRE1 states
If scientific, technical, or other specialized knowledge will assist the trier of fact to understand the evidence or to determine a fact in issue, a witness qualified as an expert by knowledge, skill, experience, training, or education, may testify thereto in the form of an opinion or otherwise, if
(1) the testimony is based upon sufficient facts or data,
(2) the testimony is the product of reliable principles and methods, and
(3) the witness has applied the principles and methods reliably to the facts of the case.
The key points in this rule are that an expert witness may be qualified by knowledge, skill, experience, training, or education.
Where this gets sticky is when the judge making the qualification decision has no expertise or knowledge in the area of qualification. This can easily lead to completely unqualified individuals being allowed to offer expert testimony and opinions in a case where they do not have the proper training or experience. As you prepare for the qualification process, pay special attention to the expert’s resume or curriculum vitae for strengths and weaknesses. Your expert should be able to assist you with examining the opposing expert’s qualifications prior to trial.
You will want to focus on your expert’s strengths during qualification. During cross-examination of the opposing expert, you would want to do the opposite and press any weakness in his qualifications.
13.1.2. The resume or curriculum vitae
The expert’s resume or curriculum vitae will include information on their education, training, and experience that provide a foundation for their claim of knowledge or skill in a particular area. The problem is that some experts will overstate their qualifications to the point of perjury. This can be especially problematic when an expert claims a degree she does not have, as has happened in some cases. That is one reason to make sure that the expert has actual verifiable experience, knowledge, education, and skills.
You can verify these areas by having the expert, at a minimum, supply along with her resume or CV, copies of training certificates, copies of certifications, and copies of college degrees or diplomas. If you have any doubts, check up on the area you are concerned about by contacting the college or university that issued the degree or the organization that issued any certifications and checking to make sure the expert earned them and that they are still valid. Many certifications expire if the expert does not pay the renewal fee and/or fails to meet the continuing education requirement to retain the certification.
13.1.3. Certifications
One aspect of certifications that can be very positive is that many, but not all, certifications in the forensics field require a minimum amount of verified training and work experience before the examiner can take the examination. When an expert presents certifications as part of his qualifications, it is important to ask upon cross-examination whether any training or experience was required in order to obtain the certification.
For any certification presented as part of an expert’s qualifications, she should be asked to explain the type of certification and how it applies to the specific area of forensics in which she will be expected to testify. There are dozens of computer and software certifications that have no bearing on forensic analysis of digital or electronic evidence.
If in doubt, ask the expert to explain the qualifications required to obtain the certificate and who the certifying body is that issued the certificate.
13.1.4. Training
If an examiner claims hours of training specific to digital forensics, copies of the training certificates should be included for inspection by both sides as a form of verification. Watch closely for training specific to the area of forensics involved in your case, as the expert’s training may indicate expertise in some area of computing, but it is not an indication of forensic training.
13.1.5. Experience
When an expert presents work experience, it is important to ask upon cross-examination if his job includes specific forensic duties. One way to attack this section is if the expert’s place of employment is known prior to the hearing, you look up the company website or any other information that may help you to determine if the company that employs the expert even offers any forensic services. If he is working as a paid consultant on a case and relying on expertise gained in his employment, digging into his specific job function and tasks can assist in either supporting or weakening his qualifications.
13.1.6. Education
If your expert has a degree related to the field that you want to qualify them in, this is another area that can be used to assist in getting the expert qualified. There are degrees that can be earned specifically in digital forensics or computer forensics. However, other degrees in the computer science and information security fields cross over and can be used as a foundation for qualifying the expert witness as well. On the other hand, if your expert does not have a degree in a digital forensics area or in a computer science field, or does not have a degree at all, it may be better to not ask about education but concentrate more on experience and training. Many people in the computer or digital forensics fields do not have degrees, and the lack of a degree, if the expert is strong in other areas, should not be a barrier to getting them qualified.
13.2. Qualifying experts in court
What you will want to accomplish through questioning of the expert witness is whether or not she has enough of any of the above to qualify her as an expert in the area in which she will be testifying. The ongoing challenge with experts is that lawyers and judges do not know enough about this particular field to adequately make a determination in many cases of whether an expert is actually qualified or not.
There are a couple of ways to attack this particular issue:
1. Cross-examination specific to the area of expertise compared to the expert’s resume or curriculum vitae
2. Cross-examination on the underlying principles and practices that form the basis of the area of expertise
13.2.1. Sample qualification questions
These sample questions will use computer forensics as the focus; however, you should substitute the specific area of forensics when applicable (GPS, cell phone, cellular technology or cell tower technology, audio, video, and so on).
1. Please state your full name.
2. What is your business address?
3. Where are you employed?
4. What is your position there?
5. How long have you been employed at this company?
6. What is your job function at this company?
7. Where were you employed prior to your current job?
8. What was your position there?
9. How long were you employed there?
10. What was your job function at that company?
11. How long have you been doing computer forensics?
12. Have you ever been hired as a computer forensics expert in the past?
13. Approximately how many times have you been hired as a computer forensics expert?
14. Have you ever testified in the area of forensics?
15. How many times?
16. Have you received any training specific to computer forensics?
17. Do you hold any certifications specific to computer forensics?
18. Are those certifications current?
19. Do you have a degree or certificate in computer forensics?
20. Can you briefly explain what computer forensics is?
21. Can you briefly explain chain of custody?
22. Have you published any articles or books in the area of computer forensics?
24. Are you a member of any professional organizations specifically in the field of forensics?
Summary
In this chapter we looked at Federal Rules of Evidence Rule 702 regarding the qualification of expert witnesses. We also covered the types and nature of qualifying documents and statements of expert witnesses in digital forensics. Lastly, we looked at questions for the purpose of voir dire regarding the qualifications of expert witnesses.
Reference
[1]
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.