Discussion Question
John_matt
chapter_10.docxChapter 10: How to Testify in Court
Overview
In this chapter, you'll learn more about:
· Preparing for trial
· Presenting an appropriate appearance
· Making sure your audience receives the right message
· Being comfortable with your own processes
· Being brief
· Avoiding complexities
· Patiently justifying your actions
As a computer forensic professional, you collect evidence for the sole purpose of discovering the truth. Once you do collect evidence, you must be prepared to present it to someone to convince them of its truth and veracity. Some evidence you collect may be destined only to grace the pages of a summary report to your boss. At other times, you may be asked to testify in court. This chapter covers the basics of how to present yourself and your evidence in a court of law.
All the material covered in this chapter also applies to more informal proceedings, but your ability to present basic evidence matters most in court. Our goal is not to provide legal advice. You can research the specific laws that govern your actions as a witness. This chapter covers only the most important things you need to know to be an effective witness in a courtroom.
Preparation Is Everything
The best way to be a successful witness is to be well-prepared. You probably won't be successful if you arrive at the last minute and attempt to answer questions off the top of your head. This would likely make you appear both unprepared and unprofessional. Never allow yourself to be unprepared when presenting your evidence.
|
|
Note |
In all things, act in an impeccably ethical manner. Never sacrifice your personal or professional ethics by participating in questionable actions. Remember that all actions and statements must adhere to strict ethical standards. |
In many cases, your role in a trial will be as an expert witness . To be considered an expert witness, you need to acquire or demonstrate special knowledge of computers and computer evidence and skill at retrieving evidence from computers. Achieving the status of expert comes through education and experience. You become an expert witness when you appear in court for the purpose of presenting evidence or opinion. Most witnesses are allowed to testify only to facts they have perceived first-hand. That is, a regular witness can tell only what she has seen, heard, touched, felt, and smelled. After you are accepted as an expert in your field, however, your status as an expert witness allows you to provide an opinion about the evidence as well.
A person called to testify in a court of law who possesses special knowledge or skill in some specific area that applies to a case.
Take note: You will be required to justify your status as an expert in your field. You will have to produce documented qualifications, including education and practical experience from valid sources. This information will be provided to both parties. In other words, opposing counsel will receive a copy of your credentials and justification as an expert witness. Generally speaking, a résumé is not enough. You also need to provide additional information, such as:
· Education received and degrees earned
· Professional training received
· Certifications held
· Experience details
· Other times you testified as an expert
You are generally requested to appear in court either by receiving a summons or by a client request. In either case, your testimony should be completely unbiased and independent. The weight of your testimony depends on your credibility. When you receive a summons, make sure you are prepared before you appear in court.
A court order that compels a witness to appear in court and answer questions.
Most attorneys recognize that an expert in a particular field is not necessarily expert in presentation skills as well. For those who appear in court, however, an ability to convey and explain information is nearly as important as possessing such information. If you are uncomfortable speaking in front of audiences, spend some time with a member of your legal team working on your delivery skills. Take the time necessary to ensure you are effective at getting your message across.
Expert Witness Training and Practice
Numerous trial support companies do business all over the United States (and elsewhere, to be sure). If you have never testified in court, or haven't seen the inside of a courtroom lately, you can—and probably should—request your legal team to send you to an expert witness school or to a jury and courtroom consultant. These firms or individuals provide one-on-one training and coaching, along with practice at giving testimony and being cross-examined in a mock trial situation. One of your authors attended such a school at Bloom Strategic Consulting in Dallas, TX, and found the experience not just educational and helpful, but invaluable in preparing him to testify effectively in court.
The legal team and all expert witnesses must spend time preparing for a case. Attorneys usually want to meet with witnesses early in the process. Expert witnesses are sought only when they are needed to explain evidence or strengthen its impact. As an expert, you will be asked to provide information on your experience in one or more areas of expertise. You will need to recite information about other times you have testified. Be prepared to field the following questions:
· What is your educational background, including degrees earned?
· What experience do you have in the area in which you are an expert?
· How are you qualified as an expert in this area?
· Are you aware of any conflicts of interest you might have with respect to this case?
· Have you ever testified in court?
· If so, were you called as an expert witness?
In most cases, initial contact and an interview take place before a formal agreement to testify is put in place. The initial conversation becomes billable time only if you are ultimately hired. If you want to work as an expert witness, collect as much background information as possible before the initial interview so you won't waste uncompensated time during initial conversations.
After you are hired as an expert witness, the legal team should question you thoroughly to uncover any issues that could hurt their case. Such issues could include past complaints or claims filed against you, conflict of interest issues, or involvement in activities that reduce your objectivity. During the initial conversations and interview, you'll be asked to state that you are not aware of any conflicts of interest, or perceived conflicts of interest, that could arise during the trial that warrant the attention of opposing counsel.
Conflict of Interest
We've all heard the rules of radio giveaways: "Employees of Mega Radio Corporation and their families are not eligible to win this contest." Avoiding a conflict of interest is the reason for this restriction. If Mega Radio Corporation gave prizes to its employees and their families, eyebrows would be raised. It might look as if the advertisers' money were being spent on employee bonuses. As a result, listeners might lose interest and start tuning into other radio stations that give them a better chance to win prizes. Fewer listeners mean advertisers get less return on their advertising investments. Such situations result from allowing the interests of one party (the employees' desire for bonuses) to conflict with the interests of another party (the advertisers' desire to entice more listeners by using contests). When you find yourself in a situation in which you have incentive to make a decision in a particular direction, a conflict of interest probably exists. Such situations are best avoided whenever possible.
Your first opportunity to share your knowledge may occur before the trial. A common pretrial activity involves taking depositions from witnesses. Depositions are conducted under oath and the testimony you give is admissible in court. A court reporter will take down and transcribe every word you say while you are "on the record." In addition, your deposition may also be videotaped.
Testimony that is reduced to written form. (Video recorded depositions are also transcribed and reduced to written form, and both the written transcription as well as the video recording of the testimony may be admitted in court.)
During a deposition, you are asked questions that pertain to your area of expertise and aspects of the case by counsel for both sides. You can exert a material impact on the case at this point. If you provide strong testimony and speak with authority, you may influence opposing counsel to explore a settlement without going to trial. On the other hand, weak and unsure testimony might encourage the other side to pursue a trial.
If your deposition is videotaped, it's important to recognize that the camera is your audience. The temptation is to ignore the camera and concentrate on your questioner. If you do this, and your video testimony is shown in the courtroom, you will appear to be looking away from the audience. This is commonly perceived as insincere, arrogant, or untruthful to audiences who are used to seeing people on-camera looking straight ahead at the camera lens at all times.
It's important to remember that you're also talking to people who will be watching the video, possibly in a court room, not to the attorneys and the court reporter in the deposition room with you as you testify. Even if you look at the attorney who's questioning you while he or she is talking, remember to look straight at the camera as you give your answers.
|
|
Note |
The section titled "What Matters Is What They Hear," later in this chapter, discusses techniques to get your point across. |
When a case goes to court, you will participate in two basic phases of the trial—direct examination and cross examination. Direct examination is where attorneys ask questions that allow a witness to provide testimony. Your legal team should provide you with a list of the direct examination questions they plan to use. Opposing counsel then has an opportunity to question you. Their line of questioning is called cross examination . The purpose of cross examination is generally to weaken your testimony. The best approach to handling cross examination is to be fully prepared with answers to likely questions.
Initial questions asked to a witness to extract testimony.
Questions asked by opposing counsel to cast doubt on testimony provided during direct examination.
Understand the Case
As early as possible before a court appearance, meet with your legal team to discuss the case. The goal of such a meeting is to understand the basic facts of the case. Although you may have been integral in the evidence collection effort, you may not know about other critical aspects of the case. Becoming an expert in every detail of the case is unnecessary, but understanding the case as a whole will help you testify for your own piece of it. Such knowledge also keeps your testimony from conflicting with other witnesses' testimony. (We'll return to this topic in the section titled "Say Only What You Must" later in this chapter.)
Many attorneys who work with technical cases understand their intricacies and want the whole team to be well informed. If you work with an attorney who seems to guard case information, think long and hard before agreeing to participate. If you do proceed with only limited awareness for a case, you may be surprised—even blind-sided—by some of the questions you will be asked when it is your turn in court.
Another reason to understand the case is that you may not be the only expert witness. Other expert witnesses may be called on both sides. You need to understand the likely testimony of each expert before you prepare your own testimony. This knowledge will not change any of the facts in the case, but it will help you determine the scope of your own testimony. For example, if you know your own counsel will use a database expert, you can focus on other areas. Likewise, knowing that the opposing counsel has hired an expert to counter your testimony will direct your preparation. You should talk with your counsel to understand likely questions, or at least a general direction, that you may face during cross examination.
Understand the Strategy
After you have a grasp of the general facts of the case, talk with the legal team about their strategy for arguing the case. They may want to emphasize technical details. Or, they may want to simply touch on the technical evidence and focus more on other aspects. Your involvement depends strongly on the strategy the legal team chooses.
These techniques apply to presentations outside the courtroom as well. If your investigation is part of an incident response effort, the equivalent of a courtroom appearance might be a presentation to clients about the incident. The rules and environment might be different, but the general goals are the same. Your goal is to present evidence and provide an expert opinion as to what it means.
Remember the part you play in the courtroom. You are a witness; the attorneys are the primary players. They direct the action and call you when it's time for you to contribute to the case. You were hired to play a specific role—namely, that of expert witness. Let's talk some more about what that supporting role really involves.
Understand Your Job
The primary purpose of a trial is to provide a forum for an impartial individual or group of individuals to decide which party prevails in a conflict. In some cases, the facts of the case are plain enough for an ordinary individual to understand them. For example, in cases that involve traffic accidents, most people are familiar with traffic laws and the operation of an automobile. Unless unusual circumstances prevail, many attorneys will present the facts directly to a judge or jury.
Cases with important technical aspects tend to be different. They commonly involve details that most people do not understand. A case that involves ballistics and traditional forensic evidence normally requires an expert to present and explain that evidence. We've all seen televised court proceedings with the expert on the stand testifying as to forensic methods employed. Those experts are essential when it comes to explaining the intricacies of such evidence to a judge or jury.
Your job is often harder, though. Few ordinary citizens will profess to understand how ballistics or DNA analysis work. Although they may be familiar with those terms, most will agree that an expert is required to perform the actual analysis. Computers are different. Nearly everyone has a home computer. What's worse, many home computer owners think they are computer security experts. Your first job is often to explain basic security concepts and how popular concepts may differ from reality.
For example, most people know what spam is, in terms of computer activities. Few know how it originates and why it is so difficult to stop. Similarly, most members of the general public do not truly understand malicious code, also known as malware. For example, very few people understand the differences between a virus, a Trojan horse, and a worm.
As an expert in the field of computers and computer forensics, you possess a level of knowledge that goes well beyond the common understanding of such things in our society. Your value to a case is to share your experience and explain how the evidence proves facts in the case. You are a teacher as well as a witness. Simply put, the legal team would not be able to convince the court that the facts presented are true and relevant without your help.
Appearance Matters
Although we often hear that we shouldn't judge a book by its cover, everyone does so anyway, and that includes judges and juries. Your appearance strongly influences your credibility in the courtroom. As unfair as this may seem, you really do need to attend carefully to what you wear and how you carry yourself. Your knowledge and the weight of your testimony will mean little if you do not appear credible and believable. Let's look at a few aspects of your courtroom appearance.
Clothing
First and foremost, dress appropriately. Wear clothes that you would wear to a conservative office. If you are a man, you should wear a suit. Darker colors (such as blue, black, and dark green) tend to exude confidence and authority. Ties should be conservative and shirts tucked in. Do not wear a hat to court. Although you may make a fashion statement with more vibrant colors, conservative colors create an aura of credibility. If you are a woman, a business suit or dress will give the court the impression that you should be taken seriously. Women should wear a brassiere, hose or dress socks, and closed-toed shoes. Avoid wearing high-heeled shoes. Both men and women should remove outerwear or overcoats before testifying.
Even though you may work wearing jeans and a T-shirt, you should never wear them to court. The way you dress gives the judge and jury an impression of how trustworthy you are. When you walk into a courtroom, you will be judged by what clothes you wear. Remember, we're not talking about fairness here—we're talking about making the most of your courtroom appearance. No matter how you dress the rest of the time, always dress to impress the court. It will serve you well.
When choosing clothing for a court appearance, don't overdo it. Women should keep jewelry to a minimum, and wear only tasteful items. Men should avoid jewelry. All in all, dress conservatively and soberly. Many courts, particularly federal courts, have rules regarding acceptable attire within the courtroom. It's always a good idea to ask your legal team if there are any rules regarding appearance that you need to be aware of before you go to court.
Grooming
Grooming is as important as clothing. Your clothes should be pressed and clean. Your physical appearance should match your crisp, clean clothes. Don't show up to court looking disheveled. You are going to testify that you seized evidence, or accepted seized evidence, and handled it in a responsible manner. Responsible people comb their hair. If you are disheveled, you will have a difficult time convincing a jury that you are responsible.
Men, a 5-o'clock shadow gives the impression that you are sloppy. It doesn't matter if you rarely shave before going to the lab; in court, you must impress a judge and jury. Your job is to present yourself as credible and responsible. The way you present yourself says a lot about your ability to be responsible. Women, use neutral colors in your make-up and avoid flamboyant (sorry, no green or pink or purple hair colors) hairstyles. Do not bring a purse or handbag to the witness stand.
Attitude
When you take the stand, remember that the judge and jury are watching and listening to you. Getting them on your side is imperative. A poor attitude can hurt your testimony. It can actually turn a jury against you. When you alienate people, you make it very difficult for them to believe in you and your testimony.
While you testify, remain aware of your attitude. A jury will read your emotions and your body language . They will watch you to decide if you are sincere. Look at the judge and jury as you speak. Ignoring the jury may appear as if you are being untruthful. Watch your body language as well. When you cross your arms, you become "closed off" and unapproachable. This action gives many people a feeling of inferiority, which is not the best way to convince a jury.
Communication using body movements, gestures, and facial expressions.
Avoid being sarcastic or overly confident. Such attitudes tend to alienate jurors. You must strive to be sincere, but not overly confident. Avoid swear words, common slang and common and colloquial phrases such as:
· Um
· You know
· Sure
· Wow
As you deliver your testimony, be willing to help the judge and jury understand what you are saying. You are as much a teacher as a witness. Avoid being rude or condescending; instead, be as helpful and respectful as possible. Remember that you are an expert who is trying to present evidence in layman's terms to make it understandable. Let's look at how you can get your message across to make the evidence understandable.
What Matters Is What They Hear
You could have the most eloquent delivery ever presented in a courtroom, but if the jury does not hear what you have to say, it's all wasted effort. Although you may present a topic using sophisticated presentation aids, actual success depends on the recipient. Your responsibility is to ensure that the target of your presentation "gets it." Far too many presenters focus on the presentation and not enough on the perception or reception of that presentation.
Take the time to really sell your presentation. Whether you are teaching a jury how a disk drive works, or responding to cross-examination, get your message across.
Communication involves three critical components:
· Sender
· Message
· Receiver
The sender is the party who prepares and sends the message. The sender is responsible for all aspects of the actual message. The sender chooses message content, tone, style, delivery medium, and recipient. It's the responsibility of the sender to ensure that the receiver understands the message.
The message is the actual content that you are sending. The sender creates and sends the message to the receiver via the chosen media. The message itself consists of the body of the message, along with the "tone" of the message. The tone of a message can be influenced by choice of vocabulary, punctuation, and structure. For example, these two text messages are identical except for their tone:
· Please come to my office.
· PLEASE COME TO MY OFFICE!!!
Clearly, the second message creates more anticipation (and dread). You can create the same distinction using your vocal tone. You can add emphasis to certain words or phrases to make them stand out. Don't overdo it, though—you must remain believable and credible. If you rely on theatrics to make your points, you will lose credibility in the long run.
Listening
Listening is an important and often overlooked skill. Use your listening ability to take in as much as you can in the courtroom. The judge's statements and actions can tell you a lot about how you should act. It may change daily, too. Judges and juries are regular people who have bad days just like we all do.
Listening allows you to "test the waters" without making a mistake by charging ahead in the wrong direction. Both legal teams can direct you through the questions they ask. As a rule of thumb, go in the direction your own legal counsel leads you. If opposing counsel leads you in some particular direction, pay close attention to what's going on. They could be trying to trip you up.
Listening always helps you to be more prepared when you do take the stand. To communicate well, use your ears more often than your mouth.
Tone
Because you are an expert, you will be perceived to have superior knowledge in one or more specific areas that pertain to the case. Many people are intimidated by people with superior knowledge or experience. Always avoid using tones in your voice that can be interpreted by others as being haughty. You cannot gain respect through intimidation; rather, you risk losing respect if you use a tone that infers superiority, condescension, impatience, or hostility.
Try to switch into "teacher mode." Take the time to explain topics that are not clear to one or more people in the courtroom. A good teacher evaluates where students are and approaches them to move them toward understanding. An expert witness cannot interact directly with jurors in the same manner a teacher does, but you can still be respectful and try to convey the essence of your message. Any time you talk "down" to a judge or jury you risk creating feelings of resentment. Jurors who resent you may not be very favorable to you during deliberations.
It looks like mom and dad were right when they said, "It's not what you say, it's how you say it that counts." Make sure the jury has an opportunity to perceive you as pleasant. It will matter.
Vocabulary
As previously discussed, the job of the expert witness is to explain complex topics or procedures to laypeople. You must use words and phrases that explain and do not confuse judges and juries. Avoid using too many industry-specific terms and acronyms. For instance, talking about the "TCP and UDP packets traveling between the server and the client" will likely confuse most people. To make good use of such language, you will first have to explain:
· How information travels across networks
· How networks split messages into smaller chunks, called packets
· What a server is and what is does
· What a client is and what it does
· Networking protocols (basic introduction)
· TCP and UDP protocols
That might look like a lot of explaining to do just to address a fairly simple concept. But that's your job as an expert witness, so do your best to revel in this work. Make the complex seem simple and be careful which words you choose. The more successfully you use common, everyday language in your explanations, the more effective your presentation will be.
Words Matter
If you tell the truth you don't have to remember anything.
—Mark Twain
Although it should go without saying, always tell the truth. Present the facts and offer your professional non-biased opinion. The facts tell a story and your job as an expert witness is to tell that story to the jury in a manner that enables them to easily understand the story the evidence tells. The facts speak to the truth of the evidence, so always speak the truth.
Know Your Forensic Process and Tools
You are a computer forensic examiner. If you are called as an expert witness, you will be asked to explain your process for collecting evidence. Many jurors will find this process interesting, but will perceive it as tedious as well. Most people are unfamiliar with the processes necessary to acquire and store digital evidence in a way that preserves the state of the evidence. You will have to educate them.
You must know your own process and your toolset like the back of your hand. It is imperative that you know, and can clearly explain, the steps you take and the tools you use in an investigation. You will be asked to explain each of your steps as you collected and analyzed evidence. If you need to use notes in your testimony, get permission from the judge first. He or she will usually ensure that your notes have already been admitted into evidence and then allow you to look at them to assist in the accuracy of your testimony. Don't just read your notes to the court—your credibility will suffer if you appear to lean too much on your notes.
The opposing counsel will certainly hammer you if you are unsure about your own practices. Don't provide them that opportunity!
Best Practices
A good place to start in explaining your own forensic process is by referencing industry best practices. A wealth of information that outlines best practices in most security areas is available online. There are several very good Web sites that discuss current computer forensic best practices. Look at several of these Web sites to make sure your processes and tools are consistent with current best practices:
· SANS Reading Room http://www.sans.org/reading_room/
· United States Secret Service (download) http://www.forwardedge2.com/pdf/bestPractices.pdf
· CERT Coordination Center (mostly related to incident response) http://www.cert.org/tech_tips/win-UNIX-system_compromise.html
· Scientific Working Group on Digital Evidence (downloads; search for "Best Practices") http://www.swgde.org/documents/current-documents/
Many more useful Web sites are available for additional best practices information. Take some time to explore as many of them as you can. They will help your investigation practices, as well as your acceptability as an expert in court.
Your Process and Documentation
The primary source of information for the testimony explaining your forensic process is your evidence documentation. You should have an activity log that shows every action taken with respect to evidence during your investigation. That activity log should commence with evidence acquisition and be current up through the present day.
Complete documentation gives a jury the impression that you have been careful. Although it is possible to win a case without appropriate documentation, it makes your job far more difficult. Make sure you are meticulous in documenting the investigation process. You will need those logs if you are called to appear in court. Organized, written information gives judges and juries the impression that you are responsible and meticulous.
Your Forensic Toolkit
Be prepared to explain the contents of your forensic toolkit. Include all hardware and software you use during an investigation. For each component, explain why you it's in your toolkit, what function it performs, and how you used it for the current investigation. Corroborating third-party information may be helpful.
For instance, your forensic software tools vendor might maintain information on the reliability of its product. Many commercial products provide online resources that make the use of their product more acceptable to a court of law. Showing how your product maintains the chain of evidence gives some jurors the answers they are seeking.
Know exactly what tools you have and which ones you use. Be ready to justify your choice of tools and explain why your choice was sufficient get the job done.
Say Only What You Must
Brevity is the soul of wit.
—William Shakespeare
Be careful with the words you choose. They may come back to haunt you. Talking too much is a common witness mistake during testimony. The more you talk, the more you risk becoming a bore and the more information you divulge. Although it may appear that the primary purpose for an expert witness is to divulge information, that's missing the point. Your main job is to provide an expert's view or interpretation, not to dump memory. The most common type of information a person divulges when talking too much is that of weaknesses or revealing information that might be viewed as a conflict with the testimony of other witnesses. When you are on the stand, answer all questions succinctly. Only add enough details to answer the question fully. Resist the urge to say more than is necessary and do not try to answer questions that aren't asked.
Be Complete, But Not Overly Elaborate
Although you want to avoid saying more than is necessary, you can't answer all questions with "Yes" or "No." When you are asked a question, provide a full answer. If more information is needed, the person asking the questions should ask for it. Incomplete answers leave the appearance that there is something to hide.
If you cannot answer a question with a single word, use an answer that is short. For example, look at the following exchange between an attorney and an expert in the area of firewalls:
· Attorney: Mr. Jones, do firewalls stop all "bad" messages coming into a system?
· Mr. Jones: No.
· Attorney: Well then, do firewalls stop any "bad" messages at all?
· Mr. Jones: In most cases, they can be set up to stop messages that you define as "bad."
· Although your second answer is not exhaustively complete in a technical sense, it does answer the question. The attorney might ask you to explain how firewalls work and how they can block messages. In contrast, here is a poor answer for the second question:
· Attorney: Well then, do firewalls stop any "bad" messages at all?
· Mr. Elaborate Jones: Firewalls examine all packets that are designated as of interest in the internal configuration. The specific action the firewall takes is contingent upon the rule set and connection status at the time the packet is received. We can block networks, IP addresses, ports, and actual variant packets at will. Most firewalls that are worth using can do all this dynamically. The days of static ACLs are long gone.
How many nontechnical jurors would understand Mr. Elaborate Jones' answer? Here are a few things that are wrong with his answer:
· It was too long. He wasn't asked to explain how firewalls work. He was asked for a general positive or negative answer.
· He used technical vocabulary. Most people aren't comfortable with terms such as internal configuration, rule set, and variant packets.
· He used technical acronyms. Don't use IP or ACL unless you explain what they mean.
· He expressed an inappropriate opinion. He could have just offended a juror who happens to be a system administrator for a company that uses static tables in a firewall.
In short, get to the point and only use elaboration to explain your answer, not to deliver it. You always must consider the target for your communication. Let's look at the importance of your audience.
Remember Your Audience
Never forget the audience for your testimony. You are speaking to the court. Specifically, you are speaking to the judge and jury. Your attorneys have heard you before. They may be comfortable with some shortcuts. Because you have met with them on several occasions, you may feel comfortable enough to drop some communication formalities. Even so, don't make the mistake of being too informal in court.
Real World Scenario
Tales from the Trenches: Letting the Attorney Tell the Story
The first time I testified in court, I was unaware of the "storytelling" approach that attorneys use. Each time that I was asked a question about the case, I provided an answer to the question asked but would then continue presenting additional information. I wanted to make sure that the jury understood exactly what had happened, and I was anxious to get in all the information. The problem was that instead of helping the attorney to "tell the story," I was distracting the jury with too many details. I was not giving the attorney the opportunity to "set the stage" and prepare the jury to receive the detailed information.
After the case was over, I made an appointment with the attorney to get her opinion of how she thought the testimony had gone. That was when I learned about the storytelling approach to presenting evidence to a jury. Since then, each time I testify, I remember to slow down and let the information flow and let the story be told.
As a result of what I learned, the best advice I can give to any investigator who is called upon to testify in a legal proceeding is to thoroughly review all documentation associated with the case and then answer each question you are asked directly and politely. Do not offer any additional information during questioning. In other words, answer the question asked and nothing more.
If you feel that additional information needs to be presented because it is relevant to the case, discuss the details with the attorney you are working for before offering information in open court or at a deposition. Once in court, let your attorney lead you into the testimony. Don't rush to present all the details of the case in your first answer. Remember that the attorney you are working with will be trying to tell a story to the jury and your job is to "complete" that story with details of the case as you are asked questions.
To convey your message effectively, always speak to your audience. Remember their level of technical expertise is more limited than your own. If a jury were composed of computer forensic examiners, there would be no reason to call you in as an expert. You are there to make the complex technical details of the case accessible to the judge and jury. Always be aware of how your delivery sounds to your audience. It's a good idea to have someone on your legal team monitor your testimony from the perspective of a nontechnical person. Comments from such a monitor can be invaluable in helping you tailor your testimony style to make the most impact.
Keep It Simple
Always use the KISS method. The old Keep It Simple, Stupid acronym reminds us that simple is better than complex. In fact, almost everyone will reject information that is confusing. If you want to be believed by the judge and jury, make your explanations simple. You'll have to walk a fine line between keeping your explanations accessible and making them too simplistic.
Explaining Technical Concepts
Humans are associative thinkers. We take new information and associate it with information we already know. If we establish a strong enough association, we remember the new information. We can remember information in isolation, but only for a short time. Here's a simple test to make my point:
· What are Newton's three laws of motion?
· Write the quadratic formula from memory.
· What are the Spanish (or French) words for cat, house, and bread?
· Diagram the first sentence in the preceding paragraph.
At one time, you could probably answer all these questions. If you're like most people, you could do it on the day of the test. But the memory tends to fade after a few days when the stored information is not frequently accessed. If you currently speak Spanish or French, the third question is a snap. The moral is: your audience will retain information longer if you help them associate it with something they already know. They will also understand it far better. Try to explain technical concepts using analogies where appropriate.
Let's assume you are asked to explain how a firewall works. You can start with something like: "A firewall is like a toll plaza. All traffic must pass through a toll booth in the plaza. Traffic is sorted by payment method: fast pass, exact change, and change provided." This starts off with a mental picture your audience can build on. Take time to develop analogies to explain technical concepts. They can go a long way to get a nontechnical audience to understand technical concepts.
Use Presentation Aids When Needed
In addition to helping your audience use mental pictures, bring some pictures of your own. The old adage "A picture is worth a thousand words" is absolutely true. When appropriate, use various presentation aids to clarify your point. However, don't use presentation aids just to look impressive. Whether you use old-fashioned overhead projectors and cellophane slides, or PowerPoint presentations delivered with computer and projectors, the goal of any presentation is to get your point across to the jury and ensure that they understand the message. The presentation method might vary depending on the evidence—use the method that is most effective for delivering the message you want the jury to understand. Regardless of the delivery media used, ensure that you are completely comfortable with the media and understand how to operate any equipment (such as a computer or projector) so that the delivery is seamless and polished before the court.
If you believe a picture will help your audience understand or remember something, use it. In many cases, projecting a picture onto a screen while you explain a topic helps to cement that topic in the minds of the audience. Pictures are only one of many presentation aids available. When they help your testimony, use any of the following:
· Pictures (including crime scene photos)
· Illustrations
· Animation
· Charts or diagrams
The preceding list is not exhaustive. Use the presentation aid you think will make the most impact. That impact is measured in how well your audience understands the points you are making, not in how impressive your presentation looks.
Watch for Feedback
One of the most crucial factors during testimony is audience feedback. Because you make eye contact with the judge and jury, you can see how they react to you. Read their facial expressions and body language. You can tell when you are boring someone. Too few witnesses care, though. When you are presenting any type of information, watch to see what your audience is "saying" to you.
Anytime you lose your audience, do something. If you see that you are losing the jury as you explain how firewalls work, ask for a break. Talk the problem over with your legal team. They may suggest you try a different approach. You may have no other alternative but to push on through. Regardless, try to react to your audience. You might not be able to make the technical exciting, but you can try. Simply responding to the facial expressions and body language of your audience can increase their trust in you.
Be Ready to Justify Every Step
Your own legal team will lead you through justifications and explanations of each step through your investigation. Be prepared to stop at any point and answer "Why" questions. Your team should prepare these questions and answers during trial preparation. Although it can be tedious, you will have to provide detailed explanations that satisfy the most skeptical listeners as to why you performed some action.
The real challenge comes during cross examination. Your own legal team questions you from the perspective that you performed your job appropriately and acquired evidence that proves facts. The opposing counsel will take the opposite approach. To the other side, the evidence does not prove the facts as they are presented or was not acquired properly. You will be asked to defend your actions at each step in the process. Be prepared to justify each action and explain precautions you took to preserve the evidence. Your investigation notebook will be invaluable. Make sure you keep your notebook up-to-date during an investigation and available during a trial.
Summary
As long as you do your homework and document everything in an investigation, your testimony can positively affect the outcome of a case. Of course, if you are poorly prepared, you can have a positive impact for the opposing counsel. There are many resources and books available to help you prepare for the role of expert witness. Neil Broom has an excellent list of recommended reading for those seeking to establish themselves as an expert witness. The list can be reviewed at the following address:
· http://www.trcglobal.com/Computer_Forensics_Expert_Witness_Books.html
Do your homework, know your stuff, be prepared, and above all remember your audience. You'll have a much more pleasant experience, and you may be asked to do it all again.
