The pause button

A key question for solicitors dealing with electronic evidence, especially in cases involving ID theft, internet fraud, and computer records falsification '“ each of which has civil and criminal components '“ is how to choose a computer forensics expert who can satisfy judicial expectations and whose record can survive close scrutiny. This article outlines some of the factors that practitioners should consider before instructing an e-evidence specialist or computer forensics expert and explores recent procedural reforms regarding the use of experts.

The widespread use of computers and electronic communications has dramatically changed the contemporary legal landscape. Technology is now so deeply embedded in every aspect of business and social relations, and in every facet of government activity, that e-evidence will soon constitute much, if not most, of the evidence used in legal proceedings.

There can be no doubt that e-evidence is now pivotal to the administration of justice. In the recent past, the majority of documentary evidence required in a typical legal proceeding could be found in filing cabinets. This approach is not merely prehistoric but antediluvian in the information age. International records management organisation ARMA estimates that 93 per cent of all records created are electronic, and over 80 per cent of electronic information is never printed.

In thousands of cases, e-evidence has proved to be the singular determinative factor (see R v Spiby (1990) 91 Cr App Rep 186, R v Fellows (1997) 2 All ER 548, R v Levin (1997) QB 65, and Hedrich v Standard Bank [2008] EWCA Civ 905).

In R v Shephard (1993) 1 All ER 225, Lord Griffiths emphasised this point in delivering the leading judgment in the House of Lords: 'Documents produced by computers are an increasingly common feature of all business and more and more people are becoming familiar with their uses and operation. Computers vary immensely in their complexity and in the operations they perform. The nature of the evidence to discharge the burden of showing that there has been no improper use of the computer and that it was operating properly will inevitably vary from case to case. The evidence must be suited to meet the needs of the case.'

A good lawyer's job is to find the 'smoking gun' e-evidence in a virtual forest of electronic data hidden in a swamp of unstructured, deleted, encrypted or anonymised files on hard drives, file servers, network drives, mobile storage devices, PDAs, mobile phones and backup tapes. How to ensure that parties to a legal proceeding are able to find and produce all the potentially relevant e-evidence, in a legally compliant manner, is one of the critical challenges facing the legal profession.

This has created a boon for techno-legal and computer forensic experts involved in finding, disclosing and presenting e-evidence in legal proceedings. These experts proliferate in all types of cases, from the obvious ID theft, internet fraud, and money laundering cases to complex, high-value litigation and to matrimonial matters where evidence of infidelity or amoral conduct can be found in emails, SMS texts, tweets, and GSM location logs.

Some caveats

As a science, digital data forensics has been around for less than 30 years, and the widespread use of e-evidence in judicial proceedings was still in its infancy ten years ago. Much of the technology and standards which underpin the process of finding, authenticating and assuring the integrity of e-evidence are still at a primordial stage. For instance, the computer system clock was a key forensic building block for the best part of two decades. The timestamp was considered sacrosanct. Forensics experts trusted the PC system timestamp to produce irrefutable evidence of timelines.

However, it is now accepted that the computer system clock is not a reliable source of evidential data, and the system timestamp can be forged. A 2007 study by two professors at the James Madison University in Virginia, United States, discovered that over a quarter of the web servers on the internet had incorrect system clocks.

An issue that bedeviled computer forensics was the lack of uniform certification. Pretty much anyone could take a few courses and set up as an expert. Sir John Wrottesly could very easily have been referring to some digital forensics experts when he commented in 1931 that ''¦ it so often happens that so-called experts are mere shams and pretenders, utterly unqualified to express an opinion upon the subject under investigation' (On Examination of Witnesses 2nd edition, p94-95, London 1931).

The conviction in March 2008 of a well-known UK computer forensics expert, Jim Bates, of four counts of making a false written witness statement and one count of perjury makes the point (R v Terence Bates, Leicester Crown Court, Case T20067408, March 6, 2008). He had been providing expert witness reports in criminal cases for many years based on his false claim that he had a degree in electronic engineering. This mirrors a 2007 case in the US where James Earl Edmiston, a popular computer forensics expert hired to testify in court cases, pleaded guilty to federal perjury charges for falsifying his CV and lying in open court.

Judicial expectations on the use of experts

The procedural underpinning for the use of experts in criminal cases in England and Wales is the Criminal Procedure (Amendment No. 2) Rules 2006 which amended the Criminal Procedure Rules 2005 on 6 November 2006. The amendments included the first Criminal Procedure Rules on expert evidence in a new part 33. The new rules set out the duty of an expert to the court and deal with the content of an expert's report. They provide explicitly for pre-trial discussion between experts and they allow the court to order that a single joint defence expert should give expert evidence for co-defendants.

The disclosure of expert evidence is governed by an amended rule 24.1, to require a party wanting to introduce expert evidence to provide the court and the parties involved in the case with a written statement of any finding, or opinion, of that expert which they intend to introduce.

Expert evidence in civil cases is governed by part 35 of the Civil Procedure Rules 1998. The disclosure of e-evidence in a civil setting (e-disclosure) is governed by the 2005 practice direction (PD) to part 31 of the CPR 1998.

Solicitors and their experts will find much similarity in part 33 CPR 2005 and part 35 CPR 1998. The thrust of CPR 2005 and CPR 1998 reforms were to reduce the amount of expert evidence used at trial and to restrict expert evidence to those issues which are reasonably required to resolve the proceedings.

The overriding focus of the court is to ensure that justice is done in a timely and cost-effective manner. To this end, the court requires an expert to be able to assist in the interpretation of specialist areas of knowledge with the added requirement in criminal cases to give an 'objective, unbiased opinion on matters within his expertise'.

Furthermore, experts appearing in the criminal courts are required by part 33.3 to state not only their qualifications but also their accreditation and experience, and that, in relation to their tests or experiments, they must summarise the findings on which they rely. They must also notify the court and all parties promptly if they vary their report or change their opinion.

Selecting and evaluating e-evidence specialists

Parts 33.7 and 33.8 of the CPR 2005 and parts 35.7 and 35.8 of the CPR 1998 provide for the selection of separate experts by the parties or for the adoption of a single joint expert whose role it is to consider differing opinions and to reach a conclusion, with a broadly median view, depending on the evidence and the strengths of potential viewpoints. The circumstances in which either approach should be adopted and the procedures for doing so are too onerous to discuss here.

The factors relevant to determining the admissibility of an expert's evidence were summarised by King CJ in the Australian case of Bonython (1984) 38 SASR 45, 46 to 47 (Supreme Court of South Australia). This case, which has been cited by the Court of Appeal on a number of occasions '“ including Luttrell [2004] EWCA Crim 1344, Dudley [2004] EWCA Crim 3336 and Harris [2005] EWCA Crim 1980 '“ enumerates three factors which are also part of the common law in England and Wales:

(1) 'whether the subject matter of the opinion is such that a person without instruction or experience in the area of knowledge or human experience would be able to form a sound judgement on the matter without the assistance of a witness possessing special knowledge or experience in the area';

(2) 'whether the subject matter of the opinion forms part of a body of knowledge or experience which is sufficiently organised or recognised to be accepted as a reliable body of knowledge or experience, a special acquaintance with which the witness would render his opinion of assistance to the court'; and

(3) 'whether the witness has acquired by study or experience sufficient knowledge of the subject to render his opinion of value in resolving the issues before the court'.

Whatever the tactical exigencies might dictate, the starting point for solicitors is to verify that their forensic specialist is registered with the Council for the Registration of Forensic Practitioners (CRFP). This scheme was established in November 2005 to provide the courts and users of forensic services with external validation of a practitioner's current forensic competence against relevant and agreed assessment criteria. Members are independently accredited as currently competent and assessed as to their commitment to high standards of professional conduct. Accreditation is time limited to four years after which a specialist must apply for revalidation.

According to Alistair Kelman, a barrister with over 20 years experience in both criminal and civil disputes involving e-evidence, a good forensics practitioner utilises an IPSEC approach in their investigations. This involves the identification, preservation, selection, examination and classification of the data-set for easy and thorough analysis. In his opinion, practitioners who adopt this approach are best equipped to research all the angles thoroughly so that you can use their reports and testimony to your best advantage.

It is equally important to assess past performance, testimony experience, chain of custody, project management, data security and quality assurance procedures by obtaining client references and advance literature on how the specialist provisions for these issues. Most reputable forensic practitioners are happy to send sample reports and supporting literature for advance evaluation.

In the civil arena where e-disclosure specialists are more prevalent, Chris Dale, a renowned e-disclosure consultant and founder of the E-disclosure Information Project, says solicitors should assess whether the specialist has clarity of expression and is able to balance pure technical expertise against proportionality '“ to deliver answers which reflect real life procedural and cost challenges as opposed to some abstract ideal. He supports the use of e-disclosure assessors, as advocated by Jackson LJ '“ a near equivalent of the US Special Master '“ to guide experts, consultants and vendors involved in handling e-evidence and to take the load off judges and masters.