What do aiding and abetting the communication of copyrighted works to the public, arson, confidential information, fraud, perjury, software copyright, terrorism and theft have in common? The answer is computer evidence – these are a sample of cases where the author has recently provided expert evidence.
My last contribution to C&L was four years ago, when I reported the arrival of a new breed of expert, the Registered Forensic Practitioner. So how have the role and duties of the expert witness developed in the meantime? Here are some of the important developments, in roughly chronological sequence.
Live Forensics
With the Live Forensics approach, a series of snapshots of the dynamic and volatile state of a running computer are made using the operating system of the system under investigation. A hardware write-blocker is not used and no forensic image is made of the entire storage media that can subsequently be verified.
As the use of these relatively novel techniques has become more widespread than originally envisaged (when justified as helping to establish where the terrorist had planted his bomb), the number of concerns expressed by computer forensics practitioners about Live Forensics has grown. These concerns include:
· intrusiveness (aka contamination)
· verifiability
· repeatability
· reviewability
· trustworthiness
· selectiveness
· uncertain legal effect.
The ACPO Guidelines version 4 published in 2007 made reference to Live Forensics for the first time. Although under review, ACPO version 4 is still in effect today and there remain apparently unresolved contradictions between Live Forensics and traditional “Pull the Plug”, after the event forensics.
Jim Bates
On 6 March 2008 Jim Bates was convicted at Leicester Crown Court on four counts of making a false statement and one count of perjury. He was the main computer expert for the Metropolitan Police in the Sergeant Virdi case, for the Soham family liaison officer DC Stevens and for the claimant in the Takenaka case (a judgment described by a leading computer law practitioner as “trial by expert”). I assumed that this would signal the end of his career. But a few months later his home was raided and a large quantity of computer evidence was seized. In subsequent court proceedings it became clear that he had continued to practice as “an assistant” or as “a consultant”. The High Court subsequently ruled that the search and seizure was unlawful.
Accreditation
Unfortunately the CRFP registration scheme was not a roaring success – only about a dozen practitioners in the computer forensics field were registered; at least one applicant was turned down. In February 2009 the National Policing Improvement Agency, ACPO, Metropolitan Police Service and the Home Office communicated apparently co-ordinated decisions to withdraw funding from CRFP, and its doors closed at the end of March 2009. I have yet to see a coherent explanation of what happened.
Instead we have a Forensic Science Regulator who has confirmed that digital forensics is within his remit. The Regulator has proposed a Code of Conduct for Forensic Science Practitioners largely salvaged from the ashes of CRFP. Its 16 clauses provide a comprehensive schedule of desirable attributes including:
· fairness
· honesty
· integrity
· objectivity
· professional Competence
· responsibility for work done by others
· confidentiality.
This schedule could also be used as a checklist to evaluate potential expert witnesses. As yet no new registration scheme has been finalised, so we remain in limbo with no effective control system of accreditation in place.
Finding an Expert
The British Computer Society continues to maintain a small register of Expert Witnesses. The Academy of Experts and Expert Witness Institute provide access to names of members by speciality. In relation to published directories, there is no longer a Law Society directory of “approved” experts. I remain astonished at the lack of action by the Law Society against forensic providers whose promotional material continues to include such claims.
The commercial sector is fiercely competitive, with new web-based directories appearing (and disappearing) regularly. Primus inter pares is clearly the UK Register of Expert Witnesses.
Undoubtedly many practitioners will rely on the in-house database (aka collegial grapevine) or counsel’s recommendations.
Admissibility of Expert Evidence
Following its recent review, the Law Commission’s main proposal is for trial judges to be given a “gate-keeping” role in determining whether expert evidence is sufficiently reliable to be admitted. In relation to computer evidence that is long overdue and would be a very welcome development.
The Commission acknowledges the distinction between the treatment of “scientific” and “experienced-based” evidence. Using the Law Commission’s terminology, is computer evidence “scientific”? I have yet to see any reasoned discussion on where expert evidence on computers would fall. Whereas expert evidence on computers may at first blush appear to have scientific attributes, my experience is that it does not stand up at all well to Daubert-style testing. Would that mean that computer expert evidence would necessarily be assessed under criteria intended for “lip-readers, handwriting examiners and literary critics”. I believe that the answer is that it will depend; the ASCII representation of Hexadecimal characters may be treated as “scientific”; opinions on trade practice in the web-hosting sector will not.
The Law Commission propose that, when assessing reliability, judges could also take into account whether an expert witness is or is not accredited – providing that the accreditation process is itself reliable. Of course, at present there are no relevant accreditation processes.
Court Assessors
The Law Commission also proposes that where the nature of the particular evidence or the field of expertise is particularly difficult, judges should exceptionally be permitted to appoint an independent assessor to provide assistance and guidance in assessing reliability. Clearly many computer cases would potentially be eligible. In a recent software copyright case I was asked to identify assessor attributes and candidates for just such a role.
Judicial Decisions
In Point Solutions v Focus, the trial judge observed that she had not been assisted by any expert evidence (notwithstanding the fact that I had been appointed as a Single Joint Expert). In the appeal against that judgment, the Court of Appeal indicated some reluctance to allow a case to proceed to trial in the absence of “the expert assistance which is needed if the court is to decide the real question in dispute”.
In SAS Institute the trial judge had to deal at some length with the parties’ numerous criticisms of each others’ expert witnesses. He held that prior experience of the claimant’s SAS System was not a pre-requisite for giving expert evidence in the case. An unrealistic case management timetable appears to have severely restricted the scope of the trial. In the words of the trial judge:
“Both experts were required to prepare lengthy and detailed reports on complex subject matter within an extremely short timescale. As a result, as they both frankly acknowledged, they were both forced to take certain shortcuts”.
The judgment follows the ruling in Navitaire that it is not the function of an expert’s report to set out particulars of similarities in software copyright cases. Rather, particulars of similarities should be set out in a statement of case, and then considered by the respective expert witnesses. That respected opinion is a counsel of perfection. In my experience of software copyright and confidential information cases the parties are in no position to identify and exhibit similarities because they do not have access to each others’ confidential materials, including source code. Typically that is precisely the experts’ role.
Paragraphs 270 – 279 of the judgment in BSkyB deal with the IT expert evidence. After a major and blanket assault on the defendant’s IT expert witness, the trial judge noted the comments made on the same expert in Pegler v Wang, but was not minded to exclude any one expert’s evidence, preferring to assess the knowledge and experience of each expert on individual issues. I believe that that reflects the reality of the situation, given that computing is a very broad church – no one expert will ever be competent in all aspects.
There are also some interesting comments about the risks of diversionary “satellite investigations” into such previous form of experts.
Prejudicial Publicity on the Internet
The problem of internet research by jurors in criminal trials has recently been highlighted by the recommendations made by the Lord Chief Justice in Thompson. I gave expert evidence on the extent of this problem in two high-profile cases in Scotland.
In Sinclair, the Appeal Court dealt with a claim that access by jurors to information on the internet that was gravely prejudicial to a fair trial could not be controlled before or during the trial. The appellant had a very serious criminal record, with convictions for rape and murder, and was now charged with other counts of rape and murder. At first instance it was accepted that there was a problem in relation to prejudicial publicity on the internet.
The Appeal Court heard that since that hearing the prosecution had taken steps to mitigate that potential prejudice, including persuading web site owners to remove items of particular concern; and that that process was ongoing. The Court was satisfied as a result that it was reasonable to expect that the appellant’s trial would not be rendered unfair by prejudicial material coming to the knowledge of jurors at his trial.
The Appeal Court accepted that in high-profile cases, it would be appropriate for the trial judge to receive representations as to the terms in which he might instruct the jury regarding any past or prospective use of the internet.
Funding
The Ministry of Justice has continued to work on ways to reduce the costs of experts in publicly funded cases. This will likely add further pressure to the labyrinthine complexity of public funding arrangements. Taken together with the current state of the economy, the outlook can only be expected to worsen. Indeed the process has already started with unilateral cuts announced by the Legal Services Commission to travelling time and the abolition of cancellation fees.
Expert Immunity
Undoubtedly the most significant potential development for experts in this period has been the leap-frog appeal of Jones v Kaney. This is due to be heard by the Supreme Court in January 2011. I believe that clarification and simplification of an expert’s liability is long overdue. Instructing solicitors will need to be extra vigilant in ensuring that any expert appointed has adequate Professional Indemnity insurance cover.
Role of the Expert
There are two distinct aspects of the work of the expert witness, that of a professional adviser and that of the court expert. These two roles don’t necessarily need to be fulfilled by the same person.
When acting as a professional adviser, the expert’s duty is to his client. His independent opinions on the merits/demerits of the case should be uncompromisingly frank; for that reason, any preliminary written report needs to be privileged.
The second role is the classic role as a witness of technical opinion. In this role, the expert’s over-riding duty is to the court. He will likely be ordered by the court to produce a report for exchange, to attend meetings with his opposite number and prepare joint statements of such experts’ meetings.
Confusion and conflict between these two separate roles is perhaps inevitable in an adversarial system, but what is not acceptable is compromise. The courts have rightly become much tougher on experts who are little more than advocates with a degree of expertise.
But, in commercial cases, the emphasis on the expert’s duty to the court may lead to tensions with the instructing solicitor. Some solicitors may be concerned that they need to stop experts from “trying to run the case” or “making some stupid agreement with their opponent”. In my view if you really want to keep a compliant poodle and bark yourself, there is no point in appointing an expert who is capable of making an independent assessment, bridging the gap between technologists and lawyers, and delivering forthright, reasoned opinions.
Retrospective Evidence
Finally, because it is virtually impossible to remove all traces of a disputed transaction from digital evidence, and because that evidence generally does not degrade, the intriguing possibility exists of conducting cold case reviews. What I call retrospective evidence has emerged come from two sources. First is the tsunami of digital evidence that has accumulated over the last 25 years. The internet is clearly a main driver and two of my most frequently used sources are in fact Google and the web archives. Second is the continuing, rapid development of computer forensics. That means that investigations can be done today that would have been impossible or at least uneconomic even five years ago.
The moral is: Don’t overlook the possibility of retrospective evidence, it may be much more valuable than you realise. Always tell your clients to look in their archives – or as in the case of IBCOS, their lofts, caravans and garages.
Michael J L Turner is an experienced forensic computer examiner and an established expert witness on computer evidence. For more information, see www.computerevidence.co.uk.
References
Registered Forensic Practitioner: A New Breed of Expert, Computers & Law, March 2006
Good Practice Guide for Computer Based Evidence, ACPO
Mr G S Virdi v Commissioner of Police of the Metropolis, London North Employment Tribunal 2202774/98 (Computers & Law, February 2001)
Takenaka (Uk) Ltd and Brian Corfe v David Frankl [2001] EWCA Civ 348
Terence James Bates v Chief Constable of Avon and Somerset Police and Bristol Magistrates’ Court [2009] EWHC 942 (Admin)
Forensic Codes of Practice and Conduct for forensic science providers and practitioners in the Criminal Justice System, Forensic Science Regulator
Admissibility of Expert Evidence in Criminal Proceedings in England and Wales: A New Approach to the Determination of Evidentiary Reliability, Law Commission (Law Com No 190, 2009)
Point Solutions Ltd v Focus Business Solutions Ltd & Anor [2007] EWCA Civ 14
SAS Institute Inc v World Programming Ltd [2010] EWHC 1829 (Ch)
BSkyb Ltd & Anor v HP Enterprise Services UK Ltd & Anor [2010] EWHC 86 (TCC)
Pegler v Wang (2000) 70 Con LR 68
R v Thompson and Others [2010] EWCA Crim 1623
Angus Robertson Sinclair v Her Majesty’s Advocate [2007] HCJAC 27
Jones v Kaney [2010] EWHC 61 (QB)
IBCOS Computers v Barclays Mercantile Highland Finance [1994] FSR 275
