Wednesday, February 18, 2009

Part 2 - Considering a Career in Computer Forensics?

As much as some people who enter this field would prefer to stay in the lab, there are times where you will have to get out in front of the public. Some of these are deal breakers for people thinking about entering the field. Probably the most common one is the possibility of having to testify in court. If you are not someone who can at least tolerate speaking in public, then this can be especially unnerving. Not only will you be required at some point to perform this particularly difficult form of public speaking, you will have to do it with your professional reputation on the line.

However, from some of the testimony I have seen in court transcripts, whether or not your reputation can truly be damaged by poor testimony is questionable.

As an expert, your testimony can have a profound impact on a case, whether it is a civil matter, a child custody case or a capital murder case where someone’s life is at stake.

The reason your testimony can have a profound impact on a case is because the attorney has decided that your testimony is important enough to risk putting you on the stand. Putting any expert on the stand is a risk. Why is that? Experts can be brilliant in the lab and stupid on the stand. Experts can be charming and personable in normal situations and turn stiff and distant on the stand. Experts can be eloquent in the conference room and totally fail to communicate in the courtroom.

Having an expert testify who manages to alienate the jury or who makes mistakes on the stand can hurt a case very badly.

When you think about what a computer forensics examiner really does, he or she bears the same burden of responsibility that any investigator in a case bears. It is up to the examiner to properly locate and expose information that relates to a case. Whether that information helps or hurts the client, as an expert, your responsibility is to present that information to the client and or counsel. If is not up to you to make value judgments. Nor are you an advocate.

One thing that all examiners share is the likelihood of having to read or view things that will have a lasting effect on them. This is more likely for the law enforcement examiner who has to cover child pornography cases.

As an examiner, you will end up viewing a great deal of pornography. That is the nature of the job. You will be exposed to images on computers that will shock and disgust you. I have seen everything from dismembered bodies, medical deformities, sexual torture and sexual mutilation to horrific disfigurements while scanning through pictures on computers that I have examined. And these are the legal images.

When people choose to enter law enforcement or other fields that deal with crimes against persons and accidents and other medical emergencies, they have an expectation that they will be confronted by these situations. Although some of the situations I have heard about from police I have worked with seem almost unbearable to have witnessed.

Some of the most horrific things you can witness are crimes against children. When you view a picture of a child being molested or a movie of a child being molested or exploited, you are viewing a crime in progress. In the case of a picture, it is one moment of that child’s misery frozen in time. In the case of a movie, you are seeing a record of the crime that is preserved so it can be viewed time and again by persons who enjoy watching a child being molested to the point of imagining themselves in the role of the adult  in the movie.
While viewing crime scene photos of murders have an effect that lasts a long while. Viewing child pornography images may not remain crystal clear in your mind forever, but the emotional impact of seeing them probably will.

Why would I or anyone else work to defend people who have these images on their computer? Believe it or not, not everyone is guilty. It is for those few that I work cases, to insure that an innocent person does not get punished for a crime simply because the state had the leverage of an expert on their side. I am not saying that law enforcement does anything wrong in these cases. But I will say that simply showing that something is present has long been enough to get a conviction without the evidence being properly challenged. Because there are now, and have been, almost no computer forensic experts who will work sex crime cases for the defense.

To be continued...


  1. Concerning your last paragraph; are you at a point where you can quantify just how many people are innocent versus guilty when you assist the defense?

    Do you only go to court when you have good data to explain the childporn found and that the defendant is not guilty?

    Can you make money as a defense expert by reviewing the hard drive and informing the attorney that their client is toast? Maybe 1 in 10 goes to trial, the rest of them you review case data and give the attorney the bad news.

  2. I would have to venture to guess that less than 1 in 250 ever go to court. That has less to do with forensics than the practicality of our justice system.

    As far as how many are innocent, I am not going to quantify that because it could come back to haunt me some day in court.

    As far as making money, I am assuming you mean do I get paid if the outcome is not good.

    Working on contingency is unethical for an expert. I get a retainer up front for all cases, except indigent cases, since those are guaranteed by the court. In other words, getting paid has no bearing on the results of my examinations.

  3. Thank you for your response - after reading my comment I realized it could be construed as questioning your ethics; I did not mean that at all, so I apologize for that.

    I was in fact interested to know the business implication in your support of defense attorneys, and you have answered that very well.


  4. I did not take it that way at all. But I did want to be clear.

  5. On of the hardest call you have to make as an expert is the one to your client attorney, telling him or her that the evidence shows that his client is guilty. Surprisingly, when I've had to do that, the attorney is good about it. Like one southern lawyer said to me, "Well, shame. He lied to me and I lied to you. I'm sorry about that."


I have moderated my comments due to spam.