THE role of expert witnesses in court proceedings has generated much controversy as their ranks have expanded to cover a range of increasingly arcane specialisms.
Last year the Court of Appeal found itself considering ear-print evidence, lip-reading and facial mapping, all of which had been used — to varying degrees of success — in criminal cases. There was palpable disquiet among many lawyers who feared that the courts were a little too willing to entertain evidence on esoteric matters presented by people whose claim to “expertise” was, at best, dubious.
Problems concerning expert evidence also extend to the rarefied world of forensic computer analysis, according to Adrian Palmer, the managing director of Kroll Ontrack, a leading data recovery company. It is not that this is a bogus science — far from it — but rather a case of too little regulation spoiling the broth. “I am not saying that people out there are cowboys, as such,” Palmer says, “but there is a real worry that law firms are being taken advantage of by barely qualified individuals.”
Forensic computer analysis — the scientific examination of data held on, or retrieved from, computers to use as evidence in a court of law — has developed exponentially in the past few years. It can be used for a variety of purposes, ranging from tracking commercial fraud to determining whether an employee is spending his lunchbreak downloading inappropriate material from the internet. Would-be lotharios should also beware: e-mails and text messages arranging a rendezvous with an illicit lover can easily be retrieved. So, too, computer files containing trade secrets and client lists that have been copied by an employee who is planning to leave and join a rival company.
To the layman, it is mind-boggling stuff. Surely once the “delete” button is hit a computer file is erased from a computer? Not so. “Even if a file is deleted from the recycle bin, all that happens is that its index on the computer is removed,” Palmer says. “We can come in and take an image of the hard drive, reassemble pieces of the file and recover deleted documents. Even when a computer overwrites something it is still possible to reconstitute it. Likewise, a non-saved document might not be allocated in the computer’s memory, but it is still there and we can find it.”
Palmer’s company specialises in the recovery of data that is apparently “lost” — for example, because of a crashed hard drive — and also in the collation of electronic evidence in litigation. It is this latter area that gives him cause for concern.
“There is no professional body regulating experts in the field of computer forensics,” he says. Worse, there is an all but negligible financial barrier to entry. “Many practitioners are one-man bands who buy standard forensics software packages for a few thousand pounds and then set themselves up as experts. They often lack the experience and expertise necessary for serious investigative legal work.”
Mark Humphries, head of advocacy at Linklaters, shares Palmer’s concerns. “With computer forensics there are evidential issues that need to be considered,” he says. “The audit trail needs to be preserved so that challenges to the reliability of the evidence produced by the expert are minimised. This is particularly crucial in criminal cases but can be very important in civil cases, too. As a lawyer you do not want an expert to start fiddling around with a computer unless he really knows what he is doing. Even booting the hard drive can change data.”
How, though, can a lawyer ensure that the expert is up to the job? Humphries agrees that the sector is unregulated and, though he expects increased demands for regulation, he has to rely upon “reputation and recommendations”.
Ian Jeffery, head of Lewis Silkin’s media, brands and technology group, says that the appointment of forensic computer analysts is much like that of any other expert. “You need to be sure that they have relevant academic qualifications and practical experience of the kind of case you’re working on,” he says. “It would be helpful if there were a specialist qualification for computer forensics practitioners but even then I would want to do my own due diligence on who they were.”
Janet Lambert, a partner in Barlow Lyde & Gilbert’s reinsurance and international risk team, says that it is vital that forensic computer analysts have “appropriate credentials and established expertise”.
Lambert deals with large-scale commercial disputes and arbitrations, and says that two things are crucial. “I need to ensure that any technical work done by experts produces data that can be relied upon in court or before a tribunal and I need to ensure that the expert can give credible evidence.”
She points out that the landscape is changing. “Experts are emerging, such as Kroll, QinetiQ and Data Genetics, all of whom have gained experience in giving expert evidence in fraud and other cases.”
Lambert was a member of the Commercial Court Working Party, which produced a report in October on electronic disclosure. This, in turn, resulted in a revised Commercial Court Guide governing the use of electronic disclosure. nevertheless, the flock of forensic computer analysts remains unshepherded. Palmer suggests that a dedicated practice direction should be implemented, setting out the criteria that experts must meet and precisely governing the work that they do. “We are about three years behind the US,” he says, “where there is a more developed regulatory framework. It is what we need here.”
