What do aiding and abetting the communication of copyrighted works
to the public, arson, confidential information, fraud, perjury,
software copyright, terrorism and theft have in common? The answer
is computer evidence - these are a sample of cases where the author
has recently provided expert evidence.
When approached by the editor, I was surprised to see that my last
contribution to C&L was four years ago, when I reported the arrival
of a new breed of expert, the Registered Forensic Practitioner.
So how have the role and duties of the expert witness developed
in the meantime? In roughly chronological sequence:
With the Live Forensics approach, a series of snapshots of the
dynamic and volatile state of a running computer are made using
the operating system of the system under investigation. A hardware
write-blocker is not used and no forensic image is made of the entire
storage media that can subsequently be verified.
As the use of these relatively novel techniques has become more
widespread than the original justification of finding where the
terrorist had planted his bomb, so has the number of concerns expressed
by computer forensics practitioners about Live Forensics. These
· Intrusiveness (aka Contamination)
· Uncertain legal effect
ACPO Guidelines version 4 published in 2007 made reference to Live
Forensics for the first time. Although under review, ACPO version
4 is still in effect today and there remain apparently unresolved
contradictions between Live forensics and traditional "Pull the
Plug", after the event forensics.
On 6 March 2008 Jim Bates was convicted at Leicester Crown Court
on four counts of making a false statement and one count of perjury;
he was the main computer expert for the Metropolitan Police in the
Sergeant Virdi case, for the Soham family liaison officer DC Stevens
and for the claimant in the Takenaka case (a judgement described
by a leading computer law practitioner as "trial by expert"). I
assumed that this would signal the end of his career. But a few
months later his home was raided and a large quantity of computer
evidence was seized. In subsequent court proceedings it became clear
that he had continued to practice as "an assistant" or as "a consultant".
The High Court subsequently ruled that the search and seizure was
Unfortunately the CRFP registration scheme was not a roaring success
- only about a dozen practitioners in the computer forensics field
were registered; at least one applicant was turned down. In February
2009 the National Policing Improvement Agency, ACPO, Metropolitan
Police Service and the Home Office communicated apparently co-ordinated
decisions to withdraw funding from CRFP, and its doors closed at
the end of March 2009. I have yet to see a coherent explanation
of what happened.
Instead we have a Forensic Science Regulator who has confirmed
that digital forensics is within his remit. The Regulator has proposed
a Code of Conduct for Forensic Science Practitioners largely salvaged
from the ashes of CRFP. Its sixteen clauses provide a comprehensive
schedule of desirable attributes including:
· Professional Competence
· Responsibility for work done by others
This schedule could also be used as a checklist to evaluate potential
expert witnesses. As yet no new registration scheme has been finalised,
so we remain in limbo with no effective control system of accreditation
Where to find an expert?
The British Computer Society continues to maintain a small register
of Expert Witnesses. The Academy of Experts and Expert Witness Institute
provide access to names of members by speciality. In relation to
published directories, there is no longer a Law Society directory
of "approved" experts. I remain astonished at the lack of action
by the Law Society against forensic providers whose promotional
material continues to include such claims. The commercial sector
is fiercely competitive, with new web-based directories appearing
(and disappearing) regularly. Primus inter pares is clearly the
UK Register of Expert Witnesses. Undoubtedly many practitioners
will rely on the In-house database (aka collegial grapevine) or
Admissibility of expert evidence
Following its recent review, the Law Commission's main proposal
is for trial judges to be given a "gate-keeping" role in determining
whether expert evidence is sufficiently reliable to be admitted.
In relation to computer evidence that is long overdue and would
be a very welcome development.
The Commission acknowledges the distinction between the treatment
of "scientific" and "experienced-based" evidence. Using the Law
Commission's terminology, is computer evidence "scientific"? I have
yet to see any reasoned discussion on where expert evidence on computers
would fall. Whereas expert evidence on computers may at first blush
appear to have scientific attributes, my experience is that it does
not stand up at all well to Daubert-style testing. Would that mean
that computer expert evidence would necessarily be assessed under
criteria intended for "lip-readers, handwriting examiners and literary
critics". I believe that the answer is that it will depend; the
ASCII representation of Hexadecimal characters may be treated as
"scientific"; opinions on trade practice in the web-hosting sector
The Law Commission propose that when assessing reliability, judges
could also take into account whether an expert witness is or is
not accredited - providing that the accreditation process is itself
reliable. Of course, at present there are no accreditation processes.
The Law Commission also proposes that where the nature of the
particular evidence or the field of expertise is particularly difficult,
judges should exceptionally be permitted to appoint an independent
assessor to provide assistance and guidance in assessing reliability.
Clearly many computer cases would potentially be eligible. In a
recent software copyright case I was asked to identify assessor
attributes and candidates for just such a role.
In Point Solutions v Focus, the trial judge observed that
she had not been assisted by any expert evidence (notwithstanding
the fact that I had been appointed as a Single Joint Expert). In
the appeal against that judgement the Court of Appeal indicated
some reluctance to allow a case to proceed to trial in the absence
"the expert assistance which is needed if the court is to
decide the real question in dispute".
In SAS Institute the trial judge had to deal at some length
with the parties' numerous criticisms of each others' expert witnesses.
He found/held that prior experience of the Claimant's SAS System
was not a pre-requisite for giving expert evidence in the case.
An unrealistic case management timetable appears to have severely
restricted the scope of the trial. In the words of the trial judge:
"Both experts were required to prepare lengthy and detailed
reports on complex subject matter within an extremely short timescale.
As a result, as they both frankly acknowledged, they were both
forced to take certain shortcuts".
The judgement follows the judgement in Navitaire that it is not
the function of an expert's report to set out particulars of similarities
in software copyright cases. Rather, particulars of similarities
should be set out in a statement of case, and then considered by
the respective expert witnesses.
In my view that respected opinion is a counsel of perfection. In
my experience of software copyright and confidential information
cases the parties are in no position to identify and exhibit similarities
because they do not have access to each others' confidential materials,
including source code. Typically that is precisely the experts'
Paragraphs 270 - 279 of the judgement in BSkyb deal with
the IT expert evidence. After a major and blanket assault on the
defendant's IT expert witness, the trial judge noted the comments
made on the same expert in Pegler v Wang, but was not minded
to exclude any one expert's evidence, preferring to assess the knowledge
and experience of each expert on individual issues. I believe that
that reflects the reality of the situation, given that computing
is a very broad church - no one expert will ever be competent in
all aspects. There are also some interesting comments about the
risks of diversionary "satellite investigations" into such previous
form of experts.
Prejudicial publicity on the internet
The problem of internet research by jurors
in criminal trials has recently been highlighted by the recommendations
made by the Lord Chief Justice in Thompson.
The author has given expert evidence on the extent of this problem
in two high-profile cases in Scotland. In Sinclair, the Appeal
Court dealt with a claim that access by jurors to information on
the internet that was gravely prejudicial to a fair trial could
not be controlled before or during the trial. The Appellant had
a very serious criminal record, with convictions for rape and murder
and was now charged with other counts of rape and murder. At first
instance it was accepted that there was a problem in relation to
prejudicial publicity on the internet.
The Appeal Court heard that since that hearing the Prosecution
had taken steps to mitigate that potential prejudice, including
persuading website owners to remove items of particular concern;
and that that process was ongoing. The Court was satisfied as a
result that it was reasonable to expect that the appellant's trial
would not be rendered unfair by prejudicial material coming to the
knowledge of jurors at his trial.
The Appeal Court accepted that in high-profile cases, it would
be appropriate for the trial judge to receive representations as
to the terms in which he might instruct the jury regarding any past
or prospective use of the internet.
The Ministry of Justice has continued to work on ways to reduce
the costs of experts in publicly funded cases. This will likely
add further pressure to the labyrinthine complexity of public funding
arrangements. Taken together with the current state of the economy,
the outlook can only be expected to worsen. Indeed the process has
already started with unilateral cuts announced by LSC to travelling
time and the abolition of cancellation fees.
Undoubtedly the most significant potential development for experts
in this period has been the leap-frog appeal of Jones v Kaney. This
is due to be heard by the Supreme Court in January 2011. I believe
that clarification and simplification of an expert's liability is
long overdue. Instructing solicitors will need to be extra vigilant
in ensuring that any expert appointed has adequate Professional
Indemnity insurance cover.
Role of the expert
There are two distinct aspects of the work of the expert witness,
that of an professional adviser and that of the court expert. These
two roles don't necessarily need to be fulfilled by the same person.
When acting as a professional adviser, the expert's duty is to
his client. His independent opinions on the merits/demerits of the
case should be uncompromisingly frank; for that reason, any preliminary
written report needs to be privileged.
The second role is the classic role as a witness of technical opinion.
In this role, the expert's over-riding duty is to the court. He
will likely be ordered by the court to produce a report for exchange,
to attend meetings with his opposite number and prepare joint statements
of such experts' meetings.
Confusion and conflict between these two separate roles is perhaps
inevitable in an adversarial system, but what is not acceptable
is compromise. The courts have rightly become much tougher on experts
who are little more than advocates with a degree of expertise.
But, in commercial cases, the emphasis on the expert's duty to
the court may lead to tensions with the instructing solicitor. Some
solicitors may be concerned that they need to stop experts from
"trying to run the case" or "making some stupid agreement with their
opponent". In my view if you really want to keep a compliant poodle
and bark yourself, there is no point in appointing an expert who
is capable of making an independent assessment, bridging the gap
between technologists and lawyers, and delivering forthright, reasoned
Finally, because it is virtually impossible to remove all traces
of a disputed transaction from digital evidence, and because that
evidence generally does not degrade, the intriguing possibility
exists of conducting cold case reviews. What I call retrospective
evidence has emerged from two sources. First is the tsunami of digital
evidence that has accumulated over the last twenty-five years. The
internet is clearly a main driver and two of my most frequently
used sources are in fact Google and the web archives. Second is
the continuing, rapid development of computer forensics. That means
that investigations can be done today that would have been impossible
or at least uneconomic even five years ago.
So the moral is: Don't overlook the possibility of retrospective
evidence, it may be much more valuable than you realise. Always
tell your clients to look in their archives - or as in the case
of IBCOS, their lofts, caravans and garages.
Registered Forensic Practitioner: A New Breed of Expert Computers
& Law, March 2006
Good Practice Guide for Computer Based Evidence, ACPO
Mr G S Virdi v Commissioner of Police of the Metropolis, London
North Employment Tribunal 2202774/98 (Computers and Law, February
Takenaka (Uk) Ltd And Brian Corfe v David Frankl  EWCA Civ
Terence James Bates v Chief Constable of Avon and Somerset Police
and Bristol Magistrates Court  EWHC 942
Forensic Codes of Practice and Conduct for forensic science providers
and practitioners in the Criminal Justice System, Forensic Science
Admissibility of Expert Evidence in Criminal Proceedings in England
and Wales: A New Approach to the Determination of Evidentiary Reliability,
Law Commission (Law Com No 190, 2009)
Point Solutions Ltd v Focus Business Solutions Ltd & Anor 
EWCA Civ 14 (23 January 2007)
SAS Institute Inc v World Programming Ltd  EWHC 1829 (Ch)
(23 July 2010)
BSkyb Ltd & Anor v HP Enterprise Services UK Ltd & Anor (Rev 1)
 EWHC 86 (TCC) (26 January 2010)
Pegler v Wang 70 Con LR 68
R v Thompson and Others  EWCA Crim 1623
Angus Robertson Sinclair vHer Majesty's Advocate, Appeal Court,
High Court Of Justiciary  HCJAC 27. Appeal No: XC903/06
Jones v Kaney  EWHC 61 (QB)21 January 2010
IBCOS Computers v Barclays Mercantile Highland Finance (
Michael J L Turner MA FBCS CITP MAE FEWI is an experienced forensic
computer examiner and an established independent expert witness
on computer evidence.