Big Galoot Diatribe - Superheroes and independence of expert witnesses

March 28th, 2008 Drazen Drazic Posted in Big Galoot Diatribe, Forensics, Industry Specialists Talk, cyber crime |

The rantings of Craig Chapman, IT Security Legend and good bloke.

I’ve previously drivelled-on about the time I was approached at a conference by a couple of computer forensic ‘experts’ from a global IT co.

If you believed their story, these guys were IT super-heroes. The only things missing from this pair of turkeys was their red capes, masks and tight fitting, lycra underpants (although I strongly suspect these were being worn under their tailored suits).

See, not only had they interviewed the suspects of a recent computer crime and taken statements from witnesses, but they’d also done the computer forensics as well….the entire investigation, computer forensics everything - lock, stock & barrell, according to them. And they were proud as punch.

All that remained was the impending Court case….

And an overlooked, but rather important detail - known as ‘independence’ of an expert witness. DD has asked me to elaborate on this very basic principle.

The NSW Supreme Court has specified that an expert witnesses’ paramount duty is to the Court, and not to the person that retains them.

On a similar note, it has been argued (successfully) that performing a dual role of investigator (interviewing suspects, taking statements etc) and computer forensics expert effectively nullifies the perceived independence of the expert witness. The real potential here is that highly expensive, hard-gathered computer evidence is unceremoniously thrown out.

Thats what happened in a very similar case of a forensic accountant, acting on behalf of ASIC in the Jodee Rich/One.tel case. He played the dual role of investigator & ‘expert’ forensic accountant. His evidence was tossed out. Reason? Lack of independence. It’s that simple.

Don’t take it from me though. If you want to go play cowboys & superheroes - go right ahead, who knows - you might even get lucky. But be fully prepared to have your evidence dismissed and possibly lose your case completely, with costs awarded. Doesn’t sound like fun, does it ?