The Defense's Cyber Forensic Expert Who Agrees With the Prosecution

Two forensic experts already turned the case down. The third has read the logs and thinks the state is right.

Simulated scenario. This is a hypothetical thought exercise. The case, the defendant ("Mr. Anon"), and the attorney are fictional, and no real investigation is described. I wrote it for an ethics class assignment. The sources cited are real.

This scenario is a thought exercise meant to spark reflection on the ethical questions that could arise. I play the role of a digital forensics analyst contacted by a criminal defense attorney to analyze the contents of his client's phone. The client, accused of murder, maintains his innocence, yet the local district attorney, along with digital forensics experts at the state crime lab, believe that deleted search results and geolocation data on the defendant's phone is proof of guilt. The criminal defense attorney has reached out to me after two other experts refused the case. The defendant's counsel has expressed to me that he simply wants his client to receive a vigorous legal defense.

I received only the disk image of the phone that was imaged by the state crime lab. I did not physically interact with the phone. Upon reviewing logs, SQL application data and geolocation data of the night in question, I realized that the state's forensics analysts were correct in their interpretation that the evidence pointed at the defendant as the perpetrator of the crime.

The Conflict

This situation places me in a moral conflict. I have been hired by a defense attorney, which creates pressure to come to a professional disagreement with the state. (Experts are supposed to be paid for their time and analysis, not for a particular conclusion, but the pressure is real.) That immediately pulls personal and professional ethics into conflict. Some practitioners, understanding their "role" in the situation, may decide to play "devil's advocate," look the other way, and agree to testify for the defense. After all, repeatedly agreeing with prosecutorial assessments and findings could be bad for business as a defense expert witness. I believe operating solely out of a sense of protectionism and greed in this situation is unethical.

However, from a deontological perspective, I believe justice is only served when individuals receive competent and vigorous legal defense. The state, having the burden of proof, must be able to prove its case. Although I may be convinced the evidence of guilt is solid, I could go along with testifying as to why the state's interpretation of the evidence could be flawed or point out any issues with how the evidence was processed and handled. This course is ethical as it isn't directly supportive of innocence, but it debates the evidence of guilt, forcing the state to make its case. That only holds if the criticisms are real. The ISFCE code of ethics asks examiners to maintain the utmost objectivity and to testify truthfully, which rules out manufacturing doubt I don't actually have. Doing so without lying would preserve my sense of deontological and virtue ethics while serving a sense of utilitarianism in seeing that the justice system works as intended, and that everyone is defended competently.

The Witness Stand

However, by its nature, this course of action is fraught with ethical landmines further down the road. Without venturing into the oblivion of eventual theoretical outcomes, you don't have to go very far to foresee being on the witness stand, under oath, and being asked by the prosecutor: "You believe, based on the forensic evidence, that Mr. Anon's phone, and by extension himself, were not present at the crime scene during the time of the murder?" What could the ethical answer to that question possibly be?

The same code says examiners never express an opinion on the guilt or innocence of any party, so I wouldn't adopt that question's premise. But on cross-examination I would still have to answer truthfully about what my own analysis found. That means the real ethical question isn't what to say on the stand. It's whether to be on the stand at all.

A Third Option: Consult, Don't Testify

Defense attorneys often retain a consulting expert first. Communications with a consultant generally stay confidential until the expert is designated to testify, so I could review the image, tell the attorney honestly what I found, and leave it to him to decide whether to call me. In federal court, the defense must disclose an expert's opinions only in specific circumstances, and defense work product is generally shielded from discovery, though scientific reports can be an exception. State rules vary, and a local prosecution like this one would be governed by the state's.

The same ABA article notes that lawyers can't knowingly offer false evidence, so my candor with the attorney matters to his obligations too. And a consultant can still help the defense in honest ways, like pointing out where the state's handling of evidence deserves a hard look, without ever having to say something I don't believe.

The Alternative: Walk Away

The alternative path is to reject the job of advocacy and testimony in the case altogether. Obviously, this would steer me clear of any further ethical conundrums but could come at the aforementioned price of reduced popularity as a go-to witness for digital forensics. In this scenario I would weigh my personal virtue ethics suggesting that I not aid in the defense of someone whom I believe to be guilty, against the need to preserve my livelihood, and sense of utilitarianism in seeing that the justice system functions as designed. The main thought here being, even if I followed a sense of utilitarianism to provide a vigorous defense, could I live with myself in the end if I helped a killer go free? Then again, I have only seen a fraction of the evidence in the case. Could Mr. Anon actually be innocent? What if my belief based on only what I have seen is incorrect? Shouldn't a jury make the final decision? Can I ethically and professionally find points of disagreement with the state's experts?

Takeaway

These are tough questions, but I think the third option answers more of them than it first appears to. I would take the job as a consultant, not a witness. I would review the evidence honestly and tell the attorney what I found, including that the state's reading holds up. If I find real problems with how the evidence was collected or analyzed, I can say so under oath, truthfully, and stop there. If the only honest testimony I have helps the prosecution, I don't take the stand.

Mr. Anon still gets a vigorous defense, because the state still has to prove its case. What he doesn't get is an expert who bends. A vigorous defense and an honest expert aren't in conflict, as long as the expert knows which job they were hired to do.

Sources

• ISFCE. Code of Ethics and Professional Responsibility. International Society of Forensic Computer Examiners.
• American Bar Association. Ethics Issues in the Use of Expert Witnesses. The Professional Lawyer, vol. 24, no. 3.
• Federal Rules of Criminal Procedure, Rule 16: Discovery and Inspection. Justia.