The British legal system, adversarial as it is, is of necessity a game of two halves. Attention is sometimes given in the media to the assistance provided to prosecuting authorities by digital forensic experts, but reporting of the case for the Defence almost always focuses on the words of the Defence Counsel. But who provides Defence barristers with the material they need to call into question the Prosecution interpretation of the evidence in situations where digital evidence is crucial to the case?
While many barristers are sufficiently au fait with digital technology to raise the obvious objections to Prosecution findings – ‘are there any viruses?’, ‘has the computer been hacked’ – on more subtle points Defence Counsel frequently lacks the technical knowledge to spot the less obvious weaknesses in the Prosecution case. This is where the Defence Expert steps in.
Working for the Defence is a subtly different beast to Prosecution work. A Prosecution submission will usually contain a broad remit – ‘search for illegal images’, ‘are there any documents relating to fraudulent transactions?’ – but Defence work tends to focus on specific questions, accompanied by a general ‘review the Prosecution reports and comment on them’ request. The specific questions come either from the defendant’s own objections to Prosecution interpretation of evidence, or from the analysis of the Prosecution’s findings, as conducted by the defendant’s lawyers. Also, while a Prosecution case involves a short period of contact with the customer, Defence cases generally are the beginning of a long conversation with the Defence Counsel, which often continues into the courtroom itself. Answers to questions lead to further questions; unlike Prosecution casework, Defence cases become a sequence of additional questions and answers as Counsel builds each new insight into the overall defence case. Then, as Prosecution is made aware of submitted reports from the Defence side, they may in turn provide their own questions and challenges.
Eventually, both parties in the case will make a decision to agree or disagree on the evidence (indeed, the judge may insist upon it), and the Defence Expert will be invited to collaborate on a joint statement with his or her Prosecution counterpart. Additional negotiations between the two Experts may lead to a general agreement on facts and their interpretation; or, some outstanding differences of opinion on interpretation may make their way into courtroom.
Conversations will occur via email and telephone conversation. As trial dates loom, more questions will be sent by Defence Counsel, which may require an answer on the hoof, as the Defendant may be present for consultation in Chambers; the answers will be put to the Defendant and his or her reaction may be fed back. This process is likely to continue into court, also.
Court attendance may be required so that the Defence Expert can give evidence in the witness box, or it may be to provide on site guidance to Defence Counsel on issues and questions which arrive as a result of the pre-trial discussions between all concerned parties. Such conversations often add to the defence case as clarification of fine technical points leads to new insights about details of the events under scrutiny, such as timings of file creation or the activity of a specific piece of software. As Defence Experts are often not lawyers, and vice versa, it is this synergy of two minds considering the same problem from different angles, which can sometimes provide radical observations, the significance of which either party alone might not have grasped.
Unlike in Prosecution cases, a Defence Expert is likely to have face to face contact with the Defendant, either in case conferences or actually in court; the Expert may have discovered facts which undermine his or her belief in the Defendant’s innocence, or they may encounter material which while not illegal may be distasteful or offensive to them personally. It is at times like these that the Defence Expert’s professionalism and detachment are most sternly tested. Defence Experts have a duty to ensure that what interactions they may have with Defendants are polite, professional and non-judgemental and, above all, in accordance with the Defence Counsel’s instructions.
On a lower level, there are logistical issues with defence work which rarely occur with prosecution cases. As the Prosecution is the custodian of the Defendant’s digital devices, the Defence must apply to the Prosecution for access to the original exhibits or verified copies taken from them. This Prosecution obligation sometimes takes longer to fulfil than is convenient for both sides; the Defence cannot be sure to secure an adjournment from the judge to give the Defence Expert sufficient time to examine the devices, so Defence Experts often work to short deadlines.
In summary, Defence Work is an interesting and important part of Digital Forensics. Just as a Prosecution Expert is determined to help Law Enforcement to ensure that the guilty in society are justly dealt with, so the Defence Expert strives to ensure that Defendants have a chance of a fair hearing in front of their peers, and a just outcome to their cases.
Senior PC Analyst