In a criminal trial, the lawyers submit all items of evidence, including anticipated testimony, to the judge for approval, before the jury gets to hear it and “find the facts.” A good judge excludes some items, because they are of questionable veracity, not probative, unduly prejudicial, and so on.
All sorts of activities are recorded on all sorts of electronic equipment, all of which seems to fall under the rubric of computer-forensics evidence. I’m not talking only about PCs; I’m talking about all sorts of electronic records. I’m convinced that much of the computer-forensics evidence that makes it into a trial should be excluded, because it is not probative (to-the-point, if you will, and incriminating) and/or it’s prejudicial. In other words, I feel that judges should exclude a lot of computer-related evidence. (I’ll supply specific examples in a minute.)
Some electronic records are–obviously–evidence of crime, though. Such records include actual communications which are themselves crimes, such as bank fraud, wire fraud, mail fraud, and conspiracy. If a murderer emails his accomplice about when they will meet after the murder–that’s evidence. If a murderer tells a friend she wants to buy a gun out of state so that she doesn’t have to wait as long for the background check as she would if she were buying it in her home state, that’s evidence, too.
That sort of electronic communication may, in and of itself, be criminal activity. It certainly should be presented to a jury. One reason it should be presented is that a jury can decide the facts for themselves based on the evidence. They don’t need an expert witness to read the email message to them or to tell them what to think about it.
A jury can also decide whether such a communication is evidence of some other crime. A jury may decide it is proof that certain facts alleged by the prosecution are true. The problem is, some evidence is so technical that only experts can evaluate it. A good deal of computer forensics falls under this heading, and so the jury is unable to evaluate it.
(I hate how wordy you have to get when you’re talking about the law. Let’s see if I can say this is human terms.)
A jury is called “the finder of fact.” That means they weigh the evidence and evaluate it. They listen to witnesses and decide if they’re telling the truth. They don’t have to believe every witness simply because the judge permitted him to testify. The judge’s admission of the testimony isn’t “vouching” for the witness.
A jury observes the visual evidence, too, and makes up their own minds about what it means. They don’t have to believe that a certain knife is the murder weapon, for instance, simply because the judge admitted it into evidence.
They also read the email messages or bank statements or word-processed documents or spreadsheets or whatever other electronic records and decide what they mean. For example, the jury can decide whether or not the gun the defendant ordered off of eBay is the murder weapon or not.
But some of the computer-forensics data presented to a jury is meaningless to jurors unless an expert interprets it. I have a problem with this sort of “evidence,” because an expert’s interpretation of something is only as good as the expert’s expertise. And as far as I’m concerned, current computer-forensics experts are not experts in interpretation. They are only experts in retrieving obscure data from obscure and damaged media. (I hope I’ve expressed this distinction clearly, because it is a critical distinction.)
Another problem with computer-forensic experts’ testimony is that defense attorneys have no expertise in cross-examining them. Defense attorneys rarely ask the right questions about the integrity of the retrieved data and the methodologies used.
(I’ve heard a few pointed questions, but only a few. For example, I heard one defense attorney ask the expert whether he was using the latest version available of his analytical software. The expert admitted he was not. But the attorney left it at that–as if a layperson juror would understand how much that compromises the results of the computer-forensic investigation. The lawyer should have hammered him on this and then brought on a defense expert to list exactly the sorts of flaws the old software might produce. Better yet, the defense ought to have sought to have the judge exclude the data from the trial on this basis.)
Some of the computer-forensics data that many, many judges admit into trials aren’t evidence of crime–they are simply clues to the crime, which the criminal investigators used in the investigation. And we all know that everything that comes out in an investigation, isn’t admitted into court, because it isn’t relevant. This is my biggest complaint with computer-forensics data as evidence.
The following sorts of records may give investigators clues to follow, but they should not be treated as actual evidence of crime–just of suspicious behavior:
1) Searching the web for crime-related information (or everyone who reads this blog would be under suspicion)
2) Searching the web for sexual information
3) Searching the web for last-minute travel plans
4) Searching the web or other online directories for legal assistance or information
5) Records of GPS locations (from GPS monitors or from cell phones, etc.)–unless, of course, the records show that the suspect was at the scene of the crime precisely when the crime occurred
6) Security camera videos showing a suspect in a public space in the general vicinity of the crime, but doing nothing criminal or suspicious
Yes, these are great clues that can lead investigators to real, solid evidence that can be presented in court. But, since there is also an innocent explanation for all of these records, I don’t think they should make it past the judge and into court.
Unfortunately, far too much of this sort of information (which is subject to widely varying interpretations) makes it into court. For example, in almost every recent murder trial the prosecution brought on a computer-forensics expert to testify to the defendant’s web surfing habits, which almost always included porn searches, crime information, and travel plans. Except for the porn, which appalls me because it is a form of violence against women and children and sometimes animals, I am constantly surfing for crime information and travel information. If a person does this often and then a crime occurs in her circle of friends or neighbors, suddenly the surf pattern looks suspicious. It’s taken out of context. I am convinced that this is the case for Neil Entwistle–guilty or not, his porn and escort searches are completely irrelevant and prejudicial and should never have made it into the trial.
Another sort of computer-forensics testimony occasionally makes it into a trial. It’s rare. But it’s terrifically incriminating–if you can believe it. This testimony is related to forensic linguistics (which is actually something I approve of, as long as it is interpreted by a wise expert), but what I’m complaining about is actually a sort of pseudo-linguistics, a junk linguistics, if you will.
I’m referring to the analysis of computer keystrokes and “individual web-search preferences” when more than one person has access to a computer, whether at home or in the office or in public.
The most egregious use of this crystal-ball-gazing, computer voodoo was in the Scott Peterson trial. A computer expert testified that he could tell that only Peterson was on the family computer on the morning of the murder and that the victim, Lacy Peterson, was not on the computer at that time, even though there was a click-through to an ad for an umbrella stand with a daisy pattern on it (daisy, being a favorite emblem of Lacy’s). The expert claimed he could tell that the click-through was not Lacy’s. That meant it had to be Scott who was clicking on the ad.
An aside: What if the expert was right? What if Scott did click on the umbrella stand? It was Christmas Eve. He might have been thinking about buying a present for his wife. This would tend to exonerate Peterson, wouldn’t it?
However, the prosecution used this testimony as evidence of premeditation. They even claimed Peterson clicked on the ad just to make everyone think that Lacy was still alive at the time. Now, if that is true, Scott Peterson very nearly devised an incredibly clever crime. How did he know that a Google ad would pop up next to a search for the currents in San Francisco Bay? Or sturgeon? Or whatever he was searching for at the time? Google claims that they display ads based on the keywords in the search. Hmm.
This kind of testimony prejudices a jury against a defendant unfairly. The judge doesn’t understand it, so he admits it into the trial rather than going out on a limb and doubting an expert. The defense attorney doesn’t know how to cross-examine an expert who makes such claims. Unless the jury includes someone who really understands computers, the jury won’t question it, either.
To be continued . . . .