Guide to Computer Forensics and Investigations, Fiftth Edition 16-1
Chapter 16
Ethics for the Expert Witness
At a Glance
Instructor’s Manual Table of Contents
• Overview
• Objectives
• Teaching Tips
• Quick Quizzes
• Class Discussion Topics
Guide to Computer Forensics and Investigations, Fiftth Edition 16-2
Lecture Notes
Overview
For computer forensics examiners, maintaining the highest level of ethical behavior in
Chapter Objectives
• Explain how ethics and codes apply to expert witnesses
Teaching Tips
Applying Ethics and Codes to Expert Witnesses
1. Define ethics as rules you internalize and use to measure your performance. Codes of
professional conduct or responsibility are standards that others apply to you or that you
are compelled to adhere to by external forces, such as licensing bodies.
3. Explain that laws governing codes of professional conduct or responsibility define the
lowest level of action or performance required to avoid liability.
4. Mention that expert witnesses are expected to present unbiased, specialized, and
5. Explain that the most important laws applying to attorneys and witnesses are the rules
of evidence. Experts are bound by their own personal ethics and the ethics of their
Computer Forensics Examiners’ Roles in Testifying
2. Explain that as an expert witness, you can testify even if you weren’t present when the
event occurred or if you didn’t handle the data storage device personally.
Considerations in Disqualification
2. Explain that opposing counsel might attempt to disqualify you based on any deviations
3. Explain why you should determine who the parties are to reduce the possibility of a
conflict.
5. Describe some of the factors to disqualify an expert, including:
a. Whether the attorney informed the expert that their discussions were
confidential
b. Whether the expert reviewed materials marked as confidential or attorney work
product
Guide to Computer Forensics and Investigations, Fiftth Edition 16-4
k. Whether the expert was requested to perform services for the attorney
Guide to Computer Forensics and Investigations, Fiftth Edition 16-5
Traps for Unwary Experts
1. Explain that you should be cautious about the following potential traps:
a. What are some differences between the attorney’s motives and the investigator’s
duty?
b. Is the function of the expert witness in conflict with the investigator’s code of
professional responsibility?
2. Mention that contingency fees aren’t allowed except in certain limited circumstances.
3. Describe some of the obvious ethical errors that you should avoid, including:
a. Don’t present false data or alter data
b. Don’t report work that was not done
c. Don’t ignore available contradictory data
d. Don’t do work beyond your expertise or competence
e. Don’t allow the attorney who retained you to influence your opinion in an
Determining Admissibility of Evidence
2. Explain that although expert opinions can be presented without stating the underlying
factual basis, the testimony isn’t admissible if the facts on which the opinion is based
are inadequate or there’s insufficient evidence to allow stating a legitimate opinion.
Organizations with Codes of Ethics
1. Explain that no single source offers a definitive code of ethics for expert witnesses, so
you must draw on standards from other organizations to form your own ethical
Guide to Computer Forensics and Investigations, Fiftth Edition 16-6
International Society of Forensic Computer Examiners
1. Mention that the ISFCE includes guidelines such as the following:
a. Maintain the utmost objectivity in all forensic examinations and present findings
accurately
b. Conduct examinations based on established, validated principles
c. Testify truthfully in all matters before any board, court, or proceeding
d. Avoid any action that would appear to be a conflict of interest
e. Never misrepresent training, credentials, or association membership
f. Never reveal any confidential matters or knowledge learned in an examination
without an order from a court of competent jurisdiction or the client’s express
permission
International High Technology Crime Investigation Association
1. Explain that the HTCIA core values include the following requirements related to
testifying:
a. The HTCIA values the Truth uncovered within digital information and the
effective techniques used to uncover that Truth, so that no one is wrongfully
convicted
b. The HTCIA values the Integrity of its members and the evidence they expose
through common investigative and computer forensic best practices, including
specialized techniques used to gather digital evidence
International Association of Computer Investigative Specialists
1. Explain that the standards for IACIS members include:
a. Maintain the highest level of objectivity in all forensic examinations and
accurately present the facts involved
b. EThoroughly examine and analyze the evidence in a case thoroughly
c. Conduct examinations based upon established, validated principles
d. Render opinions having a basis that is demonstratively reasonable
e. Not withhold any findings that would cause the facts of a case to be
misrepresented or distorted
American Bar Association
1. Mention that you should be aware of the basic rules of professional conduct attorneys
Guide to Computer Forensics and Investigations, Fiftth Edition 16-7
2. Explain that the ABA’s Model Code of Professional Responsibility (Model Code) and
its successor, the Model Rules of Professional Conduct (Model Rules) are the basis of
state licensing bodies’ codes.
American Medical Association
American Psychological Association
1. Define the APA’s Ethical Principles of Psychologists and Code of Conduct as the most
broadly accepted set of guidelines governing psychologists’ conduct as experts.
2. Explain that several standards in the APA’s Ethics Code apply to psychologists’ expert
Ethical Difficulties in Expert Testimony
1. Explain that there are inherent conflicts between the goals of attorneys and the goals of
scientists or technicians (experts). Attorneys work in an adversarial system and look to
2. Mention that as a result, Daubert and the APA’s forensics guidelines can challenge
experts to choose between complete impartiality and responsible advocacy.
4. Mention that all guidelines rely primarily on internalization of the codes and witnesses’
analysis of when and how they will participate in a case.
Ethical Responsibilities Owed to You
1. Explain that your attorney owes you a fair statement of the case or situation, adequate
2. Mention that most attorneys, including opposing counsel, are competent, courteous
professionals.
3. Explain that some opposing counsel attempt to make discovery depositions physically
uncomfortable. As a measure of protection, you might want to have your personal
attorney attend the deposition. This attorney can’t object to questions but is available to
advise the attorney who retained you or to advise you during breaks.
Standard and Personally Created Forensics Tools
1. Explain that the tools you use to recover, control, and track evidence are subject to
review by opposing parties. If the court deems them unreliable, the evidence you
recovered with those tools might not be admitted or might be admitted with a limiting
instruction.
Quick Quiz 1
1. ____ are the rules you internalize and use to measure your performance.
2. One of the effects of violating court rules or laws is____. This outcome isn’t usually
punitive, but it can be embarrassing for you as a professional and potentially for the
attorney who retained you.
3. True or False: Contingency fees aren’t allowed except in certain limited circumstances.
4. True or False: The American Bar Association (ABA) is a licensing body.
Class Discussion Topics
1. What are the differences between ethics and codes of professional conduct? Explain
2. What is the official organization that dictates codes of professional conduct for forensic
computer examiners? What is its mission statement?
Additional Projects
1. Ask your students to write a report providing guidelines to create a code of ethics. They
Additional Resources
1. Creating a Code of Ethics for Your Organization:
www.ethicsweb.ca/codes/
Key Terms
➢ codes of professional conduct or responsibility — External rules that often have the
