Witnesses testifying as to documents

From HORSE - Holistic Operational Readiness Security Evaluation.
Jump to navigation Jump to search

Witnesses testifying as to documents

Documents are often a significant part of a computer crime case. Knowledge of the types of documentation used in computer installation is a very effective tool in challenging the reliability of any documentary evidence offered at a computer crime trial. Therefore, one of the most important first steps of defense counsel is to consult an expert for the purpose of analyzing the documentary evidence in the specific case.

The custodian of records or any individual the prosecution uses to establish the validity of records it seeks to introduce, must be established as an expert; thereby laying the necessary foundation for admission of these documents.FN42

When the admissibility of computerized evidence is at issue, there are a number of tactics available, which may elicit admissions from the custodian of records that can be used to challenge the admissibility of the records in question. A major problem the prosecution may encounter is the disparity between the system as the documentation describes it and the system as it actually exists. Interviews with the employees, who actually use this system, should help counsel develop questions to ask the representative. If these matters have not been handled prior to discovery, it is useful to ask the custodian of records to respond to the following questions: Who created the documentation under consideration? Who implements the initial orders to create such documentation? Who keeps track of the documentation?

The custodian of records was most likely not present at the time the records were made, therefore, his or her testimony will be limited to the manner in which the records are usually produced.

The most basic attack on such records is to establish that, possibly, the records were made in another way. It may be useful to pursue this line of questioning not only in the hope that the court will rule the records inadmissible, but also because the questioning, if before a jury pursuant to a general cross-examination challenging the weight of the testimony of a custodian of records may contribute to the jury's feeling that there is a reasonable doubt. Such questioning may also fuel the jury's prejudice that computers do make mistakes and that an attack on a computer system is not as unjustified as an attack on a person. If the witness is neutral or favorable to the defense, counsel should try to get the witness to admit that computers do make mistakes or at least that programming errors and system failures are frequent occurrences.

The next step in cross-examination is to elicit testimony from the record custodian, that, what the custodian believes to have taken place may not have actually taken place. Absolute certainty is not required for admissibility. However, it is a more effective argument if counsel can state that the very custodian of the records admitted that the records might be incorrect.

If the witness is obviously hostile to the defense, it may be useful to elicit, if possible, from the witness that computers make no mistakes. This testimony is often refuted by expert testimony or by time logs of the system in question, which list the times the computer was not functioning. This type of cross-examination weakens the credibility of the witness, and consequently, reduces the strength of the prosecution's case.

Counsel may also determine if the custodian of records is a useful witness to establish elements that are not essential to the admissibility of the records. If the witness is open to agreeing with the defense, he or she may be asked a number of general questions about the operation of the computer system. Such questions should include determining if there are other ways the result, for which the defendant is being tried, may have occurred, such as by accident or by another individual.