Internet Expert Witness: A Hiring Guide

As more people interact with the Internet in meaningful ways, the functionality of Internet-related services becomes increasingly complex. An Internet expert witness helps to inform the trier of fact on an array of matters both online and offline, such as the capacity of web applications, digital multimedia systems, privacy, security, and Internet culture and website operating practices, just to name a few.

The Qualities of an Internet Expert Witness

An Internet expert witness is an individual with intensive knowledge and experience in the digital and technological bases of the Internet. Such experience is often rooted in cyber security, database and operating systems administration, computer forensics, eDiscovery, information technology, military communications, software design and development, data recovery and analysis, or in the computer software, hardware or technology retail industry.

Certain Internet expert witnesses teach software engineering, programming, web development, computer science, or network development courses at colleges and universities. They author computer science or computer security volumes, both for general and academic consumption. They also contribute to research papers, peer-reviewed studies, industry-standard-defining certification courses and exams, and Internet technology and practice consortiums. Some Internet expert witnesses hold patents for computer technologies that they have helped create.

Internet expert witnesses may advise private companies on an array of topics, including computing infrastructures and information security. They may erect superior defense systems for government agencies, academic research labs, and companies, working to safeguard individuals and entities from identity theft. In recent years, large companies such as The New York Times and the U.S. Chamber of Commerce have employed Internet security experts to detect hacking and protect their computer systems.

Internet expert witnesses may carry information security industry certifications that confirm their education and experience in the field. These certifications include:

CISSP (Certified Information Systems Security Professional)
ISSAP (Information Systems Security Architecture Professional)
CEH (Certified Ethical Hacker)
MCT (Microsoft Certified Trainer)
CISO (Chief Information Security Officer), and
CWNA (Certified Wireless Network Administrator)

Internet expert witnesses may also be members of the Association for Computing Machinery (ACM), the Institute of Electrical and Electronic Engineers Computer Society (IEEECE), or other international scientific and educational societies within the computing field.

Cases that Call for an Internet Expert Witness:

Litigation that requires the ever-widening knowledge of the Internet expert witness is proliferating. First and Fourth Amendment rights, information security breach cases, instances of improper sexual communication, and copyright issues are just some matters which now commonly involve the Internet in significant ways. Subsequently, they need an Internet expert witness to help parse the details.

Cases that require analysis and explanation of the following elements can benefit from the insight of an Internet expert witness.

Computer Forensics
Cyber Security
Cybersquatting
Data Analysis
Data Breach
Database Management
Digital Evidence Tampering
Electronic Mail
Enterprise Recourse Planning Systems
Fraud
Hacking
Identity Theft
Intellectual Property Infringement
Internet Pornography
Metadata Analysis
Network Security
Patent Infringement
Phishing/Malware
Search Engine Marketing (SEM)
Search Engine Optimization (SEO)
Software Audits
Software Engineering
Source Code Forensics
Spyware Deployment
Systems Administration
Technology Hardware Defects
Web Applications
Three-Tiered Web Architecture
Web Clients and Browsers
Web Protocols and Standards

Forensic Analysis

Internet expert witness testimony often involves the forensic analysis of parties’ digital circumstances. An expert may examine computer content, security, vulnerability, history, capacity and tendencies. Additionally, the skilled ability of an Internet expert witness to recover deleted or obscured digital evidence can prove key in discovery, and in the court’s ultimate decision.

Case Example: Network Sys. Architects Corp. v. Dimitruk, 23 Mass. L. Rep 339

Plaintiff, the defendant’s former employer, alleged that the defendant misappropriated trade secrets from the plaintiff company to the benefit of defendant’s current employer. Defendant claimed he contacted customers of his former employer using only client contact information he remembered. Thus denying that he ever electronically transferred any such information from his former employer.

The plaintiff’s forensic computer expert confirmed the former employer’s claim. The Internet expert witness examined the defendant’s laptop computers and testified that he found traces of a client-information transfer.

Although an expert called by the defense attempted to dispute this finding, offering an alternate explanation and preventing summary judgment for the plaintiff, an additional forensic finding diffused the stalemate. The defendant’s expert witness had to agree with the plaintiff’s Internet expert witness that the defendant had attempted to clear his laptop, deleting a substantial amount of content on dates that related directly to significant events in the case. The court granted the plaintiff’s Motion for Sanctions for Spoliation of Evidence as a result.

Privacy

Technological advances have created a need for Internet expert witnesses to testify on cases related to privacy laws, national security, and freedom of speech. Specifically, recent lawsuits based on claims of intelligence agencies monitoring online communications and activities have raised great debate among lawyers and citizens. Such cases highlight the tension between the protection of private communication and the mission of surveillance. Internet expert witnesses provide testimony that helps guide the finder of fact in these high-profile and influential decisions.

Internet expert witnesses largely focus on the methods by which government agencies collect phone call records, metadata (data about data), and Internet content. Experts knowledgeable about cryptography and encryption discuss details about Internet security measures that protect websites and online accounts, such as private banking and email.

Internet Security

Any online account holder—from a private citizen to a global company—may be vulnerable to online attack. Those seeking to illegally apprehend valuable personal information may install malicious software, or malware, to steal data.

Internet expert witnesses produce vital evidence and testimony that assists the trier of fact to determine whether computer systems were illegally violated and what damages resulted. They are vital to understanding the context of a cyberattack. Internet expert witnesses analyze a security system’s weaknesses and identify reasons for vulnerability. They explain if and how a security breach occurred, and discuss what – if any – information was recovered by the online assailants, also known as hackers. Their testimony helps to illustrate whether data was properly secured and whether any industry-standard defenses were missing.

Target and Neiman Marcus have both disclosed that their companies were the target of a massive cyberattack in 2013. Internet security experts investigating these hackings believe that these schemes were part of a coordinated assault on large retailers using credit card processing. Target, the second-largest discount retailer in the U.S., has estimated that as many as 110 million customer credit and debit cards were compromised. The company is facing legal actions by customers and banks. They are alleging that “Target either failed to properly secure the customer data, did not promptly notify customers of the breach, or both.”. If courts allow these class action lawsuits to move forward, Internet expert witnesses will be vital in assessing whether Target breached a standard of care and the extent of damages they could potentially be liable for.

Cyberbullying

As more children and young adults interact with each other through the Internet, increased attention is placed on cyberbullying, a hostile and deliberate act of bullying inflicted through digital channels such as text, email, or social media.

A 2011 Consumer Reports study revealed that “one million children were harassed, threatened or subjected to other forms of cyberbullying on [Facebook] in the past year.”. About half of young people have experienced cyberbullying, with 20% experiencing it regularly, according to the Cyberbullying Research Center.

In lawsuits involving cyberbullying, Internet expert witnesses may testify on factors such as social media abuse and Internet culture. They will provide the context for the cyberbullying circumstances of the particular case. Internet expert witnesses specializing in social media or cyberbullying often work alongside behavioral psychologists, educators, and school administrators.

Sexual Crimes

Internet-facilitated sexual misconduct includes distribution of obscene material, online solicitation, sexual registration violations, and Internet-initiated sex crimes against minors, including providing obscene material to minors via the Internet or downloading or uploading child pornography.

Cases concerning such situations can require elucidation of Internet or chat room culture, Internet addiction, pornography addiction, cybersex (sex via Internet communication) addiction, and online child pornography platforms. Internet expert witnesses who specialize in these sexually-charged fields often work alongside general addiction or compulsive behavior experts. Certain Internet expert witnesses specialize in helping defendants and their council construct defenses in cases involving Internet technology abuse or addiction.

Case Example: People v. Mahoney, 220 Cal. App. 4th 781

After government officials seized four computers from the defendant’s home, Internet experts employed by the prosecution discovered various forms of child pornography that had been saved on and eventually deleted from the defendant’s four hard drives. These materials included more than 1,000 child pornography images, Internet history records of various child-erotica-themed Google searches, and a partially downloaded movie file with a title consistent with child pornography content.

During an appeal of judgment, the prosecution’s Internet expert witness provided testimony that ultimately convinced the court of appeals to affirm the judgment against the defendant. The Internet expert witness testified that content found on the defendant’s hard drives had been displayed on their monitors. Continuing to say that the illicit content had to have been posted on a web page that the computer user visited in order for the images to have been saved in the temporary Internet files in which they were discovered.

The Internet expert witness dismissed the idea that a computer virus was to blame for the appearance of the illicit materials. Professing that no virus he knew of would search Google for child pornography under the defendant’s username consistently, and on multiple computers. Additionally, the expert explained that pop-up ads and redirects between websites were not the sources of the child pornography found on the defendant’s computer.

Although the defense’s Internet expert witnesses attempted to discredit this testimony, their arguments were not effective. The defense witnesses disagreed amongst themselves on how illicit images could be sourced to redirects without those images being clicked on or downloaded. One admitted that a computer user must first visit a child pornography site. However, another claimed that legitimate websites do redirect to child pornography sites at times, and that such redirection or pop-ups are out of the computer user’s control. The latter defense Internet expert witness claimed that Google may suggest search terms that lead to child pornography; however, experiments based on this hypothesis produced mixed results.

There was one point of consensus among the prosecution’s and defense’s Internet expert witnesses. All agreed that the child pornography images found on the defendant’s computer could not have gotten onto the hard drives unless a computer user visited the website that housed those images.

The court of appeals was ultimately swayed by the opinion of prosecution’s Internet expert witness. Agreeing that the defendant must have actively searched the Internet for child pornography and viewed this content on at least two distinct dates. The court found that such actions could sufficiently establish that the defendant “knowingly possessed or controlled improper images in temporary Interment files on his computer hard drives.”. Furthermore, because the prosecutor’s Internet expert witness traced and identified the dates on which the defendant possessed or controlled child pornography, and those dates fell within the applicable statute of limitations, the court of appeals affirmed judgment against the defendant for the possession of child pornography and child erotica within the 10 year statute of limitations period.

Copyright

The Internet enables a wide variety of communications to take place. Unfortunately, this also provides an opportunity for creative works that are owned or copyrighted to be improperly transferred from user to user. Lawsuits arise where the copying or reproducing of information for transfer is done without proper license. In such cases, an Internet expert witness explains copyright issues related to Internet platforms.

Case Example: Field v. Google Inc., 412 F. Supp. 2d 1106

Plaintiff, the author of 51 copyrighted books, sued Google for facilitating Internet users’ access to his books online. Alleging that the Internet search engine operator infringed on his exclusive right to reproduce and distribute copies of his works.

Google’s defense Internet expert witness provided undisputed testimony that was pivotal to the resolution of this copyright infringement action in Google’s favor. The Internet expert witness testified that website publishers typically include “no archive meta-tags” on their websites in order to disallow search engines from accessing their content. The Internet expert witness explained that the use of these meta-tags is a “highly publicized” and “well-known” industry standard.

The plaintiff acknowledged that he was aware of this standard, and that he knew that by not including these links, Google would reasonably interpret the lack of meta-tags as permission to link to the plaintiff’s content. The court granted summary judgment in favor of Google, finding that the testimony of the Internet expert witness established that the plaintiff’s failure to include “no archive meta tags” granted the search operator an implied license to facilitate user access to his copyrighted works.