Recently in one of my classes we were discussing the role of an “expert“, and the meaning of the word. While we did not work out a formal definition of the term, the general consensus among the class was that an expert is someone who is a master of their field. This was consistent with my own personal view and that of many others I have known in both digital forensics and other forensic fields. For example Eric Huber describes himself as a “student”. The discussion then turned to the frustration many of us had experienced when giving evidence and someone who clearly (to us) did not have the necessary experience to be presenting the evidence they were giving. This was a fairly common scenario when giving evidence in criminal matters. Often the defense would co-opt a local computer store technician or network installer. These would then be accepted as experts by the court in some cases they would provide useful testimony, unfortunately more often they would proceed to confuse the issue as they tried to explain matters of which they had little to no understanding*.
After this discussion I was thinking about the rules the court uses for defining an expert, the terms used are similar in both Australia and the US (and I suspect other countries where the legal system is founded on the Westminster system). The definitions of an expert from these countries are:
Australia
If a person has specialized knowledge based on the person's training, study or experience, the opinion rule does not apply to evidence of an opinion of that person that is wholly or substantially based on that knowledge.
(Federal EVIDENCE ACT 1995 No. 2 of 1995 - SECT 79)
United States
If scientific, technical, or other specialized knowledge will assist the trier of fact to understand the evidence or to determine a fact in issue, a witness qualified as an expert by knowledge, skill, experience, training, or education, may testify thereto in the form of an opinion or otherwise, if (1) the testimony is based upon sufficient facts or data, (2) the testimony is the product of reliable principles and methods, and (3) the witness has applied the principles and methods reliably to the facts of the case.
Breaking these rules down we see that the requirement to be recognized as an expert is that you have special knowledge that you have gained through education, training or experience. The US rule is slightly wordier and includes skill as well. The first question I have here is: is it possible to gain knowledge through some means other than training, education or experience? I certainly cannot think of any other way. Experience is a catch all that can cover pretty much anything. So the key point then becomes do you know more about a topic than either the Judge or jury? Since neither of these groups are likely to have specific knowledge when it comes to computer systems it is easier to understand why someone with little or no digital forensics experience my still be accepted as an expert witness.
The US rule provides us with slightly more guidance than the Australian ones, in that it insists that the witness provides evidence that “will assist the trier of fact to understand the evidence or to determine a fact in issue”. It could also be argued that this is redundant as all the rules of evidence include the requirement that evidence must be relevant to the matter at hand.
So where does this leave us will defining an expert? We could refer to dictionaries however these do not provide any greater guidance than the various rules of evidence. The Macquarie dictionary defines an expert as: “a person who has special knowledge or skill in some particular field” while Merriam Webster states: “having, involving, or displaying special skill or knowledge derived from training or experience”, so by definition and the law, pretty much everyone is an expert so long as we all know something the average person does not know!
