Say Only What Is Necessary

Brevity is the soul of wit.
-William Shakespeare

Be careful with the words you choose. They may come back to haunt you. Talking too much is a common mistake. The more you talk, the more you risk becoming a bore and the more information you divulge. Although it may appear that the primary purpose for an expert witness is to divulge information, that's missing the point. Your main job is to provide an expert's view or interpretation, not to dump memory. The most common type of information a person divulges when talking too much is that of weaknesses. When you are on the stand, answer all questions succinctly. Only add enough details to fully answer the question. Resist the urge to say more than is necessary and do not try to answer questions that aren't asked.

Be Complete, But Not Overly Elaborate

Although you want to avoid saying more than is necessary, you can't answer all questions with 'Yes' or 'No.' When you are asked a question, provide a full answer. If more information is needed, the person asking the questions should ask for more information. Incomplete answers leave the appearance that there is something to hide.

If you cannot answer a question with a single word, use an answer that is still short. For example, look at the following exchange between an attorney and an expert in the area of firewalls:

Attorney: Mr. Jones, do firewalls stop all 'bad' messages coming into a system?

Mr. Jones: No.

Attorney: Well then, do firewalls stop any 'bad' messages at all?

Mr. Jones: In most cases, they can be set up to stop messages that you define as 'bad.'

Although your second answer is not exhaustively complete in a technical sense, it does answer the question. The attorney might ask you to explain how firewalls work and how they can block messages. In contrast, here is a poor answer for the second question:

Attorney: Well then, do firewalls stop any 'bad' messages at all?

Mr. Elaborate Jones: Firewalls examine all packets that are designated as of interest in the internal configuration. The specific action the firewall takes is contingent upon the rule set and connection status at the time the packet is received. We can block networks, IP addresses, ports, and actual variant packets at will. Most firewalls that are worth using can do all this dynamically. The days of static ACLs are long gone.

How many nontechnical jurors would understand Mr. Elaborate Jones' answer? Here are a few things that are wrong with his elaborate answer:

• It was too long. He wasn't asked to explain how firewalls work. He was asked for a general positive or negative answer.

• He used technical vocabulary. Most people aren't comfortable with terms such as internal configuration, rule set, and variant packets.

• He used technical acronyms. Don't use IP or ACL unless yoexplain what they mean.

• He expressed an inappropriate opinion. He could have just offended a juror who happens to be a junior system administrator for a company that does use static tables in a firewall.

In short, get to the point and only use elaboration to explain your answer, not to deliver it. You always must consider the target of your communication. Let's look at the importance of your audience.

Remember Your Audience

Never forget who the audience is for your testimony. You are speaking to the court . Specifically, you are speaking to the judge and jury. Your attorneys have heard you before. They should be comfortable with some shortcuts. Because you have met with them on several occasions, you may feel comfortable enough to drop some of the communication formalities . Don't make the mistake of being too informal in court.

To convey your message in the most effective manner, always speak to your audience. Remember their level of technical expertise is more limited than your own. If the jury were composed of computer forensic examiners, there would be no reason to call you in as an expert. You are there to make the complex technical details of the case accessible to the judge and jury. Always be aware of how your delivery sounds to your audience. It's a good idea to have someone on your legal team monitor your testimony from the perspective of a nontechnical person. Comments from such a monitor can be invaluable in helping you tailor your testimony style to make the most impact.

Real World Scenario-Tales from the Trenches: Testimony

The computer forensics expert will from time to time be called upon to testify about the actions they took and the findings they found while performing a forensics investigation.

Although the majority of cases worked in the field of computer forensics never reach a courtroom, having the ability to present information in a legal proceeding will be very helpful to your career.

The best advice that I can give to any investigator who is called upon to testify in a legal proceeding is to thoroughly review all the documentation associated with the case and then answer each question that you are asked in a direct and polite manner. Do not offer any additional information during the questioning except to answer the question. In other words, provide an answer for the question asked and nothing more.

If you feel that additional information needs to be presented because it is relevant to the case, discuss the details with the attorney you are working for before offering the information in open court or at a deposition. Let your attorney lead you into the testimony. Don't rush to present all the details of the case in your first answer. Remember that the attorney you are working with will be trying to tell a story to the jury and your job is to 'complete' that story with details of the case as you are asked questions.

The first time that I testified in court, I was unaware of this "storytelling" approach that attorneys use. Each time that I was asked a question about the case, I provided an answer to the question asked but would then continue presenting additional information. I wanted to make sure that the jury understood exactly what had happened , and I was anxious to get in all the information. The problem was that instead of helping to "tell the story," I was distracting the jury with too many details. I was not giving the attorney the opportunity to "set the stage" and prepare them to receive the detailed information.

After the case was over, I made an appointment with the attorney to get her opinion of how she thought the testimony had gone. That was when I learned about the storytelling approach to presenting evidence to a jury. Since then, each time I testify, I remember to slow down and let the information flow and let the story be told.