Ten Tips for Better ESI Expert Reports from Craig Ball

Episode Notes

Transcript

[Music]

Intro: Welcome to Digital Detectives Reports from the Battlefront. We’ll discuss computer forensics, electronic discovery, and information security issues and what’s really happening in the trenches, not theory, but practical information that you can use in your law practice. Right here, on the Legal Talk Network.

[Music]

Sharon D. Nelson: Welcome to the 129 Edition of Digital Detectives. We’re glad to have you with us. I’m Sharon Nelson, President of Sensei Enterprises, a digital forensics, cybersecurity, and information technology firm in Fairfax, Virginia.

John W. Simek: And I’m John Simek, Vice President, Sensei Enterprises. Today on Digital Detectives, our topic is Ten Tips for Better ESI Expert Reports from Craig Ball.

Sharon D. Nelson: Before we get started, I’d like to thank our sponsors, PInow.com and CaseFleet.

John W. Simek: Today, we’re lucky to have as our guest, our good friend Craig Ball. Craig’s passion is to learn how things work so he can teach others. A compulsive tinkerer, Craig Briggs, he can fix anything but the human heart. After decades trying cases as lead counsel, then becoming a certified computer forensic examiner. Craig turned a lifelong fascination with technology into a unique law practice limited to service as a special master and electronic evidence and discovery subjects. He teaches at the University of Texas School of Law in Tulane Law School. A prolific author and speaker, Craig’s articles on digital evidence can be found at craigball.com and his blog, ballinyourcourt.com. It’s great to have you with us again, Craig.

Craig Ball: My pleasure, thank you both.

Sharon D. Nelson: Well, Craig, your first tip about Better ESI Expert Reports is to answer the questions that you are engaged to resolve. I gather that’s a pet peeve of yours, Craig.

Craig Ball: It is and before I explain what I mean by that, Sharon, I want to give a very quick background of what these are, these ten tips. They’re very much speed of the pants kind of things. A colleague of mine, an expert in lawyer, and electronic evidence, asked me to speak with a person she works with. Who is going to be doing an expert report and hadn’t done a lot of that and just kind of help them along and before I had that conversation, I started thinking about, what are the things that I like to see an expert report? What are the things that I’ve learned in my many, many years of writing these reports that I thought might be helpful? So, for anyone listening who’s looking for a guide for their own expert’s reports. Please feel free to accept any of these you think are worthwhile and throw the rest away because they’re just something I came up with pretty quickly. So, you ask me about answering the questions that you were hired to answer. That seems like a truism, but I’ve seen so many reports that I’ve read from examiners over the years that have just page after page of tables and screenshots and the kind of things that can be spit out by a forensic tool set without framing the issues in terms of the questions that typically my lawyer clients want answered and sometimes you can’t answer the questions. So, the question is, posed in a way that it is too vague or unanswerable with forensic artifacts and that’s fine. I say, I can’t address that and I’ll try to reframe it or break it down in some ways so that I can take what I’m learning from the evidence and give it back to the lawyers in ways that they can apply it to the questions they face in court. So, that’s my first pet peeve is figure out what you’re being asked before you bloviate for page upon page. Hoping that maybe something you’ll throw out there will be useful.

Sharon D. Nelson: I love blow ache, Craig. Great word.

John W. Simek: I predict we’re going to hear many great words from Craig, during the session today.

Craig Ball: You’re right. I mean, it’ll be much as they do as I say, not as I do, when I later talk about the language we should use these kinds of reports, but I’m not making a report right now, I’m just being me.

John W. Simek: Well, Craig, your second tip was about not overreaching your expertise in a sense that you run across that quite a bit.

Craig Ball: I do, I think most lawyers are very considerate when you say, I don’t feel I can address that, I don’t feel I have the formal training or the experience, your qualifications to express an opinion of that nature, but sometimes they’re just so desperate to address a particular issue or not have to hire another expert that they will push and push to try to get you to stick your neck out.

00:05:05

Craig Ball: Let me give you an example, I mean, I’m a certified computer forensic examiner as you are John and I’ve studied a lot of accounting in college. Business is one of my majors, but I’m not a forensic accountant. I’ve done a lot of work in digital forgery and I’ve looked at altered video and images, but I’m not a trained question document examiner. These are specialties. I try to stay in my own lane professionally and I commended to other experts. Figure out where you have the actual provable expertise to meet the requirements of expertise. Not just that very low bar that Federal Rule of Evidence 702 puts forward, but are you truly someone who should be in a position of answering hypothetical questions in that particular discipline?

John W. Simek: Well, I think I have the solution to that, Craig. I experienced where the lawyer actually showed up and he had the expert report already completed for me, so I didn’t have to overreach.

Craig Ball: You already did it. That reminds me about the old story when I was a trial lawyer, I was told about in working with local council and the little small towns in Texas. There would be two different prices paid to the local council. The one where you provided the witnesses and the one where they provided the witness. So, yeah, I’ve had that, too. Where I don’t mind that, if a lawyer wants to put something down and says, can you support this proposition? If I can, I may want to put it in my own words, but if I believe it to be true and I can prove it by evidence, I don’t really have a problem with them helping to frame the language, but it ultimately has to be something I can swear to and sleep on.

Sharon D. Nelson: Well, it took us most of a night to get that report into something John could swear to. He was not a happy lawyer. But let’s move to your third tip, Craig, which was to define jargon and share supporting data in useful accessible ways. We find expert reports all the time that are just full of jargon. Why do folks do that? Sometimes the reports are impenetrable to anyone who’s not an expert.

Craig Ball: Oh, I think there are great, many things that prompt someone to do that. A lot of it stems from insecurity or lack of sensitivity to other people’s education and experience. I think a lot of us who are experts often conduct ourselves more to impress than express when we write. I love words, I love having just the right bowmood (ph) to say exactly what I hope to convey. And so, I find myself often falling back on words that, if truth be told, are not words that are heard in everyday speech and that’s fine in conversation. I can be me and people can go. What a self-important pap (ph) as idiot if they want to. But when I’m writing a report for an attorney client when it’s going to be going before those who are not steep, not only not steep in computer forensic, to say the least, but who are not necessarily longtime computer users or deeply involved in modern information technology. I have to stop myself and make sure that if I use an item of jargon and I like to use the right word, the technical term, because I’m sometimes writing to communicate with an opposing expert. But I think it’s important to paraphrase or to use a parenthetical to explain what it is or I’m not fond of footnotes. I think they break the flow of a good read, but at a minimum, then use a footnote or some kind of call out to be able to make sure that anyone with an eighth-grade education. I mean, if your grandparents wouldn’t understand what it means, then it’s probably important to find a way to naturally define it so that as you move through someone without any technology skill or expertise can read it and understand it. I think that’s what we do. We are teachers. Our job is to be technical translators with a foot in the law and a foot in technology. Our job is to be able to speak geek and speak lawyer and when we are talking to a trier of fact, whether it be a judge on high or the person who is on the jury — 

00:10:02

That we speak to them in a way that demonstrates respect for what they know. And I think that it’s possible to be able to do that, and if you work at it, to do it in a way that is smooth and not condescending, and that will allow people not to be distracted by your language but instead to shake their heads throughout as though they have fully understood all along. People appreciate that. They like learning new things, but they don’t want to have to fear that you’re speaking about something that they can’t possibly understand.

Now, that the second half of that is the use of demonstratives. Before I spent my life steeped in electronic evidence as a forensic examiner and a guide on electronic discovery, I was a Trial Lawyer and a plaintiff’s Trial Lawyer, and so for me, my skill, my passion was to develop effective demonstrative AIDS to support testimony, and I think it’s very important.

I would say that I probably spend as much time in drafting reports, working on simple, clear, powerful demonstratives to explain what I’m trying to get across as I do on the particular language or even in some instances choosing the artifacts because I’d rather make a few points that really nail the issues for the trier of fact and make those clearly with solid supporting visual evidence than I would ensure that every single bit of Technical Minutiae is addressed in a report where you lose the trees for the forest.

John W. Simek: Well, I’ve got to admit, Craig. Your fourth tip is one of my favorites and you identified about distinguishing factual findings from opinions and I know I’m constantly telling my staff to that, so I’d really like to hear what if you can offer some help in determining that right? The facts from opinions because I’m sure that’s a tough road for some folks.

Craig Ball: Not only is it challenging, but it’s a very particular situation. Most of the witnesses you see in the run of the mill case tend to be fact witnesses, lay witnesses, non-expert witnesses are generally only allowed to testify to things that they have observed with their own eyes or that they have perceived with their own senses. First hand, personal observation, but one of the great privileges extended to expert witnesses, like you and I John, when we testify about computer forensics is that by virtue of our experience and expertise and training, courts allow us to express opinions based upon the kinds of reliable information on which persons who are experts in our fields customarily express such opinions, and that’s really the power of being an expert witness is not only the ability to use the proper tools and have the training and experience to recognize what an artifact signifies and in computer forensics to equate those bits and bytes with human behavior, but also the ability to be given a hypothetical set of facts and explain the most likely result.

The most likely outcome based upon the standards that are brought to bear within our profession. It’s a little tricky, I suppose to make that decision and sometimes there’s a blurring of those lines between fact and opinion but the beauty, the privilege of being an expert is that we can answer these opinion questions, these things based upon hypotheticals, and they can be so useful in helping the trier of fact to understand the issues in the case.

Sharon D. Nelson: Your fifth tip Craig was to include language addressing the applicable evidentiary standard. Can you explain that a little more fully?

Craig Ball: Absolutely. And you see this less with computer forensic experts, I think, then you do with a variety of experts in such cases as those that involved adverse effects in the use of a pharmaceutical or medical device or exposure to a toxin — 

00:15:00

where you have allegations that there is insufficient proof, a lack of reliable principles or methods for the expert to express that opinion. Now, this is articulated in the law by such things as what’s called the Daubert standard. Efforts that have emerged over the years to combat what is derisively called junk science and so it’s job of the Judge acting as gatekeeper to make sure that the opinions expressed by an expert are based on sound science that they are repeatable, that they have been reviewed by peers in the discipline, and that they should be trusted.

The risk of being an expert of publishing a few papers, of being acknowledged as an authority is that you could get carried away with the strength of your own opinions and begin confusing what you fervently believe with what has been established by good science and I think that it’s important to be aware of the applicable evidentiary standard for the opinions that you’re expressing and in a report ideally, in order to avoid such things as summary judgment or a summary dismissal, or it’s exclusion you should attempt to articulate the applicable evidentiary standard on how you’ve met it or in reaching your conclusions.

Sharon D. Nelson: Excellent advice.

John W. Simek: Well, before we moved on to our next segment, let’s take a quick commercial break.

[Music]

Advertiser: Does your law firm need an investigator for a background check, civil investigation or other type of investigation? PInow.com is a one of a kind resource for locating investigators anywhere in the US and worldwide. The professionals listed on PInow understand the legal constraints of an investigation are up-to-date on the latest technology and have extensive experience in many types of investigation, including workers’ compensation and surveillance. Find a prescreen private investigator today. Visit www.PInow.com.

[Music]

Advertiser: What could be more important than knowing the facts of your case inside and out? Case Fleets Powerful Software makes it easy to create a chronology of each case and to track the evidence for each fact. With an intuitive interface, full text search and built in document review Case Fleet makes fact management easy. Sign up for a 14-day free trial at casefleet.com/Digital Detectives and get 10% off your first subscription.

[Music]

Sharon D. Nelson: Welcome back to Digital Detectives on the Legal Talk Network. Today, our topic is Ten Tips for Better ESI Expert Reports from Craig Ball.

John W. Simek: Craig, is your six tip, you talked about the advocacy and letting your expertise advocate for you. Can you expand on that a little bit more for us?

Craig Ball: Sure. And this is one of those where it’s more again. Please do what I say, not what I do sometimes because having been a Trial Lawyer for 30, I’m going on 40 years, I guess now. I’m an advocate by nature but I have to suppress that inclination, so I have to labor to hold myself back when I’m writing a report to ensure that I’m not trying too hard to do the lawyers job of advocating, so even if you’re working for one side, even if you’re a part as an expert, not a neutral.

Attempt to be as scrupulously neutral as you can in your reporting, I think it’s important to strive to both be and sound like you don’t care who prevails even if you are in your heart of hearts rooting for the home team, and if you do your job well, the facts and your marshaling of the facts and your careful explanation of the significance of the artifacts in forensic work will serve to advocate the right outcome without you having to point everyone where to go.

Sharon D. Nelson: That’s really excellent advised. I hope a lot of people listening take that advise. I was interested in tip number seven which is to challenge yourself to be fair. That struck me as of, I don’t know. It’s struck me at something of something that Craig Ball would say. Exactly, how do you ensure that you are challenging yourself and being fair?

Craig Ball: Well, in my case you make mistakes. I think people hire experts with the expectation that we are not going to be wrong.

00:19:59

That’s why you hire an expert is to give you the right answer, not just the kind of person on the street guess and so my worst nightmare as an expert witness is that I will mistakenly express the opinion that someone committed a bad act when they didn’t and having done that once before. I mean, the person was a bad actor. They did a lot of the bad things he said. But I got one of them wrong, and I won’t pick up your time with what it was.

I wrote a blog about it, hoping others would learn from my mistake, but I look at it and I try to punch hole in my own theories. I try to ask myself; how would I approach this issue if I were working for the other side? Where would I find the weaknesses in my own analysis? And putting on the other side’s hat is a really worthwhile exercise. I mean, nowhere is this more important in my view, than when you’re doing what I do most of the time, which is working as a Court appointed neutral expert and so even if I hate the other side, even if I think they’re a terrible person and I’ll be happy to see them fry, it’s my job. It’s my moral and legal obligation to be fair to be neutral because I’m standing in the shoes of the Court.

And so, stop, stop wanting to be the hero. Stop wanting to win the day and instead find what the truth really is. Every time you do that, you will be better for it and it’s a problem in our profession because we are hired with the expectation that we’re going to find the smoking gun. We often are hired by the same lawyers over and over again and the desire to please can sometimes force us or allow us to fit the theory to the evidence instead of fitting the evidence to the theory. Well, by that, I mean that we should follow the evidence, not follow the desires of the lawyers who hire us.

Sharon D. Nelson: Amen to that.

John W, Semik: Craig number eight was, I particularly enjoyed as well. Proof Read at it, Proof Read again. Sleep on it. Edit it again. It sorts of brings back to memory that Dustin Hoffman and Outbreak, right? Test it, test it, test it again. But – 

Sharon D. Nelson: The men have them test it again. He went on with that one.

John W, Semik: But sometimes I know and I’m sure you’ve experienced this as well in reading expert reports that sometimes it even appears that they haven’t even proof read it the first time. So why do you feel that this tip is so important for these reports?

Craig Ball: I guess think it’s important because I’m a snob when it comes to language. I am a terrible snob. What they pay us, that we can’t make sure that the spelling and grammar is right. Seriously, let me put this way, they’re going to be schoolteachers on many juries, and if they’re like me and they see that you can’t tell the difference between the T-H-E-I-R and T-H-E-R-E and T-H-E-Y or apostrophe R-E. They’re not going to trust your expertise if you can’t even spell, if you can make your grammar work and so, like I say, I’m a bit of a snob, and I realize that modern thinking is all spelling and grammar.

That’s not what really matters. But I’m old school, this is something that is being presented to a Court. It may often be determinative of whether someone’s Liberty or property will be at risk and so I think you have to take the time and here’s the reality of this. We often are working until the wee hours against a deadline to get these things out and, you know, working, as the architect would say I’m Sharett working night and day to get this done.  Bleary eyed from looking at hexadecimal values, it is easy to just want to get the darn thing out the door. Oh, I’m just glad it’s done. You just wrap it up and get it out. We have to make the time to stop and sleep on it and give it a good proof.

If you’re lucky, as I have been in life, you have someone that you can trust who is within the cone of secrecy, and you can hand it off. Just as John, you have Sharon, who is gifted in this area as you are, you can look at each other’s work and bring a fresh set of eyes to it, and you can hear what doesn’t sound right and so I say, no matter what, give it a good night’s sleep, go back to it. Honestly, I don’t think I’ve ever written anything that I haven’t significantly marked up. If I just got away from it for a little time and gave it fresh eyes.

Sharon D. Nelson: That’s really remarkable to hear because it’s what we tell each other all the time.

00:25:00

Sharon D. Nelson: Okay, I just finished it. I can’t read it now, but I’m going to read it in a couple of hours or tomorrow morning and we do mark the heck out once we do that review. So that’s really, really useful.

John W, Semik: Even our staff, Craig is fearful of Sharon’s red pen.

Sharon D. Nelson: But they’ve also asked me to give them a language lesson. A grammar lessons. So now I’ve got to devise a PowerPoint to help teach grammar. So, there you go. The things one do.

Craig Ball: Sharon, then the big question is, how do you feel about the oxford comma?

John W, Semik: Oh, Jeez.

Sharon D. Nelson: No, no, not going there. I am going immediately to tip number nine.

Craig Ball: All right.

Sharon D. Nelson: One that should be obvious, but apparently is not. The tip is to avoid assuming the fact finder’s role in terms of ultimate issues. I mean, that seems to be so simple. Why don’t more people understand and abide by that tip?

Craig Ball: Well, I don’t know the answer to that. I know that here again, it’s something a trap I’ve allowed myself to fall into now and then and sometimes regretted it. It is not our job to determine the issues in the case. No, it may happen that there’s an overlap with the issue in the case and the precise issue that we are asked to opined about, but not often.

Generally, there are a series of issues that are going to be part of the form of the verdict and so forth and it’s important that you not substitute your judgment as an expert for the judgment of the trier of fact, the judge or the jury and I made this mistake a couple of years ago where I had served a special master in a very contentious, very difficult case. And I reached the conclusion — I wanted to be done. It was there was a lot of impetus to get it done and so I saw what I saw to be a futile form of inquiry.

Basically, I saw enough that I thought I saw the way the Court should go and instead of fully investigating what I saw as being a red herring issue, a cul de sac that would waste a lot of time and money, I reported on the outcome that I thought should follow based on the evidence. I’m being vague because I don’t really want to go into it. We don’t have time, and they may not be interest. But the point is that by essentially assuming the Court’s role, and here’s what you should do and here’s why you should do it. Even though I was special master, even though my job was to advise the Court, by assuming the Court would follow my advice to the letter, I left out a piece of something the Court needed and I think I complicated the Court’s job. it is my job as special master to make the Court’s life easier, not more complicated and so, as you are doing your work, be sure you aren’t cutting to the chase, but instead limiting yourself to only providing information and opinions about the issues that are appropriate for your expertise, not that intrude into the realm of the Trier effect on the ultimate issues.

John W, Semik: Well, Craig, your final tip, I think, is a little mysterious and I’m sure our listeners would love to hear you expand on this, but that tip being listened to your inner voice. What do you mean by that?

Craig Ball: You know, in my work, I’m a special master. Now, apparently, master was not strong enough for this job that they had to append special too and when people refer to you as an expert, it’s very easy to start to gain too much certainty. Arrogance, and arrogance is just as perilous as too much doubt. I mean, ultimately, you have to — you can’t just waffle on everything.

You have to answer the question that is the job decide based upon competent evidence and your expertise and training. But arrogance is dangerous. I think we all have inner voices. I think there is always going to be something in how we’ve said something or what we’ve concluded. That makes us want to get up in the middle of the night and fortunately, my bedroom is just down the hall from my lab and COVID and so I can go down, I’ll fire it up. I’ll load the data, and whatever it is that was that little voice in the back of my head saying, you really need to check this. You really need to go here. Is there an inconsistency here? Might you have missed something? So if something feels off, that could be your inner voice telling you to look again and I think that it’s important to get out of bed or drive to the office or fire up your machine and take one more look to be sure that while you don’t have certainty, at least you know you’ve been reasonable and although perfect is not the standard that the opinion you’ve given you’ve done so to the best of your ability and not just mentally papering over doubts because you just want to get done.

00:30:11

Sharon D. Nelson: Yes, I think that happens to us all. We want to have it done. Well, Craig, I’m sorry in some ways that we are coming to the end here, but we want to thank you very much for being with us. Once again, it’s always a joy to have you as our guests and today I particularly admire other than your wonderful use of language. I admire the fact that you actually talk about your own mistakes and try to use them as illustrations to help others, which I think is a very noble purpose. Many people hate to admit mistakes, but you do so in a very charming way, in a very educational way for our listeners. So, thank you for that.

Craig Ball: Thank you, Sharon, and if I could just quickly throw one bonus tip about reporting, it would be this, give people who are reading your reports a quick executive summary up front. I like to even put it in a little box at the beginning of my report so that it’s sort of the question presented and the preliminary answer so that if the judge only has time to read that one quick boxed paragraph, then the judge will or the lawyer who’s busy will at least take away my most important finding. So, I think that’s really helpful. It gives people a framework as they read what follows to understand where you’re going.

Sharon D. Nelson: That’s a good tip.

John W, Semik: Well, that does it for this edition of Digital Detectives and remember, you can subscribe to all the additions of this podcast at LegalTalkNetwork.com or an Apple podcast. If you enjoyed our podcast, please rate us on Apple Podcast.

Sharon D. Nelson: And you can find out more about Senses Digital forensics, technology and cyber security services at scnscient.com. We’ll see you next time on Digital Detectives.

John W, Semik: Thanks for lessening to Digital Detectives on the Legal Talk Network. Check out some of our other podcasts on LegalTalkNetwort.com and in iTunes.

The views expressed by the participants of this program are their own and do not represent the views of nor are they endorsed by Legal Talk Network, its officers, directors, employees, agents, representatives, shareholders and subsidiaries.  None of the content should be considered legal advice.  As always, consult a lawyer.

Podcast transcription by Tech-Synergy.com