Real-Life Communication
Cyber detectives spend a great deal of time working alone in front
of the computer. But when their work is complete, they need to communicate
the results to individuals who may not be as computer-savvy as they are.
"If
you understand the technical aspects of the work but can't communicate them,
the value will be lost," says computer forensics expert Paul Porter. "Initially,
you will have to communicate your skills to a client and your bosses. [Then]
it may be necessary to appear in court as an expert witness, hold your composure
under questioning by the opposing attorneys, and still come off as the calm,
unbiased expert."
You are a computer forensics expert testifying in
a case in which terrorists bombed a building. By searching through computer
files, you found evidence of the terrorist's plans to detonate the bomb. The
job was very difficult. While most people think forensic experts just go in
and find an offending file, your task is actually more complicated. You need
to put bits and fragments of files together in a logical sequence.
Now
you need to explain the evidence in a way that the jury can understand. You
meet with the prosecutor to go over your testimony. First, you need to explain
to the jury how you found the incriminating data. Here is what you intend
to say on the stand:
"I searched the defendant's electronic
diary. First I used the character strings 'bomb' and 'detonate.' When that
failed, I searched using the character string 'explosion.'
"I also
searched for the date of the bomb explosion. Since the bomb exploded on Sept.
5, I searched using the terms Sept. 5, and 9/5. Eventually I found the date
under 9/5. The date was encrypted. The keyword used for the encryption was
pres. I guessed the keyword after several tries because I knew the suspect's
first name is Bill."
By this time the prosecutor is waving
his hands frantically. "In English, please," he says, when you throw him a
confused glance. "This is all well and good, but the jury needs a simple explanation
of how you found the files."
You try again. Below you'll find definitions
of the computer terms given above. Use them to rewrite the testimony in a
form that the jurors can understand.
- Electronic diary: a type of electronic device used to store data. Basically,
a programmable, hand-held computer.
- Character search string: a search term consisting of a character, word,
or series of words.
- Encryption: translates data into a secret code.
- Key phrase: the password used to break the encrypted file.