On this blog I previously published ideas for capturing cyber investigation evidence, such as evidence showing what a hyperlink on the web does at a particular point in time or evidence showing what a dynamic web page displayed at a given moment. I demonstrated a split-screen video, where the investigator records his words and actions via a webcam, while at the same time he records a screencast of what appears in his web browser as he works.
I published the demonstration video on youtube: http://www.youtube.com/watch?v=UgH6hzwAg5Y
I now address how this investigator's split-screen video record might be used as evidence in a judicial proceeding.
Offering as Evidence
The precise methods for using evidence can vary depending on the nature of the proceeding, the agreement of the parties, the purposes for which the evidence is offered and the formalities typically observed in the court. (In the US a federal court typically observes more formality than a county court, for example.)
In some cases an American court could deem the content of the split-screen video to be hearsay that is inadmissible as evidence. Hearsay is an out-of-court statement that is offered to prove the matter asserted. The split-screen video might be hearsay because it is a statement made by the investigator outside of the courtroom. Normally the court would rather hear the investigator give live testimony from the witness stand.
Alternatively, the court may forbid introduction of the video unless the proponent of the evidence establishes its scientific reliability under Daubert v. Merrell Dow Pharmaceuticals, 509 U.S. 579 (1993) and related cases.
Refreshing Memory
If the video is inadmissible as evidence, it might still serve as the notes or records of an investigator, which may be used to refresh the memory of the investigator as he testifies as a witness. Typically in the US, the notes of a witness may not be used to refresh his memory until his memory is exhausted through testimony. The purpose of taking his testimony is to ascertain what he remembers, not to ascertain the content of his notes. However, as he testifies, the witness may come to particular details that he can remember no further. He may then be presented with his notes so that he can refresh his memory. After refreshing his memory, he then testifies as to his memory, which is stronger because he has just examined his notes.
Any kind of relevant item can be used to refresh the memory of a witness. The item need not be notes written on paper. It could be a physical object, such as a gun. For purposes of refreshing an investigator's memory as he sits on the witness stand, his notes and records could be the split-screen video displayed to him, for his individual examination, on a mobile computer such as a laptop. Typically, only he would see and hear the content of the video as he freshens his memory. To prevent others (such as the jury) from hearing the audio portion of the video, the investigator might be required to wear headphones.
Video Admissible as Evidence
In some cases the split-screen video might in fact be admissible into the proceedings as evidence. For example, even though the video is hearsay, it might be admissible under the "prior inconsistent statement" exception to the hearsay rule.
Some US jurisdictions recognize an exception to the hearsay rule for a prior, written and signed, statement that is inconsistent with the testimony taken of a witness. In the demonstration video, the investigator makes a point to legally sign and affirm the video with his spoken words, so the video may qualify as his signed, written statement.
The "prior inconsistent statement" exception to the hearsay rule is a way to keep the investigator honest. If he gives live testimony in the courtroom that contradicts what he said in the video, then the video can be admitted to show the contradiction.
If the video is to be admitted as evidence, the attorney offering it would typically need to lay a foundation for it with a sponsoring witness. The sponsoring witness would establish the relevance and authenticity of the video before its presentation in the courtroom.
Video Display
Many US courtrooms today have equipment for displaying audio and video in open court. Commonly the proponent of audiovisual evidence would bring it as a file stored on a mobile computer, which would plug into the court's audiovisual system. In those courtrooms that are not so equipped, the proponent would typically also bring the projector, screen and speakers necessary to present the video in court.
In a jury trial, a video admitted as evidence would normally not be available to the jury for review while it is deliberating in the seclusion of the jury room. If the jury desires to observe the video again, the jury would need to request the court for the opportunity. Then the video would typically be presented to the jury under supervision of the court and the presence of the parties.
Mr. Wright, a practicing attorney, teaches the Law of Data Security and Investigations at the SANS Institute.
The author thanks Stephen W. Harris, member of the Texas Bar Association, for help in understanding the practical steps for offering evidence into court proceedings.
