Computer expertise or when IT is put at the service of law

A computer expert is a person who a professional who extracts, analyses and attests to the technological evidence to be adduced in a trial. Their work is the same as that of an expert, but much more up to date as they are specialised in the entire technological and computer field. This profile is on the rise due to the generalisation of technology in all areas of life and, of course, in the world of crime.

Thus, the presence of a computer expert is not only required in cybernetic cases, but also in any type of case requiring the extraction of virtual data or the analysis of any electronic device such as a mobile phone or computer.

The reason for this is that judges and other legal professionals are not as technologically literate as computer experts. This does not mean that lawyers, prosecutors and judges are not digitally literate or that they do not use technology in their daily work, but that they do not know about programming, hacking, data extraction procedures or device assembly as a computer expert, whose main training focuses on new technologies.

When is a computer expert required?

As mentioned above, computer experts are required whenever an electronic device is subject to analysis and its content is likely to be presented as incriminating evidence in a trial. Thus, a judge summons a computer expert in cases of:

• Cyberbullying: In cases of cyberbullying, a computer expert tracks and collects digital evidence that can incriminate the bully or bullies of humiliating or annoying acts such as public scorn, threats, continuous provocations or blackmail towards a victim. To do this, a computer expert establishes a chronology of events and extracts evidence in the form of private messages, publications on social networks, emails and other files that the harasser has been sending to the victim.
• Digital identity theft: In phishing cases, a professional with technical knowledge of computer science and ethical hacking is needed, as the computer expert will need to examine the online records of the users involved, their IP addresses, file metadata and other traces indicative of the crime of forgery and phishing and its consequences for the victim.
• Online scams and theft: Unfortunately, online scams are becoming increasingly common and original. At the same time, online fraudsters are getting better and better at hiding their identity and dodging the clutches of justice. This is why the specialised technical profile of a computer expert is needed to analyse electronic transactions, emails, fake websites to gather digital evidence and discover the identity and whereabouts of the fraudsters.
• Child pornography: This also applies to any possession and marketing of illicit digital material. A computer expert helps to trace the distribution network of this material, its storage and, most complicated, its origin in order to identify victims, perpetrators and the whole chain of intermediaries involved. In addition, this type of content often requires decryption expertise, as it is not usually found in broad daylight.
• Murders: Although murder is not a digital crime, the widespread use of technology almost always requires the intervention of computer experts. Thus, this professional collects and analyses digital evidence such as emails, text messages or location data of witnesses, victims and defendants, extracted from electronic devices.
• Group offences: Any group crime now involves moderate online communication activity that can be traced and presented as evidence in court to support the identification of perpetrators from their messages, calls and group interactions.

What does a computer expert study?

In order to exercise his profession in a regulated manner, a computer expert must hold an official qualification directly related to his work. This qualification is the Computer Engineering or similar.

This is what can be inferred from the Article 340 of the Code of Civil Procedure: The Experts must hold the official title that corresponds to the subject matter of the report and the nature of the report. In the case of matters not covered by official professional qualifications, they shall be appointed from among persons knowledgeable in those matters. The knowledge provided by a degree in Computer Engineering is essential to understand how computer systems work, as well as to develop the technical skills needed to investigate and analyse digital evidence in legal cases. 

In addition, a computer expert may also be able to take other courses non-official specialisation studies, although these are not compulsory in order to legally exercise this profession. At the same time, it should be pointed out that specialisation training is not considered official by law, so it is not a substitute for a degree in computer engineering, but a highly valued complement. In fact, a postgraduate course in computer expertise is a way for those aspiring to this profession to specialise and learn first-hand about the day-to-day work of a computer expert and the best practices associated with their work.

Process of computer expertise

While each computer expert has his or her own way of working, they all follow a common procedure:

1. Situation analysis

   At this stage, the expert communicates with the client to fully understand the case and gather all necessary information, such as details of what happened, witnesses, current evidence and the purpose of the computer expertise being requested.

1. Information extraction and data collection

   Here, the expert examines the electronic devices that have been approved as evidence in the case, using a variety of techniques to extract data relevant to the case. This may include scanning systems, analysing software, retrieving messages, emails, files, among others. The computer expert implements in this step decryption techniques, data extraction, file conversion, and even, when necessary, ethical hacking techniques to access protected information.

1. Data analysis and report writing

   During this phase, the expert thoroughly examines the collected data for incriminating evidence. The aim is to connect the evidence in a logical manner and to establish clear and substantiated conclusions in a computer expert report. This report should be detailed, objective and understandable to non-technical people, and may include digital evidence, technical analysis, interpretations and recommendations.

1. Defence of the report before the court

   Finally, the judge summons the computer expert to testify and defend his or her report in court. In this step, the expert must explain and support his findings, methods and conclusions in a clear and convincing manner so that the judge understands the importance of the evidence that has been found and its relevant relationship to the case. This defence is decisive for the case, since depending on how the computer expert justifies his or her work, the expert report can be rejected or approved as evidence.

How is a computer expert report written?

First and foremost, a computer expert must bear in mind that the report will will be read by non-technical people The language to be used should be simple and understandable, but should not omit details that are crucial to the investigation, and the length of the report should not be over-emphasised.

The computer expert report has to start with a clear presentation of the case which includes details of the person carrying out the expertise, the nature of the assignment and the purpose of the work. In turn, this introduction addresses the background to the case, including details of the request for services and the initial documentation provided by the client to provide a framework that serves to contextualise the entire investigation.

When it comes to providing evidence and unpacking your analysis, it is necessary to explain its provenance, authorisation of use (the evidence analysed must be on file) y the methodology used in its analysis, as well as graphic, textual and legal documents that support the conclusions of the report. It is all this justification that will give credibility to the computer expert's report and make it valid evidence to be presented in court.