Business Journal Ask the Expert Column
5 Critical Considerations To Include When Evaluating A Pre-Breach Planning And Response Partner.
I usually try to answer as many questions as space will allow here in Ask The Expert, but today, I want to address the one question I seem to hear more often than any other these days. “How can we make sure we choose the right pre-breach and planning response partner for digital forensics?” I always recommend evaluating a digital forensics partner based on five key criteria. The topics below may not answer everything you’re facing, but they will provide a firm foundation upon which you can compare parties in order to find the right expert for your situation.
1. Credentials and Background.
First, make sure your partner is certified and deeply experienced in all areas of digital forensics. It sounds like a basic step, but it often goes overlooked or is assumed. Ask for certifications and references, then check them for validity. Expertise in all phases of investigations, both human and digital should be mandatory. Consider experience in enterprise IT environments, communicating analysis results, and the ability to convey complex technical data to a judge and jury in simple, concise, easy-to-understand language without the use of “geek speak.” Personal relatability and conveying a sense of trust during testimony are critical.
2. Demand Value For Your Dollar and Know Who’s Performing All Tasks.
Be sure you specify who will be handling all of your work at all times. There’s nothing worse than paying for a team of experts only to discover that inexperienced, entry-level new hires will be handling a substantial part of the workload. If you’re paying for seasoned experts, make sure key personnel do most of the work, with the remainder of the team acting in a support role.
3. Make Sure Evidence Handling Procedures Are Precise And Fully Defensible.
A smoking gun document or evidence is useless if its inadmissible. Check, check and triple check chain-of-custody, transfer and evidence handling practices before hiring anyone. Documentation practices should be strictly outlined and preservation and acquisition of evidence should exceed all court standards. Your expert should always collect evidence . . . self-collection by your client or your law firm can corrupt or change file attributes, resulting in sanctions. Remember, if your expert is even the least bit casual about the collection handling process, you have the wrong expert.
4. Clearly Define Team Member Roles.
In most cases, you’ll have front of the house and back of the house team members, who all play essential roles. It’s normal to have a tech wiz at the keyboard with a seasoned expert explaining strategies and findings to clients, board members and in the courtroom. From your standpoint, it’s essential to know which team members will be performing what tasks, along with their backgrounds, training, certifications and track records. By knowing exactly who is doing what and why that person is best for the job will help you make an informed decision when deciding who to call upon for help.
5. Investigate Expert Witness Testimony Experience.
The best evidence in the world can fall flat and fail if your expert is a dud on the stand. Your expert has to be believable, credible, likeable, trustworthy, respectful, humble and presentable.
If your expert has a wide range of experience as both in plaintiff’s and defense matters, he/she will have a much better time both fielding and answering difficult questions during depositions.
Also, look for experts who know when not to be too “overly expert.” It’s important an expert does not try to exceed what the data will support or insist on providing absolute answers on key technical points. Knowing when to give a bit on smaller issues can provide a real advantage, particularly when the opposition has their own expert and possibly even a neutral third -party expert on-hand. Over-stating evidence can open the door for the opposing expert to harpoon testimony and counteract all the hard work your team has assembled. There’s much more I could share, so perhaps I will provide more information on this critically important topic at a later date. Until then, just remember, your expert has to be an expert communicator as well as a technical expert, otherwise your chances of winning your case are greatly compromised.
