Drawing The Line On Computer Forensic Expert And Lay Testimony (Part II)

In conspiracy and bribery trial, lay testimony concerning deleted e-mails based on an understanding of Microsoft Office products was admissible as lay testimony under FRE 701 and did not constitute expert testimony under FRE 702, in United States v. Wilson, _ F.Supp.2d _, Criminal Action No. 08-128 (EDLA July 30, 2009)

As noted in a review of another case in a prior post, determining when expert or lay applies to computer forensic testimony can be challenging at best. Under some circumstances, lay testimony may be admitted to describe what was found on a computer or hard drive. However, at some point, as the computer forensics analysis and review becomes more specialized, expert testimony may be necessary. Under FRE 702, testimony involving “scientific, technical, or other specialized knowledge” may be admitted to “assist the trier of fact” where certain requirements are met. A recent case considered the issue of whether lay or expert testimony was required to describe a forensic review.

In the case, a contract employee of the U.S. Army Corps of Engineers and subcontractor were charged with conspiracy and bribery to obtain confidential bid information involving a hurricane protection project to reconstruct a levee after Hurricane Katrina. See Indictment. Five days before trial, the government provided discovery from a lay witness that defendant Wilson had deleted most of his sent e-mail from his e-mail account, including incriminating e-mails.

The witness testified at trial about the deleted e-mail. The witness concluded “that (A) Wilson's sent folder had zero sent e-mails for the relevant period but that (B) Wilson's in-box included reply e-mails to Wilson that had been sent in response to e-mails that Wilson originally sent during that same period. Thus, because Wilson's in-box contained reply e-mails sent in response to e-mails originated from his account during the relevant period, [witness] Clayton concluded that Wilson had deleted those original e-mails from his sent box.” Wilson, _ F.Supp.2d at _ n.1. At trial, the witness explained that he was not an expert and the manner in which the deleted e-mails were discovered:

Q. Now, with respect to the review of these footprints and the e-mails, I don't want to give the jury the wrong impression, you're not a computer forensic examiner, are you?

A. No, I'm not.

Q. Did you use any forensic software to perform these analyses?

A. No, I did not.

Q. What type of background do you have to be able to perform these types of analyses?

A. It would be a normal computer user of Microsoft Office products.

Q. To the extent that there is another explanation for why a document would have these characteristics, are you aware of any other explanation?

A. I'm not aware.

Q. You're not an expert?

A. I'm not an expert.
Wilson, _ F.Supp.2d at _ n.5.

The defense offered to call a software expert to respond “to the surprise testimony of [witness] Clayton, to show that the allegedly deleted e-mails were actually stored in the Corps' server.” The proffered expert witness testified at a Daubert hearing. The trial court excluded the witness since he lacked personal knowledge of the defendant’s e-mail account and the e-mail server system.

The defendants were convicted by a jury. See Department of Justice Press Release. Following their conviction, the defendant moved for a new trial, including one ground that the trial court admitted lay testimony about the deleted e-mail instead of expert testimony, as required under FRE 702, and the government failed to provide pretrial expert discovery, as required under Fed. R. Crim. P. 16(a)(1)(G). U.S. District Court Judge Carl J. Barbier, of the Eastern District of Louisiana, denied the motion for a new trial.

First, the court explained that the government witness was a lay based on everyday life observations and was not an expert witness:

“Unlike the cases cited by Defendant in which courts refused to categorize forensic investigators as lay witnesses, Clayton admitted on redirect that he was not qualified to and had not performed any forensic investigation, nor utilized any software or other forensic tests in his review of Wilson's e-mail account. Rather, Clayton simply observed that Wilson's ‘sent’ e-mail folder had no contents dated from the period of the conspiracy; observed that Wilson's ‘inbox’ folder included reply messages to e-mails that Wilson had sent during the period of the conspiracy; and, as a result, rationally inferred that Wilson had deleted the sent e-mails from the ‘sent’ folder. This series of observations and inferences resulted ‘from a process of reasoning familiar in everyday life,’ and thus Clayton's testimony was properly admitted. United States v. Yanez Sosa, 513 F.3d 194, 200 (5th Cir.2008) (“[T]he distinction between lay and expert witness testimony is that lay testimony results from a process of reasoning familiar in everyday life, while expert testimony results from a process of reasoning which can be mastered only by specialists in the field.”).”
Wilson, _ F.Supp.2d at _ (footnote omitted). The e-mail evidence was provided early in discovery and there was no surprise by this evidence. The exclusion of the defense expert was based on the his lack of personal knowledge. As the court noted, “without any personal knowledge of the Corps' server or Wilson's e-mail account, it is unclear how Stroud's testimony could have done anything other than confuse the jury.” Wilson, _ F.Supp.2d at _.

The facts in Wilson are straightforward. A witness may provide lay testimony concerning the common usage of an e-mail feature based on observations of the account. No software was used or further forensic analysis was conducted. A change in the facts, at some point, could result in a different outcome.

Federal Rules of Evidence