PPRuNe Forums - View Single Post - Judge rules crash black box should be handed over to police
Old 1st Jul 2015, 13:14
  #98 (permalink)  
Join Date: May 2008
Location: Paris
Age: 55
Posts: 95
@Piltdown Man:

I've been involved in a trial involving fraud where I was asked to perform forensic analysis of event log on a bank's core systems.

I was given no guidance whatever in terms of being asked to aid the prosecution; I was merely asked to examine the system event and transaction logs and to produce a sequence of events over a chronological period. This wasn't as simple as it may sound; on mainframes a lot of event activity is in non-human language form fr reasons of terseness and performance.

I was also advised that I would need to be aware of the regulatory requirements along with the company's internal standards. Any breaches should be highlighted.

Finally, I had to minutely document my methodology. Explicit in all of this was that I was to avoid interpretation. My job was to translate those bits into a chronology of events. The defence was given the opportunity to challenge the methodology at the outset of the process. Their expert suggested that the analysis should also include analysis of the operations of a random selection of other uses in the team concerned (cha-ching! Than you very happy!) in order to establish whether the company may have created an environment where they were allowing breaches as a matter of routine. Good call. The prosecutors were happy to go along with that.

The defence also made clear that they would - in the absence of having access to the logs - be performing their own forensics on the results of my analysis. I'd expect nothing less.

In the event, my appearance as a witness was brief. Their expert had raised just a couple of questions which were easily dealt with. He admitted to me some years later that he was obliged to justify his fees by giving them something - anything.

The point of this screed is that while the work of an expert witness as expressed in court may sound reductionist a huge amount of effort goes into making sure that it will withstand rigorous examination by the defence. The other point is that prosecutors don't rely purely on internal resources. They outsource when it is a matter in which they don't have the requisite skills.

They won't be using the Daily Mail's aviation "expert" to analyse the CVR. They won't be going to Jane's. They won't even ask an experienced pilot.

You can take it for granted that they will get in someone who has experience in accident investigations. You can take that for granted because in any putative future case that expert witness's credentials will be the first line of attack by any defence.

The only questions directed at me related to what training I had done in the area (plenty); how many years had I worked in that area (the answer rhymed with plenty); what was my level of experience with the diagnostic tools I'd used (lots: the training certificates were in the Book of Evidence along with my accreditations as a trainer in them).

True, the evidence I presented was anodyne and simplistic for the jury, but they were guided (at the direction of the judge) that since the content of it had been unchallenged by the defence they were to take it as fact. The regrettable questions regarding my expertise asked by the defence had been sufficiently dealt with and my evidence as to be taken on face value.

You can bet that by the nature of things any future case involving the CVR in this incident will be defended by defendants with great contacts in the aviation world - possibly better than those of the prosecution. That's how it should be.
Nialler is offline