So You Want to Be an Expert Witness

### Overview In "So You Want to Be an Expert Witness," technologist Hoyt Kesterson and attorney Lauren Topelsohn share practical insights on how technical and cybersecurity professionals can become effective expert witnesses in legal proceedings. Kesterson reflects on his real-world experiences across multiple trials, patent disputes, and regulatory lawsuits—such as testifying for the State of Arizona regarding Dealer Management System open APIs—while Topelsohn provides legal context on witness qualifications, evidentiary standards, and attorney expectations.

### Key Topics - **Fact Witnesses vs. Expert Witnesses**: A fact (or lay) witness testifies strictly based on firsthand direct observation of events without being paid for testimony or relying on hearsay. In contrast, an expert witness is not involved in the case events and is retained to explain complex technical concepts or provide formal opinions to the judge and jury. - **Legal Standards and Gatekeeping**: Under Federal Rule of Evidence 702, an expert opinion is admissible if scientific or specialized knowledge assists the trier of fact. Topelsohn details the five *Daubert* factors established by the U.S. Supreme Court (*Daubert v. Merrell Dow*): general acceptance in the scientific community, empirical testability, known error rate, peer review/publication, and repeatable standards/controls. Judges act as gatekeepers, deciding whether an expert and their opinion are admissible. - **Discovery, Privilege, and Work Product**: Discovery requires exchanging case-relevant information, interrogatories, documents, software, and expert reports to avoid surprise at trial. The speakers discuss attorney-client privilege, work product protection, the risks of discoverable draft reports, and maintaining strict confidentiality under non-disclosure agreements (NDAs). - **Spoliation of Evidence**: Spoliation involves failing to preserve evidence once a reasonable expectation of litigation arises (citing Judge Shira Scheindlin and the *Zubulake* cases). Failing to halt scheduled data destruction or properly handle forensic disk dumps can result in severe sanctions, such as adverse inference jury instructions, default judgments, or case dismissals.

### Technical Details - **Forensic Acquisition & Handling**: The speakers discuss a software liability case involving accounting software where evidence was mishandled by taking a Linux data dump and converting it to Windows, destroying critical filesystem metadata. Proper forensic disk imaging must be forensically sound rather than informal copies. - **Code Analysis & Intellectual Property**: Experts are often called to analyze source code for copyright infringement or backdoors, identifying stylistic signatures, function call patterns, and API usage even when variable names or tags are altered. - **Security and Cryptography Concepts**: Technical subject matters highlighted include cryptographic key escrow failures, hash chains and timestamping in patent disputes (Markman hearings), X.509 directory services, and network protocol layers.

### Takeaways - **Courtroom Demeanor and Delivery**: Resumes and degrees alone do not suffice; experts must be likable, professional, non-condescending, and articulate. They must strictly answer only the question asked, pause before answering on cross-examination to give counsel time to object, and maintain equanimity in high-pressure adversarial settings. - **Compensation Rules**: Expert compensation is fully discoverable and must be disclosed to opposing counsel; it cannot be contingent on case outcomes. - **Building Visibility**: Technologists can enter the field by publishing, speaking at local and industry conferences, engaging on LinkedIn, and participating in cross-disciplinary groups such as the American Bar Association (ABA) Section of Science and Technology Law (via Associate Memberships) and InfraGard.