January 12, 2025
Effective Advanced Communication in DF/IR
“Nothing important comes into being overnight; even grapes or figs need time to ripen.”
-Epictetus
As my bio and LinkedIn page relay, I teach a lot. One of those teaching roles is as an Adjunct Professor in the Department of Forensic Science teaching an Intro to Digital Forensics course at Virginia Commonwealth University, which also happens to be my Alma Mater. I teach one semester per year, which, when combined with a list of other responsibilities, is quite enough. For those of you who teach, you know that most semesters start off with excitement and energy and by the time the 15 or 16-week course starts to wind down, it can be a bit of a grind. Even teaching once a week for 3 hours is grueling at times, especially with regard to assignments, grading, testing, etc… Oh, and FT work too!
Teaching at VCU is also one of the most rewarding roles I fill. Not only does it help keep me up-to-date with our fields of practice, but it forces me to audit the information that is put out as accurate, timely, useful and practical. In addition to that, it presents the opportunity to get in touch with younger would-be practitioners and even potentially have some influence over their career direction. In my most recent semester, I identified one student who, while not having any pre-existing interest in digital forensics, stood out as competent, articulate and smart. His assignments were well constructed, not unnecessarily verbose, and explained the often complex principles, procedures and ultimate answers to the assignments in a clear, concise manner. I identified this as an intangible asset that many who can do the work lack. I teach that this skill is “where the rubber meets the road” because if you can’t explain what you did, how you did it and how you came to your findings and/or conclusions, ultimately the hard work may have limited impact, and when we’re working cases that deal with real consequences, this could be a large institutional problem.
But those skills generally don’t develop overnight. They are learned. And they have multiple applications beyond report writing or testimony.
As a Patrol Officer, my introduction to testimony was relaying to The Court how I came to stop a particular vehicle for a certain violation or articulate why I stopped a suspected drunk driver. These skills served me well when transitioning into the role of a School Resource Officer as I had to be much more nuanced in my articulations and thoughtful when dealing with school-aged children, their parents and school administration. This further served me when moving on to investigations, having to write much more detailed reports, testify at much higher levels of court for much more serious offenses and ensure that everything that was in testimony was accurate, understandable and factual. I credit the two main prosecutors with whom I worked at the time as helping me along in this advanced level of communication. Their lessons then still serve me today.
But beyond police work and general testimony and complex report writing, these skills cross professional boundaries in other ways, like job interviews, public speaking/teaching, relationship navigation and general interpersonal communication. In the digital age, we tend to lose these skills, and even if we had them before everyone started “working remote”, they are perishable and will dull over time if not sharpened and challenged.
Everyone has to start somewhere. If the starting point doesn’t afford the time or space to work on these skills, create that space and time yourself. Writing, speaking, engaging in well-meaning discourse with others will all help sharpen the skill of relaying complex information to others in a meaningful and understandable way. As a father of two adult-age sons, I have seen firsthand where their ability to communicate effectively has made them stand out in various positive ways.
In a recent review of testimony video of a digital forensic “defense expert” in a murder trial, some salient points were highlighted. While the witness had decades of experience conducting analysis and was no doubt knowledgeable about the findings which they were testifying, the testimony overall was hard to follow, hard to understand and generally lacked any cohesive qualities that people like to see when someone – like a witness – is relaying facts and details pertinent to a legal case. Beyond that and drilling down on some of the specific testimony, there was a lot of techno-babble and not a lot of time spent on explaining certain concepts, data, artifacts, sources or findings. I was forced to ask myself, “does this witness have 30 years of experience, or one year of experience repeated 30 times?”
This is why we must begin with the seed of basic communication and do the work to let the seed grow and foster the much more advanced requirements of communicating in digital forensics. Effective communication is an art. One only has to listen to George Carlin or watch a presentation by Steve Jobs to appreciate the way they communicate effectively sways the listener to their point of view. But the responsibility of effective advanced communication – i.e., testimony, teaching and/or advanced report writing – to be cultivated by the individual examiner. In a recent LinkedIn post (also shared by Alexis Brignoni), there were dozens of comments both pro and con to the point(s) in the original post. Agree or disagree, the practice of “pump and dump” in law enforcement & government digital forensics doesn’t help grow the seed(s) of effective communication. If no analysis is taking place by the examiner and no substantive report is generated, how can the examiner possibly hope to get better at these vital communication skills?
And therefore ultimately, is justice served?
In one of my other teaching roles, I travel the country as part of a fantastic cadre of professionals teaching law enforcement active shooter response tactics. We emphasize communication as one of the main concepts and principles, and in fact, it is the single concept/principle that can determine ultimate success or failure. Further, we emphasize that communication is a two-way street. There is a sender and a receiver. The message being sent needs to be acknowledged by the receiver in order for the cycle of communication to be completed. This can be accomplished verbally or non-verbally. And in 100% of classes, this basic concept falters under the stress of reality & scenario-based training.
Communication is a two-way street, but in the digital forensic field, it incorporates active listening as well as thoughtful responses. In the aforementioned murder trial testimony, I noted several instances – both under direct and cross examination – where the witness failed to answer the question. I can only surmise that they did not actively listen to the question. Generally speaking, people don’t listen to understand, they listen to respond. This is very nuanced point when giving testimony because the entire purpose is to respond to the question, but in order to respond to the question, you must first completely understand the question. While not conducted in real-time, the responses given to a series of written interrogatories should be equally understood and thoughtfully answered. It becomes rather problematic to walk-back answers in testimony, which is a problem that is largely solved by active listening.
With regard to testimonial or sworn responses, words matter, as does accuracy. Consider a question recently posed by an attorney: “Does the collection of the data on the iPhone change anything on the phone?” The short answer is yes, but the real answer is much more nuanced than that. It is our responsibility to explain these things in a manner that is clear, concise and relays as much factual information as possible and can be understood by the person asking the question, which requires that we also understand the question.
There’s a lot to consider when every word is recorded and may be scrutinized later. For some, this advanced effective communication can become “old hat”, but it shouldn’t. There’s an adage in law enforcement: Complacency kills. And if we’re complacent about how we’re relaying impactful, consequential information, that complacency has the ability to ultimately kill the very facts we’re trying to convey, if not our credibility overall.
This is where the rubber meets the road.
About the Author:
Patrick Siewert served 15 years in full-time law enforcement and investigated hundreds of high-tech crimes to precedent-setting results, Patrick is a graduate of SCERS & BCERT and is a court-certified expert witness in digital forensics, mobile forensics and historical cell site location analysis. He has published dozens of articles and is cited in numerous academic papers. He was the Founder & Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia (USA) and currently serves as Director of Digital Forensics and E-Discovery for a Nationwide (US) provider of DF/IR and e-disco litigation support services, while keeping in touch with the public safety community as a Law Enforcement Instructor in multiple disciplines.
Email: Patrick@ProDigital4n6.com
Patrick Siewert on LinkedIn: https://www.linkedin.com/in/patrick-siewert-92513445/
Pro Digital (old) blog site : https://prodigital4n6.blogspot.com/