Episode 12 – Erm…

Hooray, I hear you cheer, another epsiode of my joint 27th favourite podcast.  Its been a while but we have found the time to record another episode.

This week we discuss the new website and some topical news that affects the digital forensic field.

How Much Are Your Clients Worth?

I am subscribed to a mailing list in which several forensic investigators converse about various issues.  One such issue arose recently that struck me as slightly unusual, and some of the responses surprised me.  The issue in question was simply “Do you bill clients for machine time?”  The investigator was simply asking if we charge for time when the investigator is not working on the case but the computer is still working; things such as carving files or performing keyword searches.  I do not know how many times I have had to leave a case overnight, or even over the weekend, in order to complete a task.  All I know is that it happens frequently.  So what are the flaws in billing for machine time? How can investigators and clients both be satisfied with the final bill? Should I charge my usual fee, or even a reduced fee, for the time that the computer takes to complete a process?  My answer: it depends.

The variable in the answer is a case of exclusivity.

If you are an internal investigator or a law enforcement officer the article may not strictly apply to you, however I believe the principle of accountability applies to all regardless of their position or employer.  We all have to report to someone whether it be employer or client.  These people expect us to perform certain tasks in return for payment.  If we are dishonest in our endeavors it will inevitably come back to haunt us.  The best advice that I can offer?  Be completely honest with your employer, clients, and whoever else to whom you are contracted.

Billing is a basic concept.  We charge a certain amount of money ‘X’ per hour and do so many hours of work ‘Y’.  Therefore X x Y = Z (where Z is the billable amount).  The problem is that all ‘X’, ‘Y’, and ‘Z’ can be called into question if billing for machine time.

Look at your employment contract, it will likely state something along the lines of “you will not conduct business for anyone else during your working hours with…”  This is a reasonable request as your employer should not have to pay you for time that is spent working for someone else.  More to the point, why should clients feel any differently?  Many investigators will find themselves, at some point, working on several cases at once.  They may run keyword searches on two cases and, while that is processing, continue to work on a third.  What should they charge in such circumstances?  If, per se, you charge $200 per hour for your services would you charge for the work on all three cases simultaneously, totalling $600 per hour?  The compuer has been working on three cases so why not charge that much?  There are five potential pitfalls that can create a stumbling block for an investigator if they choose to do this.

• First – Audits

Imagine trying to explain to an external auditor that you have earned three times your earning potential in a year.  When the auditor looks at the total hours worked, and the fees charged for that work, how will you explain the discrepancies?

• Second – Computer Specification

Surely if you’re going to charge for machine time it should depend on how quickly your computer can process the data.  If you ran the same keyword search on the same case on two different computers the time taken to complete those searches would differ drastically depending on the specification of the computer.  What complex calculation would you use to determine the hourly rate for the differences in performance?  If you’re planning on charging for this you’d better have some answers as your clients may come back to you with this question.

• Third – Number of Cases

Aside from the spec of your computer the thing that will affect performance will be how many cases are you working on at any given time.  If you are running a keyword search on two cases simultaneously then the speed of the search could be halved, so do you charge half of your hourly rate?  What happens if the search on one case finishes before the other?  Do you charge half for the first hour taken and the full amount for the second hour?  Do you sit and stare at your screen, making notes on when the first search started so you know precisely how much to bill?

As you can see, this becomes very complicated and can waste a lot of time.

• Fourth – Expertise

Clients are not looking for the investigator with the fastest computer or the largest hard drive, the client is paying the hourly rate for your expertise in the field.  They are not paying for processing power, they are paying for your experience and knowledge.  The agreed hourly rate is for you, not for your computer.  The client is paying a substantial amount of money to you, they do not expect to pay you regardless of whether or not you are physically working on their case.

• Five – Reputation

What would happen if a client discovered that they were paying you while you were working for another client, or out shopping, or fishing, etc?  How would others perceive you?  Your reputation could well be on the line.

People may argue and say things like “What about my bills? The cost of running the computer, the cost of keeping the office open while a process is run, how do I recoup these expenses?  The answer is quite simple.  You do charge for these things but in such a way as to maintain your integrity.  When quoting for work don’t simply estimate, take your expenses into account.  The hourly rate should not only reflect your expertise, it should also take in to account depreciation of assets, such as computers, administrative efforts related to the case, as well as electricity, other consumables, and non-investigative staff.  Doing this will enable you to invoice clients with the confidence that you have done everything honestly with your integrity in tact.

There is, of course, an exception to the rule.  If you are called upon to perform an investigation outside your office (on-site) then the client should be paying you for the the time that you spend at the premises.  This will include the amount of time to acquire any devices.  You may ask ‘why the difference?’  It is down to exclusivity.  If you are at your own desk you will have other tasks that you can perform that do not relate to that client.  When you’re away from the office you are expected to give your full attention to the client, they expect exclusive access to your skills and knowledge while you are there.  Even if you are there to only acquire a single hard disk drive, the time taken to acquire, regardless of how long it takes, should always be billable.  Do not interpret this to mean that you should just kick back and wait for the process to complete.  Use the time wisely, they are paying for you to be there so do something productive such as completing forms, tidying up your notes, getting details about the case from the client (if applicable), and so forth.

There are many issues that affect how and what we bill clients but it is important that we get it right if we want our client to return with future business.  Remember the key is exclusivity.  When in the office keep track of what time you spend in front of the screen working for the client.  When you are not working for them, don’t bill them.  This way you will ensure that you clients are happy with the cost of the work, all you have to worry about is the quality.

Lee Whitfield BSc (Hons) MBCS CCE EnCE is a digital forensic investigator and founder of Forensic 4cast.

You are The Weakest Link… Goodbye

Some time ago I appeared on Anne Robinson’s Weakest Link. I wouldn’t normally wish to appear on a TV game show but whilst playing the Weakest Link at home with my family I became so adept at winning that they suggested I try my luck on the real gameshow.

Appearing on the Weakest Link was quite nerve wracking. Not because of the redoubtable Anne Robinson, but because I did not wish to appear stupid to a national TV audience. I was also determined not to make the “walk of shame” at the end of round one only to see a professional dog walker from Purley go on to win the cash.

I didn’t win and I don’t expect you to believe this, but I actually knew the answers to everyone else’s questions.

So, has my moment of TV fame made any impact on my Expert Witness role? Well, it has actually. I learned some valuable lessons during filming that I won’t forget quickly, such as:

• Don’t submit yourself for questioning unless you know the topic.
• Don’t guess the answer, it is probably going to be wrong.
• Don’t shrivel under the withering gaze of a dominant questioner, answer quickly, boldly and with conviction.

An Expert should always know his Topic

A quantum expert is expected to have an abundant knowledge of construction methods and the measurement thereof. They will understand the original contracted scope of work, the site application of the materials in use and quantities required to fulfil that scope. Finally, they will know how the contract deals with the evaluation of changes to the works.

Likewise, a planning expert will not only know how to manipulate planning software, but they will be experienced and practical. They will understand the processes of construction and how long an activity should take. The forensic expert will also know how the works should have been logically sequenced. Armed with this knowledge they can provide a tribunal with a fact based analyses.

It all sounds so obvious and simple but there are still many Expert Witnesses who fail to fulfil the basic criteria set out above.

On an engineering project that seriously overran the programme, the Contractors Planning Expert Witness accepted that the Contractor’s extension of time claim was correct, even though it sought an extension of time that took planned completion months beyond the actual completion date.

Disregarding strenuous arguments from the tribunal explaining the futility of such an expert finding, and despite being referred to earlier cases and learned academic texts to the contrary, the expert was immovable. In cross examination the expert faced the accusation that his findings were wholly “theoretical” and that as a matter of record the events did not happen at the times shown on his theoretical analysis. The Expert refused move from his stated position and a chance to narrow the issues was lost, as was the Contractor’s case.

Experts should not guess

Cardinal Wolsey said “A man may believe what he will, but he should believe what he ought”. In essence experts are allowed to have an opinion but that opinion should not ignore the evidence. An Expert’s opinion should only be constructed under strict criteria, namely:

• It should be on a matter upon which they are informed
• It should be on a matter where they are experienced
• It should be on a matter upon which they are qualified to opine
• It should always be based upon available facts, where these are available
• If contemporaneous facts are not available any published data relied upon must be from an reputable and reliable source
• Where it is a best estimate or guess, this should be clearly noted

In an arbitration on an overseas power project the Contractor’s expert was unable to verify the price of the Contractor’s bulk materials and so rather than carry out a measure of installed works the expert made the assumption that the total weights of pipeline materials delivered were installed. He applied an estimating rate and labour norms to the total delivered weights and valued the work accordingly.

Under detailed cross examination it was disclosed that the Contractor’s expert had not been able to find accurate weights for the numerous valves delivered and so he had allocated them into columns of “less than 2 kg”, “2kg to 10kg” and “10kg to 20kg”, making the assumption that every valve in each column was equal to the maximum weight in the column heading ie. 2kg, 10kg and 20kg respectively. This guess proved to be completely wrong with many valves being only 30% of that allowed.

This was a wholly avoidable error as the necessary valve weight information was available on the internet, just a few mouse clicks away.

Guessing isn’t acceptable for an expert and if experts are asked to give an educated guess then they should make it clear that their answer is an approximation based on experience.

Experts should be sure of their opinions

When an expert has carried out his research thoroughly, has found sound evidence upon which to rely and has then formulated his honestly held opinion based on his experience, he should be better placed than anyone else to influence the tribunal.

Advocates, no matter how skilled and informed, cannot know the Expert’s field better than the expert, yet they sometimes convince experts that they do. If the Expert has prepared properly he should know the answers to all relevant and important questions and then he can safely confess to the tribunal that he does not know the answer to irrelevant questions.

Perhaps because of nerves, or maybe due to lack of preparation, experts are occasionally knocked off course by aggressive questioning. Experts must remember that forming an opinion is only a small part of the expert’s job, defending his opinion in the face of cross examination is potentially the more important part.

A short while ago I watched as experienced counsel took an expert to task on his report. The expert had not done all of his own research and soon became nervous. Counsel smelled blood and moved up a gear. The expert, stammered and shook, soon his evidence collapsed completely. Later when the expert saw the transcripts he was shocked, he simply could not remember agreeing that the opposing expert’s view was probably more prescient than his own.

Facing experienced counsel in cross examination is difficult, but the expert should remember that on the issues in question, he should be better informed about his report than opposing counsel. Firm, bold answers will help to unsettle the cross examiner who is always anxious to avoid reinforcing the opposing expert’s opinion.

Conclusion

Choosing an expert can be tricky, will they do the research, can you trust them not to guess, will they fold under hostile questioning? Only time will tell unless you choose wisely from the ranks of experienced experts who have been there done it and proudly wear the tee shirt.

As for the Weakest Link, was Anne Robinson scarier than a QC, not really. In hindsight it was fun and if you don’t believe me and you live in Purley, ask you local professional dog walker.

Jeffery Whitfield LLB, FRICS, MCIArb, MAE is an expert witness and forensic consultant in the field of construction.  He is a partner at EC Harris.

New Site – Updated

Welcome to our new site.  I have spent a while working on different designs and finally arrived at one that I really like.

I have been busy writing things and getting ready to do a new podcast episode, however, due to personal issues, I have not been able to get anything up on here yet.

Please notice the layout at the bottom of the main page, there are four categories (and more can be added if good suggestions are made).  These are:

• News
• Technical Articles
• Methodolgies & Best Practice
• Podcast Episodes

The titles of these should be self explanatory, but in case they are not these will cover the following:

News

This will cover anything site related and anything news worthy from the world of digital forensics.

Techincal Articles

This will contain ‘White Papers’ based on research carried out by authors and anything that we consider to be of value to the digital forensic community.

Methodologies & Best practices

Here you will be able to find articles relating to customer relations, standard procedures, and bascially anything that is not technical in nature.

Podcast Episodes

The reason that everyone comes here in the first place – to listen

I hope that you find the new site helpful.  If you feel you have anything to contribute then please let me know.