The lesson plan considers the admissibility of evidence and the significant role the judge plays as gatekeeper. The activity plan supports individuals in developing understanding and awareness around expert evidence and the handling of evidence. A overview video outlines the structure of the active lesson plan.
Digital forensic techniques are also applied in a much broader range of inquiries, such as internal corporate investigations, that often do not result in formal proceedings in public court. Despite the fact that investigations may not require the same standard of proof, forensic analysts should always follow sound forensic practices in collecting and analysing the artifacts. This includes adherence to any judicial requirements when working with inherently personal data, which can be a non-trivial concern when the investigation is multi-jurisdictional. In such cases, it is important to seek timely legal advice to preserve the integrity of the inquiry. CyBOK Forensic Knowledge Area. Pg 5.
Learners complete FOUR blocks of activities that are designed to support them in appreciating the significant challenging in admitting digital evidence into a court of law. Using real-world cases staring points, instructors support learners through the following activity blocks:
Gatekeeper of the Court. The first block of activities is designed to motivate learners to understand the challenges of admitting evidence to court and how the judge effectively acts as gatekeeper by ultimately deciding what is acceptable.
Expert Evidence. The second block of activities supports learners in considering the challenges in admitting expert testimony prior to the class devising guidelines for admitting expert testimony.
Handling Evidence. The third block of activities supports learners in considering the challenges of admitting digital evidence to court.
Admissibility of Evidence. The fourth block is used to conclude the active lesson plan and is focused on aligning the outcomes of the activities with material presented in the CyBOK.
The active lesson plan can be adjusted to accommodate many of the United Kingdom qualification levels. In its current form the active lesson plan is targeting learners at Levels 6 and 7 on the Regulated Qualifications Framework (RQF) and Credit and Qualifications Framework (CQFW) in England and Wales, Levels 10 and 11 on the Scottish Credit and Qualifications Framework (SCQF) and Levels 6 and 7 on European Qualifications Framework (EQF).
The active lesson plan does not expect nor require an individual to posses significant knowledge in Computing Science, Mathematics or Law.
Two cases are used in this active lesson plan that act as the foundation for activities.
The first case is Julie Amero and is used as the foundation for understanding expert evidence. Julie Amero was a substitute teacher that was found guilty of several counts of risk of injury to a minor. Amero was accused of displaying pornographic and adult images to her class of minors. The images were displayed on a school computer system that Amero was using to conduct personal activities.
The second is Colin Mowday and is used as the foundation for understanding handling of digital evidence. Colin Francis Mowday was found guilty of being in possession of indecent images of children. The images were identified and located on three computer disks. The disks where collected from an Internet cafe next to a system that Mowday was using in March 2004. The owner of the Internet cafe had observed Mowday viewing indecent content on cafe systems. The owner contacted the police at which point they arrested the individual and confiscated the three disks. The three disks were investigated and images confirmed on January 2005. Mowday appealed the conviction, on several grounds, including that there was not sufficient evidence to state the indecent images where present on the disk at the point of seizure.
The FIRST block of activities is designed to motivate learners to understand the challenges of admitting evidence to court and how the judge effectively acts as gatekeeper by ultimately deciding what is acceptable.
The block is structured as follows:
Admissibility. Instructor provides a brief lecture on the significant concepts of admissibility of evidence.
Friend Flummox. Learners are required to devise an exam question that will challenge a peer in the class on the topic of admissible evidence.
Themes from Friend Flummox Activity. Instructor leads class discussion and activity on the themes that emerged from the exam questions.
Supporting the Gatekeeper. Instructor provides brief lecture on the potential for guidelines to better support judges in admitting evidence.
The session begins with a brief lecture on the significant concepts of admissibility of evidence, in terms of the challenges it represents to digital investigations.
Learners will use this material to appreciate the challenges around expert evidence and handling evidence.
The lecturer or instructor should:
Present their own admissibility lecture or provide in advance for students to consider.
Permit time for questions to address any misconceptions or issues with the material presented.
An engaging activity to motivate learners to engage with the admissibility of evidence material. Learners are required to devise an exam question that will challenge a peer in the class on the topic of admissible evidence.
The goal of the activity is to focus learners and to generate curiosity as well as to provide an opportunity for learners to develop interpersonal and communication skills.
The lecturer or instructor should:
Advise class that they are required to create an exam question that probes understanding of admissible evidence but also challenges their peers. Learners can be as creative as they want in the design of the question, for example they do not need to restrict themselves to text.
Give the learners around TEN minutes to create the question.
Maintain and ensure energy in the room by walking through the class and advising when time is running out.
Instruct learners to form pairs or trios and exchange their exam questions. The pairs or trios then have TEN minutes to tackle the question. The questions do not need to be in exam conditions, learners can have fun and help each other out.
Collect all the exam questions from the learners.
The aim of the prior activity is to drive curiosity and interest in the challenge of admissible evidence. The lecturer should now focus the class by considering the themes that emerged in the exam questions and steer learners to areas of focus.
The lecturer or instructor should:
Ask learners to nominate any particular good exam questions. Nominators should present the exam question to the class and state the advantages of the approach.
Open the question to the class and ask them to comment on the question and how they would approach it.
Repeat process until a number of questions have been considered. Open an audience response system activity, such as Mentimeter, ask learners to submit some of the themes that emerge from these questions in terms of areas of focus.
Steer the consideration of themes along the significance of the judge as gatekeeper and how digital investigators can support the judge in that role.
The block should conclude with the important role that guidelines can support in the admissibility of evidence. Guidelines for judges and digital investigators.
The remainder of the active lesson plan will focus on learners devising such guidelines before considering those that have already been established.
The lecturer or instructor should:
Present their own lecture on the importance of guidelines or provide material in advance for learners to consider.
Permit time for questions to address any misconceptions or issues with the material presented.
The SECOND block of activities supports learners in considering the challenges in admitting expert testimony prior to the class devising guidelines for admitting expert testimony.
The block is structured as follows:
Produce Summary of Case Study. Learners to produce a summary of the case that will be used in subsequent activities.
Overview of Case. Lecturer or instructor to provide an overview of the case as to ensure all learners are starting with the same knowledge.
Considering the Expert Evidence from Detective Mark Lounsbury. Pairs will consider the expert evidence from an individual and consider any concerns surrounding the testimony.
Considering the Expert Evidence from Bob Hartz. Pairs will consider the expert evidence from an individual and consider any concerns surrounding the testimony.
Considering the Competency of Members of the Court. Pairs will consider some of the behaviour and language used by some members of the court.
Generating guidelines for courts to admit expert evidence. Teams will produce guidelines to support judges in admitting expert evidence.
Presentation to Class. Teams will present the guidelines they have generated to the class.
Identify Emerging Themes in Guidelines. Teams to consider the common themes as well as any divergences between the guidelines generated by teams.
Emerging Themes Discussion. Class to have discussion on the common themes that emerge from the guidelines produced by teams.
Themes in Guidelines and Established Guidelines. Lecturer provides an overall of already established guidelines for admitting expert evidence that are presented in the CyBOK.
The lecturer or instructor should advise learners to produce a summary of the case that will act as the foundation for activities.
Optional: the lecturer or instructor can set this as an entry ticket activity as in they are required to complete in advance of session.
The lecturer or instructor should provide a brief summary of the State of Connecticut v. Julie Amero case to the class.
The motivation for providing the overview is to:
address any misconceptions or gaps in understanding that students may have developed when considering the case in advance.
support those students that have no adequately considered the case in advance as to ensure they can effectively contribute to the activity.
Pairs of learners are to consider the case and expert testimony to consider if there are any ground for appeal.
The activity acts as the first step in learners considering what it is to be an expert and when expert evidence should be admitted and on what grounds.
The lecturer or instructor should:
Issue the activity sheet that will guide and support the learners.
Advise learners are to self-organise into pairs and to consider the State of Connecticut v. Julie Amero case and court transcript from Detective Mark Lounsbury.
Pairs are to determine whether there could be grounds for an appeal based on the quality and accuracy of the expert testimony.
Permit pairs specific time to consider their summary and transcript snippets to determine if there are grounds for appeal.
Permit pairs specific time to produce a 100 word judgement and this will support them in subsequent activities.
Advise pairs they should consider specific aspects when reaching their judgement, specifically: establishing intent to access website accuracy of expert testimony and alternative explanations or positions.
As pairs consider and document their judgement, the lecturer should wander between them and address any questions or gaps in understanding.
Pairs of learners are to consider the case and expert testimony to consider if there are any ground for appeal on the basis of the second expert.
The activity acts as the second step in learners considering what it is to be an expert and when expert evidence should be admitted and on what grounds.
The lecturer or instructor should:
Issue the activity sheet that will guide and support the learners.
Advise learners they have to self-organise into pairs and are going to consider the State of Connecticut v. Julie Amero case and court transcript from Bob Hartz.
Pairs are to determine whether there could be grounds for an appeal based on the quality and accuracy of the expert testimony.
Permit pairs specific time to consider their summary and transcript snippets to determine if there are grounds for appeal.
Permit pairs specific time to produce a 100 word judgement and this will support them in subsequent activities. Advise pairs they should consider specific aspects when reaching their judgement, specifically: mousetrapping, spyware and malware and quality of testimony.
As pairs consider and document their judgement, the lecturer should wander between them and address any questions or gaps in understanding.
Pairs of learners are to consider the case and expert testimony to consider if there are any ground for appeal on the basis of how different members of the court behaved during the case.
The activity acts as the third step in learners considering what it is to be an expert and when expert evidence should be admitted and on what grounds.
The lecturer or instructor should:
Issue the activity sheet that will guide and support the learners.
Advise learners they have to self-organise into pairs and are going to consider the State of Connecticut v. Julie Amero case and court transcript from members of the court.
Pairs are to determine whether there could be grounds for an appeal based on the quality and accuracy of the expert testimony.
Permit pairs specific time to consider their summary and transcript snippets to determine if there are grounds for appeal.
Permit pairs specific time to produce an 100 word judgement and this will support them in subsequent activities. Advise pairs they should consider specific aspects when reaching their judgement, specifically: literacy, presentation of digital evidence and scrutiny.
As pairs consider and document their judgement, the lecturer should wander between them and address any questions or gaps in understanding.
Pairs should form start-up firms of no more than FOUR members and exchange summaries, summary positions adopted from consideration of prior expert testimony and behaviour of members of the court.
The firms are expected to produce guidelines that would support judges in admitting expert evidence to court. Firms will then present their guidelines to the class for further discussion.
The lecturer or instructor should:
Issue the activity sheet that will guide and support the learners.
Advise learners they are going to consider the State of Connecticut v. Julie Amero case case, overall handling of evidence and that they are going to generate no more than FOUR guidelines that support judges in admitting expert evidence.
Advise pairs to self-organise into teams, exchange summaries and judgements from previous activities.
Permit teams time to discuss and consider their summaries, judgements from previous activities.
Instruct teams to generate ONE presentation slide that succinctly outlines each of the guidelines as well as brief rationale for each.
As teams consider and document their judgement, the lecturer should wander between them and address any questions or gaps in understanding.
Collect the presentations from the teams, for example using a virtual learning environment (VLE).
The class will learn about the different guidelines that learners have produced to support in the process of admitting evidence to court.
The class should take notes during the session to support a subsequent activity in identifying emerging themes.
The lecturer or instructor should:
Prepare the presentations collected from teams, produce a running order and advise teams in advance.
Advise teams they have FIVE minutes to give their presentation. The team will be given a ONE minute warning and will be clapped off at the end of their allocated time. Teams should be advised they will not be expected to take questions but may be called upon in subsequent discussions.
Advise teams that they all have to speak and to consider how they will pass between members efficiently.
Advise teams that presentation slide decks will be made available after the session, but learners should still take notes to support subsequent activities.
Use a stopwatch and commence the presentations with teams.
Teams will use their collective notes, their own research and other team presentations to identify themes and divergences in guidelines to support the admission of expert evidence.
The lecturer or instructor should:
Advise teams that they are to produce a ONE slide presentation that covers at least THREE emerging themes that the team has devised from watching the presentations.
Advise teams they should also identify at least ONE novel aspect or divergence between the different guidelines to support the admission of expert evidence.
As teams produce their slides, the lecturer should wander between groups to observe discussion and actions.
Collect the presentation slides from teams in preparation of the next activity.
Teams will present the themes they have identified from the previous activity as well as engage in a discussion with the rest of the class.
The lecturer or instructor should:
Use a random number generator to randomly select pairs to present. The lecturer may favour to select pairs on what they have observed as to shape the discussion in a particular direction.
Advise teams have TWO minutes to present the themes they have identified as well as any divergences.
Select ONE of the themes or divergences to discuss with the wider class and ask for their comments and thoughts.
Continue to ask for teams to present either based on the discussion or what they have observed when teams were producing their slides or using a random number generator.
The lecturer should provide a brief overview of the themes identified in the prior activities and relate them to the already established guidelines for admitting expert evidence in court that are presented and discussed in the CyBOK.
The lecturer or instructor should:
Advise learners of some of the themes that have emerged from consideration of all the various guidelines.
Relate the themes from the proposed guidelines to the established guidelines presented and discussed in CyBOK.
Provide space for learners to raise any questions or address any gaps in understanding.
The THIRD block of activities supports learners in considering the challenges of admitting digital evidence to court.
The block is structured as follows:
Produce Summary of Case Study. Learners to produce a summary of the case that will be used in subsequent activities.
Overview of Case. Lecturer or instructor to provide an overview of the case as to ensure all learners are starting with the same knowledge.
First Appeal Ground for Case. Learners are to consider the case, court transcript snippets and determine whether they would grant or reject the first appeal grounds.
Second Appeal Ground for Case. Pairs are to consider the second of the appeal grounds collectively, considering the case, their summaries and prior judgements.
Generating guidelines for authorities handling evidence. Teams will produce guidelines to support judges in admitting expert evidence.
Presentation to Class. Teams will present the guidelines they have generated to the class.
Identify Emerging Themes in Guidelines. Teams to consider the common themes as well as any divergences between the guidelines generated by teams.
Emerging Themes Discussion. Class to have discussion on the common themes that emerge from the guidelines produced by teams.
Themes in Guidelines and Established Guidelines. Lecturer provides an overall of already established guidelines for admitting expert evidence that are presented in the CyBOK.
Considering the Ross Ulbricht versus United States case. Teams apply the previously generated guidelines to an unseen example and determine if they are violated in any way.
Presentation to Class. Teams present to the class how the guidelines where potentially violated when applied to the unseen case.
Guidelines fit for Task. Teams consider how the guidelines can be potentially refined after watching other teams.
The lecturer or instructor should advise learners to produce a summary of the case that will act as the foundation for activities.
Optional: the lecturer or instructor can set this as an entry ticket activity as in they are required to complete in advance of session.
The lecturer or instructor should provide a brief summary of the Mowday versus The State of Western Australia case to the class.
The motivation for providing the overview is:
address any misconceptions or gaps in understanding that students may have developed when considering the case in advance.
support those students that have no adequately considered the case in advance as to ensure they can effectively contribute to the activity.
Learners are to consider the case, court transcript snippets and determine whether they would grant or reject the first appeal grounds.
The motivation is for learners to understand the significant challenges around handling evidence and how questionable handling can undermine admissibility of evidence.
The lecturer or instructor should:
Issue the activity sheet that will guide and support the learners.
Advise learners they are going to consider the Mowday versus The State of Western Australia case and the first of two appeal grounds.
Permit learners specific time to consider their summary and transcript snippets to determine if the first appeal ground should be accepted or rejected.
Permit learners specific time to produce an 100 word judgement as this will support them in subsequent activities.
As learners consider and document their judgement, the lecturer should wander between them and address any questions or gaps in understanding.
Learners are to self-organise into pairs and consider the second of the appeal grounds collectively. Pairs are to consider the case, their summaries and prior judgements.
The motivation of the activity is to strengthen the significant challenges around handling evidence and how inadequate handling can undermine admissibility of evidence.
The lecturer or instructor should:
Issue the activity sheet that will guide and support the learners.
Advise learners they are going to consider the Mowday versus The State of Western Australia case and the second of two appeal grounds.
Advise learners to self-organise into pairs, exchange summaries and judgements for the first appeal ground.
Permit pairs time to discuss and consider their summaries, judgements and the second appeal ground.
Instruct pairs to formate a position collectively as to whether or not the second appeal judgement should be accepted or rejected.
As pairs consider and document their judgement, the lecturer should wander between them and address any questions or gaps in understanding.
Learners are to self-organise into teams and to formulate no more than FOUR guidelines that support authorities in effectively handling evidence as to ensure admissibility.
Teams are required to generate a presentation slide of the guidelines with suitable rationale that will be presented to the class.
The lecturer or instructor should:
Issue the activity sheet that will guide and support the learners.
Advise learners they are going to consider the Mowday versus The State of Western Australia case, overall handling of evidence and that they are going to generate no more than FOUR guidelines that support authorities in effectively handling evidence as to ensure admissibility of evidence in court.
Advise pairs to self-organise into teams, exchange summaries and judgements from previous activities.
Permit teams time to discuss and consider their summaries, judgements from previous activities.
Instruct teams to generate ONE presentation slide that succinctly outlines each of the guidelines as well as brief rationale for each.
As teams consider and document their judgement, the lecturer should wander between them and address any questions or gaps in understanding.
Collect the presentation slides from teams in preparation of the next activity.
The class will learn about the different guidelines that learners have produced to support in the process of handling evidence.
The class should take notes during the session to support a subsequent activity in identifying emerging themes.
The lecturer or instructor should:
Prepare the presentations collected from teams, produce a running order and advise teams in advance.
Advise teams they have TWO minutes to give their presentation. The team will be given a ONE minute warning and will be clapped off at the end of their allocated time. Teams should also be advised they will not be expected to take questions but may be called upon in subsequent activities and discussions.
Advise teams that they all have to speak and to consider how they will pass between members efficiently.
Advise teams that presentation slide decks will be made available after the session, but learners should still take notes to support subsequent activities.
Use a stopwatch and commence the presentations with teams.
Teams will use their collective notes, their own research and other team presentations to identify themes and divergences in guidelines to support handling of evidence.
The lecturer or instructor should:
Advise teams that they are to produce a ONE slide presentation that covers at least THREE emerging themes that the team has devised from watching the presentations.
Advise teams they should also identify at least ONE novel aspect or divergence between the different guidelines to support the admission of expert evidence.
As teams produce their slides, the lecturer should wander between groups to observe discussion and actions.
Collect the presentation slides from teams in preparation of the next activity.
Teams will present the themes they have identified from the previous activity as well as engage in a discussion with the rest of the class.
The lecturer or instructor should:
1.Use a random number generator to randomly select pairs to present. The lecturer may favour to select pairs on what they have observed as to shape the discussion in a particular direction.
Advise teams have TWO minutes to present the themes they have identified as well as any divergences.
Select ONE of the themes or divergences to discuss with the wider class and ask for their comments and thoughts.
Continue to ask for teams to present either based on the discussion or what they have observed when teams were producing their slides or using a random number generator.
The lecturer should provide a brief overview of the themes identified in the prior activities and relate them to the already established guidelines for handling evidence in court that are presented and discussed in the CyBOK.
The lecturer or instructor should:
Advise learners of some of the themes that have emerged from consideration of all the various guidelines.
Relate the themes from the proposed guidelines to the established guidelines discussed in CyBOK.
Provide space for learners to raise any questions or address any gaps in understanding.
The lecturer or instructor should provide their own brief summary of the Ross Ulbricht versus United States case to the class.
The case will act as an unseen case for learner to apply the previously generated guidelines.
The lecturer or instructor should:
Issue the activity sheet that will guide and support the learners.
Advise teams they are going to consider the Ross Ulbricht versus United States case and apply previously devised guidelines.
Advise teams they are to produce a single slide that highlights where the guidelines have not been met.
Collect the presentation slides from teams in preparation of the next activity.
As learners consider and document their judgement, the lecturer should wander between them and address any questions or gaps in understanding.
The class will learn about the different ways the previously guidelines have been potentially violated in the unseen example.
The class should take notes during the session to support a subsequent activity.
The lecturer or instructor should:
Prepare the presentations collected from teams, produce a running order and advise teams in advance.
Advise teams they have TWO minutes to give their presentation. The team will be given a ONE minute warning and will be clapped off at the end of their allocated time. Teams should be advised they will not be expected to take questions but may be called upon in subsequent discussions.
Advise teams that they all have to speak and to consider how they will pass between members efficiently.
Advise teams that presentation slide decks will be made available after the session, but learners should still take notes to support subsequent activities.
Use a stopwatch and commence the presentations with teams.
The last aspect is for learners to consider the different application of guidelines and reflect on how they can potentially refine the guidelines they have produced.
The lecturer or instructor should:
Advise teams should spend 10 minutes discussing and recalling the presentations from other teams and begin to refine their guidelines.
Advise teams to produce a ONE page summary in terms of how their guidelines are appropriate or how they intend to refine them.
Collect the summaries from teams.
The FOURTH block is used to conclude the active lesson plan and is focused on aligning the outcomes of the activities with material presented in the CyBOK.
The lecturer or instructor should:
Present the guidelines in greater depth that are presented and discussed in the CyBOK.
Ask the class if they have any questions or do not any aspect of what was covered in the session.
Ask learners to complete the Quad Fold Activity.