Outline of Research Protocol

DIGITAL FORENSIC EVIDENCE RESEARCH STUDY (September 2009)

Part I. Please separate and keep this part for your records.

Overview and Agreement to Participate in Digital Forensic Evidence Research Study

Gary C. Kessler Principal Investigator

You are being asked to participate in a study about trial judges in the U.S. and their attitudes related to digital forensic evidence. I am a professor of Computer & Digital Forensics and Digital Investigation Management at Champlain College in Burlington, Vermont and a member of the Vermont Internet Crimes Against Children (ICAC) Task Force. I am also a Ph.D. candidate in Computing Technology in Education (CTE) at Nova Southeastern University in Ft. Lauderdale, Florida, conducting this study as part of my dissertation research.

The purpose of this study is to identify issues related to trial judges' awareness, understanding, and application of digital forensic evidence.

I anticipate that completion of this survey will take no more than approximately 20 minutes. There will be one (possibly two) follow-up surveys sometime in the next six months. Part III of this survey provides an informed consent form and a contact information form that you can send to me if you are willing to participate in the next round.

I believe that there is little or no risk to participating in this research project. In addition, no data is being requested or maintained that will link individuals to their responses. All data will be maintained in a private and confidential manner. All survey results will be reported only in the aggregate.

Participating in this research may be of no direct benefit to you although it may make you more aware of your own attitudes about digital evidence. It is believed that the results of this study will identify training and education that will benefit the larger community of trial judges.

You will receive no compensation for participating in this study. Participation in this research project is completely voluntary. You are free to withdraw from participation at any time during the duration of the questionnaire with no penalty or loss of benefit to which you would otherwise be entitled. 2

Research data will be confidential to the extent allowed by law. Agencies with research oversight, such as Nova Southeastern University's Institutional Review Board, have the authority to review research data. All research records will be stored in encrypted files on my computer and/or in a locked file in my office for the duration of the study. All other research records will be destroyed upon completion of the project.

Your participation is greatly appreciated, and I hope that it will benefit the practice of computer forensics and the use of digital forensic evidence in court. If you have any questions or concerns regarding this research study, please contact me.

If you have any questions regarding your rights as a research participant, please contact the Nova Southeastern University Institutional Review Board at 866-499-0790 or [email protected].

Thank you very much.

I have read and understand the above information, and agree to participate in this research project. Removing this page from the survey and returning the survey indicates my consent to participate in this portion of the study.

If I submit the survey by mail or e-mail, the inclusion of Part III indicates my consent to participate in this portion of the study.

Gary C. Kessler CTE Ph.D. Candidate Principal Investigator, Digital Forensic Evidence Research Study Nova Southeastern University Ft. Lauderdale, FL

2 Southwind Drive Burlington, VT 05401 802-238-8913 [email protected] 1

Part II. Please return this portion of the survey. Feel free to use additional pages, if necessary.

QUESTIONAIRE A

Q0. Consider the following definition:

"Digital forensic evidence refers to information offered at legal proceedings to aid in the decision-making process that is derived from digital sources and the digital forensics process. Digital sources include computing devices (e.g., laptop and desktop computers, routers, music players, cameras, personal digital assistants, and cell phones) and telecommunication networks (e.g., wireline telephone and television services, wireless network providers, and Internet service providers)."

Do you agree with this working definition? (YES/NO)

Q0A. If "no" to Q0, how would you modify the definition?

Q1. Has any party offered digital forensic evidence (or evidence from the computer forensics process) in any evidentiary motion or trial over which you have presided?

YES NO

Q2. What issues, if any, have you faced in deciding on how to rule on challenges to the admissibility of digital forensic evidence? 2

Q3. Will you require lawyers to meet a higher standard than for physical forensic evidence when they seek to authenticate and admit digital forensic evidence? For example, will you require a higher standard when they seek to authenticate and admit evidence retrieved from business records databases, e-mail, or Web sites?

Q3A. If "yes" to Q3, what are the concerns that prompt you to require this higher standard and/or what is the informational basis that catalyzed this higher standard?

Q3B. If "yes" to Q3, what specific facts and circumstances must the lawyer establish in order to satisfy your concerns?

Q4. Are there some types of cases where you are generally more (or less) likely to expect digital forensic evidence to be offered at trial than other cases?

Q4A. If "yes" to Q4, what types of cases are you more likely to expect to see digital forensics evidence and what types of digital forensics evidence might you expect in those cases? 3

Q4B. If "yes" to Q4, what types of cases are you less likely to expect to see digital forensics evidence?

Q5. What factors lead to a more (or less) effective presentation of digital evidence to a fact- finder?

Q6. Consider the testimony of a digital forensic examiner whose testimony is based, in significant part, on the use of computer forensic hardware or software tools. What would you require in order to establish the reliability of the forensic tools (e.g., would you require the examiner to have a detailed understanding of how/why the relevant software or hardware works, or would it be sufficient for the examiner to establish that he/she had significant training and experience in how to use the tools)?

Q7. On a scale of 1 to 5 (with 1 being the lowest and 5 being the highest), how would you rate your own familiarity with:

Q7A. Digital forensic evidence

Q7B. The computer forensics process

Q7C. Computer technologies

Q7D. Internet applications 4

Q8. What factors have influenced your ratings in Question 7 (e.g., education, personal experience, professional training, etc.)?

Q9. Do you believe that you have more, the same, or less understanding of digital forensic evidence compared to your peer judges:

Q9A. Locally? MORE SAME LESS

Q9B. Nationally? MORE SAME LESS

Q10. How does the technical understanding of the attorneys presenting digital evidence at hearings and at trial affect the effectiveness of that evidence to the fact-finder?

Q11. DEMOGRAPHIC INFORMATION

Q11A. How long have your served on the bench?

Q11B. At what level of court do you currently preside?

Q11C. How many years have you been in your current position?

Q11D. What is your age?

Q11E. What is your gender?

Q11F. What is the approximate population of the jurisdiction in which you preside? 1

Part III (Copy 1). If you agree to participate in the survey follow-up, please detach one copy of this page, provide your contact information and signature, and return with Part II of the survey. You can keep the other copy of this page for your own records.

SURVEY FOLLOW-UP REQUEST AND INFORMED CONSENT

The nature of this study is such that one, possibly two, follow-up surveys will be required in addition to this initial questionnaire. The follow-up survey(s) will be much like this one with a series of short-answer questions and a target completion time of approximately 20 minutes.

If you would be willing to be contacted by e-mail or postal mail for a follow-up, please provide contact information below. All identifying information in this section will be separated from data gathering portion of the survey materials.

Because the information on this page is Personal Indentifying Information (PII), a signed informed consent form must be submitted prior to any subsequent contact. If you are interested in participating in the follow-up, please sign one copy of this informed consent form and retain one copy for your records.

Submitting these forms does not commit you for any further activity. Participation in this study is wholly voluntary and participants may leave the study at any time.

Name: ______

Address: ______

______

E-mail: ______

Phone: ______

Please indicate preferred method to receive the follow-up survey:

E-mail Postal mail 2

It is imperative to the integrity of this study that the researcher not have any individual identifying information when processing the surveys. In order to ensure anonymity, the following steps will be followed for any individuals who either request to participate in the initial study via postal or electronic mail or who participate in subsequent surveys via postal or electronic mail.

Survey participants should submit the survey packet with a signed informed consent form via postal or electronic mail to:

Ms. Julie Eldred Champlain College 163 S. Willard Street Burlington, VT 05401

[email protected]

To ensure the anonymity of the survey and the integrity of the Institutional Review Board (IRB) process, Ms. Eldred or a research assistant (hereafter, "the assistant") will take the following actions:

 Ensure that the survey packet includes a signed informed consent form and that the survey itself does not have any information on it that might identify the survey participant. If the consent form is signed, the assistant will initial the survey form. If the survey form has any identifying information on it, any such information will be removed or redacted.

The assistant will put the signed informed consent form in a sealed envelope, and deliver the envelope and survey to the researcher; the researcher will maintain both until the end of the study period.

 If there is no signed consent form, the assistant will place the packet into a sealed envelope that will be given to the researcher. The envelope will be stored until the end of the study period and no survey data will be compiled from this packet.

All survey packets will be destroyed at the end of the research, at the first opportunity allowed by law and IRB procedures.

______Participant's signature 1

Part III (Copy 2). If you agree to participate in the survey follow-up, please detach one copy of this page, provide your contact information and signature, and return with Part II of the survey. You can keep the other copy of this page for your own records.