It is not often that a homicide case yields important lessons for civil litigators, but the Brad Cooper case does just that.  The Cary, North Carolina resident’s trial and first degree murder conviction for killing his wife and dumping her body at a nearby construction site resulted in national attention, discussion, and debate.  In its last round of published opinions, the North Carolina Court of Appeals overturned the jury’s verdict and ordered a new trial for Cooper.  As scintillating as the underlying story may be, the Court of Appeals’ decision also has significant implications for the admission of expert testimony and, specifically, technology-related testimony.

The focus of the appeal was expert opinion testimony related to temporary internet files from Cooper’s laptop that, the State argued, showed that Cooper performed a Google Maps search the day before his wife’s murder and zoomed in on the exact area where her body was found.  The evidence was critical to the prosecution’s case.  In fact, the Court of Appeals noted that that it was “the sole direct evidence linking Defendant to the murder.”

The State presented testimony from two witnesses that were qualified as experts in forensic computer analysis.  They opined that the temporary internet files recovered from the laptop revealed that someone conducted a Google Map search on Cooper’s computer the day before Ms. Cooper was murdered.  They concluded that this search was done by someone using the laptop while it was at the Cisco office where Cooper worked, and was initiated by entering the zip code associated with the Cooper house.

Cooper proffered Jay Ward as his expert technology witness.  Ward had more than fifteen years of experience in the information technology field, during which he specialized in network security and analyzed “intrusion attempts from the internet.”   To investigate and identify such intrusions, he had analyzed temporary internet files like the Google Map files at issue “hundreds of times.”  Ward explained in voir dire that, if allowed to testify, he would have offered his opinion that the Google Map files could not have been obtained through internet searches and had, in fact, been purposefully planted on Cooper’s laptop.

The State sought to exclude Ward’s testimony on the basis that he was not a “forensic computer analyst,” a requirement and designation introduced by the State.  Cooper argued that Ward would not be testifying “as a forensic examiner,” but as a “computer security professional,” based on his years of experience determining whether a computer had been tampered with.  The trial court applied a Daubert-like analysis and ruled that because Ward was not a “forensic analyst,” he could not opine regarding the alleged planting of the Google Map files.

The Court of Appeals reversed, holding that the trial court abused its discretion in excluding Ward.  The published opinion provides that “the State did not seriously challenge Ward’s ability to understand and interpret the actual data retrieved [from the laptop by the State], and the voir dire testimony indicated that Ward had been examining precisely the kind of files at issue ‒ temporary internet files ‒ on a regular basis throughout his long career as a digital data security professional.”  In a firm reminder to the trial court that North Carolina follows the standard set out in Howerton and not Daubert, the Court noted that “it is enough that the expert witness because of his expertise is in a better position to have an opinion on the subject than is the trier of fact,” overruling the trial court’s apparent belief that because the laptop data was recovered using forensic tools and methods, only an expert forensic computer analyst was qualified to interpret and form opinions based on the data recovered.

Where Ward is concerned, the trial court’s analysis went awry because it set the bar for qualification to testify too high.  It conflated the process of forensically gathering computer evidence with the know-how necessary to analyze it.  We leave a trail when we use technology just as we leave fingerprints at places we have been. Standards associated with the competent collection of that evidence are different than those associated with analysis of it and testimony about it.  In connection with the latter, semantics and titles matter far less than the expert’s experience.  The trial court’s comparative analysis of the State’s experts with Cooper’s was far more akin to the gate-keeper approach contemplated in Daubert, and was more rigorous than called for under Howerton, which focuses instead upon whether the expert, by education or experience, knows more than the trier of fact.

Here, the Court’s reminder is likely stinging to the Wake County D.A.’s office, because the result is a new trial for an individual convicted of committing a terrible crime.  However, it also serves as a reminder that victories won by suppressing relevant and admissible evidence may be fleeting.  So, when considering motions to exclude expert testimony, remember, the key word search starts with the word “Howerton,” not “Daubert.”