This document provides guidance for prosecutors on understanding, preparing for, and presenting a cybercrime case in court. It discusses key aspects of understanding the technical details of the crime and digital evidence, educating judges and juries, addressing challenges like linking the defendant to the crime, and ensuring digital evidence is properly authenticated and admitted. Preparing involves educating everyone involved, anticipating defense strategies, and qualifying expert witnesses when needed. Presenting the case requires using techniques like analogies and visual aids to simply explain technical concepts to judges and juries.

1. The Cybercrime Trial Abigail Abraham Assistant State Attorney Cook County, Illinois Ivan Orton Sr. Deputy Prosecuting Attorney King County, Washington

13. Preparing Your Case - Education We're using age old methods of reasoning trying to evaluate an unfamiliar situation by finding analogy to a familiar one. But applied to the web the analogies get so complex that the familiar turns into the unfamiliar. To make the situation accurate you have to make it so weird that it doesn't help us figure things out. David Weinberger , Commentator on All Things Considered

46. Presenting Your Case - Complicated/Technical Issues 1. Have a very simple analogy 2. Have a uncomplicated correct definition 3. Find/develop a picture/drawing of what your technology “looks like”. 4. Have a credible expert explain technology using all above #1, #2, #3. 5. Have your expert use that picture/drawing.

51. Hard Drive File Allocation Table Storage Area CLUSTER 1 Unallocated FILE STORAGE CLUSTER 2 Unallocated CLUSTER 3 Unallocated CLUSTER 1 Allocated Image.jpg 10,555 Bytes 5/5/99 1:22 p.m. - CLUSTER 2 Allocated Image.jpg 10,555 Bytes 5/5/99 1:22 p.m. - Clusters 1+2

52. Hard Drive File Allocation Table Storage Area FILE DELETE CLUSTER 3 Unallocated Image.jpg 10,555 Bytes 5/5/99 1:22 p.m. - CLUSTER 2 Allocated Image.jpg 10,555 Bytes 5/5/99 1:22 p.m. - Clusters 1+2 CLUSTER 1 Allocated

53. Hard Drive File Allocation Table Storage Area FILE DELETE CLUSTER 3 Unallocated Image.jpg 10,555 Bytes 5/5/99 1:22 p.m. - CLUSTER 2 Allocated Image.jpg 10,555 Bytes 5/5/99 1:22 p.m. - Clusters 1+2 CLUSTER 1 Allocated CLUSTER 1 Unallocated CLUSTER 2 Unallocated ? mage.jpg 10,555 Bytes 5/5/99 1:22 p.m. - Clusters 1+2 ? mage.jpg 10,555 Bytes 5/5/99 1:22 p.m. - Clusters 1+2

54. INFO Hard Drive ownload DC01.jpg 10,555 Bytes 5/5/99 1:22 p.m. Image.jpg 10,555 Bytes 5/5/99 1:22 p.m. ecycle INFO (ownloadmage.jpg) DELETE RECYCLE BIN DELETE ? mage.jpg 10,555 Bytes 5/5/99 1:22 p.m.

55. Hard Drive ownload DC01.jpg 10,555 Bytes 5/5/99 1:22 p.m. INFO (ownloadmage.jpg) ecycle RECOVER RECYCLE BIN RECOVER ? mage.jpg 10,555 Bytes 5/5/99 1:22 p.m. Image.jpg 10,555 Bytes 5/5/99 1:22 p.m. ? C01.jpg 10,555 Bytes 5/5/99 1:22 p.m. INFO