Establishing Tap Reliability in Expert Witness Testimony: Using Scenarios to Identify Calibration Needs

A means to establish a level of soundness for low-layer network devices is important to support in-house organizational investigations that pursue legal remedies. Those providing expert testimony must be able to speak competently to the reliability of these devices in order to establish confidence in the accuracy and completeness of the data they collect; however, manufacturers rarely provide conclusive information about performance to a degree that will survive legal challenge. This paper applies a model for creating calibration test suites, developed in the paper by Endicott-Popovsky, to several misuse and defense-against-negligence scenarios in order to create appropriate calibration tests. The insights gained result in recommendations for a calibration regime for forensic aggregator taps that will ready them for supporting expert testimony