Expert Witness Work

What an expert is actually for

An expert witness exists to help a decision-maker understand something they could not reasonably be expected to work out alone. That is the whole of the role, and most of what goes wrong in this field is a failure to respect its boundaries.

A fact witness describes what they saw or did. An expert applies a method to evidence and states what the evidence supports. The distinction matters because it defines what an expert may properly say. I can explain what a server log records, reconstruct when a page changed, describe how a redirect altered a search engine's access to a site, and set out what conclusions those records will and will not carry. I should not be telling anyone whether conduct was willful, whether it constituted unfair competition, or who ought to win. Those are legal characterizations, and an expert who reaches for them has stepped outside the role in a way that gives opposing counsel an easy afternoon.

The other boundary is confidence. Internet evidence is circumstantial by nature. It is assembled from records kept by third parties for their own purposes, retained for their own periods, and frequently incomplete in ways nobody noticed at the time. An opinion that presents it with the certainty of a bank ledger will not survive competent challenge, and it should not.

Where internet evidence shows up

The subject matter varies enormously; the underlying evidentiary problems repeat. The recurring shapes are these.

Search and SEO disputes — whether contracted work was performed, whether one party's conduct caused another's traffic decline, whether a promised ranking was achievable at all, and whether a brand term was used to divert search traffic.
Domain name matters — who owned a name, who controlled it, when each of those changed, whether a transfer was authorized, and what the name was worth.
Social media matters — attributing an account to a person, establishing whether a post existed in the form alleged, and distinguishing a genuine platform export from a screenshot that could have been made in a text editor.
Web analytics matters — where traffic and revenue figures came from, whether two periods are genuinely comparable, and whether a reported number means what the report says it means.
General internet questions — what a website said on a date, who operated a group of properties, and how an online operation was structured.

Different disciplines, one common thread: somebody is asserting a causal or factual story about something that happened online, and the records either support it or they do not.

Consulting and testifying are different jobs

Counsel decides which one they are buying, and the decision has consequences that are easier to manage before the work starts than after.

A consulting expert helps the legal team understand the technical landscape, frames the questions worth asking, and drafts the discovery requests that will actually produce usable material. That work is normally protected. A disclosed expert produces an opinion that the other side will receive, examine and attempt to dismantle, and materials considered along the way may become discoverable depending on the jurisdiction and the rules in play.

In practice the most valuable early contribution is rarely analysis. It is telling counsel precisely what to demand while it still exists. Raw server access logs rather than summaries. Direct analytics and search console account access rather than exported PDFs. Registrar account records including login history and authorization code requests. Content management revision history. Tag manager container versions. Complete platform data exports rather than screenshots. Preservation letters written before anyone knows what to preserve reliably miss the things that matter, and a great deal of this material is rotated or deleted on ordinary schedules measured in weeks.

Preservation comes before analysis

The order of operations is not negotiable, because looking at something online can change it, and because evidence that was not captured properly can be attacked later without anyone having to argue about the substance.

My working rules are simple and I apply them the same way regardless of which side retained me. Work from copies and leave originals untouched. Record a cryptographic hash of each file at the moment of collection, so the version relied on can be identified beyond argument. Capture web pages as responses — status code, headers, raw HTML — alongside a full-page rendering showing the URL and the system clock, because a picture of a browser window is the weakest form of web evidence there is. Log every collection with its date, time zone, method and operator. And prefer scripted analysis to manual steps, so the work can be re-run by somebody else, which is exactly the point of a method.

Web archives deserve a specific caution. A capture from an archive is a third party's observation of a page on a date, assembled from resources fetched at slightly different moments, sometimes missing images or scripts, and subject to exclusion at the site owner's request. It is often the best available evidence of what a page said. It is not the same thing as the page.

What this evidence can and cannot establish

Being explicit about the ceiling is what separates a durable opinion from a vulnerable one.

What the records establish well: that a page existed with particular content on a date; that a domain's registration, nameservers or status changed at a recorded time; that a site's own recorded impressions or sessions moved between two dates; that a redirect, canonical tag or robots directive changed a crawler's access; that an account posted particular material according to the platform's own export; that inbound links appeared or disappeared.

What they do not establish: that a particular human being was at a keyboard. An IP address identifies a network endpoint at a moment, not a person, and shared addresses, carrier-grade translation, virtual private networks and compromised machines all sit between the two. A registrant name in a public lookup is self-asserted and was verified by nobody. Historical search rankings have no authoritative record at all; tools store samples from chosen locations and devices on the days they happened to run, and if nobody was tracking the term on the dates that matter, no tool can reconstruct it afterward.

And timing is not cause. Traffic and revenue move for many reasons at once — algorithm updates, seasonality, tracking changes, consent banners, a competitor improving, a campaign ending. The way through is mechanism testing: each alleged cause leaves a distinct fingerprint, and you go looking for the fingerprint rather than the coincidence. Sometimes several sufficient causes overlap and the data cannot apportion between them. When that is the answer, that is the answer.

Why opinions fail

The failure modes are consistent enough to list, and they are the first things I would examine in someone else's analysis.

Confidence the source data does not support. Certainty is cheap to write and expensive to defend.
Using current tool output to describe a past state. Link indexes drop URLs, caches expire, datasets get rebuilt. A crawl run this month is evidence about this month.
Screenshots as primary evidence, with no underlying response, no hash and no collection record.
Adopting the client's narrative and then gathering only the material that agrees with it.
Hidden assumptions. If an opposing expert has to argue with a stated assumption rather than discover an unstated one, the report has done its job.
Damages arithmetic on invented inputs — assumed conversion rates and assumed margins nobody inside the business would recognize.
Opining on the legal question, which is not the expert's to answer.

An expert who has never written the sentence “the available data does not show that” has not been doing the work honestly.

How engagements are arranged

Expert work is arranged through counsel, not through the party. Conflicts are cleared before I look at anything substantive, scope and role are set in writing, and whether an engagement stays advisory or becomes disclosed is counsel's decision under the rules of their jurisdiction rather than mine. Engagements are confidential by default, which is why this site describes the practice rather than any matter, and why it names no cases.

The method does not change depending on which side retains me. I would rather say early that the records do not support a theory than have that discovered later by somebody else. Expert witness and investigative engagements are handled through Hartzer Consulting.

Frequently asked questions

When should an attorney bring in an internet expert?

Earlier than most do, because this evidence expires on its own schedule. Raw server access logs are frequently rotated within weeks. Analytics and search console access often dies with a vendor relationship, and console history ages out regardless. Registrar account records require a specific request naming what you want. The highest-value early work is not analysis at all; it is producing the list of things to preserve and demand while they still exist, which is difficult to write without technical input.

Can an expert prove who was behind an anonymous account or website?

Sometimes, and rarely from public sources alone. What public records support is clustering — showing that a group of properties or accounts share reused analytics identifiers, registration details, certificate records, DNS history, template fingerprints or writing patterns strongly enough that common operation is the reasonable inference. Connecting that cluster to a named individual usually requires records held by a platform, registrar or provider, obtained through legal process. An expert who names a person from public data alone is overreaching.

Do you work for plaintiffs or for defendants?

Both, and the analysis does not change with the side. The value of a technical opinion comes from its method being indifferent to the outcome, and an expert who only ever finds for whoever is paying is not much use to anyone once that pattern is visible. Practically, this also means I will tell a retaining attorney early when the records do not support the theory they were hoping to prove, which is usually cheaper information than the alternative.

What does a technical expert report contain?

A statement of the question asked, the materials reviewed and where each came from, the method applied in enough detail to be repeated, the findings with each figure traceable to its source export and date range, the assumptions relied on stated explicitly, and the limits — what could not be determined and what data was unavailable. Exhibits carry the underlying captures and outputs. The test I apply is whether a competent person on the other side could re-run the analysis and reach the same numbers.

How is an expert different from the agency already working on the account?

Independence and method. The incumbent agency is a fact witness about its own work and has an interest in how that work is characterized, which is a difficult position to be useful from. An expert is retained to apply a method to the records and state what they support, including where that is unhelpful to the retaining party. The agency's material is usually important evidence in these matters; it is generally not a substitute for an independent analysis of it.

Are expert engagements confidential?

As a rule, yes. Engagements come through counsel, are governed by the retention terms and any protective order in place, and are frequently never public at all. That is why this site describes what the work involves rather than discussing any specific matter, and why it names no clients, cases or outcomes. If you need to evaluate an expert's suitability, the useful signals are method, publication history, and whether they will tell you plainly what the evidence cannot show.