Case Study 1 — Excluded Before the Jury Heard a Word

The evidence was strong. The examiner was skilled. And none of it reached the jury, because the report overstated, the CV was padded, and the tools were never validated. A trade-secret case worth millions collapsed not in the witness box but at a pretrial Daubert hearing — proof that you can lose before you ever testify.

Background

This is the book's second anchor case — the employee who covered their tracks — carried forward to the courtroom, and it is a cautionary tale. A mid-size robotics firm sued a former senior controls engineer who had resigned on a Friday and started at a direct competitor the following Monday, alleging he had copied the firmware repository on his way out. The technical evidence, gathered months earlier, was genuinely good: USB device history in the registry showed an external drive connected during his final week; a deleted batch script had copied the repository; and a $STANDARD_INFORMATION` / `$FILE_NAME timestamp mismatch betrayed an attempt to backdate the access — the very signature of timestomping (Chapter 16, Chapter 21, Chapter 30).

The firm retained a forensic examiner to analyze the returned company laptop and testify. He had real skill and a decade of casework. He also had habits that had never been tested by a serious opponent, because most of his prior matters had settled. This one would not.

What went wrong

The competitor's defense team was well funded and filed a motion in limine — a pretrial motion asking the judge to exclude the examiner's testimony entirely under Federal Rule of Evidence 702 and Daubert. The court set a Daubert hearing, outside the jury's presence, where the heaviest legal artillery is fired. Three problems, each avoidable, surfaced there.

The report overstated. The examiner's report did not say the evidence was consistent with deliberate exfiltration. It said, in its conclusion, that the engineer "deliberately stole the source code and attempted to conceal the theft." That sentence claimed two things his examination could not establish — the engineer's intent and the identity of the person at the keyboard — and it connected the data to that conclusion, in Joiner's language, "only by the ipse dixit of the expert." The defense did not have to disprove the theft. They only had to show the analytical gap between "files were copied to a USB device under account jdoe" and "the defendant deliberately stole them."

WHAT THE REPORT SAID            WHAT THE EVIDENCE SUPPORTED
─────────────────────           ──────────────────────────
"deliberately stole"      vs.   files copied to a USB device under
"attempted to conceal"          account jdoe; $SI backdated while $FN
"the defendant"                 showed the true time — activity
                                consistent with concealment, actor
                                not established by the forensics alone

The CV was padded. Cross-examination of his qualifications — the voir dire of the expert — turned up a "CISSP" he had let lapse three years earlier and still listed as current, and a claim of having "testified as an expert over fifty times" that he could substantiate for only about a dozen matters; the rest were depositions that never reached testimony, or cases that settled. Neither exaggeration was central to the firmware question. It did not matter. As the chapter warns, a single inflated line hands the other side a way to impeach not just the line but the witness's entire credibility, which taints everything else.

The tools were never validated. Asked the Daubert reliability questions — factors three and four weaponized — he could not state the version of the carving tool he had used, had never validated his write-blocker, and answered the reliability line with "the software is industry standard, it just works." He had, in fact, done sound work; he simply had not documented the foundation that proves it. "The software said so" is not a method.

The ruling

The judge's order excluding the testimony was clinical:

ORDER ON DEFENDANT'S MOTION IN LIMINE (excerpts, paraphrased)

  The Court does not doubt the witness's technical competence. The issue is
  RELIABILITY OF APPLICATION under Rule 702(d) and the analytical gap under
  Joiner. The opinion that the defendant "deliberately stole" the code and
  acted to "conceal the theft" opines on intent and on the identity of the
  actor — matters the witness's forensic examination does not establish and,
  as to intent in this posture, matters reserved to the trier of fact.

  The witness's inability to articulate tool versions, validation, or error
  rate further undermines the reliability showing the proponent must make by
  a preponderance. Credibility concerns arising from the curriculum vitae are
  noted but are not the basis of exclusion.

  The proffered expert testimony is EXCLUDED.

With its expert excluded, the firm had a strong factual story it could no longer explain to a jury — no one left to teach the panel what a $SI`/`$FN mismatch meant or why a hash proved the image was faithful. The case settled within weeks, for a fraction of its value. The evidence had been strong enough to win. The testimony lost it before it began.

The analysis

1. You can lose before you testify. Exclusion at a Daubert hearing is the single most catastrophic outcome in this chapter, because it happens before the jury hears one word from you. The reliability fight often occurs pretrial, on a motion in limine, and a poorly documented method or an overreaching report gets thrown out with no chance to repair it on the stand.

2. Overstatement is an admissibility problem, not just a style problem. "Deliberately stole" and "the defendant" were not merely strong wording; they triggered Rule 702(d)'s reliable-application requirement and 704(b)'s bar on opining about intent, and they created the Joiner analytical gap the defense exploited. The 2023 amendment to Rule 702 exists precisely to keep out conclusions that outrun the data — even when the underlying method is sound.

3. A padded CV is a credibility bomb with a wide blast radius. The lapsed certification and the inflated testimony count had nothing to do with firmware, yet they let the defense paint the witness as someone who exaggerates. Your CV is sworn evidence; list only what is true and current, and keep documentation for every line (Appendix I, Chapter 39).

4. Validation is the foundation, and "it just works" is not validation. The examiner's work was probably reliable, but he could not prove it — no tool versions, no write-blocker validation, no error-rate answer. The witness who records versions, cites NIST CFTT testing, and runs known-answer tests is bored by the reliability attack; the one who does not is destroyed by it.

5. Calibration would have saved the case. Had the report said the evidence was consistent with deliberate exfiltration and established that files were copied to a USB device under account jdoe while the $SI timestamp was backdated — stating source attribution and disclaiming user attribution — there would have been no analytical gap to exploit and no exclusion. The same findings, phrased to the strength of the evidence, would have reached the jury.

Discussion questions

1. The judge wrote that he "does not doubt the witness's technical competence." Explain how an expert can be technically excellent and still excluded — and why this makes the cardinal rule a matter of admissibility, not merely of good manners.

2. The CV padding was "not central to the firmware question," yet it damaged the witness badly. Explain the mechanism by which one exposed exaggeration "taints everything else you say," and why that taint persists even when the rest of the testimony is accurate.

3. ⭐ Rewrite the report's fatal conclusion sentence ("the defendant deliberately stole the source code and attempted to conceal the theft") into a defensible finding that states source attribution, disclaims user attribution and intent, and would survive a Daubert hearing. Then explain, clause by clause, why your version closes the analytical gap the original opened.

4. The reliability attack landed because the examiner could not state tool versions, validation, or error rate. Draft the three-sentence foundation he should have been able to give — naming a validation step, a NIST program, and a recorded version — and explain why each sentence has "no soft edges."

5. Contrast this case with the worked drill in the chapter, where the examiner held the line. The underlying evidence was strong in both. What single discipline separates the examiner whose testimony reached the jury from the one whose did not — and at what point in the case's life (lab, report, pretrial, or stand) was that discipline actually exercised or lost?