Disclosure and defense scrutiny

Every finding you report will be examined by someone whose job is to find its weaknesses. In criminal cases that is usually a defense lawyer, often advised by their own expert; in civil and insolvency cases it is the other side. Disclosure is the process by which they get the material to do that, and scrutiny is what they do with it. An examiner who has recorded everything, kept the inconvenient results and can explain every judgment has little to fear from either.

Why disclosure concerns the examiner

The right to a fair trial includes the right to prepare a defense. Article 14(3)(b) of the International Covenant on Civil and Political Rights guarantees a person charged with a crime "adequate time and facilities for the preparation of his defence". The UN Human Rights Committee, in its General Comment No. 32 (2007), explains that adequate facilities include access to the documents and other evidence the prosecution plans to use, and to material that is exculpatory. Behind this sits the principle of equality of arms: the defense must be able to test how the evidence against the accused was produced.

Legal systems differ on what must be disclosed, when, by whom and under what supervision. In some, prosecutors must hand over anything that might undermine their case; in others, the investigating judge or the court controls access to the file. This lesson does not teach any one regime. It teaches what the examiner must do so that prosecutors and the court can meet whatever obligations apply:

• record everything, including material you did not rely on;
• never decide alone that something is irrelevant and discard it;
• flag material that may undermine your conclusions or help the defense;
• flag material that is sensitive, so others can decide how to handle it.

What is typically disclosable

The report is only the visible part. A defense expert will usually ask for, and in most systems can obtain, the material behind it.

Unused material deserves special attention. It includes the second tracing method you ran whose result differed (see the lesson Tracing methods and their consequences), the alternative hypothesis you tested and rejected, a label from a second source that contradicted the one you used, outputs from a tool you abandoned, and leads that pointed to someone other than the suspect. Material that undermines the case is exactly what a fair process requires to be considered. Keep it, list it and describe it neutrally.

Sensitive material

Some material in a crypto case must not simply be handed over. The examiner's job is to identify it and explain why; the decision on withholding, redacting or disclosing under restrictions belongs to prosecutors and the court.

• Seed phrases and private keys: never disclosed. Provide the non-secret identifiers instead (receiving addresses, derivation path, master key fingerprint) and the transfer txids showing what was done with the funds.
• Investigator tradecraft: details of non-attributable research accounts and infrastructure (see the lesson Ethics, privacy and investigator safety).
• Third-party personal data: other customers in an exchange's records, victims' identity documents, unrelated addresses in a cluster export.
• Confidential sources and ongoing investigations: information that would reveal a source or tip off other subjects.
• Third-party confidential information: a vendor's internal methods or label data supplied under restrictions.

Record every redaction with its reason and who authorized it, so the court can review the decision later.

Tool and label provenance

Defense scrutiny increasingly targets the tools rather than the examiner. Prepare by keeping a provenance record for every finding that depends on a label or a tool's inference.

{
  "finding": "R-07: 4.25 BTC reached a deposit address of Service S",
  "raw_basis": ["F-031", "F-032", "F-040"],
  "link_type": "deterministic hops, then one heuristic link (change at F-032)",
  "label": {"entity": "Service S", "source": "provider response REQ-2026-77",
            "corroboration": "analytics tool label, snapshot 2026-10-12",
            "confidence": "high"},
  "tool": "tracing tool v12.3, method FIFO, hop limit 6",
  "reproduced_without_tool": true
}

The record shows which raw facts support the finding, which links are deterministic and which are heuristic, where the attribution comes from and how it was corroborated, and which tool and settings produced the trace. The last field matters most. When a commercial tool's clustering or labels are proprietary, the defense may argue it cannot test them. The strongest answer is to show that the finding can be reached from raw chain data and an independent attribution source, such as the provider's own records, with the tool serving as a convenience rather than the foundation. Where a finding depends on a label that cannot be independently checked, say so in the report and grade it accordingly (see the lesson Tooling, reproducibility and validation).

Challenges defense experts raise

The same lines of attack recur across cases and countries. The table lists them with the preparation that meets each; most of them aim at one layer of a finding, from the raw data up to the conclusion (see the lesson Digital evidence principles).

Preparing to answer

Before the report is signed, run your own adversarial review. A challenge register lists each key finding, its weakest link, the alternative explanations, what you did to test them, and the residual uncertainty. It forces the conclusions down to what the evidence supports, and it becomes your preparation for testimony (see the lesson Testimony and cross-examination).

Consider a draft sentence: "Address bc1q…7k3f belongs to the defendant." A defense expert will ask what supports it, and the honest answer is a common-input link plus a withdrawal from an exchange account the provider attributes to the defendant. The register leads to a better sentence: "Address bc1q…7k3f received a withdrawal from an exchange account that the provider's records attribute to the defendant (high confidence), and was co-spent with address bc1q…2m9d (heuristic link, moderate confidence)." The second version separates the facts, names their sources and grades each link. It is harder to attack because it claims only what can be defended.

When a challenge does land, concede it plainly and explain its effect on the conclusion. An expert who concedes a weak link and shows the conclusion still stands is more credible than one who defends every point.

Exam focus: the fair-trial basis of disclosure (ICCPR Article 14(3)(b), General Comment No. 32, equality of arms) and the examiner's role regardless of the legal regime; the categories of disclosable material, including notes, method records and label sources; unused material and why undermining results must be kept and listed; sensitive material (seed phrases, tradecraft, third-party data, sources) flagged by the examiner and decided by prosecutors or the court; provenance records and re-performance without the tool; the recurring defense challenges and the preparation for each; the challenge register; rewriting over-claims into graded, sourced statements; conceding limits.