Computer Forensics Licensing

[Juster1]

Heads up for the folks who are doing computer foreniscs investigations in the private sector. If you are a consultant doing outside investigations, there have been some rulings in some states that a Private Investigator's Licensed is required. The State of California has issued such a ruling as well as Delaware. I heard Texas and Nevada are the same.

Basically, the research I did shows that only a few states in the US, about 8, require no investigator licensing and leave private investigator licensing to the county or city governments.

The rest have VERY SIMILAR laws that basically say an investigation, is an investigation, is an investigation whether the evidence is on a computer or not. The issue is further being pursued by licensed Private Investigators and their organizations, who are finding that computer technicians/consultants are conducting civil and criminal investigations with the erroneous assumption that since the investigation involves computer evidence then no licensing is involved. Unfair business practices as well as criminal code violations are being alleged for not being licensed and regulated. I guess it's similar to doctors, RN's, contractors, attorneys, accountants, barbers, taxi drivers, engineers, counsellors, etc going after and ostracizing people who work in their fields while unlicensed.

Qualifying in court as a computer forensics expert witness in state or federal court will not satisfy the licensing requirement, and just shows that the computer technician has not been caught and now has court documentation to prove unlicensed investigation behavior, according to one PI organization, that has pulled extensive resumes showing numerous blatent violations of PI licensing laws.

In CA there have been examples of computer technicians (consultants) with lengthy resumes of civil and criminal computer forensics investigations being challenged and disqualified from further work on engagements.

I have heard of attorneys ambushing a computer forensics expert well into the case during discovery and testimony challenging the expert's illegal conduct of doing investigations for hire without licensing.

An unlicensed computer forensics investigator also cannot give the client a "Privileged" communication as allow by law and must give up all that was done for the client and all that the client has said.

I also found out a computer forensics investigator's bill does not have to be paid once the licensing issue is pursued along with prosecution in civil and criminal courts for doing unlicensed investigations

In conclusion, I guess one practicing in this field should check their local and state laws and see if they should be licensed.
_________________
Juster1
Computer Forensics Investigator
Modesto, CA 95357
(209)521-7379

[futureforensicist]

Hi Juster,

can you please provide more info on your research? Which states are still ok with "unlicensed" investigations?

Also, does anyone know of federal or even international regulations in this space? can anyone pick up and create a computer forensic investigation company or are those days gone?

Thanks.

[Juster1]

I know you want all the states, and their information about this issue, but that is broad request from just a forum user. I think there are 8 states that require no such licensing and leave the licensing up to the local and county governments.

Consider this view that kind of summarizes the licensing issue:

I will try to keep this as humorous as possible to defuse some of the passions regarding the issue of states regulating or not regulating the computer forensics examiner.

Let's imagine two identically qualified computer forensics investigators in the State of Delaware.

One is fully licensed by the state

One is not licensed at all

But they both have impeccable resumes. And let's give the unlicensed computer forensics investigator the edge and make him BETTER LOOKING with a BETTER CHOICE OF TIES than the licensed one.

Who does the client pick? Who does the attorney pick? And what if the attorney or client are fully briefed on this licensing issue.....? (any ideas on who would be briefing them? )

Who gets the job?......it's an easy decision since clients and attorneys WANT a prescreened licensed computer forensics investigator, licensed by the state, who will not have to weather any legal storms about hunting for computer evidence without a license. The client and attorney know up-front that the licensed person has a clear criminal record with fingerprints and photos on file. They know that state law requires honest and good faith dealings, with even some code-based privacy rules to keep and maintain client secrets. They can ask for government certified Photo ID and fictitious business license cards and documents. They know IRS/TAX issues will not be a problem, since that is regulated too. In addition there are some minimum competency requirements and tests that were met in addtion to the computer forensics qualifications. Client and attorney know that a professional with a state license cannot shield his personal liability with incorportion or an LLC. License violations are always a "cause of action" to protect the client and attorney. There just are no negatives for the client and attorney to hire the licensed professional

It's a safer, common sense "legal" decision to hire the licensed professional. If you want to increase your computer forensics marketability and compete with the licensed professional then try to get licensed. The computer forensics licensed professional is growing in numbers because it makes good business sense to have that license to compete successfully in this growing field of computer forensics wizards and sharks.

[AlanOne]

[Juster1]

I don't think this is the issue. I think the issue is: should a "computer forensic examiner" be lumped in with the "private investigator" role.

They CFE's are not being lumped in with the private investigator role, they are being lumped into the legal definition of an investigation for hire

I, being a board-certified CF examiner would not have a problem with a state wanting to "license" me as an expert, but I do not perform the same tasks as a private investigator.

What government board is certifying you as a CF examiner? Were you fingerprinted, IDentified, phtographed, background investigated, ficticious business name docmented? Are you bonded and insured? Can you legaly invoke PI-Client confidentiality, by quoting the applicable law. What code of law, federal-state-local certified you? What were your minimum work experience hours required for that? Are you allowed to have employees?

What are your code of conduct sections in the law? What are your billing and reporting requirement sections in the law.

I feel private investigators are more “intrusive” in personal lives compared to a CF examiner. We do not conduct surveillance, or follow people at the request of a client.

I don't think you have really looked at the licensed PI of the 21st Century, or you would not lump the PI into people followers. PI's being instrusive into personal lives....where are you getting this information from? The modern PI is a highly technical computer using professional, dealing with computer-based evidence on a weekly basis. CF examiner's are not intrusive.??....what about those black-bag operations where CFE's sneak onto business property during off-hours, with owner/client permission, and secretly copy employee computers leaving no trace in order to get employees fired or prosecuted for misconduct after investigating their PC data. How about eavesdropping software, spyware, and keyloggers, recording every keystroke of a person, under investigation.

Most times, data is brought to us and we examinine and translate our findings into something most people can understand. This push to consolidate people that present evidence and provide expert witness testimony to a court to obtain a private investigator license will not fly.

It will not fly? It is law in several states. YYou are talking as if this is something new. Your computer forensics data evidence searching is a "tranlation?" What language are you talking about?

You are providing, obtaining, and securing "information" a legal term in the investigation definition code sections of all the licensing states. "Information" is a legal term legally synonmous with another legal term "data." States laws have many computer words legally defined now, and "data" is one of them. "Data" is defined as "information" and the two words are interchangeable.....I have now told you one of the legal steps in removing an unlicensed CF examiner from a case, at the discovery and deposition level. Those two word concepts are easily presented, as black and white definitions of what a CF examiner does......he or she "provides, obtains, and secures "data" [information]. If you are challenged by an expert client or attorney one of the first things he is going to ask you under oath is....."What is data?" If you claim to be an expert, and you will, on your submitted resume/CV, then you will be forced to answer, and it will go downhill from there....if you are unlicensed in a state that requires licensing. You will be involved in a career changing event.

I do not see people like doctors, engineers, etc. running out to apply for a PI license. They would push for exclusion, as are CF experts. We are simply pushing exclusion from these requirements.

Doctors, engineers, etc already have licensing....once again State Laws and supporting case decisions say that those licensed professionals, investigating within the course and scope of their professional licensing do not have to "double-up" on licensing and get a PI license. You were probably going to say that a Licensed Doctor (MD) has to have a PI license to diagnose or investigated cause of illness or injury....where are you getting this information? Doctors, engineers, and others have never pushed for exclusions....licensed attorneys working their cases are also exempted.

I think you are just being onery and arguing for the sake of arguing. I tried a long time, with others in my state, to get out of the licensing requirement. We tried everything. We researched it all. We hired legal advice. We gave up and got licensed.

We have seen the unlicensed CF examiner removed from cases using a simple step-wise process, that even taught me a few new things about why one DOES NOT want to field unlicensed professional in any civil or criminal case.

Hope this advice will keep you out of "legal trouble." Of special note, if you have qualified in court before, that just means you have not been caught yet....attorneys are catching on.....it's just a matter of time.

[farmerdude]

Obtaining and retaining a PI license in the state of Georgia;

1) requires no education in computer forensics

2) requires no experience in computer forensics

3) requires no certification in computer forensics

4) requires no knowledge in computer forensics


So for any PI in the state of Georgia who feels you need to have a PI license to be a forensic practitioner ....

Anyways, I would imagine most every state would fall under the points outlined above. It's very simple, very basic, and very clear. Someone could work both as a PI and a forensic practitioner, or that same person may work as only one and not the other. Because you do one doesn't mean you do the other. Anytime you work as a PI, have the license. Whenever you do not, do not.

If you're feeling there should be regulation, certification, etc. for being a forensic practitioner, then go for it. But there's nothing out there now that will fit this discipline. Don't put a PI license to it, or a CPA, or a J.D., etc.

Greed is driving an initiative in my state of Georgia where the two PI associations are attempting to move the current misdemeaner to a felony ... but yet, NO ONE has indicated *why* a PI license should make one a forensic examiner/practitioner/analyst. Once again, there's nothing in obtaining a PI license that has anything directly to do with the tasks of data forensics (acquisition, analysis, and reporting). No knowledge of file systems, tools, operating systems, timestamps, etc. Nada.

We'll see if the bill gets signed in July or not. I would advise and hope that all persons working in data forensics start getting proactive and working together .... why have a PI license for every state you work in .... especially when the four points listed above hold true in every state requiring a PI license. NOTHING TO DO WITH DATA FORENSICS ! ! ! Can a PI do computer forensics? IF, and only if, they have the skills, knowledge and experience - absolutely. But having a PI license doesn't entitle you to hang your shingle on being a forensic guru.

regards,

farmerdude

[deckard]

Farmerdude;

I agree, as of yet in NC there isn't a move to make us PI's.

But it does point out something I have been attempting to make know to the few computer forensic examiners in m state; that is WE NEED TO START ASSOCIATING as well. There is political power in these PI associations. They are entrenched not only with politicians but they have weight with the state PI board and other state departmnets. Nothing wrong with that at all, they are simply protecting their interests and business. We simply need to do this as well. I can't imagine requiring every Dr. or private forensic lab that does physical forensics to be licensed as a PI.

We must get together and head this off because right now we as a group have no political or legal power.

[infosecwriter]

[farmerdude]

HB1259 was vetoed a week ago. Good news. However, I urge all those working in data forensics to visit: forensiclicensing.com

This is an important issue affecting everyone who works in data forensics at any stage of the process.

regards,

farmerdude

[Juster1]

I have read with interest the Georgia lobbying efforts and the unclear reporting on this issue by the unlicensed Computer Forensics Investigator community. I am amazed at the energy expended on this. The “no victory” is that Georgia Law stays the same, and unlicensed computer forensics investigators will be challenged by opposition attorneys and clients for committing a misdemeanor and not a felony violation of being unregulated, just as it was before.

I can’t see the victory here. No one has managed to make unlicensed computer forensics investigations legal….it just made the issue more popular.

As I have said for years…..the unlicensed computer forensics investigative community has been their own worse enemies regarding standards, regulation, leadership, and certification. This lobbying effort is raising awareness in the legal community about the unlicensed computer forensics investigator. The legal challenges to remove the unlicensed computer forensics investigator from civil and criminal cases will be increasing, and government will be looking more often at this unlicensed profession.

The “license/regulation free” ride will be coming to an end more rapidly now in Georgia thanks to this lobbying effort. There never was a “license free ride.” Unlicensed computer forensic investigators were just not getting caught!! Now, they are in the news as “unlicensed” folks wanting special treatment.

I don’t think the client or attorney who wants to win the civil or criminal case is going to allow the unlicensed computer forensic investigator to continue on a case, once the issue is discovered.

Remember that states “compare” notes on these kinds of issues, and there are states where this issue is resolved and clarified because of the unusual lobbying effort that has a common theme: “Unlicensed Computer Forensics Investigators should not have to pass criminal background checks, and other public protection regulations, because we are special, because we are computer technicians.”

I am pleased that the unlicensed computer forensics investigators who are yelling the loudest are at least agreeing to regulation of some sort in Georgia, and are willing to work with their legislators, but in the meantime…..it looks like unlicensed computer forensics investigations in Georgia remains illegal, and those Georgia-based unlicensed computer forensic investigators who professionally venture into a state that requires licensing will again have a difficult time when challenged.

I ask the Unlicensed Computer Forensics Investigators…..what took you so long to address this issue, and why NOW? Where were you when the professional licensing laws were being passed, amended, added to, and debated? How many of you can pass a criminal background check? How many licensed computer forensics investigators are there? And why did they obtain their state licensing, and you did not? These could be important questions a legislator may ask?

[gralfus]

With this fresh veto, I'd quickly follow up with the governor and legislators to lobby for a change in the existing law. Get the professional forensics organizations that you belong to involved in drafting a better licensing methodology that fits the computer forensics field. This will find its way into each state eventually.

[scottamoulton]

Even though the bill was vetoed it seems that we are still having issues convincing people we don't belong under the PI's. Is there a board anywhere in any state the is for computer forensics that is not under the PI? Anyone know?
_________________
Scott A. Moulton
Forensic Strategy Services, LLC.
Phone -770-926-5588

[Juster1]

Computer Forensics: Science or Fad?

By Marc Rogers

The private sectors' push to jump on the computer forensics bandwagon threatens to turn an evolving scientific discipline into a mere fad; a lack of standards and training can result in bad case law, guilty parties escaping prosecution and innocent parties being "railroaded" into incarceration.

Historically, computer forensics was restricted to law enforcement, the military or other government agencies. There were limited tools, common training and a very limited number of forensic investigators. Concepts such as the chain of custody and rules of evidence were built into standard law enforcement procedures. Today, we no longer have a restricted pool of commonly trained investigators; anyone can hang out a shingle claiming to be a computer forensics investigator.

Currently there is no recognized professional body over-seeing any designations, no nationally or internationally recognized standards, curricula, common body of knowledge or training. The state of computer forensics is proprietary and fragmented. Vendors are clouding the issue by claiming that computer forensics is merely a piece of software as opposed to a formalized methodology.

[scottamoulton]

[farmerdude]

"The “no victory” is that Georgia Law stays the same, and unlicensed computer forensics investigators will be challenged by opposition attorneys and clients for committing a misdemeanor and not a felony violation of being unregulated, just as it was before."

For the LAST time, there is NO such thing as a LICENSED COMPUTER FORENSICS INVESTIGATOR.

Data forensics has NO licensing, period.

Should there be a license? Perhaps.

Is there currently a license for Data Forensics? No.

The current law can be interpreted in many lights, and it's up for those involved to interpret it. It is an old law, long before Data Forensics was mainstream and spelled with dollar signs (foren$ic$).



"I can’t see the victory here."

Why not? The proposed changes were defeated. You can't change the current law when attempting to defeat the proposed changes. The changes were defeated, that was step one. Step two is to change the current wording, and we are working together to do this as we are also working together to come up with a 'standard'.


"The “license/regulation free” ride will be coming to an end more rapidly now in Georgia thanks to this lobbying effort."

There was no free ride, period. When you speak of awareness ... that is good, for all involved. We have a voice and we're making it heard. Senate Bill 3 trumps all, and that falls back to the Daubert Principle in Georgia. So those working as data forensics practitioners can continue to do so with NO PI license required.


ONCE AGAIN, there is no license for data forensics, anywhere in the U.S.A..


"it looks like unlicensed computer forensics investigations in Georgia remains illegal, and those Georgia-based unlicensed computer forensic investigators who professionally venture into a state that requires licensing will again have a difficult time when challenged."

WRONG again. It isn't illegal, under Senate Bill 3. Please get your facts straight before stepping up to the podium.


"I ask the Unlicensed Computer Forensics Investigators…..what took you so long to address this issue, and why NOW? "

Because no one ever had any issues prior, and because no one thought interpretation of the law being interpreted would be done in the way it was tried for one case. So, both sides of the fence, in all the years prior, NEVER brought this up as an issue. Why? Because it was a non-issue.

We're addressing them now because we realize the PI community within Georgia are trying to police us, when in fact they police themselves and have little to no understanding of the work that we do (these are their words and you can watch the video where they say this).

So, since they don't understand what it is that we do, how can they police us?


"Where were you when the professional licensing laws were being passed, amended, added to, and debated? "

Back in 1973 (IIRC, that was the year it was put on the books) I was just born, so either I was still inside my ma when it was put on the books or just making my way out into the world. That's where I was. Where were you in 1973?


"How many of you can pass a criminal background check?"

I don't know, how many? Is this a joke? lol I can, and can only speak for myself here with any certainty. However, I know many of my colleagues well and presume they can pass as well. So your smoke screen of we're all criminals is really lame, in both forums where you've posted this.


"How many licensed computer forensics investigators are there?"

Okay, what is a licensed computer forensics investigator? Because I must be lame ... as I didn't know one existed! Are you referring to a licensed private investigator who works in data forensics?


"And why did they obtain their state licensing, and you did not?'

Again, presuming you're speaking about PIs ... they obtained their PI license I guess because that is the arena they work within. I bet some of them have even ventured into data forensics recently because of the money involved.


And to the MARC ROGERS article:

"The private sectors' push to jump on the computer forensics bandwagon threatens to turn an evolving scientific discipline into a mere fad"

Again, if I could only be as intelligent as you .... I mean, where do you come up with this stuff? Do you truly believe that the tools, methodologies, and resources used in Data Forensics have come only from the LE community and nowhere else? Okay, take away Expert Witness. Take away EnCase. Take away SMART for Linux. Don't forget to take away FTK and PRTK. Oh, and all of Paraben's tools. And THE FARMER'S BOOT CD, too. So now we're left with? iLook.

If we were to throw out stupid comments as quick as you have we'd be saying "And let's look at all the cops who've been forced into forensics by their department purchasing a copy of EnCase and handing them all the casework." Yeah, that's good discipline.


"Historically, computer forensics was restricted to law enforcement, the military or other government agencies."

WHERE do you come up with this? Obviously untrue, because I know Andrew developed EW back in the day and was never in LE. That's just one supporting example. Many to come if challenged.

It was never restricted to LE, military, or government. Only in your world.


"Today, we no longer have a restricted pool of commonly trained investigators; anyone can hang out a shingle claiming to be a computer forensics investigator."

Now, we AGREE Yes, other than I don't use "investigator" as I prefer practitioner. But aside from that one word, we do agree. ANYONE, including a licensed PI, can claim to be a computer forensics person.

A PI license doesn't guarantee you any knowledge, experience, certification, or education in data forensics - in any state where a PI license is required.

So tell me, again, how a PI license should be required for data forensics? When in the process of obtaining a PI license you don't have to;
- understand file systems
- understand operating systems
- understand timestamps
- understand copying, moving, removing of files
- or any specifics to data forensics


This thread goes nowhere. The PIs line up on one side, everybody else on the other. It doesn't take much to conclude why PIs want a PI license to be the requirement for working in Data Forensics.

What is important is the fact that nothing in obtaining or retaining a PI license guarantees anything pertinent to Data Forensics other than the most basic - the chain of custody.

I ask each of you, what is more difficult to learn and understand: How to document the scene and properly acquire data while maintaining chain of custody? -OR- Analyzing the acquired data.

Hmm...

farmerdude