Join Us!

Computer Forensics ...
 
Notifications
Clear all

Computer Forensics now have to be Private Investigators!!!  

Page 1 / 6
  RSS
scottamoulton
(@scottamoulton)
Junior Member

.
.
.
.

Quote
Posted : 09/04/2006 12:54 am
MindSmith
(@mindsmith)
Active Member

Hi,

I work in several countries in one of which ; PI's are illegal under the very tough privacy laws. In such cases I work with a legal team providing them with 'support' and research assistance, there are many 'grey areas' i have to deal with on a daily basis as a forensics investigator; perhaps the best thing to do is to get the PI license and give your self a head start in comparison to your competitors?

Perhaps you should get legal counsel - as this will affect your livelihood & possibly even result in a charge against you. contact your Governor & launch an appeal via legal aid if possible.

I guess this is the trend of things to come.

good luck, and let me know if you find any good PI courses available online.

Take a look at www.eyespymag.com - they usually have such adverts, etc.

Regards,

ReplyQuote
Posted : 09/04/2006 12:40 pm
gmarshall139
(@gmarshall139)
Active Member

I do work primarily in two states, Nevada and Virginia. Nevada requires it, while Virginia (currently) does not.

I would like to see where this is coming from. Apparently it's not a federal law. Do you have any links?

This may bring us back to something my associate (and experienced Private Investigator) Alan Kaplan has been pushing for some time. A federal Private Investigator's license.

ReplyQuote
Posted : 09/04/2006 6:05 pm
armresl
(@armresl)
Community Legend

You can work for an attorney as their investigator, without a PI license. (In Indiana)

ReplyQuote
Posted : 10/04/2006 2:49 am
akaplan0qw9
(@akaplan0qw9)
Member
Dear Scott,

1. While I might well hire you myself if you hold yourself out to be a Computer Expert, or a Computer Forensics Expert who can provide expert testimony on such matters in court, I would not hire anybody who equates Computer Forensics with Investigation.
1.1. As I see it, Computer Forensics is a very important subset of investigation, but a subset, nevertheless. Although not as well known or so widely used, Forensic Odontologists give expert testimony, and in many cases provide a significant input, however they are not investigators and their work is at best, only a piece of the puzzle.
1.2. Although my partner, Greg Marshall and I are both totally committed to computer forensics, we never claim to be able to solve the investigative problem using only computer forensics. It is my belief that while a CF examination might reveal critical evidence, it would be unprofessional for me to try to sell it as a snake oil cure-all for solving every investigative problem that comes down the pike.
1.2.1. Lets say that during the course of a computer forensic examination you come up with a phone number that you think may be significant, do you stop at that point and try to convince your client that you have conducted an investigation, or do you do what the State of Georgia will soon prohibit you from doing – that is, follow through, both off and on the hard drive image to determine that the number belongs to the owner of a feed store who happens to deal in the blasting caps you are looking for? Your approach seems to be the former, not because you really believe it acceptable to produce half assed work, but because you have house payments to make and see that as a possible quick fix.
1.3. First of all, if you think about it, you’ll see that the state of Georgia is right in forcing the licensing issue. Second, you’ll see that it will take more time and legal expenses than you want to spend to try to get them to change their minds. As the lead plaintiff in an unsuccessful law suit against the Nevada DMV, I speak from experience, Third, I don’t see why, when the new law goes into effect, you can’t be doing the job the way it should be done, fully sanctioned by the state and on your way to curing the experience deficiency that has you so upset. See paragraph 2.5.3 for several approaches that you should consider before wasting time and money doing legal research.
1.4. In additional to the obvious concern for experience and professional competence there is the less talked about but more important considerations of character, honesty and integrity. Those are major factors in the granting or denying of a PI license. Although all investigators in all sectors occupy “a position of trust”, only PIs do it without the oversight of supervisors. Just as Investigation is "a position of trust", so to is "Computer Forensics" a subset of "investigation", "a position of trust".
1.5. Now, I realize that you may disagree with my basic premise that Computer Forensics is a subset of investigations. If so, just look at any case you have worked on and see if those paragraphs dealing with computer forensics in say, an affidavit or civil complaint will stand by themselves if only accompanied by the boiler plate.
1.6. You don’t get very specific, but my understanding is that your quarrel with the State of Georgia is that you claim to conduct investigations using computer forensics or that the use of computer forensics is a part of your practice and you do other things such as conduct interviews. Either way, that would require a PI license here in Nevada and in most other states as well.
2. Now, every living animal does some form of investigation, whether it is the predator sniffing for his prey, or the prey listening silently for the coast to be clear – we all look for intelligence and use that intelligence as a basis of future decisions. It is a part of life. If we make a mistake in an investigation, we stand to pay a price. If we conduct our own investigation, we have only ourselves to blame for errors.
2.1. If somebody holds themselves out as having expertise in investigation, the user of the intelligence gathered has a right to expect competence and integrity.
2.2. Businesses and law firms often hire in-house investigators to do those jobs. Like do-it-yourselfers, companies that hire in-house investigators must bear the responsibility for any problem encountered. In general, state governments do not require licenses for any investigator who works exclusively for a single entity.
2.3. Communities and governments almost always find the need for investigators. Those investigative assignments are for the most part filled by peace officers who are paid by the government and supervised through the political and judicial systems.
2.4. Lastly we have private investigators who offer services to all segments of the populous. The question now becomes one of whether the often unwitting public should somehow be protected from the charlatans and criminals who might easily take advantage of their position of trust.
2.5. Here in Nevada the answer is that all who engage in the practice of investigation for a fee or hold themselves out to provide investigative services for a fee are with the exception of those mentioned in 2.2 above, required to obtain a state private investigator’s license.
2.5.1. In Colorado you can find a completely opposite position. Colorado has no licensing laws for investigators. Anyone, including convicted felons can hang out a shingle or put an ad in the phonebook, claiming to be a private investigator. The same is true in Idaho and Mississippi. A few states like Alaska and Missouri have no state licensing but do have PI licensing at city and county levels.
2.5.2. The vast majority of states have licensing laws administered by the State Police, State Attorneys General or State Consumer Affairs Office. As you have noted, there is virtually no reciprocity between the various states because of differences in licensing requirements and insurance requirements. However, there are generally “hot pursuit” exceptions that can be made on a one time basis by the regulating authority. Many PIs are licensed in several states for that purpose.
2.5.3. Here are a few suggestions that you might want to consider before you make this into “a Federal Case”.
2.5.3.1. Most states permit PI licensees to hire any number of unlicensed employees. If you were hired as a bona fide employee of a PI licensee, you could get the experience and credit you need – without having had the LE background.
2.5.3.2. I don’t know how many years of investigative experience are required by the State of Georgia before you can get your own license. Here it is 5 years (10,000 hours) in California it is only 3 years (6000 hours). Because you represent a potentially valuable talent, you may have an easy time making such an arrangement with a PI licensed in GA – particularly if you can bring investigative work to the table.
2.5.3.3. I don’t know how close you are to Florida, but Florida has two levels of licensing. One may only require a year or two of experience. I’m not sure.
2.5.3.4. Most States, if not all, permit licensure of non-residents.
2.5.3.5. I can’t see why anyone with your background could not put two or three of these suggestions to work and be up and running weeks before the new law goes into effect. If however there is some derog in your background, get yourself some skis and move to Colorado<G>.
2.5.3.6. As Greg noted, I have been an advocate of Federal Licensing of PIs. The reaction to that proposal has been almost uniformly negative from both the regulated and the regulators, in spite of the fact that the US Congress and The Federal Trade Commission, as opposed to the states, currently regulates the flow of much of information used by investigators in all sectors as well as the permissibility of conducting certain workplace investigations. Federal PI Licensing is nothing that exists today, and is not likely to exist in the foreseeable future.
3. Are there risks associated with a failure to license investigators?
3.1. One has only to look at the actual practice of Private Investigation to appreciate that fact aside from giving the incompetent and the conn artist a chance to rip off the public, the work of an investigator provides an excellent cover for major criminal activity or even espionage activity.
3.2. Take the case of John Walker, the Virginia Licensed PI who headed up the “Navy Spy Ring” for the Soviets 20 years ago. Were it not for a disgruntled ex-wife who dropped a dime on him, he might still be on the loose. His cover as a PI allowed him to conduct all sorts of clandestine missions for the Soviets. Things like spotting and recruiting of potential sources, reconnaissance sorties, and overseas contacts are easily covered and explained by the routine work of a PI. After Walker was arrested, I learned that a sensitive source I had used had also been used by Walker and numerous FBI Agents.
3.3. I have little doubt that to most folks on here the name Kevin Mitnick is very familiar. Some may even have investigated or apprehended him. Mitnck’s mother and grandmother lived here in Las Vegas and so a Federal Judge agreed to allow him to serve one of his probations here.
3.3.1. One day, quite unexpectedly, he phoned me and announced that he wanted to go to work for me! Recalling that Mitnick was considered so omnipotent with his phone and computer skills that the Los Angeles County Sheriff, reportedly refused to let him call his lawyer for fear he would do something on the phone that would shut down North America, I had to at least try to find out if I could somehow pick his (evil) brain.
3.3.2. It was clear that because he was a convicted felon, the state licensing laws prohibited me bringing him on board as an employee. But I speculated that I might use him as guest lecturer. I ran the idea past his Parole and Probation Officer who after checking with his supervisor, came back with the expected, “Hell No!” What nobody knew at that time was that he was continuing to do his dirty work on a mini computer at an accounting firm where he was authorized to work. Of course, in addition to his computer skills, Mitnick was reportedly a brilliant “Social Engineer” who could charm the birds out of the trees. I believe that when he approached me he had targeted the cover that a PI license would give him. I have no idea what he planned to do, once inside.
3.3.3. There is little doubt in my mind that although “investigation” attracts many of “us good guys” there are plenty of bad guys out there that must be screened out. The illustrations I have set forth below appear to set a profile that the bad guys are – guys with LE backgrounds. The reason for this is simple. The vast majority of PI applicants come from that LE background. In an earlier life I carried a badge and credentials and my partner Greg Marshall, who carries a badge and credentials today, is not only a paragon of professional competence, but more importantly a man of great integrity. With the caveat that I don’t mean to disparage those with a LE background, I mean to illustrate the need to license and to thoroughly investigate all who accept this position of trust – even me, even Greg, even our esteemed colleagues with a LE background, even those like yourself without one, and even you.
3.3.3.1. Several years ago, I worked under contract to the Nevada Attorney General who chairs the PI Licensing Board. A law was enacted making it mandatory that Polygraph Examiners be licensed. We had 13 operating in the state without licenses. All 13 applied. As I recall, 3 or 4 were denied because of a history involving criminal and unethical behavior. One of those I recommended be denied was a former Lt. assigned to the office of the local District Attorney. Although he was never prosecuted, there was credible evidence of extortion and of his “making critical evidence disappear before trial”. Upon my recommendation, he was denied a license, and was later, according to a Homicide Detective friend, on the street shopping for someone to turn me into a hood ornament.
3.3.3.2. Another PI applicant was an active duty Lt. on the Las Vegas Metropolitan Police Department. This guy wanted a PI license prior to retirement. The investigation disclosed him to be a thoroughly corrupt cop who though the good offices of an even more corrupt former Sheriff, was able to get away with things like burning an undercover narcotics officer. The reform Under-Sheriff told me, "We want to get rid of him, but I can't recommend him for a position of trust, with a PI License – we've got a duty to protect the public from guys like him!"
3.3.4. In recent years the NV Attorney General hired their own full time peace officer to conduct those background investigations. You may have heard of two former NYPD Detectives Louis Eppolito and Steve Carracappa. On 04/06/06 the following news release appeared after the conviction of both guys in a Federal Court in NY

The former detectives were found guilty on all 70 racketeering counts they faced, including murder for hire, conspiracy, witness tampering, and bribery and drug charges.

3.4 What the articles failed to mention was that one of the two, Stephen Caracappa, was licensed as a PI here in NV. After retiring from the NYPD, this guy moved to Nevada and applied for, and received a PI license. This guy slipped through the cracks because the FBI, in order to protect an undercover informant, did not tell the investigator for the Nevada State Attorney General what they had going on Caracappa. Among other things, Caracappa and his partner were accused of not only “arresting” and delivering people to the LCN for assassination, but occasionally saving the trip and whacking the target on their own. I haven’t taken the time to locate or read the transcript, but it appears that whatever they were convicted of wasn’t for parking in a no parking zone.
3.5 I met Caracappa at a local PI Association meeting one night, before all this stuff came to light. He seemed like a nice guy. A perfect gentleman. Certainly not the guy that would come out of central casting as a Mafia hit man. We chatted for a while and I heard a vague reference to his un-named NY connections that could bring "us" plenty of business here in Las Vegas. We exchanged business cards.
3.6 Las Vegas is a rumor town and most of the time those rumors are true. A few days after that meeting, I picked up a street rumor about Caracappa that turned out to be pretty much on target. Naturally, I broke off all contact. I don’t know what kind of business the guy had in mind or why he wanted a PI license here.
4 Allow me to summarize in 4 sentences.
4.1 Computer Forensics is an investigative technique or tactic or methodology, it is not a substitute for investigation. Thirty years ago dumpster diving served the same purpose and still does in many cases. It is a disservice to the end user of the intelligence gathered, to represent otherwise or to try to use truncated intelligence, without incorporating other appropriate sources and methods.
4.2 Those who hold themselves out to conduct investigations in the private sector for a fee are private investigators and should be licensed as such. Those who work exclusively for a single employer (One W-2, No 1099s) are generally exempt from the licensing as a PI.
4.3 Licensing of PIs properly includes a rigorous background investigation. The nature of the job demands that.
4.4 Most states will allow you to work as an unlicensed employee of a Licensed PI. That procedure would permit you to acquire the requisite investigative experience that you don’t currently have.

Good Luck!

Al

ReplyQuote
Posted : 10/04/2006 7:18 pm
OldDawg
(@olddawg)
Active Member

Very well said, Al.

I wonder though, why wouldn't the free market accomplish the same goal of weeding out unprofessional and unproductive people without the need for yet even more government intervention?

I tend to want less government oversight in most things since they seldom do it right. Take NY, NJ, IL and CA for examples. Those states have a morass of regulations which accomplish not much more than costing taxpayers huge sums of money.

Just wondering…

ReplyQuote
Posted : 12/04/2006 11:46 pm
scottamoulton
(@scottamoulton)
Junior Member

.
.
.
.

ReplyQuote
Posted : 13/04/2006 2:07 am
akaplan0qw9
(@akaplan0qw9)
Member

Dear OldDawg,

The free market argument only works in an active market. Most people never need a PI, of those that do, few can afford it of those that can afford it, it is often a once in a lifetime do or die deal. The market it too thin in most cases to allow the next client to really make a conscious decision as a buyer.

We have been investigators 42 years! 28 of that has been as licensed PIs. Does that mean we were/are more competant than some guy that lasted 28 months before going belly up? I don't think so. I know plenty of guys who appeared to be very competant. Remember it is a business and I believe the failure factor is not necessarily tied to the competance of the practitioner. It is more likely tied to business errors or just plain bad luck. There is a tremendous amount of luck involved. Even when you run a spectacular case, the happy client may never need the services of a PI again. By the same token when we screw up (and the guy who claims not to screw up on ocassion is either a liar or so ignorant that he can't recognize a screw up) we may end up with an unhappy client. But are there any consequences in the marketplace? Not normally, who knows and who cares aside from a guy who is sorry he ever hired a guy who failed him? Right now I'm about to return a $500 flat fee retainer to a PI in another state. I guaranteed to find the SUBJECT in 30 days or give him a full refund. Two weeks have gone by and I now see this as being a big funnel I could pour money into for ever and still not succeed. So I will give the guy back his money and will probably get a lot of money back from he and others in the profession who like the odds.

We don't always screw up. One can't help but be in this business and get an A+ once in a while. But if the client is not in a position to direct more business to you – performance in the professional marketplace has no effect.

PS With that OldDawg handle you might be well advised to stay far away from Las Vegas. We have a pure Black Male Miniature Schnauzer. My daughter has a pure white Female Miniature Schnauzer. Both dogs have championship blood lines. The game plan is to breed (Zebra Stripped Schnauzers?) The nuptuals are months away, but with our dog sporting a muscle shirt reading "Bitches Love Me" A guy with a handle "OldDawg" comes to town at his own risk!

ReplyQuote
Posted : 13/04/2006 9:41 am
farmerdude
(@farmerdude)
Active Member

Data Forensics and a Private Investigator License do *not* go hand in hand. It's irritating to hear someone say this. Of course a state will be happy to pass a bill requiring those practicing Data Forensics to obtain a PI license - it is revenue for the state.

What you need to do is find out *who* is pushing, in your state, for this type of law. I will bet you it is a PI. )

Now, depending upon your role in the forensic process, a PI license may be required. For example, if you're doing domestic cases, husband and wife divorcing, etc., then you may absolutely need to be licensed (taps, etc.).

However, if you're a company, an agency, or an attorney hires you to analyze the acquired data, why should you be required to have a PI license? You are analyzing data and reporting your findings.

The irksome part of this for me it's like saying "You need a PI license to do Data Forensics. So any PI is qualified to Data Forensics, while anyone not holding their PI license is not."

Now, it doesn't take long to see how stupid that is. Because you hold a PI license doesn't mean you're experienced and have the knowledge to do Data Forensics. But because you don't have a PI license but have spent years performing Data Forensics, writing software for Data Forensics, teaching training courses for Data Forensics … nah, sorry, you can't do it! No soup for you!

Forensic practitioners *need* to get active and proactive regarding this topic, fast, and speak up and get involved. Would a base certification for all practitioners be a good idea? Perhaps. But should that requirement be a PI license? No.
regards,

farmerdude

ReplyQuote
Posted : 13/04/2006 8:06 pm
armresl
(@armresl)
Community Legend

Something that I haven't seen mentioned here is being bonded and insured. In each state there are not very many people that will write these surety bonds and they require a financial statement as well as lots of personal information.

ReplyQuote
Posted : 13/04/2006 8:21 pm
s_matthu
(@s_matthu)
New Member

farmerdude,

I completely agree with you! Under the new law, as I understand it, CPA doing forensics accounting, a civil engineer doing structural forensics, or in my case, an IT consultant doing computer forensics would all need to of a Private Investigator license.

I understand the need for professional requirements, but in my opinion, making someone get a license in a completely unrelated field is stretching it just a little bit.

If your interpretation is the same as many who have already read this legislation, please consider sending a response to the governor via the links below.

http//www.gov.state.ga.us/contact_dom.shtml

Sincerely,

ReplyQuote
Posted : 13/04/2006 8:23 pm
akaplan0qw9
(@akaplan0qw9)
Member

It is an interesting, and obviousy contraversial subject.

I would ask those who hold themselves out to be able to accomplish 100% of an investigation using CF, to prove their point by posting a successful civil complaint and describing how using ONLY that technique satisfied the investigative objectives.

Al

ReplyQuote
Posted : 14/04/2006 3:44 am
scottamoulton
(@scottamoulton)
Junior Member

.
.
.
.

ReplyQuote
Posted : 14/04/2006 7:33 am
akaplan0qw9
(@akaplan0qw9)
Member

But I am not sure of what other qualification you think need to be satisfied. I think it is really up to the attorney and what he/she thinks the needs are. If he need s the computer looked at, that be me, if he needs person followed, that be PI.

Scott,

Sometimes this typed media is difficult to understand. Sometimes it is a difference in overall investigative doctrine and philosophy. Fixing the former is not too difficult. Fixing the latter can be impossible. Accordingly, we may never agree, except to disagree. However, let me explain my thinking on this.

People do not investigate to generate revenue for investigators. They investigate to gain the intelligence they see as needed prior to deciding on a course of action. We see our mission as obtaining that intelligence. We refer to that target as the “investigative objective”.

The client or counsel lays out the investigative objective. That is spelled out clearly. If necessary, we help to clarify it, so we have a meeting of the minds.

We, not the client or counsel, then decide on the methodology, or leads or tactics that we believe to be best suited to accomplish the investigative objective. (This is one place where I believe we disagree.)

Now, as a practical matter, in private practice, this machine stops running when we run out of money. From my perspective that money is one of the tools in my toolbox. A budget is my asset to expend as I see fit. Time is another asset. If I don’t see enough time or money in the proposed assignment we decline to accept it. I demand absolute control over those expenditures and our contracts make that clear.

As I said, we leave very little up to the attorney when it comes to the leads we conduct or the tactics we employ in an investigation. We are the professionals and accept full responsibility (as well as full authority) for reaching the investigative objectives.

That does not mean that we summarily reject the leads often so freely offered by lawyers or other clients or that we necessarily disagree with the guys who are paying the bills. However if we do disagree as to approach, we evaluate the probable impact of such an approach and decide whether to go with the flow because the damage is minimal, or withdraw from the investigation. We have done both. We all know that you can give a client good advice, but you can’t always get him to take it.

Now, you are not going to get me to complain about the cost effectiveness or efficacy of CF. I am indeed a true believer.

However, CF is not the only tool in my toolbox. If a client asks for a CF Examination, I will determine from him, what he is trying to accomplish. (His investigative objective.) He may well get what he asks for, or he may get something completely different, as for example was our decision to conduct a crime scene investigation and interviews of employees on a $500,000 vandalism case we undertook yesterday.

As you can see, it would have been illegal for me to run those leads without a PI license. For me to try to stick to computer forensics (If CF did not require a PI license) would have been fraudulent and reprehensible – and in my opinion, a lot worse than trying to do a proper job without a license.

The example set forth above, involved two pieces of heavy equipment deliberately crashed together in the dead of night an isolated part of the desert miles from the nearest building or electrical service. A decision not to employ CF, at least at the outset, was obvious.

A far less cut and dry situation was encountered last year when employee defalcation at an auto dealership resulted in a 7 figure loss of used car inventory. The investigation involved the CF examination of 17 drives, record searches of DMV in two states, scores of public and private database searches, physical surveillance, interviews of present and past employees, surreptitious searches, reviews of after-hours security video, analysis of vehicle histories. Obtaining records from sensitive sources, I won’t identify her. I can’t see how we could have provided proper service to our client if our investigation was restricted to CF.

Now, I can visualize an attorney client calling you and saying, “Scott, old buddy, I need you to examine a hard drive… blah, blah…etc.).

You have to keep in mind, that many, if not most, lawyers know little about investigation. Many do not know the difference between admissibility and probative value. We have worked for some top attorneys over the years. The best ones tell you where they want to go and ask you how much of a budget you need to get there. They do not try “buy” leads or tactics.

Accordingly, be our client a lawyer or layman, we are immediately responsible for determining the investigative objective. If the tactic he requests doesn’t fit, or the timing is wrong, we point that out and hopefully supply more appropriate alternatives.

Without the PI license that GA wants you to get (or the bona fide employee-employer relationship that would also work for you in GA), you are forced to work with one hand tied behind your back.

As I see it, the PI License is not so that you can conduct CF examinations, it is so that when you hold yourself out to have the ability to conduct investigations the public gets a guy who has the ability to serve his client in any direction that the mission might require – and equally important, a guy who does not have a built in conflict of interest by being a one product store.

Al

ReplyQuote
Posted : 14/04/2006 6:02 pm
dietro
(@dietro)
Member

In my mind there is a simple distinction and it is this

Mr. Kaplan, in all of your experience, have you ever been asked to testify as an expert when you have provided strictly investigative services?

I worked as a paralegal for ten years. During that time, we retained the services of numerous private investigators to do all sorts of things background checks on opposing parties and/or witnesses, skip tracing providing information on "injured" plaintiffs, etc etc etc. Not once….as in NEVER have I ever seen a PI called as anything but a fact witness. They present what they found and let the judge or jury interpret what they found.

On the other hand, during that same period, I saw only one CF examiner called as anything but an expert witness, and that was accidental. A CF examiner, a forensic accountant and/or CPA, an engineering consultant, an economist etc etc etc all review data and provide analysis. They interpret data and provide their own interpretation to a judge or jury. Mr. Kaplan, have you ever had the opposing party call another PI to dispute your investigative "findings" when you tailed a cheating spouse? Not likely. However, if you provided a forensic examination of the cheating spouse's computer, I'm fairly certain you have seen the opposing party call another CF examiner in to provide their own analysis of what you found on the computer.

ReplyQuote
Posted : 15/04/2006 8:38 pm
Page 1 / 6
Share: