While I might well hire you myself if you hold yourself out to be a Computer Expert, or a Computer Forensics Expert who can provide expert testimony on such matters in court, I would not hire anybody who equates Computer Forensics with Investigation
Todd,
Please read the foregoing. I am quoting from my own post of 04/10/06, in my response to Scott Moulton. If it is not clear that I solidly support Computer Forensic Expert Testimony, please tell me what I have to do to clarify that.
Mr. Kaplan,
I didn't ask you if you supported CF Expert Testimony. I asked you two specific questions to illustrate my point that being a CF Expert is different than being a PI.
You and your partner can offer your clients a "complete investigation package". That's great, but most PI's are nowhere near qualified to do a CF examination. By the same token, very few CF examiners are qualified to conduct an investigation. (Not to mention that few if any CF examiners claim to be capable of conducting such investigations.)
There IS a difference, and the entire point of this thread is that the state of Georgia has a very poorly written, very vage statute already on the books that sees no distinction. Now to make matters worse, they've gone out and compounded the problem by stiffening the penalty for violating the idiocy they passed in the first place. Here's the nonense
"(3) 'Private detective business' means the business of obtaining or furnishing, or accepting employment to obtain or to furnish, information with reference to
…
"(E) The securing of evidence in the course of the private detective business to be used before any court, board, officer, or investigating committee;"
Seems like the follow professions fall into the above category
1. CPA's and/or forensic accountants
2. Engineering Consultants
3. Economists (Economic Impact Consultants)
4. Vocational Experts
5. Medical Examiners
6. Medical Doctors
7. Computer Forensic Examiners
8. Patent & trademark investigators
That's just off the top of my head….anyone else?
This thing is getting addictive. I am going to drop out of this outstanding thread after this. It either that, or stop paying the rent. I have a few thoughts.
1. Sharpies post indicates two general requirements for PI licensing exceptions for experts. One seems to be "Occasional practice" and the other seems to be "otherwise licensed".
2. Sharpies research, if valid in your state, would suggest that CPAs Engineers and guys otherwise licensed, would have no problem if they operated within the foregoing constraints.
3. I personally would not oppose a CF license limited in they same manner as Engineer etc. It has to have restrictions that keep it from spilling over into private investigation. It would also be helpful to restrict the PI license so that the incompetants are kept out of the PI field. That is not a new concept. In spite of the fact most polygraph examiners have an investigative background, not all do. Here in NV we have two separate licenses PI and PE. Nobody crosses the line unless he has both licenses.
4. This is, at least in the near term, going to be handled on a state by state basis.
5. Many of you folks are not working as active PIs today and apparently don't realize that for the past 13 years or so the Feds have slowly closed the PI spigot. With all due respect to some of the guys posting here, some of their understanding of what a PI did were flat out felonies and have been felonies for 30 years or more. Some of the worst restrictions have come down the pike in the past 5 years. Currently there are many restrictions pending that wiill further squeeze the market. Accordingly, expect a major turf battle every place a CF guy wants to hold himself out to the public as an investigator. And or course expect many more PIs to start to get cross trained into CF.
6. The thing that is not yet resolved is that while PIs who lose work in the newly closed out areas might be able to offset some of the lost revenue by getting into CF, there is no way that CF can replace the lost intelligence.
7. There are many possibilities of how this will play out. Higher prices, black market, off-shore operations are all possible. Many PIs will drift toward doing contract work for Uncle Sam. A lot of the guys with current Top Secret Clearances are already doing it. Backlogs suggest that there are years of work available. But that work is for the most part background investigations. Like CF it helps some PIs but does not fill the intelligence gaps that congress and the privacy zealots are creating.
8. I supported Federal Licensing of PIs because of the halo effect. Eisenhower once said about a subordinate about whom he had received complaints, "He may be a sonofabitch, but he's MY sonofabitch!" I wanted to put PIs under the FTC, the very guys who are turning off the water. I hoped that the FTC would then help create exceptions to various restrictions that are being written into the federal law. Most PIs were opposed as was the organization that all the various state regulators belong to. I pitched the same thing 12 years ago, but got noplace.
I'll keep watching this thread, but I don't plan to further participate! I've got to go out any make some money. Al
.
.
I do not want to know how to hold a gun, computers don't shoot back.
/on soapbox/
Scott, I agreed with everything you said until that last bit. Every able bodied American should know how to hold and use a gun. And although it shouldn't be required, I highly recommend concealed carry. Its the only proven method for reducing violent crime.
/off soapbox/
As disciplines grow and become more established, they become more formalized. I think what you are seeing here is the growing of computer forensics as a "profession." This is something to be proud of. It should mean increased status and higher wages, I think, in addition to some increased hassle (like background checks by PI licensing authorities).
Professional licensing is a form of state-sanctioned anti-trust–it gives you a monopoly to some degree. It's not all bad.
Professional licensing might mean that big boys like Kroll or Guidance or NTI can't squeeze you out of a case in your home state either they will have to get licensed in your state (could be difficult), or they might just have to associate with you SINCE YOU HAVE THE LICENSE. We'll have to see how this pans out.
You can bet, however, that the big boys will be making steps to ensure this "development" goes their way.
Eric Van Buskirk, JD, MA, CISSP (as of yesterday)
I sort of equate forensic analysts with photo developers, though the technology is vastl different the service aspect isn't. Can you imagine if ever person that developed pictures for a PI had to be a licensed PI?
In m state the law says that if you "conduct investigations" and make judgements for a client you must be a licensed PI.
We alwas contract and work for either a Pi or an attorney, theerfore the are the investigator, we just suppl a service to them just like the film store guy.
This is an old issue. The license free ride for computer forensics investigator is coming to an end more rapidly now. Here's an excerpt from a licensed computer forensics expert about this issue
<<<<<<<<<<<<<<<<
It’s pretty clear in my state what will happen. I have seen cases where the unlicensed computer forensics investigator was removed from the case do to having no license. One “computer technician†in particular, for example, has some “fame†in the field with wonderful resume’s and certifications, and prior court qualifications as an expert. I was amazed at how easy it is for the opposition attorney to take him off the case. For each issue of defense that he brought up…he was shot down. This is how it went down. The removal process does not even make it to court but is handled at the discovery and deposition level.
Expert’s Excuse #1 I have qualified in court as a computer forensics witness
ANSWER that just means you did not get caught, and we now have court records proving that you were conducting an investigation without a license with the erroneous assumption that since your investigation involved computer evidence you did not need a license. Qualifying in court does not magically produce a PI license.
Expert’s Excuse #2 What about my resume and experience and certifications?
ANSWER Those are really nice, but I have similar qualifications for being a fantastic lawyer, but I can’t be one and practice until I am licensed. Plus your resume lists many previous cases of unlicensed high tech investigations in the criminal and civil courts. We will be sending letters to those clients and attorneys advising them that you were unlicensed and failed to disclose that fact which is another series of violations.
Expert’s Excuse #3 It’s not an investigation to find computer evidence
ANSWER Yes, it is and we will be using the following code sections and case decisions to show you are wrong. Plus, we have placed your attorney and client on written notice of the license violation. The opposition attorney who hired you is now duty bound to enforce this law, since knowingly hiring an unlicensed professional investigator of any type is unlawful and a separate offense. Your very title and label has the word “forensics†in it…..clearly a legal term applicable to investigations as defined by law. The associations you belong to, clearly have “investigation†as part of their core literature and bylaws. Shall we go on? An investigation, is an investigation, is an investigation whether or not the evidence is on a computer.
Expert’s Excuse #4 I don’t have to give you any information about my previous clients….it’s confidential
ANSWER Show us the law allowing that and we will respect that. However, since you are unlicensed you cannot willingly withhold client confidential information since no body of federal or state law exists for the unlicensed investigator. If you were licensed you could quote client-confidentiality law pursuant to the licensing. Sorry, you are trying to invoke “client confidentiality†law that is only there if you are licensed. You can invoke client-attorney privilege if your work product on a previous case was attorney work product, but once that attorney is put on notice that you were unlicensed and failed to disclose the fact at that time just makes things worse for both of you. Clients get upset when they find these things out.
Expert’s Excuse #5 I didn’t know, cut me some slack this time
ANSWER Did you really think that doing high tech investigations with computer evidence hunting, storage, photography, evaluation, reporting, testimony, client interviews, witness interviews, suspect interviews, and more was not an investigation? With all of your education, experience, training, and certifications you JUST forgot to get licensed? Tell that to the barbers, plumbers, accountants, beauticians, RN, Doctors, Lawyers, Counsellors, Engineers, taxi drivers, contractors, electronic repairmen, Psychiatrists, Private Investigators, Peace Officers, and the rest who have to be licensed AFTER they get their training, certifications, and experience.
Expert’s Excuse #6 OK It’s too hard to qualify for a PI license
ANSWER Now we have the truth from you. We assumed this. You could not qualify for a PI license, and we don’t care to know why. You now have a career-changing event on your hands, and this case will probably settle in my client’s favor. We really don’t care what you do to manage or mitigate this problem….it’s not our concern. Our job is to protect OUR client’s interests, not yours.>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Am I correct to assume these PI statutes do not apply to civilians employed by LE agencies? Does it matter if they are contractors or not?
Funny thread … like everything in data forensics, there'll be no agreement… Most PIs are for it, most forensic practitioners are against it … go figure )
"The license free ride for computer forensics investigator is coming to an end more rapidly now."
License free ride … interesting …
Oddly enough, obtaining a PI license;
- requires NO educational degree in data forensics
- requires NO working experience in data forensics
- requires NO learning experience in data forensics
- requires NO training or certification in data forensics
- requires NO knowledge of file systems, operating systems, or applications
And yet anyone (PI or non-PI) wants to publicly state their personal belief is that a data forensic practitioner must hold a PI license in order to conduct data forensics work?
"Expert’s Excuse #1 I have qualified in court as a computer forensics witness…ANSWER that just means you did not get caught"
CORRECT Answer I have the knowledge and skills required to work in the field of Data Forensics. Here is my CV for review. Those who retained me hired me in good faith based on strict criteria. I have qualified because counsel, opposing counsel, and the judge qualified me (my counsel retained me, opposing counsel failed to have me dismissed, and the judge found me credible).
"Expert’s Excuse #2 What about my resume and experience and certifications?
ANSWER Those are really nice, but I have similar qualifications for being a fantastic lawyer, but I can’t be one and practice until I am licensed."
CORRECT Answer I am experienced and knowledgeable. You're not disputing my skills nor my experience nor my knowledge nor my findings. You're hoping to weasel out on your defined technicality. No where in my analysis of the data did I act as PI would, and therefore I am not required to hold a PI license.
"Expert’s Excuse #3 It’s not an investigation to find computer evidence.ANSWER Yes, it is and we will be using the following code sections and case decisions to show you are wrong."
CORRECT Answer We are now playing the game of semantics. Let's focus on the data found and how you should best represent the interests of your client(s). I am not a licensed PI, nor do I need to be one. You're not disputing my findings, clearly indicating the data is present, so you're hoping to grasp at any straw … Only you'll find that many, many individuals participate in some stage of an investigation and many of these are not PIs nor do they need to be.
"Expert’s Excuse #4 I don’t have to give you any information about my previous clients….it’s confidential. ANSWER Show us the law allowing that and we will respect that. However, since you are unlicensed you cannot willingly withhold client confidential information since no body of federal or state law exists for the unlicensed investigator."
CORRECT Answer I was retained by counsel. I signed an NDA. Please contact counsel to discuss details of cases and my participation. I'm not at liberty to discuss these.
"Expert’s Excuse #5 I didn’t know, cut me some slack this time"
CORRECT Answer Who's this - the PI who just bought the cheapest Windows forensic program and now hangs his/her shingle on a forensic practitioner?
😉
BTW … all of those folks listed as having certifications to practice … it directly fits their field of work! That's the difference here … a PI license doesn't qualify you as a forensic practitioner.
Anyone object?
Case closed.
But to reiterate the key points;
Obtaining and retaining a PI license;
- requires NO educational degree in data forensics
- requires NO working experience in data forensics
- requires NO learning experience in data forensics
- requires NO training or certification in data forensics
- requires NO knowledge of file systems, operating systems, or applications
cheers!
farmerdude
"As I see it, the PI License is not so that you can conduct CF examinations, it is so that when you hold yourself out to have the ability to conduct investigations the public gets a guy who has the ability to serve his client in any direction that the mission might require – and equally important, a guy who does not have a built in conflict of interest by being a one product store. "
One product store? Networking, programming, information security, database architectures, data classification… That's like saying a brain surgeon should become a member of the Plumbers and Electricians Union to serve his client in any direction that the mission might require.
I have a clogged sink you need to fix right after my tumor is removed, thanks.
Why not require ALL PIs to gain the CCIE+VoIP, CISSP, and Licenced Penetration Tester certs before they can investigate?
It sounds to me that some people don't understand the complexities of being an expert and specializing in a field.