Hi everyone,
I am just working on some computer forensics methodology proposal for the use of police investigators in my country and in a chapter discussing the forensic expert invoices (what is the recommended usual range of prices so that the police don't overpay etc.) I am unsure what to propose as for how to correctly charge for automatic work (usually processing) done merely by computers.
Charging for a human (manual) work done by a forensic expert is plain and simple. We have a regulation for that done by the Ministry of Justice which specifies some range of forensic experts work-hour cost (this only applies to the work for the police and courts; prices for the private customers are negotiable of course). For the sake of the example, let's just say the range is $10 - $20.
Depending on the difficulty of a given task (e.g. reading the case file or photographing the evidences is less difficult than analysis work) a forensic expert chooses a price and multiplies it by the number of hours spent on the task.
Then, the police investigator reviews the invoice and checks whether the selected work-hour costs for specified tasks are reasonable and whether the claimed number of working hours isn't unrealistic (e.g. a single human can't work 24 hours a day). And that's it.
But how to actually correctly charge for automatic work of computers? Here we don't have any regulation for that. For example, a processing done by 5 computers, 3 weeks in a row. That's 2520 (5*3*7*24) computer-hours in total. Even the lowest possible price from the range ($10/hour in our example) would be crazy. Besides, those are prices for human work.
In this case the human work done is zero. But I don't think we should charge for watt-hours only and provide our costly hardware and software for free.
So what I am looking for is some math formula where inputs would be the hardware and software costs (including recurring annual fees) and watt-hour consumption, and the result would be a hourly cost for a given computer.
In my example of 2520 computer-hours I would say $2500 would be probably acceptable for both sides. That would be $1/hour. But how to reach this cost?
The only idea I was able to come up with so far is "As for the automatic computer work costs calculation, the recommendation is to use the lowest possible price from the allowed range, further decreased by 90% due to the extremely low utilization of the human work."
Using my example, this would actually lead to $1/hour, which is ok. Just.. it sounds a bit unscientific for me ? I don't know, I would rather expect some complicated and complex formula.
How do you calculate your computer work expenses?
Billing per hour for computer time is counter-intuitive since it rewards using slow computers more than using fast computers. I.E., I spend 4k upgrading my workstation to the fastest processors, lots of RAM, and fast hard drives, then in return I get less money because processing time is less per item / GB.
This is I guess why in eDiscovery, the general trend is to charge per GB. When you're billing $300/GB like some firms, you don't need to track your human time at all. Of course, this is again counter-intuitive since the aim of ED is to reduce the amount of data that's given to the user, yet most billing is based on source material, whether it's responsive or not, and what's the true value of the 20GB of data that got instantly culled by hash comparison to a KFF/NIST database?
If you wanted to charge a nominal processing fee of some kind, it's really going to depend on what your market will bear, and I don't think anyone is in a better situation to determine that than you, and if they are, then they are likely not going to tell you because you are their competition, or they are going to charge you for the market research.
For a lot of CF firms, processing time is an opportunity cost that we wear because the hourly rate when we're billing makes up for it.
So what I am looking for is some math formula where inputs would be the hardware and software costs (including recurring annual fees) and watt-hour consumption, and the result would be a hourly cost for a given computer.
You also need to be able to justify the formula to the customer, as well as answer counter-arguments ('You charge for software? What kind of license do you have? The standard license on this software says it cannot be leased, lent, or offered for hire! What are you people up to?').
Unless you relish that kind if thing, you better talk to someone in your organization, or sufficiently near to it, who does this for a living … your CFO, budget specialist, house economist, or whatnot. They may have done this already, though in somewhat different context – say, renting computers to other departments, or such.
For a lot of CF firms, processing time is an opportunity cost that we wear because the hourly rate when we're billing makes up for it.
My approach too.
And to go back to one of the OP's other points my hourly rate doesn't vary whether I am imaging or note taking or carrying out analysis or sitting in a meeting.
I will try to rephrase and add some background info so my question hopefully makes more sense.
Here in the Czech Republic we have 140 licensed forensic experts in the information technologies field. "Licensed" means that the person passed rather difficult and lengthy process of evaluation of his skills and at the end was appointed by the Minister of Justice (or by the county court chairman on behalf of the Minister) as a forensic expert. No one else can act as a forensic expert and do forensic examination and provide forensic report. Of those 140 people, I am the only one with explicitly declared specialization in computer forensics.
Now, because the police investigators' awareness of computer forensics is very low (they don't know much about it, like what it actually is about, what they should want from a forensic expert and what is and is not realistic, how much it should cost etc.) and since I am supposed to know a bit about this, in cooperation with the capitol city police headquarters I started to work on some guidance document (or a methodology, if you wish) for the use of police investigators in our country.
In this document I am describing every step of the whole process of seizing/gathering/analyzing of digital evidences, what are common mistakes done by the police and by FE, what to pay attention on etc. The goal is to push police investigators' requests on forensic experts to some higher and more unified level, which will subsequently lead to increased and more unified quality of the forensic work and its outputs.
I don't know where the document will end up in the end, or what it will evolve into, but if we succeed at the police level, we will try to push it also via the Ministry of Justice as a guidance document for the use of forensic experts. But right now it's written from the point of view of a police investigator who wants to "check out some computers".
So here I am, working on this draft, 23 pages so far, and in a chapter about budget I am saying that the forensic examination must be some compromise between what police wants and how much is the police willing to pay for it. Because in these days of $150 2000GB harddrives a forensic examination of a few of those may mutate into 1 year long scientific work. But who would pay for it? So, from the point of view of a police investigator, the forensic examination must be economically efficient and the budget must be adequate to the importance of the investigated crime, its seriousness and the size of damage (if it's already calculable at this point).
All this common bla bla bla police investigators already know, that's nothing new. But the problem is that although they are in charge and they are the ones who pay, they currently have no way how to check whether the forensic expert's bill is "reasonable".
As for the human work, an investigator knows what is the allowed range for work-hour costs, so he can at least check that. But as for the computer work expenses, they have no guidance. They are unable to check whether the forensic expert asks too much or too little for work of his computers. So that's what I am trying to figure out - to suggest a correct way how the computer work should be charged (or, how it should be asked by the police to be charged).
Since human work is charged per hours, my initial idea was to charge computer work also per hours and set some reasonable range for computer work-hour costs. But you are right it's not a good way (thanks for pointing that out) because in that case different forensic experts would charge a different money for the identical work and the one with the fastest computers would be the cheapest one. Which would be very bad because work for the state is not a competition (as opposite to the work for a private customer). The same as you expect that any police officer in your whole country will deal with your problem in the same way, the same our police investigators expect forensic experts to deal with given task at the same level of quality and for the comparable money.
Charging per GB seems nice at first. But it can't be linear otherwise either processing of high capacities would be too expensive, or processing of low capacities would be very cheap.
It's totally realistic to seize a single computer with 10 TB storage (5x 2 TB). How much would be reasonable to charge for processing of 10 TB? $10k? $20k? That would be $1 - $2 per GB.
But it's also totally realistic to seize a notebook with 80 GB storage. That would be $80 - $160 which would make forensic experts extremely disgusted and unwilling to work for that pittance. That's serious because we can't refuse the police. We are entitled by the law to provide forensic services to the state as well as to the private customers, but we can refuse only private customers, we can't refuse requests from the state.
Then, in an invoice, everything is labeled as a "human" work, there is no cost for work done by computers. Forensic experts cover these expenses into their work-hours. So instead of charging 100 human hours per $20, plus $2000 for computer work, they simply charge 200 human hours per $20. Which is false. The total amount is ok, but the way how to calculate it is incorrect.
So now when I am working on this guidance document I have a perfect opportunity to change the current situation and finally to start charging computer work separately from human work. But I have to come up with some suggestion how to actually calculate computer work.
So I guess it should be some kind of regressive function then? So that a small amount of data would still generate an acceptable revenue for a forensic expert, while high amount of data would be still affordable for the police investigator..
Or I just won't deal with this topic at all, but someone someday will have to do that anyway..
For a lot of CF firms, processing time is an opportunity cost that we wear because the hourly rate when we're billing makes up for it.
My approach too.
Well, the problem here is that our hourly rate is extremely low, so it really can't make up for it. I am not kidding. We have the amended version of the law (which would set much higher rate) in preparation process for last 15 years and it's still not finished. So if we have to spend tens of thousands USD for hardware and software, and then another hundreds or thousands USD a year for support fees, we would never get it back (not speaking about making any profit) had we charged only our human work-hours.
And what we do now - fictitious increasing number of human work-hours in order to cover computer expenses - is not good either because (besides it's false) it then looks like a forensic expert works in average 15 hours a day, which is obviously not true.
For a lot of CF firms, processing time is an opportunity cost that we wear because the hourly rate when we're billing makes up for it.
My approach too.
And to go back to one of the OP's other points my hourly rate doesn't vary whether I am imaging or note taking or carrying out analysis or sitting in a meeting.
My approach mirrors that of Patrick4n6 and Jonathan. Regardless of activity, my time costs the same.
Drop me an email from your official account. I have a suggestion for you.
My approach mirrors that of Patrick4n6 and Jonathan. Regardless of activity, my time costs the same.
Yes, that makes perfectly sense from your point of view. Another approach is from the point of view of the one who pays you - he might want to pay based on what actually you have done, how difficult it was etc.
Well, we have the second approach in my country and its enforced by the law, so there is not much we can do about that. If I used the highest rate for writing the report, they would punch me -)
By the way, just out of curiosity, what is your average hourly rate?
Or, in general, what is typical hourly rate for computer forensics work in USA these days?
My approach mirrors that of Patrick4n6 and Jonathan. Regardless of activity, my time costs the same.
Yes, that makes perfectly sense from your point of view. Another approach is from the point of view of the one who pays you - he might want to pay based on what actually you have done, how difficult it was etc.
Well, we have the second approach in my country and its enforced by the law, so there is not much we can do about that.
Interesting. Are other professions such doctors, lawyers and accountants paid the same way in CZ, eg, their rate depends on how complex the payee considers their work to be?