LE versus IT experience

seanmcl · 2009-09-02T03:36:33Z

I'm going to start a thread, here, because I have seen the issue come up in a number of different settings, i.e., licensing of computer forensic professionals, hiring of IT people and training in LE procedures versus hiring LE and training in forensics.And so I am going to make an assertion, a straw man to be precise, and it may sound self-serving and perhaps it is. But my goal is not to make a claim but, merely, to throw out an idea and see how the community reacts to it. And in the poll I'm not allowing for wiggle room (e.g. both, neither), because it isn't helpful to deciding how people really feel.And this is not, purely, theoretical, as we are advising people as to how to pursue a career. And it is not meant to be critical, except as a means to challenge current ideas.My assertion is that almost every other forensic professional is an expert in their primary field, and an expert in LE/rules of evidence, secondary and, thus, that forensic professionals of the future should be (or would, preferably be), experienced IT professionals who are trained forensics and in the rules of evidence rather than trained explicitly for forensic IT. Consider that forensic pathologists are, first, trained pathologists and medical doctors and then trained in investigative procedure. Forensic chemists are, first, experts in chemistry who become qualified to practice chemistry in a manner consistent with the legal process. Forensic auditors are, first, accountants, and then investigators.I am biased in that I base my conclusion, in part, on the more recent cases that I have been working in which describing the "what" is less important than being to document the "why" and "how" and that to do that,one needs to understand how IT systems and organizations behave. And, in part, I am basing my comments on recent legislative attempts to restrict IT forensics to people with investigative experience but, perhaps, no real IT/organizational experience.Of course, this does not apply to simple issues like whether there is CP on a computer or whether a spouse has been having a dalliance with someone other than the other spouse. And I realize that the profession can utilize the services of technicians as well as diagnosticians and therapists.But in more complex issues, understanding how the organism (the organization), works is as important if not more important than other knowledge, in terms of building a case.I mention this, in part, because institutes of higher eduction are building curricula around computer forensics (thanks to CSI, the interest in forensics of all sorts is on the rise), and because I have seen some recent postings emphasizing the importance of LE training or experience.And I am wondering whether, like other positions in forensic science, forensics is the specialty and the primary area of expertise is the science or technology, itself?Disclaimer I recently was interviewed by Jamie and by a publication interested in the prospects of a career in IT forensics and I expressed my opinion in the value of practical IT, not forensic, experience.Also, I am happy to be embroiled in controversy, even skewered, so I look foreward to critical, well-reasoned objections.

Page 3 / 3 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by douglasbrush 16 years ago

22 Posts

17 Users

0 Reactions

1,896 Views

RSS

jhup

(@jhup)

Noble Member

Joined: 16 years ago

Posts: 1442

09/09/2009 10:23 pm

Agreed. To be a LEO one has to start "young". Otherwise, there are limited chances to get LE experience, thereafter.

(Yes, this is a pet peeve. I can out-run, out-swim, out-bike, out-lift, out-fight and forgive me but outsmart most first years, yet I could not get a LEO job because I am too old by 7 years.)

ReplyQuote

douglasbrush

(@douglasbrush)

Prominent Member

Joined: 16 years ago

Posts: 812

12/09/2009 7:12 pm

I just had a chance to catch up with Forensic 4Cast 20 that had an interview with Larry Daniel who made some very good observations regarding LE, IT and the law in general with regards to CF.

http//4cast.whitfields.org/?p=364

ReplyQuote

Page 3 / 3 Prev

8 Forums
15.7 K Topics
92.3 K Posts
359 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed