PI licensing

The issue was first raised to our State Attorney General by the then chief of our State Law Enforcement Division (SLED), Major Mark Keel after several cases had been tossed due to botched "forensics." SAG McMaster's response is partially quoted in my previous posting. The full text can be downloaded as a PDF here.

The letter that you posted says nothing the reasons for the law. It is simply a legal opinion that the state has the authority to license computer forensic examiners.

More interestingly, it also states

As to any assertion of restraint of trade, it has been recognized that federal antitrust laws do not prohibit a state from imposing certain anticompetitive restraints as an act of government.

I see, so the fact that we can legally restrain trade means that we should?

Pursuant to Maj. Keel's request for comment, SAG McMaster tasked SLED with looking into a solution. SLED approached our State's PI association, SCALI, suggesting that we form a joint committee to look into the matter of CFE endorsement v. separate licensing for CFEs.

Well the letter posted was written after the law was passed or at least after the legislation was proposed. Where are the "botched cases" that led to this action?

No outside special interest groups were involved in the forming of this committee. The State AG does not stand to gain financial interest in licensing CFEs and any funds generated for SLED from such an endorsement would be trivial in comparison to the funds collected from regular licensing fees. The goal has always been to protect the public from substandard examinations and reduce, if not eliminate future incidents of incompetent digital forensics.

Bzzt. What would you expect the state PI association to do? Why would they not want to see the forensic practitioners fall under the same requirements as they do. If the state was truly interested, it would have convened representatives of the forensic IT community as well as law enforcement and the legal community. Why weren't the consumers of these services involved?

I would still argue that this is a solution in search of a problem. The only ones who can "botch" a case without remedy is law enforcement due to double jeopardy. Those representing defendents as well as those representing parties in civil action have mechanisms such as appeals and malpractice.

Further, have there been any studies to show what impact the law has had on the rate of "botched cases" (assuming that there are enough of these to actually measure).

Sorry, but I just don't buy any of it. PI's should no more be determining the credentials of forensic examiners than forensic examiners should be determining how to credential PIs.

The physician community in Pennsylvania tried to assert that they should be responsible for credentialling and determining the privileges of physician assistants. Luckily for the citizens of Pennsylvania, our lame legislature actually did the right thing and told them to b**t out. I never thought that I would think any legislature more tone deaf that PA's but in this case, SC clearly takes the cake.

Our committee in SC is comprised of CFEs, attorneys and LEOs. Sorry, no "consumers" were invited or asked to join. We were convened to discuss whether or not CFEs should continue to be licensed as PIs. The State Attorney General's decision effectively answered that question.

The question then became "Do we create a separate 'flavor' of PI license for CFEs or do we issue an endorsement to those folks who wish to practice digital forensics, but who must obtain their PI license to meet the law?" We decided on the latter. Now we are trying to determine the qualification process for those seeking that endorsement.

I continue to argue against some of my co-members who feel that a vendor-certification (ex. "EnCE") is sufficient for an endorsement. I would prefer to see a vendor-cert supplemented by a written exam - including scenario-based essay questions in addition to multiple-guess. Indeed, I don't feel a vendor-cert is superfluous.

To seanmcl's comment

PI's should no more be determining the credentials of forensic examiners than forensic examiners should be determining how to credential PIs.

I agree!. My fellow CFEs and I would be the gatekeepers as to who we think should be issued the endorsement. Our *recommendations* would be passed to our licensing board, the State Law Enforcement Division. (In SC, PIs do not issue licenses to PIs.)

By the way

The physician community in Pennsylvania tried to assert that they should be responsible for credentialling and determining the privileges of physician assistants. Luckily for the citizens of Pennsylvania, our lame legislature actually did the right thing and told them to b**t out.

If not physicians, (who must oversee their work), who *does* determine "the privileges of physician assistants"? Barbers??? ("The Original Surgeons!")

Are we getting anywhere on this topic? If not, I wish to plead "exhaustion of the issue" and let the rest of our global readership have some input into how *their* communities are dealing with these questions. Good discussion, though,… thanks seanmcl and farmerdud!

-AWTLPI

The fact that some members are for vendor certification truly shows the collective understanding and intelligence levels of those who have opted to decide how the residents of South Carolina are to be represented.

Designed in a vacuum, created in a vacuum, and blown to the rest of the state!

Unfortunately the residents suffer, and the "powers that be" keep on truckin', thinking they've done something good (for themselves? or for the good of their community?).

I mean, imagine that - a small group gets together to decide what shall be placed upon the majority. The majority, the residents, are almost entirely unaware of what's being decided, and that is by design, isn't it? No input needed, thank you.

Cheers!

farmerdude

www.onlineforensictraining.com

www.forensicbootcd.com

I just read through the SC law. No mention of computer forensics at all. Where exactly is it covered?

Unless you take the line about obtaining evidence to be used in a criminal or civil action.

So, if you are not doing the acquisition, I don't see where the law applies.

Help me out.

I'd only like to reply insofar as to agree with ALL of farmerdude and seanmcl's arguments against states requiring CFEs to possess a P.I. license.

I really hope that there are more folks from the SC committee (or any other potential ones), other than AWTLPI, who are reading this thread and paying attention to the points being discussed.

Jeff

I just read through the SC law. No mention of computer forensics at all. Where exactly is it covered?

Unless you take the line about obtaining evidence to be used in a criminal or civil action.

So, if you are not doing the acquisition, I don't see where the law applies.

Help me out.

You are correct. It is only the acquisition that requires that you either be in law enforcement, a PI or a lawyer. I have had a couple of cases in South Carolina and all the law did was drive up the cost because my clients needed to retain a PI in addition to me.

Of course, I'm not sure how the law applies to computers which are shipped out of SC for imaging and/or for live imaging o systems in SC acquired by a site not located in SC via enterprise software or F-Response. It it seems to me that the Commerce Clause would effectively prevent SC from taking any legal action in these cases, though the state might object to the admission of evidence obtained in this manner.

I read somewhere that the Georgia law requiring us to get PI licenses was repealed. Does anyone know if that is correct?

I read somewhere that the Georgia law requiring us to get PI licenses was repealed. Does anyone know if that is correct?

Not repealed; vetoed. HB1259 is the proposed reg we're talking about.

Gov. Sonny Perdue vetoed the bill on May 5, 2006.

-AWTLPI

I just read through the SC law. No mention of computer forensics at all. Where exactly is it covered?

Unless you take the line about obtaining evidence to be used in a criminal or civil action.

So, if you are not doing the acquisition, I don't see where the law applies.

Help me out.

You are correct. It is only the acquisition that requires that you either be in law enforcement, a PI or a lawyer. I have had a couple of cases in South Carolina and all the law did was drive up the cost because my clients needed to retain a PI in addition to me.

Of course, I'm not sure how the law applies to computers which are shipped out of SC for imaging and/or for live imaging o systems in SC acquired by a site not located in SC via enterprise software or F-Response. It it seems to me that the Commerce Clause would effectively prevent SC from taking any legal action in these cases, though the state might object to the admission of evidence obtained in this manner.

It is/was the opinion of SC Attorney General Henry McMasters that existing SC PI laws apply to computer forensics experts.

…[In] the opinion of this office, the better reading of Sections 40-18-20, 40-18-30 and 40-18-70 support the conclusion that such provisions require that an individual or company selling their services in South Carolina as “computer forensics” experts secure licenses as private investigators. Such determination would be applicable to individuals who accept fees to examine and copy computer hard-drives to extract information to be reported to clients and to be presented in courts as evidence and/or testimony in civil and criminal actions. The duties performed by such individuals or companies would appear to meet the definition of “private investigation business.”

-Excerpted from here, emphasis added.

As to the question of the "Commerce Clause" and possible concerns regarding restrain-of-trade, SAG McMasters continues

…whether enforcement by SLED so as to require individuals selling their services as “computer forensics” experts to obtain licenses as private investigators would constitute an unlawful restraint of trade or be in violation of any laws regarding interstate commerce inasmuch as most of these individuals would be associated with out-of-state companies. As to any assertion of restraint of trade, it has been recognized that federal antitrust laws do not prohibit a state from imposing certain anticompetitive restraints as an act of government. Parker v. Brown, 317 U.S. 341, 352 (1943). In Parker, it was acknowledged that the federal Sherman Anti-Trust Act was not “…intended to restrain state action or official action directed by a state.” 317 U.S. at 351. As stated by the Tennessee Attorney General in an opinion dated September 8, 1983, the United States Supreme Court in Parker determined that the Sherman Act

…is directed against “individual and not state action” and concluded that state regulatory programs cannot violate it…The immunity for state regulatory schemes is grounded in our federal structure.

-Ibid.

Note This is not published law, but the State AG's opinion holds similar weight unless/until over-ruled by State Court.

As I read, you *could* ship the evidence out of SC for examination (possible chain-of-custody issues, anyone?… anyone?); but if the out-of-state examiner is to testify in SC Court s/he needs to be licensed in SC.

-AWTLPI

Note This is not published law, but the State AG's opinion holds similar weight unless/until over-ruled by State Court.

As I read, you *could* ship the evidence out of SC for examination (possible chain-of-custody issues, anyone?… anyone?); but if the out-of-state examiner is to testify in SC Court s/he needs to be licensed in SC.

You can bet that if I was ever threatened with a fine or prosecution for analyzing data from an SC computer, I'd take it the US Supreme Court, if allowed. The issue would not be whether the state had the right to regulate practices within its state, but practices outside the state. As for testimony, if I was compelled to testify in an SC court, I would do so. And since my report (and affidavit) would likely be prepared outside SC I'd challenge the AG to oppose my admission.

Also, this (thankfully) does not cover Federal Courts located in SC. The Federal Court system allows judges, not the legislature, to determine who qualifies as an expert, as it it should be.