Wednesday, 7 November 2007

Why PI Laws do not impact Digital Forensics

There has been much debate from the non-lawyers in the digital forensic community in the US as to where a PI license is need. I will state now that under existing US state code it is not.

In the case that you are assigned to work on a criminal case for the defence, you are also not investigating engaged by the attorney (or at least if you are smart you go through the correct process and are). The collection and analysis of expert evidence is not classified as an investigation in the manner being presupposed. I suggest that you read the US Supreme court cases of “Daubert v. Merrell Dow Pharmaceuticals, 509 U.S. 579 (1993)”, and Kumho Tire Co. v. Carmichael, 526 U.S. 137 (1999).

If you are worried still about the use of the language and feel that PI (Private Investigator) licensing is required to work in digital forensics due to the Texas administrative code, Tx has stronger working in many other sections of the occupations code. I know that I have examined computers that hold Tax and financial statement information – so who is either a registered Tax examiner or Public accountant? By the reading of the wording in the PI act that is being presumed by many, we all need also to be CPA’s at least to do this work.

So a questioon to ask in Texas is are you also a licensed firm under the “Texas board of licensing" as a professional engineer? The wide reading of the PI act will encompass this as well. In fact – this is only a narrow interpretation and many IT people call themselves an engineer. If this is the case you need to consider a license under Rule 133.13 under NCEES part 9 registration as an Electrical, electronic, computer, communications engineer. Of course this has the requirement to have “graduated from a degree program in which the undergraduate or graduate degree in the same discipline has been accredited or approved by any of the organizations identified in §133.31(a)(1)(A) or (a)(2)(A)”. So all those without degrees get out of IT? Same argument and one that holds more weight than the PI argument.

I happen to be a professional Engineer – so I am ok, how about you? Should we add to the FUD and spread this as well?

Should we spread the word that all Windows Helpdesk tech's need to get a degree and become members of a Professional Engineering Society to be in the IT industry? It is the same arguement being applied to the PI asertions.

So are we going to keep the FUD up and keep misinforming everyone as to what they need according to free legal advice from all the non-qualified lawyers on the list? I do not practice and am not licensed in Tx, but at least I am a qualified lawyer, how about you? It is about time that this BS is put to rest.

Kennard v Rosenberg, 127 CA 2d 340; 273 P2d 839, hrg den (1954).

“Where a statute is susceptible of two constructions, one leading to absurdity, and the other consistent with justice, good sense and sound policy, the former should be rejected and the latter adopted.”

"The uncontradicted evidence is that none of the plaintiffs herein were engaged in the private detective business or represented themselves to be so engaged. Plaintiffs were licensed engineers and as such were authorized to make investigations in connection with that profession. It seems quite clear that the private detective license law was not intended by the Legislature to place a limitation on the right of professional engineers to make chemical tests, conduct experiments and to testify in court as to the results thereof. A physician, geologist, accountant, engineer, surveyor or a handwriting expert, undoubtedly, may lawfully testify in court in connection with his findings without first procuring a license as a private detective, and, as in the instant case, a photographer may be employed to take photographs of damaged premises for use in court without procuring such a license. Likewise, plaintiff, who was hired as a consultant and expert and not as a private detective and investigator was not required to have a license as such before being permitted to testify in court as an expert."

"… it was the intent of the Legislature to require those who engage in business as private investigators and detectives to first procure a license so to do; that the statute was enacted to regulate and control this business in the public interest; that it was not intended to apply to persons who, as experts, were employed as here, to make tests, conduct experiments and act as consultants in a case requiring the use of technical knowledge."

An investigator (digital forensic) is not required to have a license as a PI. Plain and Simple. This does not make a shread of differnce be it in the US state of Texas, Georgia or even CA.

At the worst the argument is that you need to be one of a(n):
· Computer Systems Engineer
· Accountant
· Lawyer
· Academic
· Scientist
· …
· And eventually we get PI somewhere as an option - not the be all and end all it is made to be.

So at the least lets get the argument straight.

[FUD = Fear, Uncertainty and Doubt for those not in the know]


Anonymous said...

Well I liked your well structured arguments with legal quotes, but you failed to show an example of where the unlicensed professional was or was not taken off a case for being unlicensed. Qualifying as an expert witness does not produce professional licensing for the field of expertise. It just means that the person was not caught yet.

PI licensing is required depending on what the expert did as an "investigator" in the case. Double-licensing is also not required, thus a lawyer, doctor, engineer, etc can investigate within the course and scope of his licensing without having an additional PI license. In some states there are no PI licensing requirements with PI licensing left to the local jurisdictions.

How do I know all this stuff? I have watched the removal of the unlicensed professional from cases, including unlicensed computer forensics examiners who just ignored or forgot to look at the law regarding investigating for hire while unlicensed.


Licensed Computer Forensics Investigator

Craig S Wright said...

The issue is that there is no “unlicensed professional” per se from a legal perspective. The nature of what formulates a licensure is what I will discuss here.

In legal terms a professional is a member of a recognised profession. As you have stated, this includes doctors, lawyers and engineers as well as accountants, actuaries, scientists and many others. The agreement is often brought up that one needs to be a PI. This is false as one can be a member of any related profession (a PI license does not make one a member of such a cohort) and not validly be a PI.

Digital forensics is a subfield of a number of professional pursuits. To be recognised by a court, one needs to provide weight to the testimony that states one is an expert. Membership of a professional society, licensure and publication all adduce weight in support of the testimony.
The exceptions to the hearsay rules for business documents also apply in these instances.
I will add a transcript copy tonight of an unlicensed “professional” giving testimony (which was upheld) where an expert provided email server logs to a court on a printed and altered document and an email header where it was designated “hearder.txt”.

In response to, “PI licensing is required depending on what the expert did as an "investigator" in the case” I have to add that this only applies ion cases outside the scope of the digital forensic engagement.

This does include the collection of physical evidence without a court order and the interviewing of people not directly associated with the case, neither of these are tasks that are included in the realm of digital forensics.

Craig S Wright said...

Please see the Post on Dec 17, "What passes as evidence" as a more complete response.