Saturday, 5 July 2008

PI laws and ignorance as a perspective.

Ignorance is the condition of being uninformed or uneducated, lacking knowledge or information. It seems that some desire to make this an outlook on life.

I am actually being swayed to support the introduction of additional professional laws. Not by the government, but through the constant display of ignorance I continue to see from people who refuse to look at the issue unemotionally and actually weigh the facts. In attempting to help people who do not have any professional qualifications or a degree, I keep being rebutted by those to whom I am offering advice that could help them have some slim chance of achieving their goals.

The introduction of Private Investigator (PI) licensing does not in fact, as it touted, restrict people from the practice of digital forensics in the manner posited. It is rather an increase in the expansiveness of the parties who can engage in an action that is already restricted. In this essay, I will concentrate selectively on Texas for the main part due to the difficultly on reporting issues across multiple states in a single essay.

This is NOT a new issue. This was addresses over 50 years ago and has been replayed time and again. For instance, in Kennard v Rosenberg, 127 CA 2d 340; 273 P2d 839, hrg den (1954).…“Where a statute is susceptible of two constructions, one leading to absurdity, and the other consistent with justice, good sense and sound policy, the former should be rejected and the latter adopted.”…"The uncontradicted evidence is that none of the plaintiffs herein were engaged in the private detective business or represented themselves to be so engaged. Plaintiffs were licensed engineers and as such were authorized to make investigations in connection with that profession. It seems quite clear that the private detective license law was not intended by the Legislature to place a limitation on the right of professional engineers to make chemical tests, conduct experiments and to testify in court as to the results thereof. A physician, geologist, accountant, engineer, surveyor or a handwriting expert, undoubtedly, may lawfully testify in court in connection with his findings without first procuring a license as a private detective, and, as in the instant case, a photographer may be employed to take photographs of damaged premises for use in court without procuring such a license. Likewise, plaintiff, who was hired as a consultant and expert and not as a private detective and investigator was not required to have a license as such before being permitted to testify in court as an expert."…"… it was the intent of the Legislature to require those who engage in business as private investigators and detectives to first procure a license so to do; that the statute was enacted to regulate and control this business in the public interest; that it was not intended to apply to persons who, as experts, were employed as here, to make tests, conduct experiments and act as consultants in a case requiring the use of technical knowledge."

What we see from this is that it is going to be absurd to make the claim in the way it is being made. It is more absurd to presumptively argue that all computer repair personal are now required to hold a PI license. The issue being posited is flawed.

Again to take the largest focus of this fallacious argument of the requirement for a PI license, Texas code: “§1702.324. CERTAIN OCCUPATIONS” states:

"(b) This chapter does not apply to: ...(6) a licensed engineer practicing engineering or directly supervising engineering practice under Chapter 1001, including forensic analysis, burglar alarm system engineering, and necessary data collection;...
(9) an attorney while engaged in the practice of law;
(10) a person who obtains a document for use in litigation under an authorization or subpoena issued for a written or oral deposition;
(12) a person who on the person's own property or on property owned or managed by the person's employer:
(14) a person or firm licensed as an accountant or accounting firm under Chapter 901, an owner of an accounting firm, or an employee of an accountant or accounting firm while performing services regulated under Chapter 901;

The issue is not (and never has been) that a PI license is required. This is an exercise in ignorance. The issue at most is the requirement of a license.

But what is an expert in the eyes of the law?
Most “Experts” are not experts. If you think that having a CCE and even a couple years experience in digital forensics makes you an expert, I am sorry to say that you are sadly mistaken.

Supreme Court Justice Potter Stewart stated, “I know pornography when I see it”, but the question is would he have known an “expert”. Some people are easy – they are fools from the word go and no issue. Some have a good track record, published works and industry acknowledgement. The issue is where the line is drawn in the middle. The easy case is where the law has already decided on the point. This includes a person with a degree in the topic. A degree will suffice for a court as will a demonstrable membership in a recognised professional body.

Even Engineers need a license.
The requirements in Texas to be a Professional Engineer are stated in Texas code 1001. This act states:
"a person may not, unless the person holds a license issued under this chapter, directly or indirectly use or cause to be used as a professional, business, or commercial identification, title, name, representation, claim, asset, or means of advantage or benefit any of, or a variation or abbreviation of, the following terms:
(1) “engineer”;
(2) “professional engineer”;
(3) “licensed engineer”;
(4) “registered engineer”;
(5) “registered professional engineer”;
(6) “licensed professional engineer”; or
(7) “engineered.”"

The vast majority of the people in the IT industry in Texas without degrees and who are not licensed but call themself an engineer are in breach of section 1001 of the occupations code already (and related state laws in other parts of the US). A Professional Engineer is an excluded occupation under Texas code 1702.324b. As a consequence, a professional engineer does not need a PI license.

In fact, section 1702 specifically states "including forensic analysis". The section of the code explicitly excludes professional engineers:
"(6) a licensed engineer practicing engineering or directly supervising engineering practice under Chapter 1001, including forensic analysis, burglar alarm system engineering, and necessary data collection;"
As with many of the other professions that one can join instead of becoming a PI, a person may work under the supervision of a licensed member.

In law, accountancy and engineering (in fact any recognised profession); this is not only common practice, but the standard. This is the nature of professional membership. Doing a course, or a degree is in itself insufficient. There is, that which is in effect the apprenticeship. This remains at the end of ones preliminary training before one may practice on one’s own. To become a CPA or be accepted by the Bar in the US is analogous to an apprenticeship in many ways. It is however a necessary step in the process of professionalising members of such a body. Engineering is no different in this regard.

This all of course begs the question, what should be argued?
The issue is not as stated that we need to stop PI laws, rather it is that we need to professionalise IT and in particular digital forensics. To some extent this can be difficult if incorrectly handled. There is a viable option in current existence in a number of existing and defined fields. The division of computer systems engineering is an already defined subset of the engineering profession. A licensed professional computer systems engineer (PEng) is already allowed to practice. This is a PEng may legally engage in the provision of unsupervised forensic services without gaining a PI license. This is with any interpretation of the PI law no matter how poor the interpretation. Similarly, a licensed attorney, accountant, insolvency practitioner, insurance investigator and many other recognised professions may engage in forensic analysis of computer systems.

Having been through University when maths was a prerequisite for any studies in computer science, and having engaged in post graduate education in maths subsequent to this, I have no issues with personally obtaining an professional engineering license in Texas. I fear that one of the issues is that others do not have this luxury.

I would extend this argument to the fact that most of those ignoring the licensing issues for what it truly is will also not have a degree in law or accounting. This makes the PI issue the favourable one to concentrate on as it is the easiest option. It takes far less effort to become a PI then an engineer, lawyer, actuary etc. The argument to fighting the introduction of a PI law however remains flawed. It is the addition of an additional party and not the subtraction of others.

Where real issues will occur for those who do not have a degree in any of the aforementioned professions or even one in computer science is that the professionalisation of digital forensics will in all probability require that one obtains a degree.

The argument that a PI license is required is flawed. The false belief that removing the PI law will legalise the provision of digital forensic services is likewise flawed. Many of the people who have a CCE who are arguing along these lines do not meet the courts test of what is an expert.

The licensing issue is only an issue when the following conditions apply:
1. You do not work for a Professional body (an accepted one)
2. You are not yourself a member of such a body (Accountant, Professional engineer, lawyer, etc) 3. You are investigating a case with direct instruction from the client who controls the systems who is not a lawyer, accountant etc.
4. You are not a PI
5. On finding evidence of criminal actions, you do not directly hand the evidence to the police etc.

The Texas 1702 specifically states "including forensic analysis"
"(6) a licensed engineer practicing engineering or directly supervising engineering practice under Chapter 1001, including forensic analysis, burglar alarm system engineering, and necessary data collection;"

Supervised and Unsupervised
In an earlier paragraph I state the term “unsupervised”. This is as it will still (even as a non-professional partitioner) be possible for a CCE who has not obtained a license of any category to work. This is aligned to the state of a paralegal in a litigation firm. In this instance, it is the partner at the law firm who is responsible for the conduct of the work, and in due order the previous exemption that applied to the attorney extends to the person who is acting to conduct work for them.

In applying something such as the US Daubert rule [1], the issue that will apply is that a CCE alone is not sufficient to express expertise.

This all comes to WHY there is a push for accreditation and licensing. To be a professional engineer I have to be a member of an accredited professional society, have state licensure etc (differs on location). If one wants to start to practice as an attorney I have to join the law society as a full member (or the bar in the US etc). Most professional societies have rules and ethical requirements.

We on this list are all members of what could become an accredited professional society. It is not one that is accredited to represent us as a professional association as yet and this means that there is a gap. This means there are perception issues. On top of this, a CCE alone will not satisfy the requirements of a professional designation in the eyes of the law. This would leave a graded system with CCE alone being a paraprofessional position with the requirements for a degree or its equivalent being necessary for those members wishing to practice on their own or for those who wish to start their own practice.

On top of this and what fits with the majority of people working as forensic analysts for court is that the exclusion "person who obtains a document for use in litigation under an authorization or subpoena issued for a written or oral deposition;" can be extrapolated to include CCE's and other suitably qualified people who are operating under court orders or even under the supervision of a recognised party.

The case in point includes the case where you are working under the instruction of "an attorney while engaged in the practice of law" you are also excluded from this code. Many examinations will be covered under one or more of these provisions and thus not need to be licensed directly. So if you see what I am saying now is not that you do not need to be licensed at all, but that you do not need to be a PI. A private investigator is not the ONLY licensed person able to do forensic work in Texas (and other US locations). A licensed Accountant, a licensed Engineer and many other professions all suffice. They are explicitly excluded from chapter 1702 of the Texas occupations code.

I am not stating that the states can not license forensic collections, just that this (as some suggest) does not mean that it is restricted to only PI's. It includes ALL the occupations deemed acceptable. As an engineer, doing work for an accounting firm in the course of an engagement for a law firm I would have no issues at all not having a PI license.

Given a choice, I would (if I was not already one) become an engineer BEFORE thinking of being a PI (though to be honest I have my security diploma - but let the license lapse years ago).

The solution is that those in the US who fear licensure need to act to make an organisation such as the ISFCE an accredited professional body or to instigate an acceptable alternative scheme.

[1] Evidence law allows for an attorney in the US to engage both "Testifying" and "Non-Testifying" Expert witnesses. "Non-Testifying" Expert witnesses are covered and protected by attorney-client privilege. "Testifying" Expert witnesses are not.

The case, Daubert v. Merrell Dow Pharmaceuticals, 509 U.S. 579 (1993), sets the standard in US federal rules of evidence. These supply the standard for governing expert testimony.

The Daubert standard was upheld and extended in Kumho Tire Co. v. Carmichael, 526 U.S. 137 (1999). In this case a "non-scientist" technitian was allowed as an expert witness.

"This case requires us to decide how Daubert applies to the testimony of engineers and other experts who are not scientists. We conclude that Daubert’s general holding– setting forth the trial judge’s general “gatekeeping” obligation–applies not only to testimony based on “scientific” knowledge, but also to testimony based on “technical” and “other specialized” knowledge."
See (and please avoid the Wiki bastardisation).

“nothing in either Daubert or the Federal Rules of Evidence requires a district court to admit opinion evidence that is connected to existing data only by the ipse dixit of the expert.” 522 U.S., at 146. However, this does not impact the status and standing of the individual giving testimony.

No comments: